release: v0.2.2 — auto-reconcile abandoned txs + covenant-input passthrough

- daemon: monitor ticker now runs cleanup-abandoned every 300s (TS
  TaskFailAbandoned analog) so jammed/abandoned actions self-heal
  instead of wedging coin selection (#18).
- cleanup_abandoned: ReconcileReport summary; reconcile a server-spent
  UTXO via reviewSpendableOutputs(all,release)+abortAction.
- server: createAction passthrough for caller-provided inputs /
  inputBEEF / lockTime / trustSelf so covenant spends (CLTV reclaim,
  delayed earnings) sign against the real prevout, not change.
- deps: bsv-wallet-toolbox 0.3.38 -> 0.3.41 (covenant unlock fix).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Calgooon

Cargo.lock

@@ -4,7 +4,7 @@ resolver = "2"
 
 [package]
 name = "bsv-wallet-cli"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2021"
 license = "MIT"
 authors = ["John Calhoun"]
@@ -23,7 +23,7 @@ name = "bsv-wallet"
 path = "src/main.rs"
 
 [dependencies]
-bsv-wallet-toolbox = { package = "bsv-wallet-toolbox-rs", version = "0.3.38", features = ["sqlite"] }
+bsv-wallet-toolbox = { package = "bsv-wallet-toolbox-rs", version = "0.3.41", features = ["sqlite"] }
 bsv-sdk = { package = "bsv-rs", version = "0.3.4", features = ["full"] }
 tokio = { version = "1", features = ["full"] }
 clap = { version = "4", features = ["derive"] }

Cargo.toml

@@ -1,31 +1,73 @@
 use anyhow::{Context, Result};
+use bsv_wallet_toolbox::Chain;
 use sqlx::Row;
 
 use crate::commands::receive;
 use crate::context::WalletContext;
 
-pub async fn run(ctx: &WalletContext, db_path: &str, execute: bool) -> Result<()> {
-    let pool = sqlx::SqlitePool::connect(&format!("sqlite:{}", db_path))
-        .await
-        .with_context(|| format!("failed to open {} (is the daemon running?)", db_path))?;
-
-    let rows = sqlx::query("SELECT transaction_id, txid FROM transactions WHERE status='unproven'")
-        .fetch_all(&pool)
-        .await?;
+/// Summary of one reconcile pass over abandoned transactions.
+#[derive(Default, Debug, Clone)]
+pub struct ReconcileReport {
+    /// `unproven` txs inspected (after the min-age filter).
+    pub checked: usize,
+    /// txids still tracked by the network (kept spendable).
+    pub kept: Vec<String>,
+    /// txids missing on chain (HTTP 404) — the abandoned set.
+    pub abandoned: Vec<String>,
+    /// Whether `execute` actually applied the cleanup.
+    pub applied: bool,
+    /// Transactions transitioned `unproven` -> `failed`.
+    pub failed: u64,
+    /// Inputs of abandoned txs restored to spendable.
+    pub restored_count: u64,
+    pub restored_sats: u64,
+    /// Phantom outputs of abandoned txs invalidated (spendable=0).
+    pub phantom_count: u64,
+    pub phantom_sats: u64,
+}
 
+/// Core reconcile, shared by the CLI `cleanup-abandoned` command and the daemon's
+/// periodic ticker.
+///
+/// Scans `status='unproven'` transactions that are at least `min_age_secs` old
+/// (so a freshly-broadcast tx that has not yet propagated to WhatsOnChain is
+/// never mis-classified), checks each against WoC, and — when `execute` — fails
+/// the ones missing on chain: restore their inputs, invalidate their own phantom
+/// outputs, and mark them `failed` (which excludes them from coin selection,
+/// preventing a never-landed tx's change from funding — and orphaning — a new
+/// transaction).
+///
+/// Operates on the caller-provided pool so the daemon reuses its existing
+/// connection rather than opening a second one (the wallet DB is not in WAL
+/// mode and a fresh pool would lack the daemon's `busy_timeout`).
+pub async fn reconcile(
+    pool: &sqlx::SqlitePool,
+    chain: Chain,
+    min_age_secs: i64,
+    execute: bool,
+) -> Result<ReconcileReport> {
+    let mut report = ReconcileReport::default();
+
+    // `datetime('now', '-N seconds')`: only consider txs at least N seconds old.
+    // min_age_secs == 0 -> '-0 seconds' == now, i.e. no effective age guard
+    // (the CLI command's historical behavior).
+    let age_modifier = format!("-{} seconds", min_age_secs.max(0));
+    let rows = sqlx::query(
+        "SELECT transaction_id, txid FROM transactions \
+         WHERE status='unproven' AND created_at <= datetime('now', ?)",
+    )
+    .bind(&age_modifier)
+    .fetch_all(pool)
+    .await?;
+
+    report.checked = rows.len();
     if rows.is_empty() {
-        println!("No unproven transactions found.");
-        return Ok(());
+        return Ok(report);
     }
-    println!(
-        "Found {} unproven transaction(s); checking WoC...",
-        rows.len()
-    );
 
