@1sat/cli 0.0.11 → 0.0.13

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@1sat/cli",
-	"version": "0.0.11",
+	"version": "0.0.13",
 	"description": "CLI for 1Sat Ordinals SDK",
 	"type": "module",
 	"main": "./src/cli.ts",
@@ -16,16 +16,15 @@
 	"keywords": ["1sat", "bsv", "ordinals", "cli"],
 	"license": "MIT",
 	"dependencies": {
-		"@1sat/actions": "0.0.53",
-		"@1sat/client": "0.0.16",
-		"@1sat/types": "0.0.13",
+		"@1sat/actions": "0.0.62",
+		"@1sat/client": "0.0.17",
+		"@1sat/types": "0.0.14",
 		"@1sat/wallet-node": ">=0.0.13",
-		"@bsv/sdk": "^2.0.4",
+		"@bsv/sdk": "^2.0.6",
 		"chalk": "^5.0.0",
 		"@clack/prompts": "^0.8.0",
-		"bitcoin-backup": "^0.0.8",
-		"dotenv": "^17.0.0",
-		"sigma-protocol": "^0.1.9"
+		"bitcoin-backup": "^0.0.11",
+		"dotenv": "^17.0.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.9",

package/src/cli.ts

@@ -8,6 +8,7 @@
 
 import { parseGlobalFlags } from './args'
 import { handleActionCommand } from './commands/action'
+import { handleMcpProxyCommand } from './commands/mcp-proxy'
 import { handleConfigCommand } from './commands/config'
 import { handleIdentityCommand } from './commands/identity'
 import { handleInitCommand } from './commands/init'
@@ -88,6 +89,10 @@ async function main(): Promise<void> {
 			await handleTxCommand(rest, flags)
 			break
 
+		case 'mcp-proxy':
+			await handleMcpProxyCommand()
+			break
+
 		case 'help':
 			printHelp()
 			break

package/src/commands/config.ts

@@ -28,7 +28,7 @@ import {
 const SETTABLE_KEYS: Array<keyof OneSatCliConfig> = [
 	'chain',
 	'dataDir',
-	'remoteStorageUrl',
+	'activeRemote',
 	'storageIdentityKey',
 ]
 
@@ -69,7 +69,7 @@ function configShow(opts: GlobalFlags): void {
 	printKeyValue({
 		chain: config.chain,
 		dataDir: config.dataDir,
-		remoteStorageUrl: config.remoteStorageUrl ?? '(not set)',
+		activeRemote: config.activeRemote ?? '(not set)',
 		storageIdentityKey: config.storageIdentityKey ?? '(not set)',
 	})
 	console.log()

package/src/commands/init.ts

@@ -21,7 +21,7 @@ import {
 } from '@clack/prompts'
 import type { GlobalFlags } from '../args'
 import { ensureConfigDir, loadConfig, saveConfig } from '../config'
-import { hasKey, saveKey } from '../keys'
+import { cacheKeyPassword, hasKey, saveKey } from '../keys'
 import { fatal, formatSuccess, formatValue, formatWarning } from '../output'
 
 export async function handleInitCommand(
@@ -143,6 +143,25 @@ export async function handleInitCommand(
 		fatal('Passwords do not match.')
 	}
 
+	// 3.5. Touch ID protection (macOS arm64)
+	let useTouchID = false
+	try {
+		const { isTouchIDAvailable } = await import('bitcoin-backup')
+		if (isTouchIDAvailable()) {
+			const enableTouchID = await confirm({
+				message:
+					'Enable Touch ID? (unlock your wallet without typing a password)',
+			})
+			if (isCancel(enableTouchID)) {
+				cancel('Setup cancelled.')
+				process.exit(0)
+			}
+			useTouchID = enableTouchID as boolean
+		}
+	} catch {
+		// bitcoin-backup Touch ID not available — skip silently
+	}
+
 	// 4. Optional: storage identity key
 	const storageId = await text({
 		message: 'Storage identity key (for wallet persistence):',
@@ -159,6 +178,19 @@ export async function handleInitCommand(
 
 	await saveKey(wif, pw as string)
 
