@agenticmail/enterprise 0.5.528 → 0.5.530

package/dist/cli-serve-IYTI6P3G.js

@@ -0,0 +1,322 @@
+import "./chunk-KFQGP6VL.js";
+
+// src/cli-serve.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+function loadEnvFile() {
+  const candidates = [
+    join(process.cwd(), ".env"),
+    join(homedir(), ".agenticmail", ".env")
+  ];
+  for (const envPath of candidates) {
+    if (!existsSync(envPath)) continue;
+    try {
+      const content = readFileSync(envPath, "utf8");
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        const eq = trimmed.indexOf("=");
+        if (eq < 0) continue;
+        const key = trimmed.slice(0, eq).trim();
+        let val = trimmed.slice(eq + 1).trim();
+        if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+          val = val.slice(1, -1);
+        }
+        if (!process.env[key]) process.env[key] = val;
+      }
+      console.log(`Loaded config from ${envPath}`);
+      return;
+    } catch {
+    }
+  }
+}
+async function ensureSecrets() {
+  const { randomUUID } = await import("crypto");
+  const envDir = join(homedir(), ".agenticmail");
+  const envPath = join(envDir, ".env");
+  let dirty = false;
+  if (!process.env.JWT_SECRET) {
+    process.env.JWT_SECRET = randomUUID() + randomUUID();
+    dirty = true;
+    console.log("[startup] Generated new JWT_SECRET (existing sessions will need to re-login)");
+  }
+  if (!process.env.AGENTICMAIL_VAULT_KEY) {
+    process.env.AGENTICMAIL_VAULT_KEY = randomUUID() + randomUUID();
+    dirty = true;
+    console.log("[startup] Generated new AGENTICMAIL_VAULT_KEY");
+    console.log("[startup] \u26A0\uFE0F  Previously encrypted credentials will need to be re-entered in the dashboard");
+  }
+  if (dirty) {
+    try {
+      if (!existsSync(envDir)) {
+        const { mkdirSync } = await import("fs");
+        mkdirSync(envDir, { recursive: true });
+      }
+      const { appendFileSync } = await import("fs");
+      const lines = [];
+      let existing = "";
+      if (existsSync(envPath)) {
+        existing = readFileSync(envPath, "utf8");
+      }
+      if (!existing.includes("JWT_SECRET=")) {
+        lines.push(`JWT_SECRET=${process.env.JWT_SECRET}`);
+      }
+      if (!existing.includes("AGENTICMAIL_VAULT_KEY=")) {
+        lines.push(`AGENTICMAIL_VAULT_KEY=${process.env.AGENTICMAIL_VAULT_KEY}`);
+      }
+      if (lines.length) {
+        appendFileSync(envPath, "\n" + lines.join("\n") + "\n", { mode: 384 });
+        console.log(`[startup] Saved secrets to ${envPath}`);
+      }
+    } catch (e) {
+      console.warn(`[startup] Could not save secrets to ${envPath}: ${e.message}`);
+    }
+  }
+}
+async function runServe(_args) {
+  loadEnvFile();
+  const DATABASE_URL = process.env.DATABASE_URL;
+  const PORT = parseInt(process.env.PORT || "8080", 10);
+  await ensureSecrets();
+  const JWT_SECRET = process.env.JWT_SECRET;
+  const _VAULT_KEY = process.env.AGENTICMAIL_VAULT_KEY;
+  if (!DATABASE_URL) {
+    console.error("ERROR: DATABASE_URL is required.");
+    console.error("");
+    console.error("Set it via environment variable or .env file:");
+    console.error("  DATABASE_URL=postgresql://user:pass@host:5432/db npx @agenticmail/enterprise start");
+    console.error("");
+    console.error("Or create a .env file (in cwd or ~/.agenticmail/.env):");
+    console.error("  DATABASE_URL=postgresql://user:pass@host:5432/db");
+    console.error("  JWT_SECRET=your-secret-here");
+    console.error("  PORT=3200");
+    process.exit(1);
+  }
+  const { createAdapter, smartDbConfig } = await import("./factory-6KTIEZYC.js");
+  const { createServer } = await import("./server-H5MOBKCB.js");
+  const db = await createAdapter(smartDbConfig(DATABASE_URL));
+  await db.migrate();
+  const server = createServer({
+    port: PORT,
+    db,
+    jwtSecret: JWT_SECRET,
+    corsOrigins: ["*"]
+  });
+  await server.start();
+  console.log(`AgenticMail Enterprise server running on :${PORT}`);
+  try {
+    const { startWatcherEngine, initWatcherTables, setWatcherRuntime } = await import("./polymarket-watcher-BFVZLR7U.js");
+    const edb = db.getEngineDB?.();
+    if (edb) {
+      await initWatcherTables(edb);
+      startWatcherEngine(db, {
+        log: (...args) => console.log(...args),
+        onEvent: (agentId, event) => {
+          if (event.severity === "critical") {
