coinos-server.git/index.ts, branch staging

users: add authenticated self-delete endpoint

2026-06-17T14:47:46Z

Port of master 2548f757, adapted from Express to this stack's Hono handlers (c.get("user"), c.req.json(), setCookie, bail) and TigerBeetle balances (getBalance/getPending instead of the Redis balance:/pending: keys). POST /delete (auth) wipes every key tied to the calling user: user records, payments/invoices, sub-accounts, NWC apps, nostr follow graph + nip5. Gated by typing the username and refuses while balance+pending > 10k sats so funds can't be destroyed by accident. Co-Authored-By: Claude Opus 4.8

payments: guard /replay double-credit race with SET NX idempotency

2026-06-17T14:47:45Z

Port of master ca28c19f to the staging stack. The getPayment() pre-check in the lightning listener/replay isn't atomic, so concurrent re-credits of the same settlement each ran the credit path. Claim each lightning/bolt12 settlement with an atomic SET NX on credited: (ref = preimage) and bail if already claimed. Guard sits before tbCredit and the pointer writes so a duplicate bails cleanly. Also disable the /replay route that triggered it. Co-Authored-By: Claude Opus 4.8

ln/lightning: watchdog recycles zombie receive-listener socket

2026-06-08T22:49:26Z

Port of master bd1ece3 to staging. When cl restarts (e.g. autoheal after a healthcheck timeout), the app's waitanyinvoice long-poll can hang on the now-dead listen socket: listenerActive stays true forever, nothing restarts it, and incoming lightning payments silently stop crediting until a manual app restart. The per-call RPC timeout can't catch this — waitanyinvoice is meant to block. ensureListenerAlive (run every 120s) now also detects a stalled listener — active but blocked in waitanyinvoice for >5min — probes cl via the main socket (getinfo), and only if cl is actually alive treats the listen socket as a zombie: bumps a listenerEpoch, calls lnListen.reset() (new: drops the proxy socket so the next call reconnects), and re-arms. The epoch guard makes the wedged invocation bow out when its waitanyinvoice finally rejects, so we never run two listeners or double-credit. Co-Authored-By: Claude Opus 4.8 (1M context)

remove /gateway endpoint

2026-05-18T06:42:28Z

Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context)

feat: blocked address protection, LNURL proxy, replay timestamps

2026-03-28T06:58:56Z

- Add lib/changeid.ts for in-process account rekeying - Block sends to addresses in redis blocked_addresses set, auto-rekey on attempt - Add created param to credit() for accurate replay timestamps - Add paid_at to replay() for correct payment dates - Add /lnurl/proxy endpoint for server-side LNURL callback fetching Co-Authored-By: Claude Opus 4.6 (1M context)

update migrate script

2026-03-16T23:37:03Z

ark delegation

2026-03-13T22:14:51Z

remove bumpestimate

2026-03-12T05:30:37Z

add LNURL-withdraw endpoints for fund-based NFC payments

2026-03-09T05:23:17Z

Co-Authored-By: Claude Opus 4.6

add group registry for MLS push notifications

2026-03-07T07:22:12Z

Server now tracks MLS groups (synced from clients) and subscribes to kind 445 events on group relays, sending push to all members except the sender. Registry persisted to Redis across restarts. Co-Authored-By: Claude Opus 4.6