@clanker-chain/clanker-cli 2026.9.7-1

package/lib/resolve.mjs

@@ -0,0 +1,237 @@
+/**
+ * Operator key resolution + Anvil guard for non-local RPCs.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { getAddress } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import {
+  ANVIL_DEFAULT_PRIVATE_KEY,
+  isLocalRpc,
+  loadOperator,
+  resolveNetwork,
+} from "./profile.mjs";
+
+/**
+ * Normalize a hex private key (with or without 0x).
+ * @param {string} raw
+ * @returns {`0x${string}`}
+ */
+export function normalizePrivateKey(raw) {
+  const s = String(raw ?? "").trim();
+  if (!s) throw new Error("Empty private key");
+  const hex = s.startsWith("0x") ? s : `0x${s}`;
+  if (!/^0x[0-9a-fA-F]{64}$/.test(hex)) {
+    throw new Error("Private key must be 0x + 64 hex characters");
+  }
+  return /** @type {`0x${string}`} */ (hex.toLowerCase());
+}
+
+export function isAnvilDefaultKey(key) {
+  try {
+    return normalizePrivateKey(key) === ANVIL_DEFAULT_PRIVATE_KEY.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Parse --key / --key-file from argv (does not apply Anvil default).
+ * @param {string[]} argv
+ * @returns {{ key: string|null, keyFile: string|null, usedExplicitKey: boolean }}
+ */
+export function parseKeyFlags(argv) {
+  let key = null;
+  let keyFile = null;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === "--key" && argv[i + 1]) {
+      key = argv[++i];
+    } else if (a === "--key-file" && argv[i + 1]) {
+      keyFile = argv[++i];
+    }
+  }
+  return { key, keyFile, usedExplicitKey: Boolean(key || keyFile) };
+}
+
+/**
+ * Map how the key was resolved into a durable operator.json pointer.
+ * Raw `--key` cannot be re-read later; persist env so the next command expects OPERATOR_PRIVATE_KEY.
+ *
+ * @param {{ source: string, keyFilePath?: string|null }} opts
+ * @returns {{ type: 'env'|'keyFile', value: string }}
+ */
+export function keyPointerFromSource(opts) {
+  const source = opts.source ?? "";
+  if (source.startsWith("--key-file ")) {
+    return { type: "keyFile", value: source.slice("--key-file ".length) };
+  }
+  if (source.startsWith("profile keyFile ")) {
+    return { type: "keyFile", value: source.slice("profile keyFile ".length) };
+  }
+  if (opts.keyFilePath) {
+    return { type: "keyFile", value: opts.keyFilePath };
+  }
+  if (source.startsWith("profile env ")) {
+    return { type: "env", value: source.slice("profile env ".length) };
+  }
+  return { type: "env", value: "OPERATOR_PRIVATE_KEY" };
+}
+
+/**
+ * Resolve the operator signing key with Anvil guard.
+ *
+ * Precedence: --key > --key-file > OPERATOR_PRIVATE_KEY > profile keyFile > profile env > Anvil (local only).
+ *
+ * @param {string[]} argv
+ * @param {{ home?: string, env?: NodeJS.ProcessEnv, rpc?: string, requireRegistry?: boolean }} [opts]
+ * @returns {{ key: `0x${string}`, address: string, source: string, keyPointer: { type: string, value: string }, network: object }}
+ */
+export function resolveOperatorKey(argv = [], opts = {}) {
+  const env = opts.env ?? process.env;
+  const network = resolveNetwork(argv, { home: opts.home, env });
+  const rpc = opts.rpc ?? network.rpc;
+  const flags = parseKeyFlags(argv);
+  const operator = loadOperator(opts.home ?? network.home);
+  const requireRegistry = opts.requireRegistry !== false;
+
+  let key = null;
+  let source = null;
+  let keyFilePath = null;
+
+  if (flags.key) {
+    key = normalizePrivateKey(flags.key);
+    source = "--key";
+  } else if (flags.keyFile || network.keyFile) {
+    const path = flags.keyFile || network.keyFile;
+    if (!existsSync(path)) {
+      throw new Error(`Key file not found: ${path}`);
+    }
+    key = normalizePrivateKey(readFileSync(path, "utf8").split(/\r?\n/)[0]);
+    keyFilePath = path;
+    source = `--key-file ${path}`;
+  } else if (env.OPERATOR_PRIVATE_KEY) {
+    key = normalizePrivateKey(env.OPERATOR_PRIVATE_KEY);
+    source = "OPERATOR_PRIVATE_KEY";
+  } else if (operator?.key?.type === "keyFile" && operator.key.value) {