+            console.log(`[poly-watcher] CRITICAL signal for agent ${agentId}: ${event.title}`);
+          }
+        }
+      });
+      setTimeout(async () => {
+        try {
+          const routes = await import("./routes-JDDQBS4W.js");
+          setWatcherRuntime(
+            () => routes.getRuntime?.() || null
+          );
+        } catch (e) {
+          console.warn("[poly-watcher] Could not inject runtime:", e.message);
+        }
+      }, 5e3);
+      console.log("[startup] Polymarket watcher engine started");
+    }
+    setTimeout(async () => {
+      try {
+        const { autoConnectProxy } = await import("./polymarket-runtime-SVQQ3PVF.js");
+        const pdb = db.getEngineDB?.();
+        if (pdb) await autoConnectProxy(pdb);
+      } catch {
+      }
+    }, 8e3);
+  } catch (e) {
+    console.warn("[startup] Polymarket watcher engine skipped:", e.message);
+  }
+  try {
+    const { startBackgroundUpdateCheck } = await import("./cli-update-SX7GACL3.js");
+    startBackgroundUpdateCheck();
+  } catch {
+  }
+  try {
+    const { startPreventSleep } = await import("./screen-unlock-4RPZBHOI.js");
+    const adminDb = server.getAdminDb?.() || server.adminDb;
+    if (adminDb) {
+      const settings = await adminDb.getSettings?.().catch(() => null);
+      const screenAccess = settings?.securityConfig?.screenAccess;
+      if (screenAccess?.enabled && screenAccess?.preventSleep) {
+        startPreventSleep();
+        console.log("[startup] Prevent-sleep enabled \u2014 system will stay awake while agents are active");
+      }
+    }
+  } catch {
+  }
+  try {
+    await setupSystemPersistence();
+  } catch (e) {
+    console.warn("[startup] System persistence setup skipped: " + e.message);
+  }
+  const tunnelToken = process.env.CLOUDFLARED_TOKEN;
+  if (tunnelToken) {
+    try {
+      const { execSync, spawn } = await import("child_process");
+      try {
+        execSync(process.platform === "win32" ? "where cloudflared" : "which cloudflared", { timeout: 3e3 });
+      } catch {
+        console.log("[startup] cloudflared not found \u2014 skipping tunnel auto-start");
+        console.log("[startup] Install cloudflared to enable tunnel: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/");
+        return;
+      }
+      try {
+        if (process.platform === "win32") {
+          const tasklist = execSync('tasklist /FI "IMAGENAME eq cloudflared.exe" /NH', { encoding: "utf8", timeout: 5e3 });
+          if (tasklist.includes("cloudflared.exe")) {
+            console.log("[startup] cloudflared tunnel already running");
+            return;
+          }
+        } else {
+          execSync('pgrep -f "cloudflared.*tunnel.*run"', { timeout: 3e3 });
+          console.log("[startup] cloudflared tunnel already running");
+          return;
+        }
+      } catch {
+      }
+      const subdomain = process.env.AGENTICMAIL_SUBDOMAIN || process.env.AGENTICMAIL_DOMAIN || "";
+      console.log(`[startup] Starting cloudflared tunnel${subdomain ? ` for ${subdomain}.agenticmail.io` : ""}...`);
+      let cfBin = "cloudflared";
+      if (process.platform === "win32") {
+        try {
+          cfBin = execSync("where cloudflared", { encoding: "utf8", timeout: 3e3 }).trim().split("\n")[0].trim();
+        } catch {
+          const candidate = `${process.env.LOCALAPPDATA || ""}\\cloudflared\\cloudflared.exe`;
+          try {
+            (await import("fs")).statSync(candidate);
+            cfBin = candidate;
+          } catch {
+          }
+        }
+      }
+      const child = spawn(cfBin, ["tunnel", "--no-autoupdate", "run", "--token", tunnelToken], {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.unref();
+      console.log("[startup] cloudflared tunnel started (pid " + child.pid + ")");
+    } catch (e) {
+      console.warn("[startup] Could not auto-start cloudflared: " + e.message);
+    }
+  }
+}
+async function setupSystemPersistence() {
+  const { execSync, spawnSync } = await import("child_process");
+  const { existsSync: exists, writeFileSync, mkdirSync } = await import("fs");
+  const { join: pathJoin } = await import("path");
+  const platform = process.platform;
+  if (!process.env.PM2_HOME && !process.env.pm_id) {
+    return;
+  }
+  const markerDir = pathJoin(homedir(), ".agenticmail");
+  const markerFile = pathJoin(markerDir, ".persistence-configured");
