@btc-vision/cli 1.0.13 → 1.1.0

package/build/commands/CompileCommand.js

@@ -4,7 +4,7 @@ import * as esbuild from 'esbuild';
 import bytenode from 'bytenode';
 import { BaseCommand } from './BaseCommand.js';
 import { getManifestPath, loadManifest } from '../lib/manifest.js';
-import { buildOpnetBinary, formatFileSize } from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize, toHex } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 export class CompileCommand extends BaseCommand {
@@ -63,7 +63,7 @@ export class CompileCommand extends BaseCommand {
             });
             const bytecode = fs.readFileSync(bytecodePath);
             this.logger.success(`V8 bytecode generated (${formatFileSize(bytecode.length)})`);
-            let proto = Buffer.alloc(0);
+            let proto = new Uint8Array(0);
             const protoPath = path.join(projectDir, 'plugin.proto');
             if (fs.existsSync(protoPath)) {
                 proto = fs.readFileSync(protoPath);
@@ -90,7 +90,7 @@ export class CompileCommand extends BaseCommand {
             else {
                 this.logger.warn('Skipping signing (--no-sign)');
                 mldsaLevel = 44;
-                publicKey = Buffer.alloc(1312);
+                publicKey = new Uint8Array(1312);
             }
             this.logger.info('Assembling .opnet binary...');
             const { binary, checksum } = buildOpnetBinary({
@@ -102,7 +102,7 @@ export class CompileCommand extends BaseCommand {
                 signFn,
             });
             if (options.sign) {
-                this.logger.success(`Plugin signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`);
+                this.logger.success(`Plugin signed (checksum: sha256:${toHex(checksum).substring(0, 16)}...)`);
             }
             this.logger.success(`Binary assembled (${formatFileSize(binary.length)})`);
             const outputPath = options.output ||
@@ -119,7 +119,7 @@ export class CompileCommand extends BaseCommand {
             this.logger.log(`Plugin:       ${manifest.name}@${manifest.version}`);
             this.logger.log(`Type:         ${manifest.pluginType}`);
             this.logger.log(`MLDSA Level:  ${mldsaLevel}`);
-            this.logger.log(`Checksum:     sha256:${checksum.toString('hex')}`);
+            this.logger.log(`Checksum:     sha256:${toHex(checksum)}`);
             this.logger.log(`Signed:       ${options.sign ? 'Yes' : 'No'}`);
             this.logger.log('');
             if (!options.sign) {

package/build/commands/DomainCommand.js

@@ -2,6 +2,7 @@ import { Command } from 'commander';
 import { confirm } from '@inquirer/prompts';
 import { Logger } from '@btc-vision/logger';
 import { CLIWallet } from '../lib/wallet.js';
+import { toHex } from '../lib/binary.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 import { getContenthash, getContenthashTypeName, getDomain, getDomainPrice, getResolverContract, getTreasuryAddress, parseDomainName, validateDomainName, } from '../lib/resolver.js';
 import { DEFAULT_DOMAIN_PRICE_SATS, PREMIUM_TIER_0_PRICE_SATS, PREMIUM_TIER_1_PRICE_SATS, PREMIUM_TIER_2_PRICE_SATS, PREMIUM_TIER_3_PRICE_SATS, PREMIUM_TIER_4_PRICE_SATS, PREMIUM_TIER_5_PRICE_SATS, PREMIUM_TIER_6_PRICE_SATS, } from '../types/BtcResolver.js';
@@ -126,7 +127,7 @@ async function registerDomain(domain, options) {
         const contract = getResolverContract(network, sender);
         const extraUtxo = {
             address: treasuryAddr,
-            value: Number(price),
+            value: price,
         };
         const outSimulation = [
             {
@@ -237,7 +238,7 @@ async function domainInfo(domain, options) {
                 }
             }
             else {
-                const hashHex = Buffer.from(contenthash.hashData).toString('hex');
+                const hashHex = toHex(new Uint8Array(contenthash.hashData));
                 logger.log(`Value:        ${hashHex}`);
             }
         }

