routstrd 0.4.10 → 0.4.12

package/src/daemon/http/index.ts

@@ -13,14 +13,20 @@ import type { HistoryEntry } from "@cashu/coco-core";
 import { logger } from "../../utils/logger";
 import { loadDaemonConfig, saveDaemonConfig } from "../config-store";
 import {
-  CocodHttpError,
-  type CocodClient,
-  type CocodState,
+  WalletHttpError,
+  type WalletClient,
+  type WalletRuntimeState,
   type WalletRecoveryProgress,
-} from "../wallet/cocod-client";
+} from "../wallet/wallet-client";
 import { receiveCashuToken } from "../wallet";
 import { getClientsFromStore } from "../../utils/clients";
 import { getUsageSummary } from "./usage-summary";
+import { applyDefaultOutputTokenLimit } from "./request-body";
+import { collapseDuplicatedV1 } from "./request-path";
+import {
+  buildCooldownsOutput,
+  type StoredCooldownEntry,
+} from "../../utils/cooldowns";
 
 // Hop-by-hop headers describe the *upstream* connection, not this one, and must
 // never be copied onto our response. In particular, copying the upstream's
@@ -45,7 +51,7 @@ type ClientMode = "xcashu" | "lazyrefund" | "apikeys";
 type WalletStatusOutput = {
   daemon: "running";
   wallet: "connected" | "recovering" | "error";
-  walletState: CocodState;
+  walletState: WalletRuntimeState;
   balances?: Record<string, number>;
   mode: ClientMode;
   error?: string;
@@ -56,7 +62,7 @@ type DaemonDeps = {
   server: { close(cb?: () => void): void };
   shutdown?: () => void;
   store: any;
-  walletClient: CocodClient;
+  walletClient: WalletClient;
   walletAdapter: any;
   storageAdapter: any;
   discoveryAdapter: any;
@@ -127,7 +133,7 @@ async function readJsonBody(
   try {
     return JSON.parse(bodyText) as Record<string, unknown>;
   } catch {
-    throw new CocodHttpError(400, "Invalid JSON body.");
+    throw new WalletHttpError(400, "Invalid JSON body.");
   }
 }
 
@@ -195,7 +201,7 @@ function toErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-function getWalletStateMessage(state: CocodState): string {
+function getWalletStateMessage(state: WalletRuntimeState): string {
   switch (state) {
     case "LOCKED":
       return "Wallet is locked. Unlock it before performing wallet operations.";
@@ -215,7 +221,7 @@ function respondWithError(
   error: unknown,
   fallbackStatus = 500,
 ): void {
-  if (error instanceof CocodHttpError) {
+  if (error instanceof WalletHttpError) {
     sendJson(res, error.status, { error: error.message });
     return;
   }
@@ -248,7 +254,7 @@ function getRequiredStringField(
 ): string {
   const value = requireStringField(body, field);
   if (!value) {
-    throw new CocodHttpError(400, `Missing required '${field}' field.`);
+    throw new WalletHttpError(400, `Missing required '${field}' field.`);
   }
   return value;
 }
@@ -267,7 +273,7 @@ function getRequiredPositiveNumberField(
       return parsed;
     }
   }
-  throw new CocodHttpError(400, `Missing required '${field}' field.`);
+  throw new WalletHttpError(400, `Missing required '${field}' field.`);
 }
 
 function optionalStringField(
@@ -278,6 +284,21 @@ function optionalStringField(
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 
+function optionalStringArrayField(
+  body: Record<string, unknown>,
+  field: string,
+): string[] | undefined {
+  const value = body[field];
+  if (value === undefined) return undefined;
+  if (
+    !Array.isArray(value) ||
+    value.some((item) => typeof item !== "string" || !item.trim())
+  ) {
+    throw new WalletHttpError(400, `'${field}' must be an array of non-empty strings.`);
+  }
+  return value.map((item: string) => item.trim());
+}
+
 function getCurrentMode(deps: DaemonDeps): ClientMode {
   const stateMode = deps.store.getState()?.mode;
   return stateMode || deps.mode || "apikeys";
@@ -329,7 +350,7 @@ async function buildStatusOutput(
 }
 