+  if (exists(markerFile)) {
+    try {
+      execSync("pm2 save --silent", { timeout: 1e4, stdio: "ignore" });
+    } catch {
+    }
+    return;
+  }
+  console.log("[startup] Configuring system persistence (one-time setup)...");
+  try {
+    if (platform === "darwin") {
+      const result = spawnSync("pm2", ["startup", "launchd", "--silent"], {
+        timeout: 15e3,
+        stdio: "pipe",
+        encoding: "utf-8"
+      });
+      const output = (result.stdout || "") + (result.stderr || "");
+      const sudoMatch = output.match(/sudo\s+env\s+.*pm2\s+startup.*/);
+      if (sudoMatch) {
+        console.log("[startup] PM2 startup requires sudo. Run this once:");
+        console.log("  " + sudoMatch[0]);
+      } else {
+        console.log("[startup] PM2 startup configured (launchd)");
+      }
+      const plistPath = pathJoin(homedir(), "Library", "LaunchAgents", `pm2.${process.env.USER || "user"}.plist`);
+      if (exists(plistPath)) {
+        try {
+          execSync(`launchctl load -w "${plistPath}"`, { timeout: 5e3, stdio: "ignore" });
+        } catch {
+        }
+      }
+    } else if (platform === "linux") {
+      const result = spawnSync("pm2", ["startup", "systemd", "--silent"], {
+        timeout: 15e3,
+        stdio: "pipe",
+        encoding: "utf-8"
+      });
+      const output = (result.stdout || "") + (result.stderr || "");
+      const sudoMatch = output.match(/sudo\s+env\s+.*pm2\s+startup.*/);
+      if (sudoMatch) {
+        try {
+          execSync(sudoMatch[0], { timeout: 15e3, stdio: "ignore" });
+          console.log("[startup] PM2 startup configured (systemd)");
+        } catch {
+          console.log("[startup] PM2 startup requires root. Run this once:");
+          console.log("  " + sudoMatch[0]);
+        }
+      } else {
+        console.log("[startup] PM2 startup configured (systemd)");
+      }
+    } else if (platform === "win32") {
+      try {
+        execSync("npm list -g pm2-windows-startup", { timeout: 1e4, stdio: "ignore" });
+      } catch {
+        console.log("[startup] Installing pm2-windows-startup...");
+        try {
+          execSync("npm install -g pm2-windows-startup", { timeout: 6e4, stdio: "ignore" });
+          execSync("pm2-startup install", { timeout: 15e3, stdio: "ignore" });
+          console.log("[startup] PM2 startup configured (Windows Service)");
+        } catch (e) {
+          console.warn("[startup] Could not install pm2-windows-startup: " + e.message);
+        }
+      }
+    }
+  } catch (e) {
+    console.warn("[startup] PM2 startup setup: " + e.message);
+  }
+  try {
+    const moduleList = execSync("pm2 ls --silent 2>/dev/null || true", { timeout: 1e4, encoding: "utf-8" });
+    if (!moduleList.includes("pm2-logrotate")) {
+      console.log("[startup] Installing pm2-logrotate...");
+      execSync("pm2 install pm2-logrotate --silent", { timeout: 6e4, stdio: "ignore" });
+      execSync("pm2 set pm2-logrotate:max_size 10M --silent", { timeout: 5e3, stdio: "ignore" });
+      execSync("pm2 set pm2-logrotate:retain 5 --silent", { timeout: 5e3, stdio: "ignore" });
+      execSync("pm2 set pm2-logrotate:compress true --silent", { timeout: 5e3, stdio: "ignore" });
+      console.log("[startup] Log rotation configured (10MB, 5 files)");
+    }
+  } catch {
+  }
+  try {
+    execSync("pm2 save --silent", { timeout: 1e4, stdio: "ignore" });
+    console.log("[startup] Process list saved");
+  } catch {
+  }
+  try {
+    if (!exists(markerDir)) mkdirSync(markerDir, { recursive: true });
+    writeFileSync(markerFile, (/* @__PURE__ */ new Date()).toISOString() + `
+platform=${platform}
+`, { mode: 384 });
+    console.log("[startup] System persistence configured successfully");
+  } catch {
+  }
+}
+export {
+  runServe
+};

package/dist/cli.js

@@ -65,14 +65,14 @@ Skill Development:
     break;
   case "serve":
   case "start":
-    import("./cli-serve-R4K2E4ZR.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
+    import("./cli-serve-IYTI6P3G.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
     break;
   case "agent":
-    import("./cli-agent-HTPQCEN4.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
+    import("./cli-agent-UZ3ND3G6.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
     break;
   case "setup":
   default:
-    import("./setup-C66RQXDO.js").then((m) => m.runSetupWizard()).catch(fatal);