+	// Cache password with Touch ID if user opted in
+	if (useTouchID) {
+		try {
+			await cacheKeyPassword(pw as string)
+		} catch {
+			console.log(
+				formatWarning(
+					'  Touch ID caching failed. You can enable it later with "1sat touchid enable".',
+				),
+			)
+		}
+	}
+
 	saveConfig({
 		...loadConfig(),
 		chain: chain as 'main' | 'test',
@@ -168,5 +200,6 @@ export async function handleInitCommand(
 	const pk = PrivateKey.fromWif(wif)
 	const address = pk.toPublicKey().toAddress()
 
-	outro(formatSuccess(`Wallet configured! Address: ${address}`))
+	const touchIdNote = useTouchID ? ' (Touch ID enabled)' : ''
+	outro(formatSuccess(`Wallet configured${touchIdNote}! Address: ${address}`))
 }

package/src/commands/mcp-proxy.ts

@@ -0,0 +1,169 @@
+/**
+ * 1sat mcp-proxy — stdio-to-HTTP bridge for the wallet-desktop MCP server.
+ *
+ * Performs BRC-31 handshake, then proxies JSON-RPC messages from stdin
+ * to the MCP server at :3322 with signed auth headers on each request.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { Hash, KeyDeriver, PrivateKey, Signature, Utils } from '@bsv/sdk'
+import type { WalletProtocol } from '@bsv/sdk'
+
+const { toBase64, toArray } = Utils
+
+const MCP_URL = process.env.ONESAT_MCP_URL ?? 'http://127.0.0.1:3322'
+const KEY_DIR = `${process.env.HOME}/.1sat-wallet`
+const CLIENT_KEY_PATH = `${KEY_DIR}/mcp-agent.key`
+const AUTH_PROTOCOL_ID: WalletProtocol = [2, 'authrite message signature']
+
+function log(msg: string): void {
+	process.stderr.write(`[1sat mcp-proxy] ${msg}\n`)
+}
+
+function generateNonce(): string {
+	const bytes = new Uint8Array(32)
+	crypto.getRandomValues(bytes)
+	return toBase64(Array.from(bytes))
+}
+
+function getClientKey(): PrivateKey {
+	mkdirSync(KEY_DIR, { recursive: true })
+	if (existsSync(CLIENT_KEY_PATH)) {
+		return PrivateKey.fromWif(readFileSync(CLIENT_KEY_PATH, 'utf-8').trim())
+	}
+	const key = PrivateKey.fromRandom()
+	writeFileSync(CLIENT_KEY_PATH, key.toWif(), { mode: 0o600 })
+	log('Generated new agent identity key')
+	return key
+}
+
+interface Session {
+	serverIdentityKey: string
+	serverNonce: string
+	clientKey: PrivateKey
+}
+
+async function handshake(key: PrivateKey): Promise<Session> {
+	const pubkey = key.toPublicKey().toString()
+	const clientNonce = generateNonce()
+
+	const res = await fetch(`${MCP_URL}/.well-known/auth`, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			authrite: '0.1',
+			messageType: 'initialRequest',
+			identityKey: pubkey,
+			nonce: clientNonce,
+		}),
+	})
+
+	if (!res.ok) throw new Error(`Handshake failed: HTTP ${res.status}`)
+
+	const data = await res.json()
+	if (data.messageType !== 'initialResponse') throw new Error(`Unexpected: ${data.messageType}`)
+
+	const serverNonce = data.nonce as string
+	const deriver = new KeyDeriver(key)
+	const serverPub = deriver.derivePublicKey(
+		AUTH_PROTOCOL_ID, `${serverNonce} ${clientNonce}`, data.identityKey as string, false,
+	)
+
+	const clientNonceBytes = toArray(clientNonce, 'base64')
+	const serverNonceBytes = toArray(serverNonce, 'base64')
+	const msgHash = Hash.sha256(Array.from(new Uint8Array([...clientNonceBytes, ...serverNonceBytes])))
+
+	const sig = Signature.fromDER(data.signature as string, 'hex')
+	if (!serverPub.verify(Array.from(msgHash), sig)) throw new Error('Server signature verification failed')
+
+	log(`Authenticated with ${(data.identityKey as string).slice(0, 12)}...`)
