routstrd 0.4.9 → 0.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "routstrd",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "module": "src/index.ts",
   "type": "module",
   "private": false,
@@ -23,6 +23,7 @@
     "monitor": "bun src/index.ts monitor",
     "lint": "tsc --noEmit",
     "test": "bun test",
+    "smoke": "scripts/smoke/chat-completions.sh",
     "build": "bun build src/index.ts --target=bun --outfile=dist/index.js --external better-sqlite3 && bun build src/daemon/index.ts --target=bun --outfile=dist/daemon/index.js --external better-sqlite3",
     "build:binary": "bun build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig src/index.ts --outfile=dist/routstrd",
     "prepublishOnly": "bun run build"
@@ -38,7 +39,7 @@
     "@cashu/cashu-ts": "^4.3.0",
     "@cashu/coco-core": "^1.0.1",
     "@cashu/coco-sqlite-bun": "^1.0.1",
-    "@routstr/sdk": "^0.4.4",
+    "@routstr/sdk": "^0.4.6",
     "@scure/bip39": "^2.2.0",
     "applesauce-core": "^5.1.0",
     "applesauce-relay": "^5.1.0",

package/src/daemon/http/index.ts

@@ -21,6 +21,7 @@ import {
 import { receiveCashuToken } from "../wallet";
 import { getClientsFromStore } from "../../utils/clients";
 import { getUsageSummary } from "./usage-summary";
+import { applyDefaultOutputTokenLimit } from "./request-body";
 
 // Hop-by-hop headers describe the *upstream* connection, not this one, and must
 // never be copied onto our response. In particular, copying the upstream's
@@ -1747,17 +1748,10 @@ export function createDaemonRequestHandler(deps: {
     // limit. Without this, the SDK prices at the provider's worst-case
     // max_completion_cost, which varies widely across providers (2.3× for
     // kimi-k3) and balloons during provider failover. Chat/completions use
-    // max_tokens; the OpenAI Responses API uses max_output_tokens.
-    if (deps.maxTokens > 0) {
-      const isResponsesPath = url.pathname.includes("/responses");
-      if (isResponsesPath) {
-        if (typeof bodyObj.max_output_tokens !== "number") {
-          bodyObj.max_output_tokens = deps.maxTokens;
-        }
-      } else if (typeof bodyObj.max_tokens !== "number") {
-        bodyObj.max_tokens = deps.maxTokens;
-      }
-    }
+    // max_tokens; the OpenAI Responses API uses max_output_tokens. Endpoints
+    // that do not define those fields (e.g. /v1/systemone) are forwarded
+    // verbatim — injecting one makes a strict upstream answer 400.
+    applyDefaultOutputTokenLimit(url.pathname, bodyObj, deps.maxTokens);
 
     const forcedProvider: string | undefined =
       url.searchParams.get("provider") ||