package/build/commands/KeygenCommand.js

@@ -2,6 +2,7 @@ import { Command } from 'commander';
 import * as fs from 'fs';
 import { BaseCommand } from './BaseCommand.js';
 import { computePublicKeyHash, generateMLDSAKeypair, generateMnemonic } from '../lib/wallet.js';
+import { toHex } from '../lib/binary.js';
 import { isValidMldsaLevel } from '../lib/credentials.js';
 export class KeygenCommand extends BaseCommand {
     constructor() {
@@ -68,10 +69,10 @@ export class KeygenCommand extends BaseCommand {
             if (options.output) {
                 const privateKeyPath = `${options.output}.private.key`;
                 const publicKeyPath = `${options.output}.public.key`;
-                fs.writeFileSync(privateKeyPath, keypair.privateKey.toString('hex') + '\n', {
+                fs.writeFileSync(privateKeyPath, toHex(keypair.privateKey) + '\n', {
                     mode: 0o600,
                 });
-                fs.writeFileSync(publicKeyPath, keypair.publicKey.toString('hex') + '\n', {
+                fs.writeFileSync(publicKeyPath, toHex(keypair.publicKey) + '\n', {
                     mode: 0o644,
                 });
                 this.logger.success('Keys generated successfully!');
@@ -85,8 +86,8 @@ export class KeygenCommand extends BaseCommand {
             else if (options.json) {
                 const output = {
                     level: levelNum,
-                    privateKey: keypair.privateKey.toString('hex'),
-                    publicKey: keypair.publicKey.toString('hex'),
+                    privateKey: toHex(keypair.privateKey),
+                    publicKey: toHex(keypair.publicKey),
                     publicKeyHash,
                     privateKeySize: keypair.privateKey.length,
                     publicKeySize: keypair.publicKey.length,
@@ -100,10 +101,10 @@ export class KeygenCommand extends BaseCommand {
                 this.logger.log(`Private Key Size: ${keypair.privateKey.length} bytes`);
                 this.logger.log('');
                 this.logger.log('Public Key (hex):');
-                this.logger.log(keypair.publicKey.toString('hex'));
+                this.logger.log(toHex(keypair.publicKey));
                 this.logger.log('');
                 this.logger.log('Private Key (hex):');
-                this.logger.log(keypair.privateKey.toString('hex'));
+                this.logger.log(toHex(keypair.privateKey));
                 this.logger.log('');
                 this.logger.warn('IMPORTANT: Store the private key securely!');
                 this.logger.warn('Use --output <prefix> to save to files.');

package/build/commands/LoginCommand.js

@@ -17,6 +17,16 @@ export class LoginCommand extends BaseCommand {
     }
     async execute(options) {
         try {
+            if (options.mnemonic) {
+                this.logger.warn('WARNING: Mnemonic passed via CLI argument. It may be visible in shell history and process list.');
+                this.logger.warn('Consider using interactive mode instead: opnet login');
+                this.logger.log('');
+            }
+            if (options.wif || options.mldsa) {
+                this.logger.warn('WARNING: Private key passed via CLI argument. It may be visible in shell history and process list.');
+                this.logger.warn('Consider using interactive mode or environment variables instead.');
+                this.logger.log('');
+            }
             const credentials = await this.buildCredentials(options);
             this.logger.info('Deriving wallet...');
             const wallet = CLIWallet.fromCredentials(credentials);

package/build/commands/PublishCommand.js

@@ -135,7 +135,7 @@ export class PublishCommand extends BaseCommand {
             const treasuryAddress = await contract.getTreasuryAddress();
             const extraUtxo = {
                 address: treasuryAddress.properties.treasuryAddress,
-                value: 10_000,
+                value: 10000n,
             };
             let txParams = buildTransactionParams(wallet, network, DEFAULT_MAX_SAT_TO_SPEND, DEFAULT_FEE_RATE, extraUtxo);
             if (isNewPackage) {
@@ -184,7 +184,7 @@ export class PublishCommand extends BaseCommand {
             }
             txParams = buildTransactionParams(wallet, network, DEFAULT_MAX_SAT_TO_SPEND, DEFAULT_FEE_RATE);
             this.logger.info('Publishing version...');
-            const publishResult = await contract.publishVersion(meta.name, meta.version, pinResult.cid, new Uint8Array(parsed.checksum), new Uint8Array(parsed.signature), mldsaLevelToRegistry(mldsaLevel), meta.opnetVersion, pluginTypeToRegistry(meta.pluginType), permissionsHash, dependencies);
+            const publishResult = await contract.publishVersion(meta.name, meta.version, pinResult.cid, parsed.checksum, parsed.signature, mldsaLevelToRegistry(mldsaLevel), meta.opnetVersion, pluginTypeToRegistry(meta.pluginType), permissionsHash, dependencies);
             if (publishResult.revert) {
                 this.logger.fail('Version publishing would fail');
                 this.logger.error(`Reason: ${publishResult.revert}`);