 async function buildWalletDetails(deps: DaemonDeps): Promise<{
-  state: CocodState;
+  state: WalletRuntimeState;
   ready: boolean;
   balances?: Record<string, number>;
   unit?: "sat";
@@ -370,12 +391,52 @@ function makeSdkLogger(...parts: string[]): SdkLogger {
   };
 }
 
+/**
+ * Parse a `type` query parameter into a list of normalized transaction types.
+ * Accepts comma-separated values and is case-insensitive.
+ */
+export function parseHistoryTypes(raw: string | null | undefined): string[] {
+  if (!raw) return [];
+  return raw
+    .split(",")
+    .map((value) => value.trim().toLowerCase())
+    .filter((value) => value.length > 0);
+}
+
+/** Page size used when scanning history to apply a type filter. */
+const HISTORY_TYPE_SCAN_PAGE_SIZE = 200;
+
+/**
+ * Return history entries matching `types`, with offset/limit applied after
+ * filtering. The coco history repository only paginates by raw position, so we
+ * scan pages until enough matches accumulate (or history is exhausted).
+ */
+export async function getHistoryByTypes(
+  client: Pick<WalletClient, "getHistory">,
+  types: string[],
+  offset: number,
+  limit: number,
+): Promise<HistoryEntry[]> {
+  const wanted = new Set(types);
+  const matched: HistoryEntry[] = [];
+  let scanOffset = 0;
+  while (matched.length < offset + limit) {
+    const page = await client.getHistory(scanOffset, HISTORY_TYPE_SCAN_PAGE_SIZE);
+    for (const entry of page) {
+      if (wanted.has(entry.type)) matched.push(entry);
+    }
+    if (page.length < HISTORY_TYPE_SCAN_PAGE_SIZE) break;
+    scanOffset += HISTORY_TYPE_SCAN_PAGE_SIZE;
+  }
+  return matched.slice(offset, offset + limit);
+}
+
 export function createDaemonRequestHandler(deps: {
   provider: string | null;
   server: { close(cb?: () => void): void };
   shutdown?: () => void;
   store: any;
-  walletClient: CocodClient;
+  walletClient: WalletClient;
   walletAdapter: any;
   storageAdapter: any;
   discoveryAdapter: any;
@@ -387,6 +448,8 @@ export function createDaemonRequestHandler(deps: {
   mode?: "xcashu" | "apikeys";
   /** Default max_tokens/max_output_tokens to inject when the client omits one. */
   maxTokens: number;
+  /** Enable SDK automatic DeepSeek V4.1 Flash model-path selection. */
+  autoModelPath?: boolean;
   /** Nostr hex pubkey for routstr review/audit events (kind 38425). */
   routstrPubkey?: string;
   /** Nostr hex pubkey for the routstr-21 model list only (kind 38423). Falls back to routstrPubkey. */
@@ -400,6 +463,19 @@ export function createDaemonRequestHandler(deps: {
     const host = req.headers.host || "localhost";
     const url = new URL(req.url || "/", `http://${host}`);
 
