@agtnames/cli 0.0.0-stage → 0.1.0

package/dist/browser.js

@@ -0,0 +1,309 @@
+/**
+ * Browser-wallet signer: the CLI serves one page on 127.0.0.1 and the page asks MetaMask (or any EIP-1193 wallet
+ * injected as window.ethereum) to approve each request. The key never leaves the wallet, and nothing outside this
+ * machine is involved: no relay, no project id.
+ *
+ * Protocol (all under /s/<token>, a random 192-bit path the CLI prints and opens):
+ *   GET  /s/<token>          the page
+ *   GET  /s/<token>/next     long poll: the next request { id, method, params, description }, or 204 after 25 s
+ *   POST /s/<token>/result   { id, result } or { id, error: { code?, message } }
+ *
+ * Hardening: bound to 127.0.0.1 only; the Host header must be this origin (DNS rebinding); POSTs must carry this
+ * Origin and a JSON body; the token is compared in constant time; every response is no-store and the page runs
+ * under a nonce CSP with connect-src 'self'. The CLI re-checks what comes back: a signature must recover to the
+ * connected address, and the page re-checks the chain and account before each transaction.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+import { getAddress, verifyMessage } from "viem";
+export class WalletRejectedError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "WalletRejectedError";
+    }
+}
+export function openInBrowser(url) {
+    const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+        : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+    try {
+        spawn(cmd, args, { detached: true, stdio: "ignore" }).on("error", () => { }).unref();
+    }
+    catch { /* the URL is printed too */ }
+}
+const utf8Hex = (s) => ("0x" + Buffer.from(s, "utf8").toString("hex"));
+export async function browserSigner(opts) {
+    const { network } = opts;
+    const token = randomBytes(24).toString("base64url");
+    const nonce = randomBytes(16).toString("base64");
+    const timeoutMs = opts.timeoutMs ?? 10 * 60_000;
+    const queue = [];
+    const waiters = [];
+    let nextId = 1;
+    let origin = "";
+    const server = createServer((req, res) => handle(req, res).catch(() => { if (!res.headersSent)
+        send(res, 500, "error"); }));
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(opts.port ?? 0, "127.0.0.1", () => resolve()); });
+    const port = server.address().port;
+    origin = `http://127.0.0.1:${port}`;
+    const allowedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    const allowedOrigins = new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+    const tokenBuf = Buffer.from(token);
+    function send(res, status, body, type = "text/plain; charset=utf-8") {
+        res.writeHead(status, {
+            "content-type": type,
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+            "x-frame-options": "DENY",
+            "x-content-type-options": "nosniff",
+            "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+        });
+        res.end(body);
+    }
+    const tokenOk = (t) => { const b = Buffer.from(t); return b.length === tokenBuf.length && timingSafeEqual(b, tokenBuf); };
+    function dispatch() {
+        while (waiters.length) {
+            const p = queue.find((q) => !q.dispatched);
+            if (!p)
+                return;
+            const res = waiters.shift();
+            if (res.writableEnded || res.destroyed)
+                continue;
+            p.dispatched = true;
+            send(res, 200, JSON.stringify({ id: p.id, method: p.method, params: p.params, description: p.description }), "application/json");
+        }
+    }
+    async function readBody(req) {
+        let size = 0;
+        const chunks = [];
+        for await (const c of req) {
+            size += c.length;
+            if (size > 64 * 1024)
+                throw new Error("body too large");
+            chunks.push(c);
+        }
+        return Buffer.concat(chunks).toString("utf8");
+    }
+    async function handle(req, res) {
+        if (!allowedHosts.has(req.headers.host ?? ""))
+            return send(res, 403, "forbidden host");
+        const m = /^\/s\/([A-Za-z0-9_-]+)(\/next|\/result)?$/.exec((req.url ?? "").split("?")[0]);
+        if (!m || !tokenOk(m[1]))