-    let base = receive::woc_base(ctx.chain);
+    let base = receive::woc_base(chain);
     let client = reqwest::Client::new();
     let mut to_fail: Vec<(i64, String)> = Vec::new();
-    let mut still_in_mempool: Vec<String> = Vec::new();
 
     for row in &rows {
         let tx_id: i64 = row.get("transaction_id");
@@ -38,54 +80,82 @@ pub async fn run(ctx: &WalletContext, db_path: &str, execute: bool) -> Result<()
         if resp.status().as_u16() == 404 {
             to_fail.push((tx_id, txid));
         } else {
-            still_in_mempool.push(txid);
+            report.kept.push(txid);
         }
     }
+    report.abandoned = to_fail.iter().map(|(_, t)| t.clone()).collect();
+
+    if to_fail.is_empty() || !execute {
+        return Ok(report);
+    }
+
+    let ids: Vec<i64> = to_fail.iter().map(|(id, _)| *id).collect();
+    let restored = restore_inputs(pool, &ids).await?;
+    let phantoms = remove_phantom_outputs(pool, &ids).await?;
+    let failed = mark_failed(pool, &ids).await?;
+
+    report.applied = true;
+    report.failed = failed;
+    report.restored_count = restored.0;
+    report.restored_sats = restored.1;
+    report.phantom_count = phantoms.0;
+    report.phantom_sats = phantoms.1;
+    Ok(report)
+}
 
+pub async fn run(ctx: &WalletContext, db_path: &str, execute: bool) -> Result<()> {
+    let pool = sqlx::SqlitePool::connect(&format!("sqlite:{}", db_path))
+        .await
+        .with_context(|| format!("failed to open {} (is the daemon running?)", db_path))?;
+
+    // Operator-initiated: no age guard (inspect every unproven tx).
+    let report = reconcile(&pool, ctx.chain, 0, execute).await?;
+
+    if report.checked == 0 {
+        println!("No unproven transactions found.");
+        return Ok(());
+    }
+    println!(
+        "Found {} unproven transaction(s); checked against WoC.",
+        report.checked
+    );
     println!(
         "  Missing on chain: {}    Still tracked by network: {}",
-        to_fail.len(),
-        still_in_mempool.len()
+        report.abandoned.len(),
+        report.kept.len()
     );
-    for txid in &still_in_mempool {
+    for txid in &report.kept {
         println!("    keep: {}", txid);
     }
-    for (_, txid) in &to_fail {
+    for txid in &report.abandoned {
         println!("    fail: {}", txid);
     }
 
-    if to_fail.is_empty() {
+    if report.abandoned.is_empty() {
         println!("Nothing to clean up.");
         return Ok(());
     }
-
     if !execute {
         println!();
         println!("Dry run. Re-run with --execute to apply.");
         return Ok(());
     }
 
-    let ids: Vec<i64> = to_fail.iter().map(|(id, _)| *id).collect();
-
-    let restored = restore_inputs(&pool, &ids).await?;
-    let phantoms = remove_phantom_outputs(&pool, &ids).await?;
-    let failed = mark_failed(&pool, &ids).await?;
-
     println!();
     println!("Applied:");
-    println!("  Transactions marked failed: {}", failed);
+    println!("  Transactions marked failed: {}", report.failed);
     println!(
         "  Inputs restored to spendable: {} ({} sats)",
-        restored.0, restored.1
+        report.restored_count, report.restored_sats
     );
     println!(
         "  Phantom outputs unspendable: {} ({} sats)",
-        phantoms.0, phantoms.1
+        report.phantom_count, report.phantom_sats
     );
     println!();
     println!(
         "Net balance delta: {:+} sats. Restart the daemon to refresh its in-memory view.",
-        restored.1 as i64 - phantoms.1 as i64
+        report.restored_sats as i64 - report.phantom_sats as i64
     );
 