package/src/daemon/http/request-body.ts

@@ -0,0 +1,67 @@
+/**
+ * Request-body shaping for the proxied path.
+ *
+ * The ingress forwards the caller's JSON body to the upstream provider. It is
+ * allowed to add exactly one thing — a default output-token limit — and only
+ * where that field is part of the endpoint's documented vocabulary. Anything
+ * else must be forwarded verbatim: several upstreams (notably TypeSafe's
+ * `POST /v1/systemone`) validate strictly and reject unknown fields, so an
+ * injected chat-completions field turns a valid request into an opaque
+ * `400 Invalid request.`
+ */
+
+/**
+ * OpenAI-compatible endpoints whose bodies define `max_tokens`,
+ * `max_output_tokens`, and `stream`.
+ *
+ * Matched by path suffix so `/v1/chat/completions`, `/chat/completions`, and
+ * custom path-prefixed proxies all qualify. Kept in sync with
+ * `isOpenAiJsonBodyPath` in `@routstr/sdk` (exported there since 0.4.6); once
+ * routstrd depends on that version this local copy can be dropped.
+ */
+export const OPENAI_JSON_BODY_PATH_SUFFIXES = [
+  "/chat/completions",
+  "/completions",
+  "/responses",
+] as const;
+
+/**
+ * True when `pathname` addresses an endpoint whose body carries the OpenAI
+ * request vocabulary. Ignores a query string and a trailing slash.
+ */
+export function isOpenAiJsonBodyPath(pathname: string): boolean {
+  const path = (pathname.split("?")[0] ?? "").replace(/\/+$/, "");
+  return OPENAI_JSON_BODY_PATH_SUFFIXES.some((suffix) => path.endsWith(suffix));
+}
+
+/**
+ * Cap the completion budget when the client does not set an output token
+ * limit. Without this, the SDK prices at the provider's worst-case
+ * `max_completion_cost`, which varies widely across providers (2.3× for
+ * kimi-k3) and balloons during provider failover. Chat/completions use
+ * `max_tokens`; the OpenAI Responses API uses `max_output_tokens`.
+ *
+ * Non-OpenAI endpoints are left untouched — `/v1/systemone` returns typed
+ * judgments rather than generated text, so it has no completion budget, and it
+ * rejects the field outright. Mutates `body` in place. Returns true when a
+ * field was added.
+ */
+export function applyDefaultOutputTokenLimit(
+  pathname: string,
+  body: Record<string, unknown>,
+  maxTokens: number,
+): boolean {
+  if (!(maxTokens > 0) || !isOpenAiJsonBodyPath(pathname)) {
+    return false;
+  }
+
+  if (pathname.split("?")[0]!.replace(/\/+$/, "").endsWith("/responses")) {
+    if (typeof body.max_output_tokens === "number") return false;
+    body.max_output_tokens = maxTokens;
+    return true;
+  }
+
+  if (typeof body.max_tokens === "number") return false;
+  body.max_tokens = maxTokens;
+  return true;
+}

package/src/daemon/models.ts

@@ -87,22 +87,25 @@ export function createModelService(
         const providers = await modelManager.bootstrapProviders(false);
         logger.log(`Bootstrapped ${providers.length} providers`);
 
-        // Sync discovered providers into the store so `providers list` reflects
-        // the same set that the model manager knows about.
+        // Mirror discovery into the store so `providers list` reports the same
+        // set that the model manager polls and routes to. The list is
+        // *replaced*, not merged: an add-only merge keeps URLs discovery no
+        // longer reports (e.g. after a bootstrap regression or a provider
+        // unpublishing) visible to the CLI and to per-model views while
+        // routing silently ignores them.
         const {
           baseUrlsList,
           setBaseUrlsList,
           setDisabledProviders,
         } = store.getState();
-        const existing = new Set(baseUrlsList);
-        const merged = [
-          ...baseUrlsList,
-          ...providers.filter((url) => !existing.has(url)),
-        ];
-        if (merged.length !== baseUrlsList.length) {
-          setBaseUrlsList(merged);
+        const known = new Set(baseUrlsList);
+        const inSync =
+          known.size === providers.length &&
+          providers.every((url) => known.has(url));
+        if (!inSync) {
+          setBaseUrlsList(providers);
           logger.log(
-            `Synced ${merged.length - baseUrlsList.length} new provider(s) into store`,
+            `Synced ${providers.length} discovered provider(s) into store (was ${baseUrlsList.length})`,
           );
         }
 

package/src/daemon/wallet/coco-client.ts

@@ -58,6 +58,9 @@ import {
   walletDir as defaultWalletDir,
   walletPidPath as defaultWalletPidPath,
 } from "./paths";
+import { DEFAULT_MINT_URL, seedTrustedMints } from "./trusted-mints";
+
+export { DEFAULT_MINT_URL, DEFAULT_TRUSTED_MINT_URLS } from "./trusted-mints";
 
 const NPC_DEFAULT_BASE_URL = "https://npubx.cash";
 
@@ -117,7 +120,6 @@ interface CocodConfig {
 }
 
 const STARTUP_LOG_PREFIX = "[routstrd:start]";
-export const DEFAULT_MINT_URL = "https://mint.cubabitcoin.org";
 
 function startupProgress(message: string): void {
   logger.info(message);
@@ -1293,10 +1295,23 @@ export async function createCocoClient(
       configuredDefault || trustedMints[0]?.mintUrl || DEFAULT_MINT_URL,
     );
 