+            return send(res, 404, "not found");
+        const route = m[2] ?? "";
+        if (req.method === "GET" && route === "")
+            return send(res, 200, page(nonce, network), "text/html; charset=utf-8");
+        if (req.method === "GET" && route === "/next") {
+            waiters.push(res);
+            const t = setTimeout(() => { const i = waiters.indexOf(res); if (i >= 0) {
+                waiters.splice(i, 1);
+                res.writeHead(204, { "cache-control": "no-store" });
+                res.end();
+            } }, 25_000);
+            res.on("close", () => { clearTimeout(t); const i = waiters.indexOf(res); if (i >= 0)
+                waiters.splice(i, 1); });
+            return dispatch();
+        }
+        if (req.method === "POST" && route === "/result") {
+            if (!allowedOrigins.has(req.headers.origin ?? ""))
+                return send(res, 403, "forbidden origin");
+            if (!(req.headers["content-type"] ?? "").startsWith("application/json"))
+                return send(res, 415, "json only");
+            let msg;
+            try {
+                msg = JSON.parse(await readBody(req));
+            }
+            catch {
+                return send(res, 400, "bad json");
+            }
+            const i = queue.findIndex((q) => q.id === msg.id && q.dispatched);
+            if (i < 0)
+                return send(res, 409, "no such request");
+            const [p] = queue.splice(i, 1);
+            clearTimeout(p.timer);
+            send(res, 204, "");
+            if (msg.error) {
+                const code = msg.error.code;
+                p.reject(code === 4001 ? new WalletRejectedError("you rejected the request in the wallet", code) : new Error(`wallet: ${msg.error.message ?? "request failed"}`));
+            }
+            else
+                p.resolve(msg.result);
+            return;
+        }
+        send(res, 405, "method not allowed");
+    }
+    function request(method, params, description) {
+        return new Promise((resolve, reject) => {
+            const p = { id: nextId++, method, params, description, dispatched: false, resolve: resolve, reject };
+            if (method !== "close")
+                p.timer = setTimeout(() => {
+                    const i = queue.indexOf(p);
+                    if (i >= 0)
+                        queue.splice(i, 1);
+                    reject(new Error(`timed out after ${Math.round(timeoutMs / 60000)} min waiting for the wallet (is the page at ${origin}/s/… still open?)`));
+                }, timeoutMs);
+            queue.push(p);
+            dispatch();
+        });
+    }
+    const url = `${origin}/s/${token}`;
+    opts.onUrl?.(url);
+    (opts.open ?? openInBrowser)(url);
+    const shutdown = async () => {
+        for (const p of queue.splice(0)) {
+            clearTimeout(p.timer);
+            p.reject(new Error("signer closed"));
+        }
+        for (const w of waiters.splice(0)) {
+            try {
+                w.writeHead(204);
+                w.end();
+            }
+            catch { /* gone */ }
+        }
+        server.closeAllConnections?.();
+        await new Promise((r) => server.close(() => r()));
+    };
+    let address;
+    try {
+        const connected = await request("connect", chainParams(network), `Connect a wallet on ${network.chain.name}`);
+        address = getAddress(connected);
+    }
+    catch (e) {
+        await shutdown();
+        throw e;
+    }
+    return {
+        kind: "browser",
+        address,
+        async signMessage(message, description) {
+            const sig = await request("personal_sign", { message, hex: utf8Hex(message), address }, description);
+            if (!(await verifyMessage({ address, message, signature: sig })))
+                throw new Error(`the wallet returned a signature that does not recover to ${address}`);
+            return sig;
+        },
+        async sendTransaction(tx) {
+            const hash = await request("eth_sendTransaction", {
+                from: address, to: tx.to, data: tx.data, value: "0x" + (tx.value ?? 0n).toString(16), chainId: "0x" + network.chainId.toString(16),
+            }, tx.description);
+            if (!/^0x[0-9a-fA-F]{64}$/.test(hash ?? ""))
