routstrd 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "routstrd",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "module": "src/index.ts",
   "type": "module",
   "private": false,
@@ -26,7 +26,7 @@
     "@cashu/cashu-ts": "^4.3.0",
     "@cashu/coco-core": "^1.0.1",
     "@cashu/coco-sqlite-bun": "^1.0.1",
-    "@routstr/sdk": "^0.4.0",
+    "@routstr/sdk": "^0.4.1",
     "@scure/bip39": "^2.2.0",
     "applesauce-core": "^5.1.0",
     "applesauce-relay": "^5.1.0",

package/src/cli.ts

@@ -1,5 +1,6 @@
 import { program } from "commander";
 import { startDaemon } from "./start-daemon";
+import { ensureDirsSync, saveDaemonConfig } from "./daemon/config-store";
 import {
   handleDaemonCommand,
   callDaemon,
@@ -217,19 +218,19 @@ async function requireLocalDaemon(): Promise<void> {
 async function initDaemon(): Promise<void> {
   console.log("Initializing routstrd...");
 
-  // Create config directory
+  // Create config directory (0700, correcting existing installs too)
   if (!existsSync(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
     console.log(`Created config directory: ${CONFIG_DIR}`);
   }
+  ensureDirsSync();
 
-  // Create initial config
+  // Create initial config (0600, atomic write)
   if (!existsSync(CONFIG_FILE)) {
     const config: RoutstrdConfig = {
       ...DEFAULT_CONFIG,
       cocodPath: null,
     };
-    await Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+    saveDaemonConfig(config);
     console.log(`Created config file: ${CONFIG_FILE}`);
   }
 
@@ -240,7 +241,7 @@ async function initDaemon(): Promise<void> {
     const nsec = nip19.nsecEncode(secretKey);
     const npub = npubFromSecretKey(secretKey);
     config.nsec = nsec;
-    await Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+    saveDaemonConfig(config);
     console.log("\nA new Nostr identity has been generated for authentication.");
     console.log(`Your npub: ${npub}`);
     console.log(`You can view it in the config file at: ${CONFIG_FILE}\n`);
@@ -295,10 +296,7 @@ program
   .command("update")
   .description("Update routstrd to the latest version")
   .action(async () => {
-    const packages = [
-      { name: "routstrd", label: "routstrd" },
-      { name: "@routstr/cocod", label: "cocod" },
-    ];
+    const packages = [{ name: "routstrd", label: "routstrd" }];
 
     let updatedAny = false;
 
@@ -520,7 +518,7 @@ program
       ...updates,
     };
 
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
 
     console.log(`Remote daemon URL set to: ${url}`);
     if (options.authUrl) {
@@ -555,7 +553,7 @@ program
     const { daemonUrl: _daemonUrl, authUrl: _authUrl, ...rest } = config;
     const updatedConfig: RoutstrdConfig = rest;
 
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
 
     console.log("Switched back to local daemon mode.");
     if (previousDaemonUrl) {
@@ -1119,6 +1117,94 @@ providersCmd
     }
   });
 