-    if (!trustedMints.some((mint) => mint.mintUrl === defaultMintUrl)) {
-      startupProgress(`Adding default mint: ${defaultMintUrl}`);
-      await coco.mint.addMint(defaultMintUrl, { trusted: true });
-    }
+    // Seeds the mints we ship as trusted. The default mint is strict (see
+    // seedTrustedMints); extra seeds only warn, so an unreachable mint that is
+    // not the default cannot stop the daemon from starting.
+    await seedTrustedMints(
+      {
+        trustedMints: trustedMints.map((mint) => mint.mintUrl),
+        addMint: (mintUrl) => coco!.mint.addMint(mintUrl, { trusted: true }),
+      },
+      defaultMintUrl,
+      {
+        onProgress: startupProgress,
+        onError: (message, error) =>
+          logger.warn(message, {
+            error: error instanceof Error ? error.message : String(error),
+          }),
+      },
+    );
 
     // Persist only after the mint was successfully fetched and trusted. A failed
     // network request must not leave config pointing at an unusable default.

package/src/daemon/wallet/trusted-mints.ts

@@ -0,0 +1,87 @@
+import { normalizeMintUrl } from "@cashu/coco-core";
+
+/**
+ * Mint used as the default for wallets that have no configured default. It is
+ * always trusted, and a wallet is never allowed to point its default at a mint
+ * it could not fetch.
+ */
+export const DEFAULT_MINT_URL = "https://mint.cubabitcoin.org";
+
+/**
+ * Mints routstrd trusts out of the box. Every entry is added as a trusted mint
+ * on startup so users can send/receive without an explicit
+ * `wallet mints add`. `DEFAULT_MINT_URL` is listed first because it seeds the
+ * default mint of a fresh wallet; extra entries never change an existing
+ * default.
+ */
+export const DEFAULT_TRUSTED_MINT_URLS: readonly string[] = [
+  DEFAULT_MINT_URL,
+  "https://mint.minibits.cash/Bitcoin",
+];
+
+export interface TrustedMintSeeder {
+  /** Mint URLs the wallet currently trusts. */
+  trustedMints: readonly string[];
+  /** Trust a mint, fetching its info and keysets from the mint itself. */
+  addMint: (mintUrl: string) => Promise<unknown>;
+}
+
+export interface SeedTrustedMintsOptions {
+  /** Mints to ensure are trusted, in order. Defaults to the shipped seeds. */
+  seeds?: readonly string[];
+  /** Called before each mint fetch with a user-facing progress message. */
+  onProgress?: (message: string) => void;
+  /** Called when a non-default seed could not be added. */
+  onError?: (message: string, error: unknown) => void;
+}
+
+// Stored and configured mint URLs come from SQLite and JSON, so a malformed
+// value must never crash startup. Normalization only strips the default port
+// and a trailing slash, so falling back to the raw string keeps comparisons
+// meaningful.
+function safeNormalizeMintUrl(mintUrl: string): string {
+  try {
+    return normalizeMintUrl(mintUrl);
+  } catch {
+    return mintUrl;
+  }
+}
+
+/**
+ * Ensure the mint seeds routstrd ships are trusted, without ever moving a
+ * wallet's default away from `defaultMintUrl`.
+ *
+ * The default mint is seeded strictly: if it cannot be fetched the error is
+ * rethrown, because persisting an unusable default is worse than failing
+ * startup. Every other seed is best-effort — sending the mint fetch failure to
+ * `onError` — so a single unreachable mint cannot keep the daemon down.
+ */
+export async function seedTrustedMints(
+  wallet: TrustedMintSeeder,
+  defaultMintUrl: string,
+  options: SeedTrustedMintsOptions = {},
+): Promise<void> {
+  const seeds = options.seeds ?? DEFAULT_TRUSTED_MINT_URLS;
+  const target = safeNormalizeMintUrl(defaultMintUrl);
+  const trusted = new Set(wallet.trustedMints.map(safeNormalizeMintUrl));
+  const attempted = new Set<string>();
+
+  for (const seed of [defaultMintUrl, ...seeds]) {
+    const mintUrl = safeNormalizeMintUrl(seed);
+    if (attempted.has(mintUrl)) continue;
+    attempted.add(mintUrl);
+    if (trusted.has(mintUrl)) continue;
+
+    const isDefault = mintUrl === target;
+    try {
+      options.onProgress?.(
+        `Adding ${isDefault ? "default" : "trusted"} mint: ${mintUrl}`,
+      );
+      await wallet.addMint(mintUrl);
+      trusted.add(mintUrl);
+    } catch (error) {
+      if (isDefault) throw error;
+      options.onError?.(`Could not add trusted mint ${mintUrl}`, error);
+    }
+  }
+}

