@dev.sail.money/sailor 1.3.0-208 → 1.3.0-210

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev.sail.money/sailor",
-  "version": "1.3.0-208",
+  "version": "1.3.0-210",
   "description": "Operator toolkit for Sail Protocol",
   "bin": {
     "sailor": "packages/cli/dist/index.cjs"

package/packages/cli/dist/index.cjs

@@ -41240,9 +41240,124 @@ async function keysShow() {
 
 // src/commands/mandate-contracts.ts
 var import_node_child_process = require("node:child_process");
+var import_node_fs14 = require("node:fs");
+var import_node_path12 = require("node:path");
+init_esm2();
+
+// src/lib/permission-explainer.ts
 var import_node_fs13 = require("node:fs");
 var import_node_path11 = require("node:path");
-init_esm2();
+function explainPermission(name, sourcePath) {
+  const resolved = sourcePath ?? (0, import_node_path11.join)(process.cwd(), "mandates", `${name}.sol`);
+  let src;
+  try {
+    src = (0, import_node_fs13.readFileSync)(resolved, "utf8");
+  } catch {
+    return null;
+  }
+  return parseStructured(src) ?? parseNatSpec(src) ?? parseRequires(src);
+}
+var ENFORCED_HEADER = /ENFORCE[SD]\s+ON-CHAIN/i;
+var NOT_ENFORCED_HEADER = /NOT\s+(ENFORCED|BOUNDED)/i;
+function parseStructured(src) {
+  if (!ENFORCED_HEADER.test(src)) return null;
+  const lines = src.split("\n");
+  const result = {
+    source: "structured",
+    enforced: [],
+    notEnforced: []
+  };
+  const headerLines = [];
+  for (const line of lines) {
+    const t = line.trim();
+    if (t.startsWith("import ") || t.startsWith("contract ") || t.startsWith("abstract contract ")) break;
+    if (t.startsWith("//")) headerLines.push(t.slice(2));
+  }
+  let section = null;
+  for (const raw of headerLines) {
+    const trimmed = raw.trim();
+    if (/^─+$/.test(trimmed)) continue;
+    if (NOT_ENFORCED_HEADER.test(trimmed)) {
+      section = "notEnforced";
+      continue;
+    }
+    if (ENFORCED_HEADER.test(trimmed)) {
+      section = "enforced";
+      continue;
+    }
+    if (trimmed.includes("VERIFY BEFORE USE")) {
+      section = null;
+      continue;
+    }
+    if (section === null) {
+      const kv = trimmed.match(/^(Protocol|Version|Chain|Target)\s*:\s*(.+)$/i);
+      if (kv) {
+        const key = kv[1].toLowerCase();
+        result[key] = kv[2].trim();
+      }
+    }
+    if (section && trimmed.startsWith("\u2022")) {
+      const bullet = trimmed.slice(1).trim();
+      if (bullet) result[section].push(bullet);
+    }
+  }
+  if (result.enforced.length === 0 && !result.protocol) return null;
+  return result;
+}
+function parseNatSpec(src) {
+  const enforced = [];
+  const notEnforced = [];
+  let current = null;
+  let buf = [];
+  const flush = () => {
+    if (current && buf.length) {
+      const text = buf.join(" ").replace(/\s+/g, " ").trim();
+      if (text) (current === "enforced" ? enforced : notEnforced).push(text);
+    }
+    buf = [];
+  };
+  for (const line of src.split("\n")) {
+    const t = line.trim();
+    const tagged = t.match(/^\/\/\/\s*@(\w+)\s+(.+)$/);
+    if (tagged) {
+      const [, tag, text] = tagged;
+      if (tag === "notice") {
+        flush();
+        current = "enforced";
+        buf.push(text.trim());
+      } else if (tag === "dev") {
+        flush();
+        current = "notEnforced";
+        buf.push(text.trim());
+      } else {
+        flush();
+        current = null;
+      }
+      continue;
+    }
+    const cont = t.match(/^\/\/\/\s?(.*)$/);
+    if (cont && current) {
+      const text = cont[1].trim();
+      if (text) buf.push(text);
+      continue;
+    }
+    if (!t.startsWith("///")) {
+      flush();
+      current = null;
+    }
+  }
+  flush();
+  if (enforced.length === 0 && notEnforced.length === 0) return null;
+  return { source: "natspec", enforced, notEnforced };
+}
+function parseRequires(src) {
+  const enforced = [];
+  const re = /require\s*\([^,)]+,\s*["']([^"']+)["']\)/g;