+providersCmd
+  .command("reviews")
+  .description(
+    "Show all known providers with their stored review events and event IDs",
+  )
+  .action(async () => {
+    await ensureDaemonRunning();
+
+    const result = await callDaemon("/providers/reviews");
+    if (result.error) {
+      console.log(result.error);
+      process.exit(1);
+    }
+
+    const output = result.output as
+      | {
+          providers: Array<{
+            index: number;
+            baseUrl: string;
+            disabled: boolean;
+            nodePubkeys: string[];
+            reviewCount: number;
+            reviews: Array<{
+              eventId: string;
+              createdAt: number;
+              authorPubkey: string | null;
+              nodePubkey: string | null;
+              label: string;
+              isLgtm: boolean;
+              tags: string[][];
+            }>;
+          }>;
+          unmatchedReviews: Array<{
+            eventId: string;
+            createdAt: number;
+            authorPubkey: string | null;
+            nodePubkey: string | null;
+            label: string;
+            isLgtm: boolean;
+            tags: string[][];
+          }>;
+          totalCount: number;
+          reviewEventCount: number;
+        }
+      | undefined;
+
+    if (!output) {
+      console.log("No provider review data available.");
+      return;
+    }
+
+    console.log(
+      `Providers (${output.totalCount} total, ${output.reviewEventCount} stored review events):\n`,
+    );
+
+    for (const provider of output.providers) {
+      const status = provider.disabled ? "DISABLED" : "enabled ";
+      console.log(
+        `  [${provider.index}] ${status}  ${provider.baseUrl}  (${provider.reviewCount} review${provider.reviewCount === 1 ? "" : "s"})`,
+      );
+
+      if (provider.nodePubkeys.length > 0) {
+        console.log(`      node pubkeys: ${provider.nodePubkeys.join(", ")}`);
+      }
+
+      for (const review of provider.reviews) {
+        const label = review.label || "review";
+        const created = new Date(review.createdAt * 1000).toISOString();
+        console.log(`      - ${label}  eventId: ${review.eventId}`);
+        console.log(`          node:   ${review.nodePubkey ?? "(none)"}`);
+        console.log(`          author: ${review.authorPubkey ?? "(none)"}`);
+        console.log(`          at:     ${created}`);
+      }
+    }
+
+    if (output.unmatchedReviews.length > 0) {
+      console.log(
+        `\n  Unmatched review events (${output.unmatchedReviews.length} — node pubkey not in any known provider):`,
+      );
+      for (const review of output.unmatchedReviews) {
+        const created = new Date(review.createdAt * 1000).toISOString();
+        console.log(`      - eventId: ${review.eventId}`);
+        console.log(`          node:   ${review.nodePubkey ?? "(none)"}`);
+        console.log(`          at:     ${created}`);
+      }
+    }
+  });
+
 // Clients - list and manage clients
 const clientsCmd = program
   .command("clients")
@@ -2142,7 +2228,7 @@ program
       ...config,
       mode: selectedMode,
     };
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
     console.log(`Mode set to '${selectedMode}'. Restarting daemon...`);
 
     // Restart daemon

package/src/daemon/config-store.ts

@@ -1,5 +1,13 @@
 import { mkdir } from "fs/promises";
-import { existsSync, readFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "fs";
 import {
   CONFIG_DIR,
   CONFIG_FILE,
@@ -10,18 +18,61 @@ import { logger } from "../utils/logger";
 
 export const REQUESTS_DIR = `${CONFIG_DIR}/requests`;
 
+// The daemon config holds spend-capable credentials (the operator `nsec` and
+// the NWC connection string), so the directory and file permissions must match
+// the wallet seed handling (0700/0600), not the umask default (0755/0644).
+
+function chmodIgnoreErrors(path: string, mode: number): void {
+  try {
+    chmodSync(path, mode);
+  } catch {
+    // Best effort on filesystems that do not support POSIX modes.
+  }
+}
+
+/** Create the config directories (0700), correcting existing installs too. */
+export function ensureDirsSync(): void {
+  try {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(CONFIG_DIR, 0o700);
+
+  try {
+    mkdirSync(REQUESTS_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(REQUESTS_DIR, 0o700);
+}
+
 export async function ensureDirs(): Promise<void> {
   try {
-    await mkdir(CONFIG_DIR, { recursive: true });
-    await mkdir(REQUESTS_DIR, { recursive: true });
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(CONFIG_DIR, 0o700);
+
+  try {
+    await mkdir(REQUESTS_DIR, { recursive: true, mode: 0o700 });
   } catch {
     // Directory may already exist
   }
+  chmodSync(REQUESTS_DIR, 0o700);
+}
+
+function repairConfigPermissions(): void {
+  if (existsSync(CONFIG_FILE)) {
+    chmodIgnoreErrors(CONFIG_FILE, 0o600);
+  }
 }
 
 export async function loadDaemonConfig(): Promise<RoutstrdConfig> {
   try {
     if (existsSync(CONFIG_FILE)) {
+      repairConfigPermissions();
       const content = await Bun.file(CONFIG_FILE).text();
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
     }
@@ -34,6 +85,7 @@ export async function loadDaemonConfig(): Promise<RoutstrdConfig> {
 export function loadDaemonConfigSync(): RoutstrdConfig {
   try {
     if (existsSync(CONFIG_FILE)) {
+      repairConfigPermissions();
       const content = readFileSync(CONFIG_FILE, "utf-8");
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
     }
@@ -43,6 +95,29 @@ export function loadDaemonConfigSync(): RoutstrdConfig {
   return DEFAULT_CONFIG;
 }
 