package/src/integrations/pi.ts

@@ -5,17 +5,144 @@ import type { RoutstrdConfig } from "../utils/config";
 import type { IntegrationConfig, RoutstrModel } from "./registry";
 import { callDaemon, getDaemonBaseUrl } from "../utils/daemon-client";
 
-type PiModelEntry = {
+export type PiThinkingLevel =
+  | "off"
+  | "minimal"
+  | "low"
+  | "medium"
+  | "high"
+  | "xhigh"
+  | "max";
+
+export type ThinkingLevelMap = Partial<Record<PiThinkingLevel, string | null>>;
+
+export type PiModelEntry = {
   id: string;
   contextWindow?: number;
   name?: string;
   input?: string[];
-  // Thinking/reasoning config is user-curated and preserved across refreshes.
   reasoning?: boolean;
-  thinkingLevelMap?: Record<string, string | null>;
+  thinkingLevelMap?: ThinkingLevelMap;
   compat?: Record<string, unknown>;
 };
 
+/** pi thinking levels, in pi's documented order. */
+export const PI_THINKING_LEVELS: readonly PiThinkingLevel[] = [
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+];
+
+/**
+ * pi level -> the value sent to the provider. routstr-core publishes its
+ * allowlist in this same vocabulary (`none`/`minimal`/`low`/`medium`/`high`/
+ * `xhigh`/`max`), so the mapping is identity apart from `off`.
+ */
+const THINKING_LEVEL_VALUES: Record<PiThinkingLevel, string> = {
+  off: "none",
+  minimal: "minimal",
+  low: "low",
+  medium: "medium",
+  high: "high",
+  xhigh: "xhigh",
+  max: "max",
+};
+
+/**
+ * Build pi's thinking fields from the daemon's per-model `reasoning` object.
+ *
+ * Every level is written explicitly: pi treats an omitted level as "use the
+ * provider's default mapping" for standard levels (through `high`) and as
+ * "unsupported" for `xhigh`/`max`, so a partial map would silently advertise
+ * levels the model rejects. `null` hides the level in pi's UI.
+ *
+ * Returns null when the daemon publishes no effort allowlist (models whose
+ * upstream only reports `mandatory`, or that report no reasoning at all).
+ * Those are not guessable, so the caller keeps whatever the user curated.
+ */
+export function deriveThinkingFields(
+  model: RoutstrModel,
+): { reasoning: true; thinkingLevelMap: ThinkingLevelMap } | null {
+  const reasoning = model.reasoning;
+  if (!reasoning) return null;
+
+  const supported = (reasoning.supported_efforts ?? [])
+    .filter((effort): effort is string => typeof effort === "string")
+    .map((effort) => effort.trim().toLowerCase())
+    .filter(Boolean);
+  if (supported.length === 0) return null;
+
+  const allowed = new Set(supported);
+  // routstr-core strips `none` from mandatory models, so never offer `off` there.
+  if (reasoning.mandatory === true) allowed.delete("none");
+
+  const thinkingLevelMap: ThinkingLevelMap = {};
+  for (const level of PI_THINKING_LEVELS) {
+    const value = THINKING_LEVEL_VALUES[level];
+    thinkingLevelMap[level] = allowed.has(value) ? value : null;
+  }
+
+  return { reasoning: true, thinkingLevelMap };
+}
+
+const isDeepSeekModel = (id: string): boolean => id.startsWith("deepseek");
+
+/** Project one daemon model onto a pi config entry. */
+export function buildPiModelEntry(
+  model: RoutstrModel,
+  previous?: PiModelEntry,
+): PiModelEntry {
+  const entry: PiModelEntry = { id: model.id };
+
+  if (model.context_length !== undefined && model.context_length > 0) {
+    entry.contextWindow = model.context_length;
+  }
+
+  if (model.name) {
+    entry.name = model.name;
+  }
+
+  // Map the daemon's input modalities to Pi's ["text", "image"] vocabulary.
+  const mods = model.architecture?.input_modalities ?? [];
+  const input: string[] = [];
+  if (mods.includes("text")) input.push("text");
+  if (mods.includes("image")) input.push("image");
+  entry.input = input;
+
+  const derived = deriveThinkingFields(model);
+  if (derived) {
+    entry.reasoning = derived.reasoning;
+    entry.thinkingLevelMap = derived.thinkingLevelMap;
+  } else {
+    // No allowlist to derive from: keep the user's hand-curated fields rather
+    // than guessing which levels the model accepts.
+    if (previous?.reasoning !== undefined) entry.reasoning = previous.reasoning;
+    if (previous?.thinkingLevelMap !== undefined) {
+      entry.thinkingLevelMap = previous.thinkingLevelMap;
+    }
+  }
+
+  // `compat` is never published by the daemon; it stays user-curated — except
+  // for deepseek* models, where the role spelling below is authoritative.
+  if (isDeepSeekModel(model.id)) {
+    // DeepSeek-backed models reject the `developer` role (OpenAI's newer
+    // spelling of `system`) on strict upstreams with a hard 400. Pi sends
+    // `developer` for reasoning models on unrecognized providers because its
+    // provider heuristics only see the local daemon URL and can't know
+    // DeepSeek sits behind it — force the universally-accepted `system`
+    // spelling for every deepseek* model, keeping any other user-set keys.
+    entry.compat = { ...(previous?.compat ?? {}), supportsDeveloperRole: false };
+  } else if (previous?.compat !== undefined) {
+    entry.compat = previous.compat;
+  }
+
+  return entry;
+}
+
 type PiProviderConfig = {
   baseUrl?: string;
   api?: string;
@@ -68,39 +195,17 @@ export async function installPiIntegration(
     }
 
