coinos-server.git, branch regtest-fulcrum

regtest: add Fulcrum (Electrum/WS) with ZMQ push for Hal realtime

2026-06-27T18:00:08Z

Adds a regtest Fulcrum service matching what prod runs, replacing the old electrs + ews bridge as the data/realtime backend for the Hal browser wallet. It connects to `bc` and gets instant block/mempool notifications over bitcoind's ZMQ (hashblock/hashtx), serving them to the browser over an Electrum WebSocket (:50003) — sub-second deposit + confirmation updates on regtest. - docker/fulcrum.Dockerfile: Fulcrum on ghcr.io/coinos/base (shares layers with the rest of the stack instead of a separate image tree). - compose.fulcrum.yml: opt-in overlay (`-f compose.fulcrum.yml up -d`), config + datadir under the gitignored data/ (seeded from sampledata by setup.sh). - sampledata/fulcrum/fulcrum.conf: regtest config pointed at `bc`, ZMQ enabled. - sampledata/bitcoin/bitcoin.conf: add zmqpubhashblock/hashtx (18508/18509) so Fulcrum can subscribe for instant notifications. Co-Authored-By: Claude Opus 4.8

scripts: add dedup-invoices cleanup for already-duplicated :invoices

2026-06-18T14:41:21Z

The source fix (LPOS guard in generate, 2d2f9856) stops NEW duplicate entries but doesn't remove the ones already accumulated. This one-time script scrubs them: scans every :invoices list and removes duplicate ids, keeping each id's original creation-order position. Dry-run by default; pass --apply to write. Idempotent. Scope on a recent prod snapshot: 2,785 of 8,735 lists had dupes (16,363 duplicate entries). Co-Authored-By: Claude Opus 4.8 (1M context)

invoices: don't re-list an invoice id on update (dedupe :invoices)

2026-06-18T14:37:04Z

generate() unconditionally lPush'd the invoice id to `${aid}:invoices`, but it's also called from the update() handler (tip/webhook changes, and repeated bolt12 offer creation) re-using the existing id — so each update re-appended the same id and the user's :invoices accumulated duplicate entries, rendering the same offer/invoice multiple times (kaliyi's OCEAN offer showed 2x, another 6x). Only push when the id isn't already in the list (LPOS guard). Co-Authored-By: Claude Opus 4.8 (1M context)

lnurl: SSRF-guard user-supplied URL fetches + validate zap events

2026-06-16T06:35:50Z

The /lnurl/proxy, /decode and /encode handlers fetched an arbitrary user-supplied URL via got() and returned the body — an unauthenticated SSRF reaching internal services. Route those fetches through a new safeGot() that rejects hosts resolving to loopback/private/link-local/ CGNAT/metadata ranges, re-validates on each redirect hop, restricts the scheme to http(s), and caps timeout + response size. Also validate the NIP-57 zap request (kind 9734 + signature) before storing it, instead of trusting the client-supplied event. These endpoints can't be removed — they back lightning-address/LNURL parsing and resolution in the wallet UI. Co-Authored-By: Claude Opus 4.8 (1M context)

Push broadcast txs directly to public explorers

2026-06-15T20:01:41Z

After broadcasting an on-chain send via bitcoind, also POST the raw tx to mempool.space and blockstream (fire-and-forget, non-blocking) so those explorers see it immediately instead of waiting ~8s for p2p propagation. Skipped on regtest/testnet. Co-Authored-By: Claude Opus 4.8 (1M context)

setup override warning

2026-06-14T15:50:05Z

scripts: add wiped-history audit and rebalance-economics model

2026-06-13T21:21:53Z

audit-wiped-history.ts (read-only) finds accounts whose :payments index was wiped by the changeid bug — balance>0 with empty history in both db and arc. rebalance-economics.ts models whether the lightning->liquid bridge throughput is fee-positive against on-chain rebalance cost. Co-Authored-By: Claude Opus 4.8 (1M context)

users: add authenticated self-delete endpoint

2026-06-13T21:21:49Z

POST /delete (auth) wipes every key tied to the calling user, mirroring scripts/delall-legacy.ts: user records, payments/invoices, sub-accounts, NWC apps, nostr follow graph + nip5. Gated by typing the username and refuses while balance+pending > 10k sats so funds can't be destroyed by accident. Co-Authored-By: Claude Opus 4.8 (1M context)

payments: guard /replay double-credit race with SET NX idempotency

2026-06-13T21:21:44Z

getPayment() pre-check in the lightning listener/replay isn't atomic, so concurrent re-credits of the same settlement each ran incrBy. Claim each lightning/bolt12 settlement with an atomic SET NX on credited: (ref = preimage) and bail if already claimed. Also disable the /replay route that triggered it. Co-Authored-By: Claude Opus 4.8 (1M context)

payments: freeze matches uid as well as username (rename-proof)

2026-06-13T21:21:39Z

The blacklist (send freeze) only matched the current username, so a compromised account could shake the freeze by renaming itself. Match on either the lowercased username OR the immutable uid; add the uid to the `blacklist` set to freeze durably. Co-Authored-By: Claude Opus 4.8 (1M context)