+                throw new Error("the wallet did not return a transaction hash");
+            return hash;
+        },
+        async close() {
+            const bye = request("close", null, "All done. You can close this tab.").catch(() => { });
+            await Promise.race([bye, new Promise((r) => setTimeout(r, 1500))]);
+            await shutdown();
+        },
+    };
+}
+function chainParams(n) {
+    return {
+        chainId: "0x" + n.chainId.toString(16),
+        chainName: n.chain.name,
+        nativeCurrency: n.chain.nativeCurrency,
+        rpcUrls: n.rpcUrls,
+        blockExplorerUrls: [n.explorer],
+    };
+}
+/** The wallet page. Everything shown to the user goes through textContent; nothing from a request is parsed as HTML. */
+function page(nonce, n) {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>agt · sign with your wallet</title>
+<style>
+  :root { color-scheme: light dark; font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+  body { max-width: 640px; margin: 48px auto; padding: 0 20px; }
+  h1 { font-size: 20px; margin: 0 0 4px; }
+  .muted { opacity: .7; }
+  .card { border: 1px solid #8884; border-radius: 10px; padding: 16px; margin: 20px 0; }
+  pre { white-space: pre-wrap; word-break: break-all; font-size: 12px; max-height: 320px; overflow: auto; background: #8881; padding: 10px; border-radius: 6px; }
+  button { font: inherit; padding: 8px 16px; border-radius: 8px; border: 1px solid #8886; cursor: pointer; }
+  .err { color: #d33; } .ok { color: #2a2; }
+  dt { font-weight: 600; margin-top: 6px; } dd { margin: 0; word-break: break-all; font-family: ui-monospace, monospace; font-size: 13px; }
+</style></head>
+<body>
+<h1>agt command line</h1>
+<div class="muted">Network: ${n.chain.name} (chain ${n.chainId}). Requests from the terminal appear here; approve each in your wallet.</div>
+<div class="card"><div id="status">Waiting for the terminal…</div><div id="detail"></div><p id="action"></p></div>
+<div class="muted" id="account"></div>
+<script nonce="${nonce}">
+(() => {
+  const base = location.pathname;
+  const $ = (id) => document.getElementById(id);
+  const eth = window.ethereum;
+  const setStatus = (text, cls) => { const s = $("status"); s.textContent = text; s.className = cls || ""; };
+  const clear = () => { $("detail").replaceChildren(); $("action").replaceChildren(); };
+  const pre = (text) => { const p = document.createElement("pre"); p.textContent = text; return p; };
+  const dl = (rows) => { const d = document.createElement("dl"); for (const [k, v] of rows) { const t = document.createElement("dt"); t.textContent = k; const x = document.createElement("dd"); x.textContent = v; d.append(t, x); } return d; };
+  let account = null, chain = null, stopped = false;
+
+  async function post(body) {
+    await fetch(base + "/result", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  }
+  function button(label) {
+    return new Promise((resolve) => { const b = document.createElement("button"); b.textContent = label; b.onclick = () => { b.disabled = true; resolve(); }; $("action").replaceChildren(b); });
+  }
+  async function ensureChain(params) {
+    const current = await eth.request({ method: "eth_chainId" });
+    if (current.toLowerCase() === params.chainId.toLowerCase()) return;
+    try { await eth.request({ method: "wallet_switchEthereumChain", params: [{ chainId: params.chainId }] }); }
+    catch (e) {
+      if (e && (e.code === 4902 || (e.data && e.data.originalError && e.data.originalError.code === 4902))) await eth.request({ method: "wallet_addEthereumChain", params: [params] });
+      else throw e;
+    }
+    const after = await eth.request({ method: "eth_chainId" });
+    if (after.toLowerCase() !== params.chainId.toLowerCase()) throw new Error("the wallet is on chain " + parseInt(after, 16) + ", expected " + parseInt(params.chainId, 16));
+  }
+  async function ensureAccount(expected) {
+    const accs = await eth.request({ method: "eth_accounts" });
+    if (!accs.length || accs[0].toLowerCase() !== expected.toLowerCase()) throw new Error("the wallet's selected account changed to " + (accs[0] || "none") + "; switch back to " + expected);
+  }
+
+  async function run(r) {
+    clear();