     // Rebuild every model entry from scratch from the daemon, so the generated
-    // models.json is always a faithful projection of the daemon's state. The only
-    // exception is thinking/reasoning config (reasoning, thinkingLevelMap, compat),
-    // which the daemon does not provide and the user curates by hand — preserve it.
+    // models.json is always a faithful projection of the daemon's state.
+    // Thinking fields are derived from the model's published reasoning allowlist;
+    // when the daemon has none, the user's hand-curated values are preserved.
+    // `compat` stays user-curated, except for the deepseek* pin applied below.
     const existingModels = new Map<string, PiModelEntry>(
       (piConfig.providers["routstr"]?.models ?? []).map((m) => [m.id, m]),
     );
 
-    const providerModels: PiModelEntry[] = models.map((model) => {
-      const previous = existingModels.get(model.id);
-      const entry: PiModelEntry = { id: model.id };
-
-      if (model.context_length !== undefined && model.context_length > 0) {
-        entry.contextWindow = model.context_length;
-      }
-
-      if (model.name) {
-        entry.name = model.name;
-      }
-
-      // Map the daemon's input modalities to Pi's ["text", "image"] vocabulary.
-      const mods = model.architecture?.input_modalities ?? [];
-      const input: string[] = [];
-      if (mods.includes("text")) input.push("text");
-      if (mods.includes("image")) input.push("image");
-      entry.input = input;
-
-      // Preserve user-curated thinking fields from the previous entry.
-      if (previous?.reasoning !== undefined) entry.reasoning = previous.reasoning;
-      if (previous?.thinkingLevelMap !== undefined) entry.thinkingLevelMap = previous.thinkingLevelMap;
-      if (previous?.compat !== undefined) entry.compat = previous.compat;
-
-      return entry;
-    });
+    const providerModels: PiModelEntry[] = models.map((model) =>
+      buildPiModelEntry(model, existingModels.get(model.id)),
+    );
 