package/build/commands/SignCommand.js

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as crypto from 'crypto';
 import { BaseCommand } from './BaseCommand.js';
-import { buildOpnetBinary, formatFileSize, parseOpnetBinary } from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize, parseOpnetBinary, toHex } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 export class SignCommand extends BaseCommand {
@@ -55,10 +55,10 @@ export class SignCommand extends BaseCommand {
                 publicKey: wallet.mldsaPublicKey,
                 metadata: parsed.metadata,
                 bytecode: parsed.bytecode,
-                proto: parsed.proto ?? Buffer.alloc(0),
+                proto: parsed.proto,
                 signFn,
             });
-            this.logger.success(`Signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`);
+            this.logger.success(`Signed (checksum: sha256:${toHex(checksum).substring(0, 16)}...)`);
             this.logger.success(`Binary rebuilt (${formatFileSize(newBinary.length)})`);
             const outputPath = options.output || file;
             fs.writeFileSync(outputPath, newBinary);

package/build/commands/VerifyCommand.js

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as crypto from 'crypto';
 import { BaseCommand } from './BaseCommand.js';
-import { formatFileSize, parseOpnetBinary, verifyChecksum } from '../lib/binary.js';
+import { formatFileSize, parseOpnetBinary, toHex, verifyChecksum } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 export class VerifyCommand extends BaseCommand {
     constructor() {
@@ -136,7 +136,7 @@ export class VerifyCommand extends BaseCommand {
                 this.logger.log(`  Proto:          ${formatFileSize(parsed.proto?.length ?? 0)}`);
                 this.logger.log('');
                 this.logger.log('Checksums:');
-                this.logger.log(`  Stored:         ${parsed.checksum.toString('hex')}`);
+                this.logger.log(`  Stored:         ${toHex(parsed.checksum)}`);
                 this.logger.log('');
                 this.logger.log('Author:');
                 this.logger.log(`  Name:           ${parsed.metadata.author.name}`);

package/build/commands/WhoamiCommand.js

@@ -1,6 +1,7 @@
 import { BaseCommand } from './BaseCommand.js';
 import { getCredentialSource, hasCredentials, loadCredentials, maskSensitive, } from '../lib/credentials.js';
 import { CLIWallet } from '../lib/wallet.js';
+import { toHex } from '../lib/binary.js';
 export class WhoamiCommand extends BaseCommand {
     constructor() {
         super('whoami', 'Display current wallet identity and configuration');
@@ -37,7 +38,7 @@ export class WhoamiCommand extends BaseCommand {
                 if (options.publicKey) {
                     this.logger.log('');
                     this.logger.log('MLDSA Public Key:');
-                    this.logger.log(wallet.mldsaPublicKey.toString('hex'));
+                    this.logger.log(toHex(wallet.mldsaPublicKey));
                 }
                 if (options.verbose) {
                     this.logger.log('');

package/build/lib/binary.d.ts

@@ -1,19 +1,20 @@
 import { IParsedPluginFile, IPluginMetadata } from '@btc-vision/plugin-sdk';
 import { CLIMldsaLevel } from '../types/index.js';
-export declare function parseOpnetBinary(data: Buffer): IParsedPluginFile;
-export declare function computeChecksum(metadata: Buffer, bytecode: Buffer, proto: Buffer): Buffer;
+export declare function toHex(data: Uint8Array): string;
+export declare function parseOpnetBinary(data: Uint8Array): IParsedPluginFile;
+export declare function computeChecksum(metadata: Uint8Array, bytecode: Uint8Array, proto: Uint8Array): Uint8Array;
 export declare function verifyChecksum(parsed: IParsedPluginFile): boolean;
 export declare function buildOpnetBinary(options: {
     mldsaLevel: CLIMldsaLevel;
-    publicKey: Buffer;
+    publicKey: Uint8Array;
     metadata: IPluginMetadata;
-    bytecode: Buffer;
-    proto?: Buffer;
-    signFn?: (checksum: Buffer) => Buffer;
+    bytecode: Uint8Array;
+    proto?: Uint8Array;
+    signFn?: (checksum: Uint8Array) => Uint8Array;
 }): {
-    binary: Buffer;
-    checksum: Buffer;
+    binary: Uint8Array;
+    checksum: Uint8Array;
 };
-export declare function extractMetadata(data: Buffer): IPluginMetadata | null;
+export declare function extractMetadata(data: Uint8Array): IPluginMetadata | null;
 export declare function getParsedMldsaLevel(parsed: IParsedPluginFile): CLIMldsaLevel;
 export declare function formatFileSize(bytes: number): string;