+/**
+ * Persist the daemon config atomically with owner-only permissions, mirroring
+ * the wallet config writer (saveConfig in wallet/coco-client.ts): write a
+ * 0600 temp file, then rename over the target. Synchronous so callers get
+ * error propagation instead of silently dropping credential updates.
+ */
 export function saveDaemonConfig(config: RoutstrdConfig): void {
-  Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+  ensureDirsSync();
+  const temporaryFile = `${CONFIG_FILE}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temporaryFile, JSON.stringify(config, null, 2), {
+      mode: 0o600,
+    });
+    renameSync(temporaryFile, CONFIG_FILE);
+  } catch (error) {
+    try {
+      unlinkSync(temporaryFile);
+    } catch {
+      // The temporary file may not have been created.
+    }
+    throw error;
+  }
+  // renameSync preserves the temp file's mode, but chmod anyway so an
+  // existing over-permissive file is corrected even on exotic filesystems.
+  chmodIgnoreErrors(CONFIG_FILE, 0o600);
 }

package/src/daemon/models.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from "bun:test";
+import type { SdkStore } from "@routstr/sdk";
+import { createModelService } from "./models";
+
+/**
+ * `ensureProvidersBootstrapped` must mirror the review-disabled provider set
+ * (kind 38425) into the SdkStore. The SDK applies review disables to the
+ * discovery adapter during bootstrap, but `providers list` and per-model
+ * provider views read the store — if the store is not kept in sync, a fresh
+ * install reports "0 disabled" while routing silently excludes them.
+ */
+describe("createModelService.ensureProvidersBootstrapped", () => {
+  function makeStore(initialBaseUrls: string[] = []) {
+    const disabledCalls: string[][] = [];
+    const state: Record<string, unknown> = {
+      baseUrlsList: initialBaseUrls,
+      setBaseUrlsList: (urls: string[]) => {
+        state.baseUrlsList = urls;
+      },
+      disabledProviders: [],
+      setDisabledProviders: (urls: string[]) => {
+        state.disabledProviders = urls;
+        disabledCalls.push(urls);
+      },
+      manuallyDisabledProviders: [],
+      manuallyEnabledProviders: [],
+    };
+
+    return {
+      store: { getState: () => state } as unknown as SdkStore,
+      state,
+      disabledCalls,
+    };
+  }
+
+  function makeModelManager(
+    providers: string[],
+    reviewedDisabled: string[] | null,
+  ) {
+    return {
+      bootstrapProviders: async () => providers,
+      syncReviewedProvidersFromNostr: async () => reviewedDisabled,
+    } as never;
+  }
+
+  it("mirrors review-disabled providers into the store after bootstrap", async () => {
+    const { store, state, disabledCalls } = makeStore();
+    const modelManager = makeModelManager(
+      ["https://ok.example/", "https://bad.example/"],
+      ["https://bad.example/"],
+    );
+    const service = createModelService(
+      modelManager as never,
+      {} as never,
+      store,
+    );
+
+    await service.ensureProvidersBootstrapped();
+
+    expect(disabledCalls).toEqual([["https://bad.example/"]]);
+    expect(state.disabledProviders).toEqual(["https://bad.example/"]);
+  });
+
+  it("leaves the store unchanged when review sync reports no change (null)", async () => {
+    const { store, state, disabledCalls } = makeStore(["https://ok.example/"]);
+    const modelManager = makeModelManager(
+      ["https://ok.example/", "https://new.example/"],
+      null,
+    );
+    const service = createModelService(
+      modelManager as never,
+      {} as never,
+      store,
+    );
+
+    await service.ensureProvidersBootstrapped();
+
+    expect(disabledCalls).toEqual([]);
+    expect(state.disabledProviders).toEqual([]);
+  });
+});

package/src/daemon/models.ts

@@ -89,7 +89,11 @@ export function createModelService(
 
         // Sync discovered providers into the store so `providers list` reflects
         // the same set that the model manager knows about.
-        const { baseUrlsList, setBaseUrlsList } = store.getState();
+        const {
+          baseUrlsList,
+          setBaseUrlsList,
+          setDisabledProviders,
+        } = store.getState();
         const existing = new Set(baseUrlsList);
         const merged = [
           ...baseUrlsList,
@@ -102,6 +106,18 @@ export function createModelService(
           );
         }
 