+    import("./setup-76LAQJRZ.js").then((m) => m.runSetupWizard()).catch(fatal);
     break;
 }
 function fatal(err) {

package/dist/dashboard/pages/polymarket.js

@@ -132,6 +132,12 @@ export function PolymarketPage() {
   const [swapLoading, setSwapLoading] = useState(false);
   const [swapCountdown, setSwapCountdown] = useState(0);
   const [chartVisible, setChartVisible] = useState(function() { try { return localStorage.getItem('pm_chart_visible') !== 'false'; } catch { return true; } });
+  // Export key PIN verification
+  const [exportStep, setExportStep] = useState('idle'); // 'idle' | 'pin' | 'setup_pin' | 'revealed'
+  const [exportPin, setExportPin] = useState('');
+  const [exportPinSetup, setExportPinSetup] = useState({ pin: '', confirm: '' });
+  const [exportLoading, setExportLoading] = useState(false);
+  const [exportAutoCloseTimer, setExportAutoCloseTimer] = useState(null);
 
   // Countdown timer during swap
   useEffect(function() {
@@ -1072,11 +1078,12 @@ export function PolymarketPage() {
     // Custom modal for pending orders on a position
     if (selectedRow.tab === 'pendingForPosition' && d.orders) {
       return h('div', { className: 'modal-overlay', onClick: function() { setSelectedRow(null); } },
-        h('div', { className: 'modal-content', style: { maxWidth: 560, maxHeight: '80vh', overflow: 'auto' }, onClick: function(e) { e.stopPropagation(); } },
-          h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: 16 } },
-            h('h3', { style: { margin: 0 } }, 'Pending Orders'),
-            h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { setSelectedRow(null); } }, '\u2715')
+        h('div', { className: 'modal', onClick: function(e) { e.stopPropagation(); }, style: { width: 560, maxHeight: '85vh', overflow: 'auto' } },
+          h('div', { className: 'modal-header' },
+            h('h2', { style: { fontSize: 16, flex: 1, display: 'flex', alignItems: 'center', gap: 8 } }, I('clock'), ' Pending Orders'),
+            h('button', { className: 'btn btn-ghost btn-icon', onClick: function() { setSelectedRow(null); } }, '\u00d7')
           ),
+          h('div', { className: 'modal-body', style: { padding: 20 } },
           h('div', { style: { marginBottom: 16, padding: '10px 14px', background: 'var(--bg-secondary)', borderRadius: 8, fontSize: 13 } },
             h('div', { style: { fontWeight: 600, marginBottom: 4 } }, d.market || 'Position'),
             h('div', { style: { color: 'var(--text-muted)' } }, 'Filled shares: ', h('strong', null, (d.filled_shares || 0).toFixed(1)),
@@ -1101,6 +1108,10 @@ export function PolymarketPage() {
           ),
           h('div', { style: { marginTop: 12, fontSize: 12, color: 'var(--text-muted)', fontStyle: 'italic' } },
             'Total pending capital: $' + d.orders.reduce(function(s, o) { return s + (o.price || 0) * (o.size || 0); }, 0).toFixed(2))
+          ),
+          h('div', { className: 'modal-footer' },
+            h('button', { className: 'btn btn-primary', onClick: function() { setSelectedRow(null); } }, 'Close')
+          )
         )
       );
     }
@@ -2376,13 +2387,13 @@ export function PolymarketPage() {
       ),
       // Wallet management bar
       (wallet || walletBalance) && h('div', { style: { display: 'flex', gap: 8, marginTop: 16, marginBottom: 4 } },
-        h('button', { className: 'btn btn-sm btn-secondary', onClick: async function() {
-          if (!(await showConfirm('Export your wallet private key?\n\nThis will reveal the private key that controls all funds. Only do this if you need to import the wallet into MetaMask, Rabby, or another wallet app.\n\nThis action is logged in the audit trail.'))) return;
-          try {
-            var res = await apiCall('/polymarket/' + selectedAgent + '/wallet/export', { method: 'POST', body: JSON.stringify({ confirm: 'EXPORT' }) });
-            if (res.privateKey) { setExportedKey(res); }
-            else { toast(res.error || 'Export failed', 'error'); }
-          } catch (e) { toast(e.message || 'Export failed — owner access required', 'error'); }
+        h('button', { className: 'btn btn-sm btn-secondary', onClick: function() {
+          // Start PIN verification flow for export
+          if (walletSecurity && walletSecurity.hasPin) {
+            setExportStep('pin'); setExportPin('');
+          } else {