package/build/lib/binary.js

@@ -1,22 +1,31 @@
 import * as crypto from 'crypto';
 import { MLDSA_PUBLIC_KEY_SIZES, MLDSA_SIGNATURE_SIZES, PLUGIN_FORMAT_VERSION, PLUGIN_MAGIC_BYTES, } from '@btc-vision/plugin-sdk';
 import { cliLevelToMLDSALevel, mldsaLevelToCLI } from '../types/index.js';
+const HEX_CHARS = '0123456789abcdef';
+export function toHex(data) {
+    let hex = '';
+    for (let i = 0; i < data.length; i++) {
+        hex += HEX_CHARS[data[i] >> 4] + HEX_CHARS[data[i] & 0xf];
+    }
+    return hex;
+}
 export function parseOpnetBinary(data) {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
     let offset = 0;
     if (data.length < 8 + 4 + 1) {
         throw new Error('Binary too small: missing header');
     }
     const magic = data.subarray(offset, offset + 8);
     offset += 8;
-    if (!magic.equals(PLUGIN_MAGIC_BYTES)) {
-        throw new Error(`Invalid magic bytes: expected ${PLUGIN_MAGIC_BYTES.toString('hex')}, got ${magic.toString('hex')}`);
+    if (!PLUGIN_MAGIC_BYTES.every((b, i) => magic[i] === b)) {
+        throw new Error(`Invalid magic bytes: expected ${toHex(PLUGIN_MAGIC_BYTES)}, got ${toHex(magic)}`);
     }
-    const formatVersion = data.readUInt32LE(offset);
+    const formatVersion = view.getUint32(offset, true);
     offset += 4;
     if (formatVersion !== PLUGIN_FORMAT_VERSION) {
         throw new Error(`Unsupported format version: ${formatVersion} (expected ${PLUGIN_FORMAT_VERSION})`);
     }
-    const mldsaLevelValue = data.readUInt8(offset);
+    const mldsaLevelValue = view.getUint8(offset);
     offset += 1;
     if (mldsaLevelValue > 2) {
         throw new Error(`Invalid MLDSA level: ${mldsaLevelValue} (must be 0, 1, or 2)`);
@@ -28,44 +37,45 @@ export function parseOpnetBinary(data) {
     if (data.length < minSize) {
         throw new Error(`Binary truncated: expected at least ${minSize} bytes, got ${data.length}`);
     }
-    const publicKey = Buffer.from(data.subarray(offset, offset + publicKeySize));
+    const publicKey = data.slice(offset, offset + publicKeySize);
     offset += publicKeySize;
-    const signature = Buffer.from(data.subarray(offset, offset + signatureSize));
+    const signature = data.slice(offset, offset + signatureSize);
     offset += signatureSize;
-    const metadataLength = data.readUInt32LE(offset);
+    const metadataLength = view.getUint32(offset, true);
     offset += 4;
     if (offset + metadataLength > data.length) {
         throw new Error(`Metadata section truncated at offset ${offset}`);
     }
     const metadataBytes = data.subarray(offset, offset + metadataLength);
     offset += metadataLength;
+    const decoder = new TextDecoder();
     let rawMetadata;
     let metadata;
     try {
-        rawMetadata = metadataBytes.toString('utf-8');
+        rawMetadata = decoder.decode(metadataBytes);
         metadata = JSON.parse(rawMetadata);
     }
     catch {
         throw new Error('Malformed JSON metadata');
     }
-    const bytecodeLength = data.readUInt32LE(offset);
+    const bytecodeLength = view.getUint32(offset, true);
     offset += 4;
     if (offset + bytecodeLength > data.length) {
         throw new Error(`Bytecode section truncated at offset ${offset}`);
     }
-    const bytecode = Buffer.from(data.subarray(offset, offset + bytecodeLength));
+    const bytecode = data.slice(offset, offset + bytecodeLength);
     offset += bytecodeLength;
-    const protoLength = data.readUInt32LE(offset);
+    const protoLength = view.getUint32(offset, true);
     offset += 4;
     if (offset + protoLength > data.length) {
         throw new Error(`Proto section truncated at offset ${offset}`);
     }
-    const proto = protoLength > 0 ? Buffer.from(data.subarray(offset, offset + protoLength)) : undefined;
+    const proto = protoLength > 0 ? data.slice(offset, offset + protoLength) : undefined;
     offset += protoLength;
     if (offset + 32 > data.length) {
         throw new Error('Checksum truncated');
     }
-    const checksum = Buffer.from(data.subarray(offset, offset + 32));
+    const checksum = data.slice(offset, offset + 32);
     return {