+    if (r.method === "close") { stopped = true; setStatus(r.description, "ok"); await post({ id: r.id, result: true }); return; }
+    if (!eth) throw Object.assign(new Error("No browser wallet found. Install MetaMask, then reload this page."), { code: -1 });
+    setStatus(r.description);
+    if (r.method === "connect") {
+      chain = r.params;
+      $("detail").append(dl([["Network", chain.chainName + " (" + parseInt(chain.chainId, 16) + ")"]]));
+      await button("Connect wallet");
+      const accs = await eth.request({ method: "eth_requestAccounts" });
+      await ensureChain(chain);
+      account = accs[0];
+      $("account").textContent = "Connected: " + account;
+      return account;
+    }
+    if (r.method === "personal_sign") {
+      $("detail").append(dl([["Signing as", r.params.address]]), pre(r.params.message));
+      await ensureAccount(r.params.address);
+      return eth.request({ method: "personal_sign", params: [r.params.hex, r.params.address] });
+    }
+    if (r.method === "eth_sendTransaction") {
+      const p = r.params;
+      $("detail").append(dl([["From", p.from], ["To", p.to], ["Value (wei)", BigInt(p.value).toString()], ["Data", (p.data.length - 2) / 2 + " bytes"]]), pre(p.data));
+      await ensureChain(chain);
+      await ensureAccount(p.from);
+      const { chainId, ...tx } = p;
+      return eth.request({ method: "eth_sendTransaction", params: [tx] });
+    }
+    throw new Error("unknown request " + r.method);
+  }
+
+  async function loop() {
+    while (!stopped) {
+      let r;
+      try { const res = await fetch(base + "/next", { cache: "no-store" }); if (res.status === 204) continue; if (!res.ok) throw new Error("terminal returned " + res.status); r = await res.json(); }
+      catch (e) { setStatus("Lost the terminal connection. If the command finished, close this tab.", "err"); return; }
+      try { const result = await run(r); if (r.method !== "close") { setStatus("Sent back to the terminal.", "ok"); await post({ id: r.id, result }); } }
+      catch (e) { setStatus((e && e.message) || String(e), "err"); await post({ id: r.id, error: { code: e && e.code, message: (e && e.message) || String(e) } }); }
+    }
+  }
+  loop();
+})();
+</script>
+</body></html>`;
+}

package/dist/chain.d.ts

@@ -0,0 +1,36 @@
+import { type Address, type Hex, type PublicClient } from "viem";
+import { type Network } from "./config.js";
+import type { Signer, TxRequest } from "./signer.js";
+export declare function publicClient(n: Network): PublicClient;
+export declare function normalizeLabel(input: string): string;
+export declare const nodeOf: (label: string) => Hex;
+export interface NameState {
+    label: string;
+    owner: Address | null;
+    resolver: Address | null;
+}
+export declare function nameState(pc: PublicClient, n: Network, label: string): Promise<NameState>;
+/** The signer must own the name and the name must have a resolver, or every write would revert. */
+export declare function assertOwner(s: NameState, signer: Address): Address;
+export interface RecordsPlan {
+    manifest?: string;
+    endpoints?: {
+        protocol: string;
+        url: string;
+    }[];
+    addr?: Address;
+    wallet?: Address;
+}
+/** One multicall: pointer (skipped if unchanged), an endpoint per protocol, addr, agent wallet. */
+export declare function recordCalls(label: string, plan: RecordsPlan, currentManifest?: string): Hex[];
+export declare function describePlan(label: string, plan: RecordsPlan, currentManifest?: string): string[];
+export declare const multicallTx: (resolver: Address, calls: Hex[], description: string) => TxRequest;
+export declare function sendAndWait(pc: PublicClient, n: Network, signer: Signer, tx: TxRequest, log: (s: string) => void): Promise<Hex>;
+/** What --dry-run prints for a transaction instead of sending it. */
+export declare const dryTx: (tx: TxRequest, from: Address) => {
+    description: string;
+    from: `0x${string}`;
+    to: `0x${string}`;
+    value: string;
+    data: `0x${string}`;
+};

package/dist/chain.js

@@ -0,0 +1,63 @@
+/** Chain reads, record-write batching, and send → receipt → one printed verification line. */
+import { namehash } from "@agtnames/resolver";