+    const path = operator.key.value;
+    if (!existsSync(path)) {
+      throw new Error(`Profile keyFile not found: ${path}`);
+    }
+    key = normalizePrivateKey(readFileSync(path, "utf8").split(/\r?\n/)[0]);
+    keyFilePath = path;
+    source = `profile keyFile ${path}`;
+  } else if (operator?.key?.type === "env" && operator.key.value && env[operator.key.value]) {
+    key = normalizePrivateKey(env[operator.key.value]);
+    source = `profile env ${operator.key.value}`;
+  }
+
+  const local = isLocalRpc(rpc);
+
+  if (!key) {
+    if (local) {
+      key = normalizePrivateKey(ANVIL_DEFAULT_PRIVATE_KEY);
+      source = "anvil-default (local RPC)";
+    } else {
+      throw new Error(
+        "Operator private key required for non-local RPC. Set OPERATOR_PRIVATE_KEY, " +
+          "pass --key / --key-file, or configure ~/.clanker/operator.json key pointer. " +
+          "Anvil account #0 is not used on public networks.",
+      );
+    }
+  }
+
+  if (!local && isAnvilDefaultKey(key)) {
+    throw new Error(
+      "Refusing Anvil account #0 key on a non-local RPC. " +
+        "Use a real OPERATOR_PRIVATE_KEY / --key for Sepolia (or any public chain).",
+    );
+  }
+
+  if (requireRegistry && (!network.registry || !/^0x[0-9a-fA-F]{40}$/.test(network.registry))) {
+    throw new Error(
+      "REGISTRY_ADDRESS or --registry is required (0x + 40 hex). " +
+        "Run `clanker init --preset sepolia` or set registry after `clanker chain deploy`.",
+    );
+  }
+
+  const account = privateKeyToAccount(key);
+  const keyPointer = keyPointerFromSource({ source, keyFilePath });
+  return {
+    key,
+    address: account.address,
+    source,
+    keyPointer,
+    network: { ...network, rpc },
+  };
+}
+
+/**
+ * Like resolveOperatorKey but for read-only commands that may not need a key
+ * (e.g. whoami can use --address). Still resolves network.
+ */
+export function resolveForRead(argv = [], opts = {}) {
+  const network = resolveNetwork(argv, opts);
+  if (!network.registry || !/^0x[0-9a-fA-F]{40}$/.test(network.registry)) {
+    throw new Error(
+      "REGISTRY_ADDRESS or --registry is required (0x + 40 hex). " +
+        "Run `clanker init --preset sepolia` or `clanker setup`, or set registry after deploy.",
+    );
+  }
+  return network;
+}
+
+/**
+ * Resolve address for read-only commands.
+ * Order: --address > signing key > operator.json owner > error (point at setup).
+ *
+ * @param {string[]} argv
+ * @param {{ home?: string, env?: NodeJS.ProcessEnv }} [opts]
+ * @returns {{ address: string, source: string, network: object }}
+ */
+export function resolveReadIdentity(argv = [], opts = {}) {
+  const network = resolveForRead(argv, opts);
+  const home = opts.home ?? network.home;
+
+  let addressFlag = null;
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === "--address" && argv[i + 1] && !argv[i + 1].startsWith("--")) {
+      addressFlag = argv[++i];
+    }
+  }
+  if (addressFlag) {
+    return {
+      address: getAddress(addressFlag),
+      source: "--address",
+      network,
+    };
+  }
+
+  try {
+    const resolved = resolveOperatorKey(argv, { ...opts, home });
+    return {
+      address: resolved.address,
+      source: resolved.source,
+      network: resolved.network,
+    };
+  } catch (err) {
+    const msg = err?.message ?? String(err);
+    if (!/private key required|Anvil account #0|Key file not found|Profile keyFile/i.test(msg)) {
+      throw err;
+    }
+  }
+
+  const operator = loadOperator(home);
+  if (operator?.owner && /^0x[0-9a-fA-F]{40}$/.test(operator.owner)) {
+    return {
+      address: getAddress(operator.owner),
+      source: "profile owner",
+      network,
+    };
+  }
+
+  throw new Error(
+    "No operator identity configured. Run `clanker setup`, pass --address 0x…, " +
+      "or set a signing key (OPERATOR_PRIVATE_KEY / --key-file / operator.json key pointer).",
+  );
+}

package/lib/setup-detect.mjs

@@ -0,0 +1,136 @@
+/**
+ * Local identity hints for `clanker setup` (no secrets printed).