+            setExportStep('setup_pin'); setExportPinSetup({ pin: '', confirm: '' });
+          }
         } }, I('key'), ' Export Private Key'),
         h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { setImportKey(''); setShowImportWallet(true); } }, I('download'), ' Import Wallet'),
         h('button', { className: 'btn btn-sm btn-secondary', onClick: async function() {
@@ -3054,58 +3065,136 @@ export function PolymarketPage() {
         )
       ),
 
-      // Export key modal
-      exportedKey && h('div', { className: 'modal-overlay', onMouseMove: hideTip, onClick: function() { setExportedKey(null); } },
+      // Export key modal — PIN-gated with auto-close
+      exportStep !== 'idle' && h('div', { className: 'modal-overlay', onMouseMove: hideTip, onClick: function() { setExportStep('idle'); setExportedKey(null); if (exportAutoCloseTimer) clearTimeout(exportAutoCloseTimer); } },
         h('div', { className: 'modal', onClick: function(e) { e.stopPropagation(); }, style: { width: 520, maxHeight: '85vh', overflow: 'auto' } },
           h('div', { className: 'modal-header' },
-            h('h2', { style: { fontSize: 16, flex: 1, display: 'flex', alignItems: 'center', gap: 8 } }, I('key'), ' Wallet Private Key'),
-            h('button', { className: 'btn btn-ghost btn-icon', onClick: function() { setExportedKey(null); } }, '\u00d7')
+            h('h2', { style: { fontSize: 16, flex: 1, display: 'flex', alignItems: 'center', gap: 8 } }, I('key'), ' Export Private Key'),
+            h('button', { className: 'btn btn-ghost btn-icon', onClick: function() { setExportStep('idle'); setExportedKey(null); if (exportAutoCloseTimer) clearTimeout(exportAutoCloseTimer); } }, '\u00d7')
           ),
           h('div', { className: 'modal-body', style: { padding: 20 } },
-            h('div', { style: { padding: 12, background: 'rgba(239,68,68,0.08)', border: '1px solid rgba(239,68,68,0.25)', borderRadius: 8, marginBottom: 16, fontSize: 12, color: '#ef4444', lineHeight: 1.6 } },
-              h('strong', null, '\u26A0 SECURITY WARNING'), h('br'),
-              'Anyone with this key has FULL CONTROL of this wallet and all funds. Never share it. Never paste it into untrusted sites.'
-            ),
-            exportedKey.mismatch && h('div', { style: { padding: 12, background: 'rgba(239,68,68,0.15)', border: '2px solid rgba(239,68,68,0.5)', borderRadius: 8, marginBottom: 16, fontSize: 12, color: '#dc2626', lineHeight: 1.6 } },
-              h('strong', null, '\u26A0 CRITICAL: KEY MISMATCH'), h('br'),
-              'This private key derives address ', h('code', null, exportedKey.address),
-              ' but your funded wallet is ', h('code', null, exportedKey.storedFunderAddress), '. ',
-              h('br'), h('strong', null, 'The agent CANNOT access funds at the stored address. '),
-              'This is likely caused by a VAULT_KEY environment variable change. Restore the original VAULT_KEY and restart to recover access.'
-            ),
-            h('div', { style: { marginBottom: 16 } },
-              h('label', { style: _labelStyle }, exportedKey.mismatch ? 'Derived Address (from private key)' : 'Wallet Address'),
-              h('div', { style: { fontFamily: 'var(--font-mono)', fontSize: 13, padding: '10px 12px', background: 'var(--bg-secondary)', borderRadius: 6, wordBreak: 'break-all', userSelect: 'all' } }, exportedKey.address),
-              exportedKey.mismatch && h('div', { style: { marginTop: 8 } },
-                h('label', { style: _labelStyle }, 'Stored Funder Address (has funds)'),
-                h('div', { style: { fontFamily: 'var(--font-mono)', fontSize: 13, padding: '10px 12px', background: 'rgba(239,68,68,0.06)', borderRadius: 6, wordBreak: 'break-all', userSelect: 'all', border: '1px solid rgba(239,68,68,0.2)' } }, exportedKey.storedFunderAddress)
+
+            // Step: Enter PIN
+            exportStep === 'pin' && h('div', null,
+              h('div', { style: { textAlign: 'center', padding: '16px 0' } },
+                h('div', { style: { marginBottom: 12, color: 'var(--text-muted)' } }, I('lock', 40)),
+                h('h3', { style: { marginBottom: 8 } }, 'Enter Wallet PIN'),
+                h('p', { style: { fontSize: 12, color: 'var(--text-muted)', marginBottom: 16 } }, 'Enter your 6-digit wallet PIN to reveal the private key.')
