@candledottv/cli 0.8.0 → 0.8.1

package/dist/index.js

@@ -18761,6 +18761,24 @@ function isLoopbackHost2(hostname) {
     return true;
   return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
+function isPrivateHost2(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (!host.includes(".") && !host.includes(":"))
+    return true;
+  if (/\.(local|internal|home\.arpa)$/.test(host))
+    return true;
+  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^f[cd][0-9a-f]{2}:/.test(host))
+    return true;
+  return /^fe[89ab][0-9a-f]:/.test(host);
+}
 function assertTransportSecurity(apiUrl, env) {
   let parsed;
   try {
@@ -18775,9 +18793,9 @@ function assertTransportSecurity(apiUrl, env) {
   }
   if (isLoopbackHost2(parsed.hostname))
     return;
-  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
+  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim() && isPrivateHost2(parsed.hostname))
     return;
-  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
+  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + (isPrivateHost2(parsed.hostname) ? "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint." : "URL. CANDLE_ALLOW_INSECURE_HTTP does not apply here: it covers private networks only, " + "and this is a public address."));
 }
 function resolveConfig(env = process.env) {
   const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL2;
@@ -19527,7 +19545,7 @@ var init_tools = __esm(() => {
 });
 
 // ../mcp/src/version.ts
-var SERVER_VERSION = "0.5.0";
+var SERVER_VERSION = "0.6.2";
 
 // ../mcp/src/server.ts
 var exports_server = {};
@@ -19578,6 +19596,24 @@ function isLoopbackHost(hostname) {
     return true;
   return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (!host.includes(".") && !host.includes(":"))
+    return true;
+  if (/\.(local|internal|home\.arpa)$/.test(host))
+    return true;
+  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^f[cd][0-9a-f]{2}:/.test(host))
+    return true;
+  return /^fe[89ab][0-9a-f]:/.test(host);
+}
 function insecureApiUrlFault(url, env = process.env) {
   let parsed;
   try {
@@ -19589,9 +19625,9 @@ function insecureApiUrlFault(url, env = process.env) {
     return;
   if (isLoopbackHost(parsed.hostname))
     return;
-  if (env[ALLOW_INSECURE_HTTP_ENV]?.trim())
+  if (env[ALLOW_INSECURE_HTTP_ENV]?.trim() && isPrivateHost(parsed.hostname))
     return;
-  return `Refusing to send credentials in the clear to ${parsed.origin}. Use https://, or set ` + `${ALLOW_INSECURE_HTTP_ENV}=1 if this really is a trusted local endpoint.`;
+  return `Refusing to send credentials in the clear to ${parsed.origin}. Use https://` + (isPrivateHost(parsed.hostname) ? `, or set ${ALLOW_INSECURE_HTTP_ENV}=1 if this really is a trusted local endpoint.` : `. ${ALLOW_INSECURE_HTTP_ENV} does not apply here: it covers private networks only, and this is a public address.`);
 }
 function resolveApiUrl(configuredApiUrl, env = process.env) {
   const fromEnv = env.CANDLE_API_URL?.trim();
@@ -19889,7 +19925,7 @@ function resolveProfileName(config, opts) {
   if (requested !== undefined) {
     if (!isValidProfileName(requested))
       return { ok: false, message: `Invalid profile name: ${requested}` };
-    if (!(requested in profiles)) {
+    if (!Object.hasOwn(profiles, requested)) {
       return {
         ok: false,
         message: `No profile named "${requested}".${names.length ? `
@@ -19899,7 +19935,7 @@ ${listForHumans(profiles, config.activeProfile)}` : " Run: candle auth login --p
     }
     return { ok: true, name: requested };
   }
-  if (config.activeProfile && config.activeProfile in profiles)
+  if (config.activeProfile && Object.hasOwn(profiles, config.activeProfile))
     return { ok: true, name: config.activeProfile };
   if (names.length === 0)
     return { ok: true, name: undefined };
@@ -19919,7 +19955,7 @@ function resolveProfileNameForLogin(config, opts) {
       return { ok: false, message: `Invalid profile name: ${requested}` };
     return { ok: true, name: requested };
   }
-  if (config.activeProfile && config.activeProfile in profiles)
+  if (config.activeProfile && Object.hasOwn(profiles, config.activeProfile))
     return { ok: true, name: config.activeProfile };
   const names = Object.keys(profiles);
   return { ok: true, name: names.length === 1 ? names[0] : undefined };
@@ -20016,6 +20052,41 @@ function profileTable(config, now) {
 import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+
+// src/file-lock.ts
+import { open, rm, stat } from "node:fs/promises";