+  let m;
+  while ((m = re.exec(src)) !== null) enforced.push(m[1]);
+  if (enforced.length === 0) return null;
+  return { source: "require-only", enforced, notEnforced: [] };
+}
 
 // src/lib/mandates.ts
 var MandateStore = class {
@@ -41708,6 +41823,8 @@ Pushing signing request for "${template.label}" permission\u2026`));
       `  The mandate signer (${permissionSigner}) must sign in the browser \u2014 not the agent wallet.`
     )
   );
+  const permRecord = new MandateStore().find(templateAddress);
+  const permExplanation = (permRecord ? explainPermission(permRecord.name, permRecord.sourcePath) : explainPermission(template.label)) ?? void 0;
   const response = await channel.requestSignature({
     type: "typed-data",
     kind: "register-permission",
@@ -41720,6 +41837,7 @@ Pushing signing request for "${template.label}" permission\u2026`));
       { label: "Permission", value: template.label },
       { label: "Mandate signer", value: permissionSigner }
     ],
+    explanation: permExplanation,
     typedData
   });
   if (response.status === "rejected") {
@@ -41934,12 +42052,12 @@ async function runDeploy(project, channel, options) {
       )
     );
   }
-  const { abi: abi2, bytecode, contractName, artifactPath } = resolveArtifact(options);
+  const { abi: abi2, bytecode, contractName, artifactPath, sourcePath } = resolveArtifact(options);
   let argsJson;
   if (options.argsFile) {
-    const argsFilePath = (0, import_node_path11.resolve)(options.argsFile);
+    const argsFilePath = (0, import_node_path12.resolve)(options.argsFile);
     try {
-      argsJson = (0, import_node_fs13.readFileSync)(argsFilePath, "utf8").trim();
+      argsJson = (0, import_node_fs14.readFileSync)(argsFilePath, "utf8").trim();
     } catch {
       throw new Error(`Cannot read --args-file: ${argsFilePath}`);
     }
@@ -41952,6 +42070,7 @@ async function runDeploy(project, channel, options) {
   const publicClient = publicClientFor(project);
   announceSigningUrl(json);
   say(() => console.log(`Pushing deploy request for "${contractName}"\u2026`));
+  const explanation = explainPermission(contractName, sourcePath) ?? void 0;
   const response = await channel.requestSignature({
     type: "transaction",
     kind: "deploy-mandate",
@@ -41966,7 +42085,8 @@ async function runDeploy(project, channel, options) {
         label: options.argsFile ? "Constructor args (from file)" : "Constructor args",
         value: argsJson ? argsJson : "(none)"
       }
-    ]
+    ],
+    explanation
   });
   if (response.status === "rejected") {
     throw new Error(`User rejected permission deployment: ${response.reason ?? "no reason given"}`);
@@ -41986,6 +42106,7 @@ async function runDeploy(project, channel, options) {
     address: deployed,
     txHash: response.txHash,
     chainId,
+    sourcePath,
     artifactPath,
     constructorArgs: parseArgsRaw(options.args),
     deployedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -42079,9 +42200,12 @@ var CLONE_TEMPLATES = {
     ]
   }
 };
-function predictCloneAddress(impl, factory, submitter, salt) {
+function predictCloneAddress(impl, factory, submitter, account2, salt) {
   const namespacedSalt = keccak256(
-    encodeAbiParameters([{ type: "address" }, { type: "bytes32" }], [submitter, salt])
+    encodeAbiParameters(
+      [{ type: "address" }, { type: "address" }, { type: "bytes32" }],
+      [submitter, account2, salt]
+    )
   );
   const initCode = concatHex([CLONE_INIT_PREFIX, impl, CLONE_INIT_SUFFIX]);
   return getCreate2Address({
@@ -42178,7 +42302,7 @@ async function runDeployClone(project, channel, options) {
       [sma, impl, BigInt(Math.floor(Date.now() / 1e3))]
     )
   );
-  const clone = predictCloneAddress(impl, project.contracts.mandateFactory, submitter, salt);
+  const clone = predictCloneAddress(impl, project.contracts.mandateFactory, submitter, sma, salt);