+	return { serverIdentityKey: data.identityKey as string, serverNonce, clientKey: key }
+}
+
+function signHeaders(session: Session, pathname: string): Record<string, string> {
+	const { serverIdentityKey, serverNonce, clientKey: key } = session
+	const nonce = generateNonce()
+	const deriver = new KeyDeriver(key)
+	const derivedKey = deriver.derivePrivateKey(AUTH_PROTOCOL_ID, `${nonce} ${serverNonce}`, serverIdentityKey)
+	const payload = new TextEncoder().encode(pathname)
+	const msgHash = Hash.sha256(Array.from(payload))
+	const sig = derivedKey.sign(Array.from(msgHash))
+
+	return {
+		'x-bsv-auth-version': '0.1',
+		'x-bsv-auth-identity-key': key.toPublicKey().toString(),
+		'x-bsv-auth-nonce': nonce,
+		'x-bsv-auth-your-nonce': serverNonce,
+		'x-bsv-auth-signature': sig.toDER('hex') as string,
+	}
+}
+
+export async function handleMcpProxyCommand(): Promise<void> {
+	try {
+		await fetch(MCP_URL, { signal: AbortSignal.timeout(2000) })
+	} catch {
+		log(`Server not reachable at ${MCP_URL} — is 1Sat wallet running?`)
+		process.exit(1)
+	}
+
+	const key = getClientKey()
+	const session = await handshake(key)
+
+	let mcpSessionId: string | null = null
+	const decoder = new TextDecoder()
+	const reader = Bun.stdin.stream().getReader()
+	let buffer = ''
+
+	while (true) {
+		const { done, value } = await reader.read()
+		if (done) break
+
+		buffer += decoder.decode(value, { stream: true })
+
+		let newlineIdx: number
+		while ((newlineIdx = buffer.indexOf('\n')) !== -1) {
+			const line = buffer.slice(0, newlineIdx).trim()
+			buffer = buffer.slice(newlineIdx + 1)
+			if (!line) continue
+
+			const headers: Record<string, string> = {
+				'Content-Type': 'application/json',
+				Accept: 'application/json, text/event-stream',
+				...signHeaders(session, '/mcp'),
+			}
+
+			if (mcpSessionId) {
+				headers['mcp-session-id'] = mcpSessionId
+			}
+
+			try {
+				const res = await fetch(`${MCP_URL}/mcp`, { method: 'POST', headers, body: line })
+
+				const sessionHeader = res.headers.get('mcp-session-id')
+				if (sessionHeader) mcpSessionId = sessionHeader
+
+				const contentType = res.headers.get('content-type') ?? ''
+
+				if (contentType.includes('text/event-stream')) {
+					const text = await res.text()
+					for (const eventLine of text.split('\n')) {
+						if (eventLine.startsWith('data: ')) {
+							const data = eventLine.slice(6).trim()
+							if (data) process.stdout.write(`${data}\n`)
+						}
+					}
+				} else {
+					const body = await res.text()
+					if (body.trim()) process.stdout.write(`${body.trim()}\n`)
+				}
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err)
+				log(`Request failed: ${msg}`)
+				process.stdout.write(`${JSON.stringify({
+					jsonrpc: '2.0',
+					error: { code: -32000, message: `MCP proxy error: ${msg}` },
+					id: null,
+				})}\n`)
+			}
+		}
+	}
+}

package/src/config.ts

@@ -16,8 +16,8 @@ export interface OneSatCliConfig {
 	chain: 'main' | 'test'
 	/** Data directory for wallet databases */
 	dataDir: string
-	/** Remote storage URL for wallet backup */
-	remoteStorageUrl?: string
+	/** Remote storage URL for wallet sync */
+	activeRemote?: string
 	/** Storage identity key for wallet persistence */
 	storageIdentityKey?: string
 }

package/src/context.ts

@@ -44,10 +44,10 @@ export async function loadContext(
 			},
 			useNullAsDefault: true,
 		},
-		remoteStorageUrl: config.remoteStorageUrl,
+		activeRemote: config.activeRemote,
 	})
 