+              ),
+              h('input', { type: 'password', value: exportPin, maxLength: 6, placeholder: '\u2022\u2022\u2022\u2022\u2022\u2022', autoFocus: true,
+                style: { width: '100%', padding: '12px 16px', fontSize: 24, textAlign: 'center', letterSpacing: 8, fontFamily: 'var(--font-mono)', border: '2px solid var(--border)', borderRadius: 8, background: 'var(--bg-secondary)' },
+                onChange: function(e) { setExportPin(e.target.value.replace(/\D/g, '').slice(0, 6)); }
+              }),
+              h('div', { style: { display: 'flex', gap: 8, marginTop: 16 } },
+                h('button', { className: 'btn btn-secondary', onClick: function() { setExportStep('idle'); } }, 'Cancel'),
+                h('button', { className: 'btn btn-primary', disabled: exportPin.length !== 6 || exportLoading, onClick: async function() {
+                  setExportLoading(true);
+                  try {
+                    var verify = await apiCall('/polymarket/' + selectedAgent + '/wallet/verify-transfer', { method: 'POST', body: JSON.stringify({ method: 'pin', code: exportPin }) });
+                    if (verify.ok) {
+                      var res = await apiCall('/polymarket/' + selectedAgent + '/wallet/export', { method: 'POST', body: JSON.stringify({ confirm: 'EXPORT' }) });
+                      if (res.privateKey) {
+                        setExportedKey(res); setExportStep('revealed');
+                        // Auto-close after 60 seconds
+                        var timer = setTimeout(function() { setExportStep('idle'); setExportedKey(null); toast('Export modal auto-closed for security', 'info'); }, 60000);
+                        setExportAutoCloseTimer(timer);
+                      } else { toast(res.error || 'Export failed', 'error'); }
+                    } else { toast(verify.error || 'Invalid PIN', 'error'); }
+                  } catch (e) { toast(e.message || 'Verification failed', 'error'); }
+                  setExportLoading(false);
+                } }, exportLoading ? 'Verifying...' : 'Verify & Export')
               )
             ),
-            h('div', { style: { marginBottom: 16 } },
-              h('label', { style: _labelStyle }, 'Private Key'),
-              h('div', { style: { fontFamily: 'var(--font-mono)', fontSize: 12, padding: '10px 12px', background: 'var(--bg-secondary)', borderRadius: 6, wordBreak: 'break-all', userSelect: 'all', border: '1px solid rgba(239,68,68,0.3)' } }, exportedKey.privateKey)
-            ),
-            h('div', { style: { display: 'flex', gap: 8, marginBottom: 16 } },
-              h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { navigator.clipboard?.writeText(exportedKey.privateKey); toast('Private key copied', 'success'); } }, 'Copy Key'),
-              h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { navigator.clipboard?.writeText(exportedKey.address); toast('Address copied', 'success'); } }, 'Copy Address')
-            ),
-            h('div', { style: { fontSize: 13, color: 'var(--text-secondary)' } },
-              h('div', { style: { fontWeight: 600, marginBottom: 6 } }, 'Import into a wallet app:'),
-              h('div', { style: { display: 'grid', gap: 8 } },
-                h('div', { style: { padding: '8px 12px', background: 'var(--bg-secondary)', borderRadius: 6, fontSize: 12 } },
-                  h('strong', null, 'MetaMask: '), 'Open MetaMask \u2192 Account menu \u2192 Import Account \u2192 Paste private key'
+
+            // Step: Set up PIN (first time)
+            exportStep === 'setup_pin' && (function() {
+              var pinVal = exportPinSetup.pin;
+              var confVal = exportPinSetup.confirm;
+              var isTrivial = pinVal.length === 6 && (/^(.)\1{5}$/.test(pinVal) || pinVal === '123456' || pinVal === '654321');
+              var mismatch = pinVal.length === 6 && confVal.length === 6 && pinVal !== confVal;
+              var canSubmit = pinVal.length === 6 && confVal.length === 6 && pinVal === confVal && !isTrivial && !exportLoading;
+              return h('div', null,
+                h('div', { style: { textAlign: 'center', padding: '12px 0 16px' } },
+                  h('div', { style: { marginBottom: 12, color: '#b45309' } }, I('shield', 40)),
+                  h('h3', { style: { marginBottom: 8 } }, 'Set Up Wallet PIN First'),
+                  h('p', { style: { fontSize: 12, color: 'var(--text-muted)', marginBottom: 4 } }, 'A 6-digit wallet PIN is required to export your private key. This PIN is also used for fund transfers.')