   say(() => {
     console.log(`
 ${spec.label} clone (${options.template})`);
@@ -42620,6 +42744,15 @@ async function attachBatchToSma(project, channel, publicClient, sma, permissions
 Attaching ${permissions.length} permissions in one signature \u2014 the mandate signer (${permissionSigner}) signs in the browser\u2026`
     )
   );
+  const permStore = new MandateStore();
+  const permExplanations = permissions.map((addr) => {
+    const rec = permStore.find(addr);
+    return {
+      label: rec?.name ?? addr,
+      address: addr,
+      explanation: (rec ? explainPermission(rec.name, rec.sourcePath) : null) ?? void 0
+    };
+  });
   const response = await channel.requestSignature({
     type: "typed-data",
     kind: "register-permission",
@@ -42631,6 +42764,7 @@ Attaching ${permissions.length} permissions in one signature \u2014 the mandate
       { label: "Permissions", value: String(permissions.length) },
       { label: "Mandate signer", value: permissionSigner }
     ],
+    permissions: permExplanations,
     typedData
   });
   if (response.status === "rejected") {
@@ -42778,11 +42912,11 @@ function resolveArtifact(options) {
   let contractName = options.contract ?? options.name ?? "";
   if (!artifactPath) {
     if (!options.contract) throw new Error("Provide --artifact <path> or --contract <name>");
-    artifactPath = (0, import_node_path11.join)(options.out, `${options.contract}.sol`, `${options.contract}.json`);
+    artifactPath = (0, import_node_path12.join)(options.out, `${options.contract}.sol`, `${options.contract}.json`);
   }
-  const resolved = (0, import_node_path11.resolve)(artifactPath);
-  const projectRoot = (0, import_node_path11.resolve)(process.cwd());
-  if (!resolved.startsWith(projectRoot + import_node_path11.sep) && resolved !== projectRoot) {
+  const resolved = (0, import_node_path12.resolve)(artifactPath);
+  const projectRoot = (0, import_node_path12.resolve)(process.cwd());
+  if (!resolved.startsWith(projectRoot + import_node_path12.sep) && resolved !== projectRoot) {
     throw new Error(
       `Artifact path must be inside the project directory.
 Resolved: ${resolved}`
@@ -42790,14 +42924,14 @@ Resolved: ${resolved}`
   }
   artifactPath = resolved;
   if (options.build) runForgeBuild();
-  if (!(0, import_node_fs13.existsSync)(artifactPath)) {
+  if (!(0, import_node_fs14.existsSync)(artifactPath)) {
     ensureForgeHint();
     throw new Error(
       `Artifact not found: ${artifactPath}
 Compile your mandate first (e.g. \`forge build\`), or pass --build.`
     );
   }
-  const artifact = JSON.parse((0, import_node_fs13.readFileSync)(artifactPath, "utf8"));
+  const artifact = JSON.parse((0, import_node_fs14.readFileSync)(artifactPath, "utf8"));
   const abi2 = artifact.abi;
   const bytecodeRaw = artifact.bytecode?.object ?? artifact.bytecode;
   if (!bytecodeRaw || typeof bytecodeRaw !== "string") {
@@ -42808,7 +42942,16 @@ Compile your mandate first (e.g. \`forge build\`), or pass --build.`
     const m = artifactPath.match(/([^/\\]+)\.json$/);
     contractName = m ? m[1] : "Mandate";
   }
-  return { abi: abi2, bytecode, contractName, artifactPath };
+  let sourcePath;
+  const compilationTarget = artifact.metadata?.settings?.compilationTarget;
+  if (compilationTarget && typeof compilationTarget === "object") {
+    sourcePath = Object.keys(compilationTarget)[0];
+  }
+  sourcePath = sourcePath ?? artifact.ast?.absolutePath;
+  if (sourcePath && !sourcePath.startsWith("/")) {
+    sourcePath = (0, import_node_path12.resolve)(projectRoot, sourcePath);
+  }
+  return { abi: abi2, bytecode, contractName, artifactPath, sourcePath };
 }
 function parseArgsRaw(argsJson) {
   if (!argsJson) return void 0;
@@ -42878,88 +43021,6 @@ function runForgeBuild() {
 
 // src/commands/mandate.ts
 init_esm2();
-
-// src/lib/permission-explainer.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path12 = require("node:path");