+var STALE_MS = 30000;
+var RETRY_MS = 25;
+var TIMEOUT_MS = 1e4;
+async function withFileLock(target, fn) {
+  const lockPath = `${target}.lock`;
+  const deadline = Date.now() + TIMEOUT_MS;
+  for (;; ) {
+    try {
+      await (await open(lockPath, "wx")).close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      const age = await stat(lockPath).then((s) => Date.now() - s.mtimeMs).catch(() => 0);
+      if (age > STALE_MS) {
+        await rm(lockPath, { force: true });
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new Error(`Timed out waiting for ${lockPath}. Another candle process is writing; if none is running, delete that file.`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, RETRY_MS));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await rm(lockPath, { force: true });
+  }
+}
+
+// src/secret-store.ts
 var SECRET_REFS = {
   deviceToken: "device_token",
   apiKey: "api_key"
@@ -20073,26 +20144,30 @@ class EncryptedFileSecretStore {
   }
   async set(ref, value) {
     const passphrase = await this.resolvePassphrase();
-    const contents = await this.readContents();
-    const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH_BYTES));
-    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH_BYTES));
-    const key = await deriveKey(passphrase, salt, this.iterations);
-    const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(value));
-    contents[ref] = {
-      salt: toBase64(salt),
-      iv: toBase64(iv),
-      ciphertext: toBase64(new Uint8Array(ciphertext)),
-      iterations: this.iterations
-    };
-    await this.writeContents(contents);
+    return withFileLock(this.path, async () => {
+      const contents = await this.readContents();
+      const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH_BYTES));
+      const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH_BYTES));
+      const key = await deriveKey(passphrase, salt, this.iterations);
+      const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(value));
+      contents[ref] = {
+        salt: toBase64(salt),
+        iv: toBase64(iv),
+        ciphertext: toBase64(new Uint8Array(ciphertext)),
+        iterations: this.iterations
+      };
+      await this.writeContents(contents);
+    });
   }
   async delete(ref) {
     await this.resolvePassphrase();
-    const contents = await this.readContents();
-    if (!(ref in contents))
-      return;
-    delete contents[ref];
-    await this.writeContents(contents);
+    return withFileLock(this.path, async () => {
+      const contents = await this.readContents();
+      if (!Object.hasOwn(contents, ref))
+        return;
+      delete contents[ref];
+      await this.writeContents(contents);
+    });
   }
   async resolvePassphrase() {
     if (this.cachedPassphrase !== undefined)
@@ -20128,7 +20203,7 @@ class EncryptedFileSecretStore {
     const dir = dirname(this.path);
     await mkdir(dir, { recursive: true });
     await chmod(dir, 448);
-    const tmpPath = `${this.path}.tmp`;
+    const tmpPath = `${this.path}.${crypto.randomUUID()}.tmp`;
     await writeFile(tmpPath, JSON.stringify(contents, null, 2), { encoding: "utf8", mode: 384 });
     await chmod(tmpPath, 384);
     await rename(tmpPath, this.path);
@@ -20183,7 +20258,7 @@ async function resolveApiKey(deps, profile) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.8.0";
+var CLI_VERSION = "0.8.1";
 
 // src/commands/auth.ts
 var DEVICE_CODE_PATH = "/api/v1/agent/device/code";
@@ -20865,21 +20940,25 @@ async function keysCreate(args, ctx) {
   }
   const body = result.body;
   const apiKeyRef = ctx.profile ? profileSecretRef(ctx.profile, "apiKey") : SECRET_REFS.apiKey;
-  const existingKey = await deps.store.get(apiKeyRef);
   let stored = false;
-  if (!existingKey) {
-    await deps.store.set(apiKeyRef, body.key);
-    if (ctx.profile) {
-      await deps.updateProfile(ctx.profile, { keyPrefix: body.keyPrefix, scopes: body.scopes });
-    } else {
-      await deps.writeConfig({ keyPrefix: body.keyPrefix, scopes: body.scopes });
+  let storeError;
+  try {
+    if (!await deps.store.get(apiKeyRef)) {
+      await deps.store.set(apiKeyRef, body.key);
+      if (ctx.profile) {
+        await deps.updateProfile(ctx.profile, { keyPrefix: body.keyPrefix, scopes: body.scopes });
+      } else {
+        await deps.writeConfig({ keyPrefix: body.keyPrefix, scopes: body.scopes });
+      }
+      stored = true;
     }
-    stored = true;
+  } catch (error) {
+    storeError = error instanceof Error ? error.message : String(error);