                 ),
-                h('div', { style: { padding: '8px 12px', background: 'var(--bg-secondary)', borderRadius: 6, fontSize: 12 } },
-                  h('strong', null, 'Rabby: '), 'Open Rabby \u2192 Add Address \u2192 Import Private Key \u2192 Paste'
+                h('div', { style: { marginBottom: 12 } },
+                  h('label', { style: { fontSize: 12, fontWeight: 600, display: 'block', marginBottom: 4 } }, 'PIN (6 digits)'),
+                  h('input', { type: 'password', inputMode: 'numeric', value: pinVal, maxLength: 6, placeholder: '\u2022\u2022\u2022\u2022\u2022\u2022', autoComplete: 'new-password',
+                    style: { width: '100%', padding: '10px 14px', fontSize: 20, textAlign: 'center', letterSpacing: 8, fontFamily: 'var(--font-mono)', border: '2px solid ' + (isTrivial ? '#ef4444' : 'var(--border)'), borderRadius: 8, background: 'var(--bg-secondary)' },
+                    onInput: function(e) { setExportPinSetup(Object.assign({}, exportPinSetup, { pin: e.target.value.replace(/\D/g, '').slice(0, 6) })); }
+                  }),
+                  isTrivial && h('div', { style: { fontSize: 11, color: '#ef4444', marginTop: 4 } }, 'PIN is too simple. Choose a less predictable PIN.')
                 ),
-                h('div', { style: { padding: '8px 12px', background: 'var(--bg-secondary)', borderRadius: 6, fontSize: 12 } },
-                  h('strong', null, 'Polymarket: '), 'Go to polymarket.com \u2192 Login \u2192 Connect Wallet \u2192 Use imported wallet via MetaMask/Rabby'
+                h('div', { style: { marginBottom: 12 } },
+                  h('label', { style: { fontSize: 12, fontWeight: 600, display: 'block', marginBottom: 4 } }, 'Confirm PIN'),
+                  h('input', { type: 'password', inputMode: 'numeric', value: confVal, maxLength: 6, placeholder: '\u2022\u2022\u2022\u2022\u2022\u2022', autoComplete: 'new-password',
+                    style: { width: '100%', padding: '10px 14px', fontSize: 20, textAlign: 'center', letterSpacing: 8, fontFamily: 'var(--font-mono)', border: '2px solid ' + (mismatch ? '#ef4444' : 'var(--border)'), borderRadius: 8, background: 'var(--bg-secondary)' },
+                    onInput: function(e) { setExportPinSetup(Object.assign({}, exportPinSetup, { confirm: e.target.value.replace(/\D/g, '').slice(0, 6) })); }
+                  }),
+                  mismatch && h('div', { style: { fontSize: 11, color: '#ef4444', marginTop: 4 } }, 'PINs do not match')
+                ),
+                h('div', { style: { display: 'flex', gap: 8, marginTop: 16 } },
+                  h('button', { className: 'btn btn-secondary', onClick: function() { setExportStep('idle'); } }, 'Cancel'),
+                  h('button', { className: 'btn btn-primary', disabled: !canSubmit, onClick: async function() {
+                    setExportLoading(true);
+                    try {
+                      var res = await apiCall('/polymarket/' + selectedAgent + '/wallet/setup-pin', { method: 'POST', body: JSON.stringify({ pin: pinVal }) });
+                      if (res.ok) {
+                        toast('Wallet PIN created!', 'success');
+                        setWalletSecurity(Object.assign({}, walletSecurity, { hasPin: true }));
+                        // Now export immediately
+                        var exp = await apiCall('/polymarket/' + selectedAgent + '/wallet/export', { method: 'POST', body: JSON.stringify({ confirm: 'EXPORT' }) });
+                        if (exp.privateKey) {
+                          setExportedKey(exp); setExportStep('revealed');
+                          var timer = setTimeout(function() { setExportStep('idle'); setExportedKey(null); toast('Export modal auto-closed for security', 'info'); }, 60000);
+                          setExportAutoCloseTimer(timer);
+                        }
+                      } else { toast(res.error || 'PIN setup failed', 'error'); }
+                    } catch (e) { toast(e.message, 'error'); }
+                    setExportLoading(false);
+                  } }, exportLoading ? 'Setting up...' : 'Create PIN & Export Key')
+                )
+              );
+            })(),
+
+            // Step: Key revealed (auto-closes in 60s)
+            exportStep === 'revealed' && exportedKey && h('div', null,
+              h('div', { style: { padding: 10, background: 'rgba(180,83,9,0.1)', border: '1px solid rgba(180,83,9,0.3)', borderRadius: 8, marginBottom: 12, fontSize: 12, color: '#b45309', textAlign: 'center' } },
+                I('clock'), ' This window will auto-close in 60 seconds for security.'
+              ),
+              h('div', { style: { padding: 12, background: 'rgba(239,68,68,0.08)', border: '1px solid rgba(239,68,68,0.25)', borderRadius: 8, marginBottom: 16, fontSize: 12, color: '#ef4444', lineHeight: 1.6 } },
+                h('strong', null, '\u26A0 SECURITY WARNING'), h('br'),
+                'Anyone with this key has FULL CONTROL of this wallet and all funds. Never share it.'