-function explainPermission(name, sourcePath) {
-  const resolved = sourcePath ?? (0, import_node_path12.join)(process.cwd(), "mandates", `${name}.sol`);
-  let src;
-  try {
-    src = (0, import_node_fs14.readFileSync)(resolved, "utf8");
-  } catch {
-    return null;
-  }
-  return parseStructured(src) ?? parseNatSpec(src) ?? parseRequires(src);
-}
-function parseStructured(src) {
-  if (!src.includes("ENFORCED ON-CHAIN")) return null;
-  const lines = src.split("\n");
-  const result = {
-    source: "structured",
-    enforced: [],
-    notEnforced: []
-  };
-  const headerLines = [];
-  for (const line of lines) {
-    const t = line.trim();
-    if (t.startsWith("import ") || t.startsWith("contract ") || t.startsWith("abstract contract ")) break;
-    if (t.startsWith("//")) headerLines.push(t.slice(2));
-  }
-  let section = null;
-  for (const raw of headerLines) {
-    const trimmed = raw.trim();
-    if (/^─+$/.test(trimmed)) continue;
-    if (trimmed.includes("ENFORCED ON-CHAIN")) {
-      section = "enforced";
-      continue;
-    }
-    if (trimmed.includes("NOT ENFORCED")) {
-      section = "notEnforced";
-      continue;
-    }
-    if (trimmed.includes("VERIFY BEFORE USE")) {
-      section = null;
-      continue;
-    }
-    if (section === null) {
-      const kv = trimmed.match(/^(Protocol|Version|Chain|Target)\s*:\s*(.+)$/i);
-      if (kv) {
-        const key = kv[1].toLowerCase();
-        result[key] = kv[2].trim();
-      }
-    }
-    if (section && trimmed.startsWith("\u2022")) {
-      const bullet = trimmed.slice(1).trim();
-      if (bullet) result[section].push(bullet);
-    }
-  }
-  if (result.enforced.length === 0 && !result.protocol) return null;
-  return result;
-}
-function parseNatSpec(src) {
-  const enforced = [];
-  const notEnforced = [];
-  for (const line of src.split("\n")) {
-    const t = line.trim();
-    const notice = t.match(/^\/\/\/\s*@notice\s+(.+)$/);
-    if (notice) enforced.push(notice[1].trim());
-    const dev = t.match(/^\/\/\/\s*@dev\s+(.+)$/);
-    if (dev) notEnforced.push(dev[1].trim());
-  }
-  if (enforced.length === 0 && notEnforced.length === 0) return null;
-  return { source: "natspec", enforced, notEnforced };
-}
-function parseRequires(src) {
-  const enforced = [];
-  const re = /require\s*\([^,)]+,\s*["']([^"']+)["']\)/g;
-  let m;
-  while ((m = re.exec(src)) !== null) enforced.push(m[1]);
-  if (enforced.length === 0) return null;
-  return { source: "require-only", enforced, notEnforced: [] };
-}
-
-// src/commands/mandate.ts
 function resolveActiveChain(account2) {
   try {
     const project = new ProjectContext();
@@ -43035,7 +43096,9 @@ ${permissions.length} permission(s) tracked for SMA ${account2.safe}:
   const draft = {
     account: account2.safe,
     chainId,
-    permissions: permissions.filter((p) => !p.revokedOnChain).map((p) => {
+    // Only permissions not already registered on this SMA belong in the signing
+    // draft — re-registering an already-registered permission reverts on-chain.
+    permissions: permissions.filter((p) => !p.revokedOnChain && !p.registeredOnSma).map((p) => {
       const mandate2 = store.find(p.address);
       const explanation = explainPermission(p.label, mandate2?.sourcePath) ?? void 0;
       return { address: p.address, label: p.label, explanation };
@@ -45170,9 +45233,12 @@ function tailscaleServeUp(port) {
     ["serve", "--bg", "--https=443", `http://127.0.0.1:${port}`],
     { encoding: "utf-8" }
   );
+  const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
   if (r.status !== 0) {
-    const detail = (r.stderr || r.stdout || "").trim() || `exit ${r.status ?? "?"}`;
-    throw new Error(detail);
+    throw new Error(out.trim() || `exit ${r.status ?? "?"}`);
+  }
+  if (/serve is not enabled/i.test(out)) {
+    throw new Error(out.trim());
   }
 }
 function tailscaleServeDown() {