Closes the two findings left open from the pre-launch review.
Node redundancy (it was node reachability, not chain health)
RPC_ENDPOINTS accepts any number of daemons in preference order; PRIMARY /
FALLBACK still work and are appended. The list is deduplicated, which exposes
that the stock config pointed both at the SAME host — what looked like
redundancy was one node.
One logical call now walks every endpoint before failing, instead of needing
three consecutive failures to try exactly one alternate. Each node still has
to pass the chain-identity check before it may answer, so failover cannot
silently serve another chain's data. `failoverActive` is no longer a one-way
latch: the preferred node is re-tested every RPC_PREFERRED_RETRY_MS, so
recovery no longer requires a restart. healthCheck probes every node.
Graceful failure
Entries are refused while no node is reachable. A run is measured in blocks
and its entry block comes from the last successful poll, so a game admitted
during an outage was anchored to an already-past block and killed as a timeout
on the first recovered poll — the player lost a run, and in paid mode an
entry, to our infrastructure. The gate sits in _runAdmission, ahead of any
credit spend, and says so to the player.
Wallet: refused, not failed over
Two wallet-rpc processes over one wallet file can build transactions from the
same outputs and corrupt the cache. A standby wallet is a custody decision for
the operator, not something this code may take on its own — daemons are
read-only and interchangeable, wallets are neither. So a wallet outage
declines paid intake cleanly and leaves credits and free play working.
Auth limiter evicts instead of refusing
The bounded key map 429'd any NEW ip once full, turning a memory cap into a
DoS primitive: a distributed source could hold it at capacity and lock every
first-time caller out of Smirk login. It now reclaims expired entries and, if
still full, evicts the oldest live windows. Same memory ceiling, still a
working limiter.
129 suites / 1026 tests pass.
Adversarial multi-agent review of the launch candidate produced 22 confirmed
findings (12 more were refuted). This closes the critical, high, and the
mediums/lows that are cheap and real, then does the iso/3D/Tavern art pass.
CRITICAL — unauthenticated remote kill switch
Socket.IO does not wrap listener invocation, and this process treats
uncaughtException/unhandledRejection as fatal, so ONE unguarded throw in ANY
listener exits the server. `socket.emit('debug_ping')` with no argument did
exactly that, and systemd restarts straight back into it. Every registration
in handleConnection now goes through a safe-dispatch wrapper that contains
sync throws and rejected promises to the offending socket; handleDebugPing
also stops trusting its payload.
HIGH
- NIP-98 login now binds the signed event to this deployment's host. The path
check alone let an event signed for any other origin authenticate here, and
linking ADOPTS the account owning that pubkey — full account takeover.
- Fog of war is enforced server-side. getState() shipped absolute
entrance/exit/treasure coordinates and the monster's exact position in every
frame, with concealment implemented only in the browser. Discovery is sticky;
the monster is reported only while in view.
- NODE_ENV must now be explicit and recognized. Unset, every production gate
read false while DebugManager reported production and silenced logging.
- Tavern chat applies the lobby's ban list, rate limiter and user_id
attribution before entering global chat.
- userRegistry is deleted by socket.id (it was keyed by socket.id and deleted
by socket.client.id, so nothing was ever freed).
MEDIUM / LOW
- Payouts: a legitimately split transfer_split kept its transaction hashes
instead of quarantining already-broadcast funds with tx_hash NULL, and
provably pre-broadcast failures return to 'pending' rather than needs_review.
- RateLimiter key parsing fixed — cleanup() freed nothing and expired windows
never reset, because ids contain colons.
- Enter no longer submits a paid entry from behind a modal.
- Lobby chat no longer double-escapes server-escaped text.
- Rate limits for identity:get / address:prompt / early_entry.
- Spectators released when a game ends by disconnect, not just settlement.
- movementManager / addressManager per-socket maps cleaned on disconnect.
Renderers
Iso: opaque shading instead of translucent fog, additive torch/lantern/beacon
light pools, crevice AO, embers, cold memory wash, and it stops reallocating
the whole canvas every animation frame.
3D: instanced level geometry (3 draw calls), procedural stone/flagstone
materials, torch lights + shadows, real meshes for stairs/chest/monster
(they were humanoid capsules), dust motes, wall cutaway, and lighting
rebalanced now that fog is measured from the camera.
Tavern
Block height and hash fragments drift around the stage edge and ripple when a
block lands, fed by a cosmetic chain tip added to the blockheight broadcast.
Speech bubbles work again (they keyed off a socketId the server stopped
sending).
126 suites / 1005 tests pass.
- Replace deprecated 'request' with axios in rpccalls.js
- Remove 'request' from package.json (was only used in one file)
- Update node-pg-migrate to ^8.0.4 to fix glob vulnerability
- Run npm audit fix to resolve axios, form-data, js-yaml vulnerabilities
- Fix test/index.js to use correct path for rpccalls import
- Add Node.js installation and npm audit instructions to README
- Add deploy key setup instructions to README
Before: 8 vulnerabilities (1 low, 2 moderate, 3 high, 2 critical)
After: 0 vulnerabilities
jwinterm