+    // The node canonicalizes exactly ONE optional "v1/" segment (routstr-core
+    // `_canonical_api_path`). A client whose base URL already ends in /v1 while
+    // its transport appends /v1 itself — the Anthropic SDKs do, the OpenAI ones
+    // do not — would otherwise get a paid upstream 404 from every provider in
+    // the pool. Collapse the duplicate before any routing or payment decision.
+    const canonicalPath = collapseDuplicatedV1(url.pathname);
+    if (canonicalPath !== url.pathname) {
+      logger.warn(
+        `[daemon] Collapsing duplicated '/v1' in request path: ${url.pathname} -> ${canonicalPath}`,
+      );
+      url.pathname = canonicalPath;
+    }
+
     if (req.method === "GET" && url.pathname === "/health") {
       sendJson(res, 200, { ok: true });
       return;
@@ -452,7 +528,7 @@ export function createDaemonRequestHandler(deps: {
     if (req.method === "POST" && url.pathname === "/wallet/cleanup") {
       await respond(res, async () => {
         if (!deps.walletClient.cleanupStuckOperations) {
-          throw new CocodHttpError(
+          throw new WalletHttpError(
             501,
             "Wallet cleanup is not supported by this wallet client.",
           );
@@ -466,12 +542,63 @@ export function createDaemonRequestHandler(deps: {
               ? body.minAgeMs
               : undefined,
           dryRun: body.dryRun === true,
+          force: body.force === true,
         });
         return { output: result };
       });
       return;
     }
 
+    if (req.method === "POST" && url.pathname === "/wallet/recover") {
+      await respond(res, async () => {
+        if (!deps.walletClient.recoverMintQuotes) {
+          throw new WalletHttpError(
+            501,
+            "Mint quote recovery is not supported by this wallet client.",
+          );
+        }
+
+        const body = await readJsonBody(req);
+        const operationIds = optionalStringArrayField(body, "operationIds");
+        if (body.includeFailed === true && !operationIds?.length) {
+          throw new WalletHttpError(
+            400,
+            "'includeFailed' requires non-empty 'operationIds'.",
+          );
+        }
+        if (
+          body.timeoutMs !== undefined &&
+          (typeof body.timeoutMs !== "number" ||
+            !Number.isFinite(body.timeoutMs) || body.timeoutMs <= 0)
+        ) {
+          throw new WalletHttpError(
+            400,
+            "'timeoutMs' must be a positive finite number.",
+          );
+        }
+        const result = await deps.walletClient.recoverMintQuotes({
+          operationIds,
+          includeFailed: body.includeFailed === true,
+          timeoutMs: body.timeoutMs as number | undefined,
+        });
+        return { output: result };
+      });
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/wallet/recover/operations") {
+      await respond(res, async () => {
+        if (!deps.walletClient.recoverStuckOperations) {
+          throw new WalletHttpError(
+            501,
+            "Stuck operation recovery is not supported by this wallet client.",
+          );
+        }
+        return { output: await deps.walletClient.recoverStuckOperations() };
+      });
+      return;
+    }
+
     if (req.method === "POST" && url.pathname === "/wallet/receive/cashu") {
       await respond(res, async () => {
         const body = await readJsonBody(req);
@@ -502,7 +629,7 @@ export function createDaemonRequestHandler(deps: {
       const operationId = decodeURIComponent(mintQuoteMatch[1]);
       await respond(res, async () => {
         const quote = await deps.walletClient.getMintQuote?.(operationId);
-        if (!quote) throw new CocodHttpError(404, "Mint quote not found");
+        if (!quote) throw new WalletHttpError(404, "Mint quote not found");
         return { output: quote };
       });
       return;
@@ -589,9 +716,25 @@ export function createDaemonRequestHandler(deps: {
       await respond(res, async () => {
         const offsetParam = url.searchParams.get("offset");
         const limitParam = url.searchParams.get("limit");
+        const idParam = url.searchParams.get("id")?.trim() || "";
+        const types = parseHistoryTypes(url.searchParams.get("type"));
         const offset = offsetParam ? parseInt(offsetParam, 10) || 0 : 0;
         const limit = limitParam ? parseInt(limitParam, 10) || 50 : 50;
-        const entries = await deps.walletClient.getHistory(offset, limit);
+
+        let entries: HistoryEntry[];
+        if (idParam) {
+          const entry = await deps.walletClient.getHistoryEntryById(idParam);
+          entries = entry ? [entry] : [];
+        } else if (types.length > 0) {
+          entries = await getHistoryByTypes(
+            deps.walletClient,
+            types,
+            offset,
+            limit,
+          );
+        } else {
+          entries = await deps.walletClient.getHistory(offset, limit);
+        }
 