+        // Mirror the review-disabled set (kind 38425) into the store. The SDK
+        // applies review disables to the discovery adapter during bootstrap,
+        // but `providers list` and the per-model provider views read the store,
+        // so without this a fresh install reports "0 disabled" while routing
+        // silently excludes the review-disabled providers.
+        const reviewedDisabled = await modelManager.syncReviewedProvidersFromNostr(
+          providers,
+        );
+        if (reviewedDisabled !== null) {
+          setDisabledProviders(reviewedDisabled);
+        }
+
         logger.log("Provider bootstrap complete.");
       })().catch((error) => {
         providerBootstrapPromise = null;
@@ -117,7 +133,7 @@ export function createModelService(
   ): Promise<ExposedModel[]> => {
     const routstr21ModelIds = Array.from(
       new Set(await modelManager.fetchRoutstr21Models(forceRefresh)),
-    ).slice(0, 21);
+    );
 
     let discoveredModels: ExposedModel[];
     if (!forceRefresh) {

package/src/integrations/pi.ts

@@ -8,6 +8,8 @@ import { callDaemon, getDaemonBaseUrl } from "../utils/daemon-client";
 type PiModelEntry = {
   id: string;
   contextWindow?: number;
+  // Preserve arbitrary manual fields (reasoning, thinkingLevelMap, compat, cost, maxTokens, etc.)
+  [key: string]: unknown;
 };
 
 type PiProviderConfig = {
@@ -61,15 +63,29 @@ export async function installPiIntegration(
       return;
     }
 
+    // Preserve any manually-added per-model fields (reasoning, thinkingLevelMap,
+    // compat, cost, maxTokens, etc.) across refreshes. Only `id` and `contextWindow`
+    // are managed by routstrd.
+    const existingModels = new Map<string, PiModelEntry>(
+      (piConfig.providers["routstr"]?.models ?? []).map((m) => [m.id, m]),
+    );
+
     const providerModels: PiModelEntry[] = models.map((model) => {
-      const entry: PiModelEntry = { id: model.id };
+      const previous = existingModels.get(model.id);
+      const entry: PiModelEntry = previous ? { ...previous } : { id: model.id };
+
+      entry.id = model.id;
       if (model.context_length !== undefined && model.context_length > 0) {
         entry.contextWindow = model.context_length;
       }
+
       return entry;
     });
 
+    // Preserve provider-level manual fields (compat, headers, name, etc.); only update
+    // the routstrd-managed fields below.
     piConfig.providers["routstr"] = {
+      ...(piConfig.providers["routstr"] ?? {}),
       baseUrl,
       api: "openai-completions",
       apiKey,

package/src/tui/usage/data.ts

@@ -1,5 +1,10 @@
 import type { UsageTrackingEntry } from "../../daemon/types.ts";
-import { callDaemon, isDaemonRunning } from "../../utils/daemon-client.ts";
+import {
+  callDaemon,
+  getDaemonBaseUrl,
+  isDaemonRunning,
+  loadConfig,
+} from "../../utils/daemon-client.ts";
 import type { UsageStats, UsageSummary } from "./types.ts";
 
 export { isDaemonRunning };
@@ -21,12 +26,17 @@ export interface StatusInfo {
   daemon: string;
   wallet: string;
   mode: "xcashu" | "apikeys";
+  /** URL the TUI is connected through (local bind or remote daemonUrl). */
+  url?: string;
   error?: string;
 }
 
 export async function fetchStatus(): Promise<StatusInfo | null> {
   try {
-    const result = await callDaemon("/status");
+    const [result, config] = await Promise.all([
+      callDaemon("/status"),
+      loadConfig(),
+    ]);
     if (result.error) return null;
 