+              ),
+              exportedKey.mismatch && h('div', { style: { padding: 12, background: 'rgba(239,68,68,0.15)', border: '2px solid rgba(239,68,68,0.5)', borderRadius: 8, marginBottom: 16, fontSize: 12, color: '#dc2626', lineHeight: 1.6 } },
+                h('strong', null, '\u26A0 KEY MISMATCH'), h('br'),
+                'Key derives ', h('code', null, exportedKey.address), ' but funded wallet is ', h('code', null, exportedKey.storedFunderAddress)
+              ),
+              h('div', { style: { marginBottom: 16 } },
+                h('label', { style: _labelStyle }, 'Wallet Address'),
+                h('div', { style: { fontFamily: 'var(--font-mono)', fontSize: 13, padding: '10px 12px', background: 'var(--bg-secondary)', borderRadius: 6, wordBreak: 'break-all', userSelect: 'all' } }, exportedKey.address)
+              ),
+              h('div', { style: { marginBottom: 16 } },
+                h('label', { style: _labelStyle }, 'Private Key'),
+                h('div', { style: { fontFamily: 'var(--font-mono)', fontSize: 12, padding: '10px 12px', background: 'var(--bg-secondary)', borderRadius: 6, wordBreak: 'break-all', userSelect: 'all', border: '1px solid rgba(239,68,68,0.3)' } }, exportedKey.privateKey)
+              ),
+              h('div', { style: { display: 'flex', gap: 8, marginBottom: 16 } },
+                h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { navigator.clipboard?.writeText(exportedKey.privateKey); toast('Private key copied', 'success'); } }, 'Copy Key'),
+                h('button', { className: 'btn btn-sm btn-secondary', onClick: function() { navigator.clipboard?.writeText(exportedKey.address); toast('Address copied', 'success'); } }, 'Copy Address')
+              ),
+              h('div', { style: { fontSize: 13, color: 'var(--text-secondary)' } },
+                h('div', { style: { fontWeight: 600, marginBottom: 6 } }, 'Import into a wallet app:'),
+                h('div', { style: { display: 'grid', gap: 8 } },
+                  h('div', { style: { padding: '8px 12px', background: 'var(--bg-secondary)', borderRadius: 6, fontSize: 12 } }, h('strong', null, 'MetaMask: '), 'Account menu \u2192 Import Account \u2192 Paste key'),
+                  h('div', { style: { padding: '8px 12px', background: 'var(--bg-secondary)', borderRadius: 6, fontSize: 12 } }, h('strong', null, 'Rabby: '), 'Add Address \u2192 Import Private Key \u2192 Paste')
                 )
               )
             )
           ),
           h('div', { className: 'modal-footer' },
-            h('button', { className: 'btn btn-primary', onClick: function() { setExportedKey(null); } }, 'Done')
+            h('button', { className: 'btn btn-primary', onClick: function() { setExportStep('idle'); setExportedKey(null); if (exportAutoCloseTimer) clearTimeout(exportAutoCloseTimer); } }, 'Close')
           )
         )
       ),

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 import {
   provision,
   runSetupWizard
-} from "./chunk-ILFP55AY.js";
+} from "./chunk-F4JP4JTF.js";
 import {
   AgenticMailManager,
   GoogleEmailProvider,
@@ -28,7 +28,7 @@ import {
   executeTool,
   runAgentLoop,
   toolsToDefinitions
-} from "./chunk-7OINTHV5.js";
+} from "./chunk-C2NLQSYZ.js";
 import "./chunk-HP63Q326.js";
 import {
   ValidationError,
@@ -43,7 +43,7 @@ import {
   requireRole,
   securityHeaders,
   validate
-} from "./chunk-LQ5OYZ7O.js";
+} from "./chunk-OEXL5Z7T.js";
 import "./chunk-DJBCRQTD.js";
 import {
   PROVIDER_REGISTRY,
@@ -117,10 +117,10 @@ import {
   init_agent_config,
   init_deployer
 } from "./chunk-PSZU6FMQ.js";
-import "./chunk-APNB5LUP.js";
+import "./chunk-OU4SSVW2.js";
 import "./chunk-X5IZUXDC.js";
 import "./chunk-I5IGHBXW.js";
-import "./chunk-MKE6LND3.js";
+import "./chunk-JPYR5M5N.js";
 import {
   SecureVault,
   init_vault
@@ -128,7 +128,7 @@ import {
 import "./chunk-2CDGYMJK.js";
 import "./chunk-V3LPIDTL.js";
 import "./chunk-A4CX3XQS.js";
-import "./chunk-5CENM5VB.js";
+import "./chunk-6SYNFKPW.js";
 import {
   CircuitBreaker,
   CircuitOpenError,