         const encoded = entries.map((entry: HistoryEntry) => {
           const base = { ...entry } as Record<string, unknown>;
@@ -630,12 +773,12 @@ export function createDaemonRequestHandler(deps: {
           const amount = typeof pr.amount === "number" ? pr.amount : 0;
           const mints = Array.isArray(pr.mints) ? pr.mints.join(", ") : "";
           if (confirm) {
-            throw new CocodHttpError(
+            throw new WalletHttpError(
               402,
               `Failed to set username. Required amount: ${amount} SATS. Required mints: ${mints}`,
             );
           }
-          throw new CocodHttpError(
+          throw new WalletHttpError(
             402,
             `Payment required to set username: ${amount} SATS. ` +
               `Use 'routstrd wallet npc username ${username} --confirm' to proceed`,
@@ -1285,6 +1428,124 @@ export function createDaemonRequestHandler(deps: {
       return;
     }
 
+    if (req.method === "POST" && url.pathname === "/providers/nostr-sync") {
+      try {
+        const bodyText = await readBody(req);
+        const body = bodyText ? JSON.parse(bodyText) : {};
+        const indices = body.indices as number[] | undefined;
+
+        if (!Array.isArray(indices)) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: "Missing or invalid 'indices' field (expected number[]).",
+            }),
+          );
+          return;
+        }
+
+        const state = deps.store.getState();
+        const baseUrlsList: string[] = state.baseUrlsList || [];
+
+        const validIndices: number[] = [];
+        const skippedIndices: unknown[] = [];
+        for (const idx of indices) {
+          if (
+            typeof idx === "number" &&
+            Number.isInteger(idx) &&
+            idx >= 0 &&
+            idx < baseUrlsList.length
+          ) {
+            if (!validIndices.includes(idx)) validIndices.push(idx);
+          } else {
+            skippedIndices.push(idx);
+          }
+        }
+
+        if (validIndices.length === 0) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: `No valid indices provided (valid range: 0-${Math.max(baseUrlsList.length - 1, 0)}).`,
+              skipped: skippedIndices,
+            }),
+          );
+          return;
+        }
+
+        // Clearing both manual lists returns the provider to the
+        // review-based state: the effective disabled set is the union of
+        // disabledProviders (kind-38425 review sync) and the manual lists,
+        // so with no manual entries the Nostr review verdict applies again.
+        const manuallyDisabledProviders: string[] = [
+          ...(state.manuallyDisabledProviders || []),
+        ];
+        const manuallyEnabledProviders: string[] = [
+          ...(state.manuallyEnabledProviders || []),
+        ];
+
+        const synced: string[] = [];
+        for (const idx of validIndices) {
+          const baseUrl = baseUrlsList[idx]!;
+          const disabledPos = manuallyDisabledProviders.indexOf(baseUrl);
+          if (disabledPos !== -1) {
+            manuallyDisabledProviders.splice(disabledPos, 1);
+          }
+          const enabledPos = manuallyEnabledProviders.indexOf(baseUrl);
+          if (enabledPos !== -1) {
+            manuallyEnabledProviders.splice(enabledPos, 1);
+          }
+          synced.push(baseUrl);
+        }
+
+        deps.store.getState().setManuallyDisabledProviders(manuallyDisabledProviders);
+        deps.discoveryAdapter.setManuallyDisabledProviders(manuallyDisabledProviders);
+        deps.store.getState().setManuallyEnabledProviders(manuallyEnabledProviders);
+        deps.discoveryAdapter.setManuallyEnabledProviders(manuallyEnabledProviders);
+
+        // Recompute the review verdict now that the manual overrides are
+        // gone. This is load-bearing, not just cosmetic: the SDK's review
+        // sync skips manually-enabled providers when it rebuilds the
+        // review-disabled set, so a provider that was manually enabled
+        // across a review refresh is absent from that set — reading the
+        // stale set here would fail OPEN for a review-rejected provider.
+        const reviewed =
+          await deps.modelManager.syncReviewedProvidersFromNostr(baseUrlsList);
+        if (reviewed !== null) {
+          deps.store.getState().setDisabledProviders(reviewed);
+        }
+
+        // Report each synced provider's resulting state from the discovery
+        // adapter (the source the router uses). With both manual lists
+        // cleared for these URLs, membership in the adapter's disabled set
+        // is exactly the review verdict.
+        const reviewDisabled = new Set(
+          deps.discoveryAdapter.getDisabledProviders() || [],
+        );
+        const resulting = synced.map((baseUrl) => ({
+          baseUrl,
+          disabled:
+            reviewDisabled.has(baseUrl) ||
+            reviewDisabled.has(normalizeProviderBaseUrl(baseUrl)),
+        }));
+
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            output: {
+              message: `Reverted ${synced.length} provider(s) to Nostr review-based state`,
+              providers: resulting,
+              ...(skippedIndices.length > 0 ? { skipped: skippedIndices } : {}),
+            },
+          }),
+        );
+      } catch (error) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(error) }));
+      }
+      return;
+    }
+
     // Client management endpoints
     if (req.method === "GET" && url.pathname === "/clients") {
       try {
@@ -1486,20 +1747,33 @@ export function createDaemonRequestHandler(deps: {
 