     const output = result.output as {
@@ -40,6 +50,7 @@ export async function fetchStatus(): Promise<StatusInfo | null> {
       daemon: output?.daemon || "unknown",
       wallet: output?.wallet || "unknown",
       mode: output?.mode || "apikeys",
+      url: getDaemonBaseUrl(config),
       error: output?.error,
     };
   } catch {

package/src/tui/usage/render.ts

@@ -162,6 +162,14 @@ export function renderOverview(stats: UsageStats, balance: BalanceInfo | null, s
     const walletColor = status.wallet === "connected" ? COLORS.green : COLORS.red;
     const modeColor = COLORS.cyan;
     statusLines.push(`${COLORS.bold}Daemon:${COLORS.reset} ${daemonColor}${status.daemon}${COLORS.reset}`);
+    if (status.url) {
+      const label = "Running on: ";
+      const maxUrlLen = Math.max(8, halfWidth2 - 4 - label.length);
+      const url = status.url.length > maxUrlLen
+        ? `${status.url.slice(0, Math.max(0, maxUrlLen - 1))}…`
+        : status.url;
+      statusLines.push(`${COLORS.bold}${label}${COLORS.reset} ${COLORS.cyan}${url}${COLORS.reset}`);
+    }
     statusLines.push(`${COLORS.bold}Wallet:${COLORS.reset} ${walletColor}${status.wallet}${COLORS.reset}`);
     statusLines.push(`${COLORS.bold}Mode:${COLORS.reset} ${modeColor}${status.mode}${COLORS.reset}`);
     if (status.error) {

package/src/utils/config.ts

@@ -48,8 +48,10 @@ export interface RoutstrdConfig {
    * Defaults to daemonUrl or localhost:{port} if not set. */
   authUrl?: string;
   nsec?: string;
-  /** Nostr hex pubkey for routstr review/model events (kind 38425/38423). */
+  /** Nostr hex pubkey for routstr review/audit events (kind 38425). */
   routstrPubkey?: string;
+  /** Nostr hex pubkey for the routstr-21 model list only (kind 38423). Falls back to routstrPubkey. */
+  routstrModelsPubkey?: string;
   /** Nostr relay URLs for provider/model discovery (kinds 38421/38423/38425).
    * When unset, each method uses its own built-in defaults. */
   relays?: string[];

package/tests/daemon/config-store.perms.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { spawnSync } from "child_process";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+
+// These scenarios mutate process.env.ROUTSTRD_DIR before the config-store
+// module is loaded, and other test files import the same module singleton
+// first — so each scenario runs in an isolated bun subprocess where the env
+// is guaranteed to be in place before module evaluation.
+
+const SCENARIO = join(import.meta.dir, "config-store.scenario.ts");
+
+function runScenario(name: string): { code: number; out: string } {
+  const dir = mkdtempSync(join(tmpdir(), `routstrd-cfg-${name}-`));
+  const res = spawnSync("bun", [SCENARIO, name], {
+    env: {
+      ...process.env,
+      NODE_ENV: "test",
+      ROUTSTRD_DIR: join(dir, "daemon"),
+    },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const out = `${res.stdout}${res.stderr}`;
+  rmSync(dir, { recursive: true, force: true });
+  // bun's spawnSync reports the exit code in `status` (exitCode is undefined).
+  return { code: res.status ?? res.exitCode ?? -1, out };
+}
+
+describe("daemon config store permissions", () => {
+  test("fresh install: config dir 0700, config file 0600, atomic write", () => {
+    const { code, out } = runScenario("fresh-install");
+    expect(out).toContain("SCENARIO-OK");
+    expect(code).toBe(0);
+  });
+
+  test("existing over-permissive install (0755/0644) is repaired", () => {
+    const { code, out } = runScenario("repair-perms");
+    expect(out).toContain("SCENARIO-OK");
+    expect(code).toBe(0);
+  });
+
+  test("write failure surfaces synchronously with no temp file left", () => {
+    const { code, out } = runScenario("write-failure");
+    expect(out).toContain("SCENARIO-OK");
+    expect(code).toBe(0);
+  });
+
+  test("corrupt JSON falls back to defaults", () => {
+    const { code, out } = runScenario("corrupt-json");
+    expect(out).toContain("SCENARIO-OK");
+    expect(code).toBe(0);
+  });
+});