         formatVersion,
         mldsaLevel,
@@ -86,26 +96,31 @@ export function computeChecksum(metadata, bytecode, proto) {
     return hash.digest();
 }
 export function verifyChecksum(parsed) {
-    const metadataBytes = Buffer.from(parsed.rawMetadata, 'utf-8');
-    const computed = computeChecksum(metadataBytes, parsed.bytecode, parsed.proto ?? Buffer.alloc(0));
-    return computed.equals(parsed.checksum);
+    const encoder = new TextEncoder();
+    const metadataBytes = encoder.encode(parsed.rawMetadata);
+    const computed = computeChecksum(metadataBytes, parsed.bytecode, parsed.proto ?? new Uint8Array(0));
+    if (computed.length !== parsed.checksum.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(computed, parsed.checksum);
 }
 export function buildOpnetBinary(options) {
-    const { mldsaLevel, publicKey, metadata, bytecode, proto = Buffer.alloc(0), signFn } = options;
+    const { mldsaLevel, publicKey, metadata, bytecode, proto = new Uint8Array(0), signFn, } = options;
     const sdkLevel = cliLevelToMLDSALevel(mldsaLevel);
     const expectedPkSize = MLDSA_PUBLIC_KEY_SIZES[sdkLevel];
     const expectedSigSize = MLDSA_SIGNATURE_SIZES[sdkLevel];
     if (publicKey.length !== expectedPkSize) {
         throw new Error(`Public key size mismatch: expected ${expectedPkSize}, got ${publicKey.length}`);
     }
+    const encoder = new TextEncoder();
     const tempMetadata = { ...metadata, checksum: '' };
-    const tempMetadataBytes = Buffer.from(JSON.stringify(tempMetadata), 'utf-8');
+    const tempMetadataBytes = encoder.encode(JSON.stringify(tempMetadata));
     const checksum = computeChecksum(tempMetadataBytes, bytecode, proto);
-    const checksumHex = `sha256:${checksum.toString('hex')}`;
+    const checksumHex = `sha256:${toHex(checksum)}`;
     const finalMetadata = { ...metadata, checksum: checksumHex };
-    const metadataBytes = Buffer.from(JSON.stringify(finalMetadata), 'utf-8');
+    const metadataBytes = encoder.encode(JSON.stringify(finalMetadata));
     const finalChecksum = computeChecksum(metadataBytes, bytecode, proto);
-    const signature = signFn ? signFn(finalChecksum) : Buffer.alloc(expectedSigSize);
+    const signature = signFn ? signFn(finalChecksum) : new Uint8Array(expectedSigSize);
     if (signature.length !== expectedSigSize) {
         throw new Error(`Signature size mismatch: expected ${expectedSigSize}, got ${signature.length}`);
     }
@@ -121,31 +136,32 @@ export function buildOpnetBinary(options) {
         4 +
         proto.length +
         32;
-    const buffer = Buffer.alloc(totalSize);
+    const buffer = new Uint8Array(totalSize);
+    const view = new DataView(buffer.buffer);
     let offset = 0;
-    PLUGIN_MAGIC_BYTES.copy(buffer, offset);
+    buffer.set(PLUGIN_MAGIC_BYTES, offset);
     offset += 8;
-    buffer.writeUInt32LE(PLUGIN_FORMAT_VERSION, offset);
+    view.setUint32(offset, PLUGIN_FORMAT_VERSION, true);
     offset += 4;
-    buffer.writeUInt8(sdkLevel, offset);
+    view.setUint8(offset, sdkLevel);
     offset += 1;
-    publicKey.copy(buffer, offset);
+    buffer.set(publicKey, offset);
     offset += publicKey.length;
-    signature.copy(buffer, offset);
+    buffer.set(signature, offset);
     offset += signature.length;
-    buffer.writeUInt32LE(metadataBytes.length, offset);
+    view.setUint32(offset, metadataBytes.length, true);
     offset += 4;
-    metadataBytes.copy(buffer, offset);
+    buffer.set(metadataBytes, offset);
     offset += metadataBytes.length;
-    buffer.writeUInt32LE(bytecode.length, offset);
+    view.setUint32(offset, bytecode.length, true);
     offset += 4;
-    bytecode.copy(buffer, offset);
+    buffer.set(bytecode, offset);
     offset += bytecode.length;
-    buffer.writeUInt32LE(proto.length, offset);
+    view.setUint32(offset, proto.length, true);
     offset += 4;
-    proto.copy(buffer, offset);
+    buffer.set(proto, offset);
     offset += proto.length;
-    finalChecksum.copy(buffer, offset);
+    buffer.set(finalChecksum, offset);
     return { binary: buffer, checksum: finalChecksum };
 }
 export function extractMetadata(data) {