         const state = deps.store.getState();
         const baseUrlsList: string[] = state.baseUrlsList || [];
-        const manuallyEnabled = new Set(
-          state.manuallyEnabledProviders || [],
+        // Read disable/override state from the discovery adapter (the same
+        // source the router/ProviderManager uses), not the mirror in the
+        // SdkStore, which can lag behind the scheduled kind-38425 review
+        // sync — that updates the adapter without touching the store.
+        const manuallyEnabled = new Set<string>(
+          (deps.discoveryAdapter.getManuallyEnabledProviders?.() || []) as string[],
+        );
+        const manuallyDisabled = new Set<string>(
+          (deps.discoveryAdapter.getManuallyDisabledProviders?.() || []) as string[],
+        );
+        const disabledProviders = new Set<string>(
+          [
+            ...((deps.discoveryAdapter.getDisabledProviders() || []) as string[]),
+            ...manuallyDisabled,
+          ].filter((url) => !manuallyEnabled.has(url)),
         );
-        const disabledProviders: string[] = [
-          ...new Set([
-            ...(state.disabledProviders || []),
-            ...(state.manuallyDisabledProviders || []),
-          ]),
-        ].filter((url) => !manuallyEnabled.has(url));
+        // Adapter URLs are normalized (trailing slash); the store list may
+        // not be. Compare against both forms.
+        const inSet = (set: Set<string>, baseUrl: string) =>
+          set.has(baseUrl) || set.has(normalizeProviderBaseUrl(baseUrl));
 
         const providers = baseUrlsList.map((baseUrl, index) => ({
           index,
           baseUrl,
-          disabled: disabledProviders.includes(baseUrl),
+          disabled: inSet(disabledProviders, baseUrl),
+          manuallyDisabled: inSet(manuallyDisabled, baseUrl),
+          manuallyEnabled: inSet(manuallyEnabled, baseUrl),
         }));
 
         // Only count disabled providers that are actually in the current list
@@ -1523,6 +1797,23 @@ export function createDaemonRequestHandler(deps: {
       return;
     }
 