   }
   if (json) {
-    deps.stdout.write(`${JSON.stringify({ ...body, stored })}
+    deps.stdout.write(`${JSON.stringify({ ...body, stored, ...storeError ? { storeError } : {} })}
 `);
-    return 0;
+    return storeError ? 1 : 0;
   }
   deps.stdout.write(`API key: ${body.key}
 `);
@@ -20889,14 +20968,22 @@ async function keysCreate(args, ctx) {
 `);
   deps.stdout.write(`Scopes: ${formatScopesForSummary(body.scopes)}
 `);
+  if (storeError !== undefined) {
+    deps.stderr.write(`
+WARNING: the key above was NOT stored in the ${deps.backend} store: ${storeError}
+` + "It is live on your account. Save it now, or revoke it with: candle keys revoke " + `${body.keyPrefix}
+`);
+  }
   if (!requestedScopes) {
     deps.stdout.write(`No --scopes given: the server granted the default scopes (swap:write excluded).
 `);
   }
-  deps.stdout.write(stored ? `Stored in the ${deps.backend} backend as the CLI's working key.
+  if (storeError === undefined) {
+    deps.stdout.write(stored ? `Stored in the ${deps.backend} backend as the CLI's working key.
 ` : `Not stored: the CLI already manages a different working key. This key belongs to whichever agent it was minted for.
 `);
-  return 0;
+  }
+  return storeError === undefined ? 0 : 1;
 }
 async function keysRevoke(args, ctx) {
   const { deps, apiUrl, json } = ctx;
@@ -21149,7 +21236,7 @@ async function profileAdd(args, ctx) {
     return 2;
   }
   const config = await deps.readConfig();
-  if (config.profiles?.[name]) {
+  if (config.profiles !== undefined && Object.hasOwn(config.profiles, name)) {
     writeLocalFailure(deps, {
       code: "PROFILE_EXISTS",
       message: `Profile "${name}" already exists.`,
@@ -21181,7 +21268,7 @@ async function profileUse(args, ctx) {
     return 2;
   }
   const config = await deps.readConfig();
-  const profile = config.profiles?.[name];
+  const profile = config.profiles !== undefined && Object.hasOwn(config.profiles, name) ? config.profiles[name] : undefined;
   if (!profile) {
     const names = Object.keys(config.profiles ?? {}).join(", ") || "(none)";
     writeLocalFailure(deps, {
@@ -24768,11 +24855,16 @@ function buildCipherSuite() {
 function parseSolanaSecret(input) {
   const trimmed = input.trim();
   if (!trimmed.startsWith("[")) {
+    let decoded;
     try {
-      return base58.decode(trimmed);
+      decoded = base58.decode(trimmed);
     } catch {
       throw new Error("Invalid Solana private key: expected a base58 string or an id.json byte array.");
     }
+    if (decoded.length !== 64) {
+      throw new Error(`Invalid Solana private key: expected 64 bytes, got ${decoded.length}. A 32-byte value is the ` + "SEED, not the keypair; export the full secret key, which is what solana-keygen writes to id.json.");
+    }
+    return decoded;
   }
   const parsed = (() => {
     try {
@@ -24790,8 +24882,8 @@ function parseSolanaSecret(input) {
 function decodeWalletPrivateKey(chain2, privateKey) {
   if (chain2 === "evm") {
     const hex2 = privateKey.startsWith("0x") ? privateKey.slice(2) : privateKey;
-    if (hex2.length === 0 || hex2.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex2)) {
-      throw new Error('Invalid EVM private key: expected a hex string (optionally "0x"-prefixed)');
+    if (hex2.length !== 64 || !/^[0-9a-fA-F]+$/.test(hex2)) {
+      throw new Error("Invalid EVM private key: expected 32 bytes as 64 hex characters " + `(optionally "0x"-prefixed), got ${hex2.length} characters`);
     }
     return Uint8Array.from(Buffer.from(hex2, "hex"));
   }
@@ -25315,7 +25407,7 @@ async function writeKeystoreFile(path, contents) {
   const dir = dirname3(path);
   await mkdir2(dir, { recursive: true });
   await chmod2(dir, 448);
-  const tmpPath = `${path}.tmp`;
+  const tmpPath = `${path}.${crypto.randomUUID()}.tmp`;
   await writeFile2(tmpPath, contents, { encoding: "utf8", mode: 384 });
   await chmod2(tmpPath, 384);
   await rename2(tmpPath, path);
@@ -27919,7 +28011,16 @@ async function walletsGenerate(args, ctx) {
   let existingRaw = null;
   try {
     existingRaw = await deps.readFile(keystorePath);
-  } catch {
+  } catch (error) {
+    const code = error?.code;
+    if (code !== undefined && code !== "ENOENT") {
+      writeLocalFailure(deps, {
+        code: "KEYSTORE_UNREADABLE",
+        message: `Could not read ${keystorePath}: ${error instanceof Error ? error.message : error}`,
+        suggestion: "Refusing to continue: a keystore may exist at that path, and overwriting it would destroy the only copy of its keys."