+import { createPublicClient, encodeFunctionData, fallback, http, zeroAddress } from "viem";
+import { registryAbi, resolverAbi } from "./abi.js";
+import { UsageError } from "./args.js";
+import { txUrl } from "./config.js";
+export function publicClient(n) {
+    return createPublicClient({ chain: n.chain, transport: n.rpcUrls.length > 1 ? fallback(n.rpcUrls.map((u) => http(u))) : http(n.rpcUrls[0]) });
+}
+export function normalizeLabel(input) {
+    const label = input.trim().toLowerCase().replace(/\.agt$/, "");
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
+        throw new UsageError(`"${input}" is not a valid .agt name: 1–63 characters, a-z 0-9 and hyphens, no leading or trailing hyphen`);
+    return label;
+}
+export const nodeOf = (label) => namehash(`${label}.agt`);
+export async function nameState(pc, n, label) {
+    const tokenId = await pc.readContract({ address: n.registry, abi: registryAbi, functionName: "tokenIdOf", args: [label] });
+    const owner = await pc.readContract({ address: n.registry, abi: registryAbi, functionName: "ownerOf", args: [tokenId] }).catch(() => null);
+    const resolver = owner ? await pc.readContract({ address: n.registry, abi: registryAbi, functionName: "resolverOf", args: [tokenId] }).catch(() => null) : null;
+    return { label, owner: owner && owner !== zeroAddress ? owner : null, resolver: resolver && resolver !== zeroAddress ? resolver : null };
+}
+/** The signer must own the name and the name must have a resolver, or every write would revert. */
+export function assertOwner(s, signer) {
+    if (!s.owner)
+        throw new Error(`${s.label}.agt is not registered (run \`agt register ${s.label}\` first)`);
+    if (s.owner.toLowerCase() !== signer.toLowerCase())
+        throw new Error(`${s.label}.agt is owned by ${s.owner}, but you are signing as ${signer}. Sign with the owner's wallet.`);
+    if (!s.resolver)
+        throw new Error(`${s.label}.agt has no resolver (the name may have expired)`);
+    return s.resolver;
+}
+/** One multicall: pointer (skipped if unchanged), an endpoint per protocol, addr, agent wallet. */
+export function recordCalls(label, plan, currentManifest = "") {
+    const node = nodeOf(label);
+    return [
+        ...(plan.manifest && plan.manifest !== currentManifest ? [encodeFunctionData({ abi: resolverAbi, functionName: "setAgentManifest", args: [node, plan.manifest] })] : []),
+        ...(plan.endpoints ?? []).map((e) => encodeFunctionData({ abi: resolverAbi, functionName: "setAgentEndpoint", args: [node, e.protocol, e.url] })),
+        ...(plan.addr ? [encodeFunctionData({ abi: resolverAbi, functionName: "setAddr", args: [node, plan.addr] })] : []),
+        ...(plan.wallet ? [encodeFunctionData({ abi: resolverAbi, functionName: "setAgentWallet", args: [node, plan.wallet] })] : []),
+    ];
+}
+export function describePlan(label, plan, currentManifest = "") {
+    return [
+        ...(plan.manifest ? [plan.manifest === currentManifest ? `manifest pointer already ${plan.manifest} (unchanged)` : `manifest → ${plan.manifest}`] : []),
+        ...(plan.endpoints ?? []).map((e) => `endpoint ${e.protocol} → ${e.url}`),
+        ...(plan.addr ? [`addr → ${plan.addr}`] : []),
+        ...(plan.wallet ? [`agent wallet → ${plan.wallet}`] : []),
+    ].map((l) => `  ${label}.agt ${l}`);
+}
+export const multicallTx = (resolver, calls, description) => ({ to: resolver, data: encodeFunctionData({ abi: resolverAbi, functionName: "multicall", args: [calls] }), description });
+export async function sendAndWait(pc, n, signer, tx, log) {
+    log(`→ ${tx.description}${signer.kind === "browser" ? " (approve in your wallet)" : ""}`);
+    const hash = await signer.sendTransaction(tx);
+    log(`  sent ${txUrl(n, hash)}`);
+    const rc = await pc.waitForTransactionReceipt({ hash, timeout: 180_000 });
+    if (rc.status !== "success")
+        throw new Error(`transaction reverted: ${txUrl(n, hash)}`);
+    log(`  confirmed in block ${rc.blockNumber}`);
+    return hash;
+}
+/** What --dry-run prints for a transaction instead of sending it. */
+export const dryTx = (tx, from) => ({ description: tx.description, from, to: tx.to, value: (tx.value ?? 0n).toString(), data: tx.data });

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};