+    // Providers/models the router is currently skipping. Cooldown state lives
+    // in the SdkStore (written by the SDK's ProviderManager); entries that have
+    // already expired are filtered out by buildCooldownsOutput.
+    if (req.method === "GET" && url.pathname === "/cooldowns") {
+      await respond(res, async () => {
+        const state = deps.store.getState();
+        const stored: StoredCooldownEntry[] = state.providersOnCooldown || [];
+        return {
+          output: buildCooldownsOutput(
+            stored,
+            deps.providerManager.getCooldownDurationMs(),
+          ),
+        };
+      });
+      return;
+    }
+
     if (req.method === "GET" && url.pathname === "/providers/reviews") {
       try {
         const state = deps.store.getState();
@@ -1747,17 +2038,10 @@ export function createDaemonRequestHandler(deps: {
     // limit. Without this, the SDK prices at the provider's worst-case
     // max_completion_cost, which varies widely across providers (2.3× for
     // kimi-k3) and balloons during provider failover. Chat/completions use
-    // max_tokens; the OpenAI Responses API uses max_output_tokens.
-    if (deps.maxTokens > 0) {
-      const isResponsesPath = url.pathname.includes("/responses");
-      if (isResponsesPath) {
-        if (typeof bodyObj.max_output_tokens !== "number") {
-          bodyObj.max_output_tokens = deps.maxTokens;
-        }
-      } else if (typeof bodyObj.max_tokens !== "number") {
-        bodyObj.max_tokens = deps.maxTokens;
-      }
-    }
+    // max_tokens; the OpenAI Responses API uses max_output_tokens. Endpoints
+    // that do not define those fields (e.g. /v1/systemone) are forwarded
+    // verbatim — injecting one makes a strict upstream answer 400.
+    applyDefaultOutputTokenLimit(url.pathname, bodyObj, deps.maxTokens);
 
     const forcedProvider: string | undefined =
       url.searchParams.get("provider") ||
@@ -1786,6 +2070,7 @@ export function createDaemonRequestHandler(deps: {
         requestBody,
         path: url.pathname,
         forcedProvider,
+        autoModelPath: deps.autoModelPath === true,
         headers: incomingHeaders,
         walletAdapter: deps.walletAdapter,
         storageAdapter: deps.storageAdapter,

package/src/daemon/http/request-body.ts

@@ -0,0 +1,67 @@
+/**
+ * Request-body shaping for the proxied path.
+ *
+ * The ingress forwards the caller's JSON body to the upstream provider. It is
+ * allowed to add exactly one thing — a default output-token limit — and only
+ * where that field is part of the endpoint's documented vocabulary. Anything
+ * else must be forwarded verbatim: several upstreams (notably TypeSafe's
+ * `POST /v1/systemone`) validate strictly and reject unknown fields, so an
+ * injected chat-completions field turns a valid request into an opaque
+ * `400 Invalid request.`
+ */
+
+/**
+ * OpenAI-compatible endpoints whose bodies define `max_tokens`,
+ * `max_output_tokens`, and `stream`.
+ *
+ * Matched by path suffix so `/v1/chat/completions`, `/chat/completions`, and
+ * custom path-prefixed proxies all qualify. Kept in sync with
+ * `isOpenAiJsonBodyPath` in `@routstr/sdk` (exported there since 0.4.6); once
+ * routstrd depends on that version this local copy can be dropped.
+ */
+export const OPENAI_JSON_BODY_PATH_SUFFIXES = [
+  "/chat/completions",
+  "/completions",
+  "/responses",
+] as const;
+
+/**
+ * True when `pathname` addresses an endpoint whose body carries the OpenAI
+ * request vocabulary. Ignores a query string and a trailing slash.
+ */
+export function isOpenAiJsonBodyPath(pathname: string): boolean {
+  const path = (pathname.split("?")[0] ?? "").replace(/\/+$/, "");
+  return OPENAI_JSON_BODY_PATH_SUFFIXES.some((suffix) => path.endsWith(suffix));
+}
+
+/**
+ * Cap the completion budget when the client does not set an output token
+ * limit. Without this, the SDK prices at the provider's worst-case
+ * `max_completion_cost`, which varies widely across providers (2.3× for
+ * kimi-k3) and balloons during provider failover. Chat/completions use
+ * `max_tokens`; the OpenAI Responses API uses `max_output_tokens`.
+ *
+ * Non-OpenAI endpoints are left untouched — `/v1/systemone` returns typed
+ * judgments rather than generated text, so it has no completion budget, and it
+ * rejects the field outright. Mutates `body` in place. Returns true when a
+ * field was added.
+ */
+export function applyDefaultOutputTokenLimit(
+  pathname: string,
+  body: Record<string, unknown>,
+  maxTokens: number,
+): boolean {
+  if (!(maxTokens > 0) || !isOpenAiJsonBodyPath(pathname)) {
+    return false;
+  }
+
+  if (pathname.split("?")[0]!.replace(/\/+$/, "").endsWith("/responses")) {
+    if (typeof body.max_output_tokens === "number") return false;
+    body.max_output_tokens = maxTokens;
+    return true;
+  }
+
+  if (typeof body.max_tokens === "number") return false;
+  body.max_tokens = maxTokens;
+  return true;
+}