     Ok(())

src/commands/cleanup_abandoned.rs

@@ -120,6 +120,19 @@ pub async fn run(cli: &Cli) -> Result<()> {
         .and_then(|v| v.parse().ok())
         .unwrap_or(3);
     let check_wallet = wallet_state.clone();
+    // Auto-reconcile abandoned transactions (#18): a never-landed `unproven` tx's
+    // change must not be selected to fund — and orphan — a new transaction. Each
+    // tick we WoC-check unproven txs older than RECONCILE_ABANDONED_MIN_AGE_SECS
+    // (default 1h, so an in-flight tx still propagating is never mis-classified)
+    // and fail the ones missing on chain. Toggle off with RECONCILE_ABANDONED=0.
+    let reconcile_chain = chain;
+    let reconcile_enabled = std::env::var("RECONCILE_ABANDONED")
+        .map(|v| v != "0" && !v.eq_ignore_ascii_case("false"))
+        .unwrap_or(true);
+    let reconcile_min_age_secs: i64 = std::env::var("RECONCILE_ABANDONED_MIN_AGE_SECS")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(3600);
     tokio::spawn(async move {
         let mut interval = tokio::time::interval(std::time::Duration::from_secs(300));
         loop {
@@ -157,6 +170,34 @@ pub async fn run(cli: &Cli) -> Result<()> {
                     tracing::debug!("UTXO check failed: {}", e);
                 }
             }
+
+            // Auto-reconcile abandoned (never-landed) transactions (#18).
+            if reconcile_enabled {
+                match crate::commands::cleanup_abandoned::reconcile(
+                    check_wallet.storage().pool(),
+                    reconcile_chain,
+                    reconcile_min_age_secs,
+                    true,
+                )
+                .await
+                {
+                    Ok(r) if r.applied => {
+                        tracing::warn!(
+                            failed = r.failed,
+                            restored_count = r.restored_count,
+                            restored_sats = r.restored_sats,
+                            phantom_count = r.phantom_count,
+                            phantom_sats = r.phantom_sats,
+                            "auto-reconciled abandoned tx(s): marked {} failed, restored {} input(s) ({} sats), invalidated {} phantom output(s) ({} sats)",
+                            r.failed, r.restored_count, r.restored_sats, r.phantom_count, r.phantom_sats
+                        );
+                    }
+                    Ok(_) => {}
+                    Err(e) => {
+                        tracing::debug!("abandoned-tx reconcile skipped: {}", e);
+                    }
+                }
+            }
         }
     });
 

src/commands/daemon.rs

@@ -17,6 +17,7 @@ use bsv_sdk::wallet::{
     // Core types
     Counterparty,
     CreateActionArgs,
+    CreateActionInput,
     CreateActionOptions,
     CreateActionOutput,
     CreateHmacArgs,
@@ -44,6 +45,7 @@ use bsv_sdk::wallet::{
     // Output types
     ListOutputsArgs,
     ListOutputsResult,
+    Outpoint,
     Protocol,
     ProveCertificateArgs,
     ProveCertificateResult,
@@ -57,6 +59,7 @@ use bsv_sdk::wallet::{
     SecurityLevel,
     SignActionArgs,
     SignActionResult,
+    TrustSelf,
     VerifyHmacArgs,
     VerifySignatureArgs,
     WalletCertificate,
@@ -297,19 +300,51 @@ pub async fn create_action(
         })
         .transpose()?;
 
+    // Map caller-provided explicit inputs (e.g. a covenant spend carrying a full
+    // unlockingScript). An absent/empty list stays `Some(vec![])` so the wallet
+    // auto-selects its own funding UTXOs — the prior behaviour for plain sends.
+    // Before this, the handler discarded `inputs`/`inputBEEF`/`lockTime`, so any
+    // covenant input was silently dropped and the tx was funded from change.
+    let inputs = match req.inputs {
+        Some(reqs) if !reqs.is_empty() => {
+            let mut mapped = Vec::with_capacity(reqs.len());
+            for i in reqs {
+                let outpoint = Outpoint::from_string(&i.outpoint)
+                    .map_err(|e| anyhow::anyhow!("invalid input outpoint '{}': {e}", i.outpoint))?;
+                let unlocking_script = match i.unlocking_script {
+                    Some(h) => Some(hex::decode(&h).context("invalid unlockingScript hex")?),
+                    None => None,
+                };
+                mapped.push(CreateActionInput {
+                    outpoint,
+                    input_description: i.input_description.unwrap_or_else(|| "input".to_string()),
+                    unlocking_script,
+                    unlocking_script_length: i.unlocking_script_length,
+                    sequence_number: i.sequence_number,
+                });
+            }
+            Some(mapped)
+        }
+        _ => Some(vec![]),
+    };
+
     let args = CreateActionArgs {
         description: req.description,
-        input_beef: None,
-        inputs: Some(vec![]),
+        input_beef: req.input_beef,
+        inputs,
         outputs,
-        lock_time: None,
+        lock_time: req.lock_time,
         version: None,
         labels: req.labels,
         options: req.options.map(|o| CreateActionOptions {
             accept_delayed_broadcast: o.accept_delayed_broadcast,
             randomize_outputs: o.randomize_outputs,
             sign_and_process: o.sign_and_process,
             no_send: o.no_send,
+            trust_self: match o.trust_self.as_deref() {
+                Some("known") => Some(TrustSelf::Known),
+                _ => None,
+            },
             ..Default::default()
         }),
     };