package/build/lib/credentials.js

@@ -3,11 +3,22 @@ import * as path from 'path';
 import * as os from 'os';
 import { ensureConfigDir } from './config.js';
 const CREDENTIALS_FILE = path.join(os.homedir(), '.opnet', 'credentials.json');
+const VALID_MLDSA_LEVELS = [44, 65, 87];
+function parseEnvMldsaLevel() {
+    const raw = process.env.OPNET_MLDSA_LEVEL;
+    if (!raw)
+        return 44;
+    const parsed = parseInt(raw, 10);
+    if (!VALID_MLDSA_LEVELS.includes(parsed)) {
+        throw new Error(`Invalid OPNET_MLDSA_LEVEL="${raw}". Must be one of: ${VALID_MLDSA_LEVELS.join(', ')}`);
+    }
+    return parsed;
+}
 export function loadCredentials() {
     if (process.env.OPNET_MNEMONIC) {
         return {
             mnemonic: process.env.OPNET_MNEMONIC,
-            mldsaLevel: parseInt(process.env.OPNET_MLDSA_LEVEL || '44', 10) || 44,
+            mldsaLevel: parseEnvMldsaLevel(),
             network: process.env.OPNET_NETWORK || 'mainnet',
         };
     }
@@ -15,18 +26,29 @@ export function loadCredentials() {
         return {
             wif: process.env.OPNET_PRIVATE_KEY,
             mldsaPrivateKey: process.env.OPNET_MLDSA_KEY,
-            mldsaLevel: parseInt(process.env.OPNET_MLDSA_LEVEL || '44', 10) || 44,
+            mldsaLevel: parseEnvMldsaLevel(),
             network: process.env.OPNET_NETWORK || 'mainnet',
         };
     }
     if (!fs.existsSync(CREDENTIALS_FILE)) {
         return null;
     }
+    try {
+        const stat = fs.statSync(CREDENTIALS_FILE);
+        const mode = stat.mode & 0o777;
+        if (mode !== 0o600 && mode !== 0o400) {
+            process.stderr.write(`WARNING: Credentials file ${CREDENTIALS_FILE} has permissions ${mode.toString(8)}. Expected 600 or 400.\n` +
+                `Run: chmod 600 ${CREDENTIALS_FILE}\n`);
+        }
+    }
+    catch {
+    }
     try {
         const content = fs.readFileSync(CREDENTIALS_FILE, 'utf-8');
         return JSON.parse(content);
     }
-    catch {
+    catch (error) {
+        process.stderr.write(`WARNING: Failed to parse credentials file: ${error instanceof Error ? error.message : String(error)}\n`);
         return null;
     }
 }