+ */
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { privateKeyToAccount } from "viem/accounts";
+import {
+  ANVIL_DEFAULT_ADDRESS,
+  clankerHome,
+  loadConfig,
+  loadOperator,
+  openclawKeysDir,
+} from "./profile.mjs";
+import { normalizePrivateKey } from "./resolve.mjs";
+
+/** Faster Sepolia log floor for public RPC (registry floor remains SEPOLIA_FROM_BLOCK). */
+export const SEPOLIA_FAST_FROM_BLOCK = 46_000_000n;
+
+/**
+ * Parse `cast wallet list` stdout into account names.
+ * @param {string} stdout
+ * @returns {string[]}
+ */
+export function parseCastWalletList(stdout) {
+  const names = [];
+  for (const line of String(stdout ?? "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    // Formats: "name (Local)" or "0xname (Local)" or just "name"
+    const m = trimmed.match(/^(\S+)/);
+    if (!m) continue;
+    let name = m[1];
+    if (name.startsWith("0x") && name.length > 2 && !/^0x[a-fA-F0-9]{40}$/.test(name)) {
+      // cast sometimes prefixes 0x to the account name display
+      name = name.slice(2);
+    }
+    if (/^0x[a-fA-F0-9]{40}$/.test(name)) continue;
+    names.push(name);
+  }
+  return [...new Set(names)];
+}
+
+/**
+ * @param {{ castBin?: string, spawn?: typeof spawnSync }} [opts]
+ * @returns {{ available: boolean, accounts: string[] }}
+ */
+export function listFoundryAccounts(opts = {}) {
+  const spawn = opts.spawn ?? spawnSync;
+  const castBin = opts.castBin ?? "cast";
+  const result = spawn(castBin, ["wallet", "list"], {
+    encoding: "utf8",
+    shell: false,
+  });
+  if (result.error || result.status !== 0) {
+    return { available: false, accounts: [] };
+  }
+  return { available: true, accounts: parseCastWalletList(result.stdout ?? "") };
+}
+
+/**
+ * Bot key basenames under ~/.openclaw/keys (context only).
+ * @param {{ openclawDir?: string }} [opts]
+ * @returns {string[]}
+ */
+export function listOpenclawBotKeys(opts = {}) {
+  const dir = opts.openclawDir ?? openclawKeysDir();
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((f) => f.endsWith(".key"))
+    .map((f) => basename(f, ".key"))
+    .sort();
+}
+
+/**
+ * Derive address from a key file (first line). Does not log the key.
+ * @param {string} path
+ * @returns {string}
+ */
+export function addressFromKeyFile(path) {
+  if (!existsSync(path)) throw new Error(`Key file not found: ${path}`);
+  const key = normalizePrivateKey(readFileSync(path, "utf8").split(/\r?\n/)[0]);
+  return privateKeyToAccount(key).address;
+}
+
+/**
+ * Derive address from OPERATOR_PRIVATE_KEY (or named env).
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {string} [envName]
+ * @returns {string|null}
+ */
+export function addressFromEnv(env = process.env, envName = "OPERATOR_PRIVATE_KEY") {
+  const raw = env[envName];
+  if (!raw) return null;
+  const key = normalizePrivateKey(raw);
+  return privateKeyToAccount(key).address;
+}
+
+/**
+ * Snapshot of local hints for setup UX.
+ * @param {{ home?: string, env?: NodeJS.ProcessEnv, openclawDir?: string, castBin?: string, spawn?: typeof spawnSync }} [opts]
+ */
+export function detectSetupHints(opts = {}) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? clankerHome(env);
+  const config = loadConfig(home);
+  const operator = loadOperator(home);
+  const foundry = listFoundryAccounts({
+    castBin: opts.castBin,
+    spawn: opts.spawn,
+  });
+  const openclawBots = listOpenclawBotKeys({ openclawDir: opts.openclawDir });
+  let envAddress = null;
+  try {
+    envAddress = addressFromEnv(env);
+  } catch {
+    envAddress = null;
+  }
+
+  return {
+    home,
+    configPath: join(home, "config.json"),
+    operatorPath: join(home, "operator.json"),
+    hasConfig: Boolean(config),
+    hasOperator: Boolean(operator),
+    config,
+    operator,
+    hasOperatorPrivateKeyEnv: Boolean(env.OPERATOR_PRIVATE_KEY),
+    envAddress,
+    foundryAvailable: foundry.available,
+    foundryAccounts: foundry.accounts,
+    openclawBots,
+    anvilDefaultAddress: ANVIL_DEFAULT_ADDRESS,
+  };
+}