package/src/daemon/http/request-path.ts

@@ -0,0 +1,39 @@
+/**
+ * Request-path canonicalization for the proxied path.
+ *
+ * routstr-core reduces an incoming path to its allowlist key by stripping
+ * exactly ONE optional leading `v1/` segment (`_canonical_api_path` in
+ * `routstr/proxy.py`), then requires an exact match against its endpoint
+ * table. Both `/chat/completions` and `/v1/chat/completions` therefore reach
+ * the same handler, and no spelling with the prefix repeated ever does:
+ * `/v1/v1/messages` canonicalizes to `v1/messages`, which is not an endpoint,
+ * so the node answers `404 Path '/v1/v1/messages' not found`.
+ *
+ * That second prefix is not hypothetical — it is what an Anthropic-style
+ * client produces when its base URL already ends in `/v1`, because the
+ * Anthropic SDKs append `/v1/messages` themselves (the OpenAI SDKs append only
+ * `/chat/completions` and leave the prefix to the configured base URL). One
+ * such client turns every request into a paid upstream 404 on every provider in
+ * the pool, so collapse the duplicate here, before any routing or payment
+ * decision.
+ */
+
+/**
+ * Collapse a repeated leading `/v1` segment to a single one.
+ *
+ * `/v1/v1/messages` and `/v1/v1/v1/messages` both become `/v1/messages`;
+ * `/v1/messages`, `/chat/completions`, and every other spelling are returned
+ * unchanged. Only the repeated `v1` segment is touched: the node owns the
+ * endpoint allowlist, and rewriting anything else here would make this
+ * ingress answer for paths it knows nothing about.
+ *
+ * Never throws and is idempotent: each pass shortens the path, so a path
+ * that does not start with a doubled `/v1` is returned as-is.
+ */
+export function collapseDuplicatedV1(pathname: string): string {
+  let path = pathname;
+  while (path.startsWith("/v1/v1/") || path === "/v1/v1") {
+    path = path.slice(3);
+  }
+  return path;
+}

package/src/daemon/index.ts

@@ -181,7 +181,6 @@ export async function runDaemon(argv: string[] = process.argv): Promise<void> {
   };
 
   const walletAdapter = await createWalletAdapter({
-    cocodPath: config.cocodPath,
     walletClient,
     getAutoRefillConfig,
     nwcConnectionString: config.nwc?.connectionString,
@@ -214,6 +213,7 @@ export async function runDaemon(argv: string[] = process.argv): Promise<void> {
       getModelProviders,
       refreshProvidersAndModels,
       mode: config.mode || "apikeys",
+      autoModelPath: config.autoModelPath === true,
       maxTokens: config.maxTokens ?? 64000,
       routstrPubkey: config.routstrPubkey,
       routstrModelsPubkey: config.routstrModelsPubkey,