+      }, json);
+      return 1;
+    }
     existingRaw = null;
   }
   if (existingRaw !== null && !resuming) {
@@ -28045,14 +28146,25 @@ Sealed to ${keystorePath}
       if (alreadyExists) {
         const found = await lookupByAddress(entry.address, apiKey, ctx);
         if (found) {
+          const promoted = await promoteStagedSigner(deps, entry, found._id);
           entry.imported = true;
-          entry.privyWalletId = found._id;
+          entry.linkedWalletId = found._id;
           entry.importedAt = new Date().toISOString();
           await persist(store, keystorePath);
-          if (!json)
-            deps.stdout.write(`  [${entry.index}] ${entry.address} already imported, reconciled
+          if (promoted.ok) {
+            if (!json) {
+              deps.stdout.write(`  [${entry.index}] ${entry.address} already imported, reconciled as ${found._id}
 `);
-          continue;
+            }
+            continue;
+          }
+          failures++;
+          writeLocalFailure(deps, {
+            code: "SIGNER_MISSING",
+            message: `Wallet ${entry.address} exists as ${found._id}, but ${promoted.message}.`,
+            suggestion: `Revoke it (candle wallets revoke ${found._id}) and run: candle wallets generate --resume`
+          }, json);
+          break;
         }
       }
       failures++;
@@ -28068,6 +28180,7 @@ Sealed to ${keystorePath}
       break;
     }
     entry.imported = true;
+    entry.linkedWalletId = flow.submitted.id;
     entry.privyWalletId = flow.submitted.privyWalletId;
     entry.importedAt = new Date().toISOString();
     await persist(store, keystorePath);
@@ -28106,6 +28219,22 @@ ${imported}/${store.entries.length} imported.
 `);
   return 0;
 }
+async function promoteStagedSigner(deps, entry, linkedWalletId) {
+  const committedRef = walletSignerRef(linkedWalletId);
+  if (await deps.store.get(committedRef) !== null)
+    return { ok: true };
+  const pendingRef = importPendingSignerRef(entry.chain, entry.address);
+  const staged = await deps.store.get(pendingRef);
+  if (staged === null) {
+    return {
+      ok: false,
+      message: `its signer is on neither "${committedRef}" nor "${pendingRef}" in the ${deps.backend} store`
+    };
+  }
+  await deps.store.set(committedRef, staged);
+  await deps.store.delete(pendingRef).catch(() => {});
+  return { ok: true };
+}
 async function persist(store, path) {
   await writeKeystoreFile(path, await serializeKeystore(store.entries, store.key, store.salt, store.iterations));
 }
@@ -28124,7 +28253,7 @@ async function lookupByAddress(address, apiKey, ctx) {
 }
 
 // src/config.ts
-import { chmod as chmod3, mkdir as mkdir3, readFile as readFile2, rm, writeFile as writeFile3 } from "node:fs/promises";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { join as join6 } from "node:path";
 function configDir2() {
@@ -28159,7 +28288,7 @@ async function updateProfile(name, patch) {
 }
 async function clearConfig() {
   try {
-    await rm(configFilePath());
+    await rm2(configFilePath());
   } catch (err) {
     if (err.code !== "ENOENT")
       throw err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "The Candle CLI: authorize a device from your browser, then manage API keys, wallets, and setup health from the terminal",
   "type": "module",
   "bin": {