-	walletResult.monitor.startTasks()
+	walletResult.monitor?.startTasks()
 
 	const ctx = createContext(walletResult.wallet, {
 		services: walletResult.services,

package/src/help.ts

@@ -10,9 +10,9 @@ const VERSION = (() => {
 		const pkg = JSON.parse(
 			readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
 		)
-		return pkg.version || '0.0.9'
+		return pkg.version || '0.0.11'
 	} catch {
-		return '0.0.9'
+		return '0.0.11'
 	}
 })()
 

package/src/keys.ts

@@ -2,12 +2,14 @@
  * Encrypted key management for the 1sat CLI.
  *
  * Key resolution priority:
- * 1. PRIVATE_KEY_WIF env var
- * 2. ~/.1sat/keys.bep encrypted file
- * 3. Fail with "Run 1sat init"
+ * 1. PRIVATE_KEY_WIF env var (headless/CI)
+ * 2. Touch ID cached password → decrypt keys.bep (macOS arm64)
+ * 3. Explicit password → decrypt keys.bep
+ * 4. Fail with guidance
  */
 
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { arch, platform } from 'node:os'
 import { join } from 'node:path'
 import { PrivateKey } from '@bsv/sdk'
 import { type WifBackup, decryptBackup, encryptBackup } from 'bitcoin-backup'
@@ -28,9 +30,19 @@ export function hasKey(): boolean {
 }
 
 /**
- * Load the private key from env or encrypted file.
+ * Check if Touch ID is available for password caching.
+ */
+export function isTouchIDAvailable(): boolean {
+	return platform() === 'darwin' && arch() === 'arm64'
+}
+
+/**
+ * Load the private key from env, Touch ID cache, or password.
  *
- * @param password - Required if loading from encrypted file
+ * Resolution order:
+ * 1. PRIVATE_KEY_WIF env var
+ * 2. Touch ID cached password (if available)
+ * 3. Explicit password parameter
  */
 export async function loadKey(password?: string): Promise<PrivateKey> {
 	// Priority 1: Environment variable
@@ -47,14 +59,29 @@ export async function loadKey(password?: string): Promise<PrivateKey> {
 		)
 	}
 
-	if (!password) {
+	const encrypted = readFileSync(keysPath, 'utf8')
+
+	// Priority 2a: Try Touch ID cached password
+	let resolvedPassword = password
+	if (!resolvedPassword) {
+		try {
+			const { getCachedPassword } = await import('bitcoin-backup')
+			const cached = await getCachedPassword(keysPath)
+			if (cached) {
+				resolvedPassword = cached
+			}
+		} catch {
+			// Touch ID not available or no cached password — fall through
+		}
+	}
+
+	if (!resolvedPassword) {
 		throw new Error(
-			'Password required to decrypt key file. Pass --password or set ONESAT_PASSWORD.',
+			'Password required to decrypt key file. Pass --password, set ONESAT_PASSWORD, or run "1sat init --touchid" to enable Touch ID.',
 		)
 	}
 
-	const encrypted = readFileSync(keysPath, 'utf8')
-	const backup = await decryptBackup(encrypted, password)
+	const backup = await decryptBackup(encrypted, resolvedPassword)
 	if (!('wif' in backup) || typeof backup.wif !== 'string') {
 		throw new Error('Key file does not contain a WIF key.')
 	}
@@ -80,6 +107,22 @@ export async function saveKey(wif: string, password: string): Promise<void> {
 	writeFileSync(keysPath, encrypted, { mode: 0o600 })
 }
 
+/**
+ * Cache the password for keys.bep using Touch ID.
+ */
+export async function cacheKeyPassword(password: string): Promise<void> {
+	const { cachePassword } = await import('bitcoin-backup')
+	await cachePassword(getKeysPath(), password)
+}
+
+/**
+ * Remove the cached password for keys.bep.
+ */
+export async function forgetKeyPassword(): Promise<void> {
+	const { forgetPassword } = await import('bitcoin-backup')
+	await forgetPassword(getKeysPath())
+}
+
 /**
  * Resolve a password from flag or environment variable.
  */