     // Rebuild provider from scratch too; only write routstrd-managed fields.
     piConfig.providers["routstr"] = {

package/src/integrations/registry.ts

@@ -14,6 +14,19 @@ export interface IntegrationConfig {
   configPath: string;
 }
 
+/**
+ * Per-model reasoning metadata as published by routstr-core (OpenRouter shape).
+ * Models with no reasoning support omit the whole object, and models whose
+ * upstream publishes no effort allowlist carry only `mandatory`.
+ */
+export type RoutstrReasoning = {
+  mandatory?: boolean | null;
+  default_enabled?: boolean | null;
+  supported_efforts?: string[] | null;
+  default_effort?: string | null;
+  supports_max_tokens?: boolean | null;
+};
+
 export type RoutstrModel = {
   id: string;
   name?: string;
@@ -27,6 +40,7 @@ export type RoutstrModel = {
     context_length?: number;
     max_completion_tokens?: number;
   };
+  reasoning?: RoutstrReasoning | null;
 };
 
 export type IntegrationFn = (

package/src/tui/usage/app.ts

@@ -1,6 +1,6 @@
 import { getVisibleTabs } from "./constants.ts";
 import type { Tab } from "./types.ts";
-import { fetchBalance, fetchClients, fetchStatus, fetchUsageSummary, hasAnyNpubs, isDaemonRunning, type BalanceInfo, type ClientInfo, type StatusInfo } from "./data.ts";
+import { buildClientNaming, emptyClientNaming, fetchBalance, fetchClients, fetchNpubs, fetchStatus, fetchUsageSummary, hasAnyNpubs, isDaemonRunning, type BalanceInfo, type ClientInfo, type ClientNaming, type NpubEntry, type StatusInfo } from "./data.ts";
 import {
   applyScrollToContent,
   exitSearchMode,
@@ -48,6 +48,8 @@ export async function runUsageTui(): Promise<void> {
   let balance: BalanceInfo | null = null;
   let status: StatusInfo | null = null;
   let clients: ClientInfo[] = [];
+  let npubs: NpubEntry[] = [];
+  let naming: ClientNaming = emptyClientNaming();
   let visibleTabs: Tab[] = getVisibleTabs(false);
   let refreshInterval: ReturnType<typeof setInterval> | null = null;
   let autoRefresh = true;
@@ -144,6 +146,18 @@ export async function runUsageTui(): Promise<void> {
           currentTab = "clients";
           vimState.scrollPos = 0;
         }
+
+        // Names/roles live on the auth proxy, not the usage summary. Only
+        // fetch them when the Npubs tab is actually reachable, and keep the
+        // last good list if the endpoint is temporarily unreachable.
+        if (npubsVisible) {
+          const newNpubs = await fetchNpubs();
+          if (newNpubs.length > 0) npubs = newNpubs;
+        }
+
+        // Owner info (for "Name (client-id)" labels in the Recent tab) comes
+        // from /clients + /npubs; both are empty in local mode.
+        naming = buildClientNaming(clients, npubs);
       }
       render();
     } finally {
@@ -170,7 +184,7 @@ export async function runUsageTui(): Promise<void> {
       return;
     }
 
-    const content = renderTabContent(currentTab, stats, balance, status, width, clients);
+    const content = renderTabContent(currentTab, stats, balance, status, width, naming);
     const footer = `${COLORS.dim}Press [Q] to quit, [R] to refresh, [A] to toggle auto-refresh${autoRefresh ? " (on)" : " (off)"}  scroll:${vimState.scrollPos}${COLORS.reset}${vimState.mode === "normal" ? `  ${COLORS.yellow}vim: hjkl/arrows, / search, g top, gg bottom${COLORS.reset}` : ""}`;
     const chrome = renderHeader(currentTab, width, visibleTabs, updateInfo ?? undefined) + renderTabs(currentTab, visibleTabs) + renderSeparator(width) + renderSearchBar();
     const chromeLines = chrome.split("\n").length - 1;