@elytro/cli 0.6.0 → 0.6.2

package/dist/index.js

@@ -365,6 +365,12 @@ var KeyringService = class {
   vault = null;
   /** Vault key kept in memory for re-encryption operations (addOwner, switchOwner). */
   vaultKey = null;
+  /**
+   * In-memory private key buffers indexed by owner address.
+   * These are the scrubbable counterparts of VaultData.owners[].key.
+   * Zero-filled on lock().
+   */
+  keyBuffers = /* @__PURE__ */ new Map();
   constructor(store) {
     this.store = store;
   }
@@ -389,6 +395,7 @@ var KeyringService = class {
     await this.store.save(STORAGE_KEY, encrypted);
     this.vault = vault;
     this.vaultKey = new Uint8Array(vaultKey);
+    this.hydrateKeyBuffers(vault);
     return account.address;
   }
   // ─── Unlock / Access ────────────────────────────────────────────
@@ -403,9 +410,14 @@ var KeyringService = class {
     }
     this.vault = await decryptWithKey(vaultKey, encrypted);
     this.vaultKey = new Uint8Array(vaultKey);
+    this.hydrateKeyBuffers(this.vault);
   }
   /** Lock the vault, clearing decrypted keys and vault key from memory. */
   lock() {
+    for (const buf of this.keyBuffers.values()) {
+      buf.fill(0);
+    }
+    this.keyBuffers.clear();
     this.vault = null;
     if (this.vaultKey) {
       this.vaultKey.fill(0);
@@ -453,7 +465,8 @@ var KeyringService = class {
     this.ensureUnlocked();
     const privateKey = generatePrivateKey();
     const account = privateKeyToAccount(privateKey);
-    this.vault.owners.push({ id: account.address, key: privateKey });
+    this.vault.owners.push({ id: account.address, key: "" });
+    this.keyBuffers.set(account.address, hexToBytes(privateKey));
     await this.persistVault();
     return account.address;
   }
@@ -473,7 +486,7 @@ var KeyringService = class {
    */
   async exportVault(password2) {
     this.ensureUnlocked();
-    return encrypt(password2, this.vault);
+    return encrypt(password2, this.buildVaultWithKeys());
   }
   /**
    * Import vault from a password-encrypted backup.
@@ -481,10 +494,11 @@ var KeyringService = class {
    */
   async importVault(encrypted, password2, vaultKey) {
     const vault = await decrypt(password2, encrypted);
-    this.vault = vault;
     this.vaultKey = new Uint8Array(vaultKey);
     const reEncrypted = await encryptWithKey(vaultKey, vault);
     await this.store.save(STORAGE_KEY, reEncrypted);
+    this.vault = vault;
+    this.hydrateKeyBuffers(vault);
   }
   // ─── Rekey (vault key rotation) ───────────────────────────────
   async rekey(newVaultKey) {
@@ -493,15 +507,23 @@ var KeyringService = class {
     await this.persistVault();
   }
   // ─── Internal ───────────────────────────────────────────────────
+  /**
+   * Get the current owner's private key as Hex for signing.
+   *
+   * Reads from the scrubbable Uint8Array keyBuffers and converts to Hex
+   * on the fly. The returned Hex string is short-lived (used immediately
+   * by viem's privateKeyToAccount, then goes out of scope for GC).
+   */
   getCurrentKey() {
     if (!this.vault) {
       throw new Error("Keyring is locked. Cannot sign.");
     }
-    const owner = this.vault.owners.find((o) => o.id === this.vault.currentOwnerId);
-    if (!owner) {
+    const ownerId = this.vault.currentOwnerId;
+    const buf = this.keyBuffers.get(ownerId);
+    if (!buf) {
       throw new Error("Current owner key not found in vault.");
     }
-    return owner.key;
+    return `0x${Buffer.from(buf).toString("hex")}`;
   }
   ensureUnlocked() {
     if (!this.vault) {
@@ -511,10 +533,44 @@ var KeyringService = class {
   async persistVault() {
     if (!this.vault) throw new Error("No vault to persist.");
     if (!this.vaultKey) throw new Error("No vault key available for re-encryption.");
-    const encrypted = await encryptWithKey(this.vaultKey, this.vault);
+    const encrypted = await encryptWithKey(this.vaultKey, this.buildVaultWithKeys());
     await this.store.save(STORAGE_KEY, encrypted);
   }
+  /**
+   * Reconstruct a complete VaultData with hex keys sourced from keyBuffers.
+   * Used by persistVault and exportVault — the live this.vault has keys scrubbed.
+   */
+  buildVaultWithKeys() {
+    return {
+      ...this.vault,
+      owners: this.vault.owners.map((owner) => {
+        const buf = this.keyBuffers.get(owner.id);
+        if (!buf) throw new Error(`Key buffer missing for owner ${owner.id}`);
+        return { ...owner, key: `0x${Buffer.from(buf).toString("hex")}` };
+      })
+    };
+  }
+  /**
+   * Convert vault owner hex keys into scrubbable Uint8Array buffers,
+   * then scrub the hex strings from the in-memory vault so the sole live
+   * copy of each private key is the zero-fillable Uint8Array in keyBuffers.
+   * Called after decryption (unlock, createNewOwner, importVault).
+   */
+  hydrateKeyBuffers(vault) {
+    for (const buf of this.keyBuffers.values()) {
+      buf.fill(0);
+    }
+    this.keyBuffers.clear();
+    for (const owner of vault.owners) {
+      this.keyBuffers.set(owner.id, hexToBytes(owner.key));
+      owner.key = "";
+    }
+  }
 };
+function hexToBytes(hex) {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  return new Uint8Array(Buffer.from(clean, "hex"));
+}
 
 // src/utils/config.ts
 var PUBLIC_RPC = {
@@ -635,19 +691,55 @@ var ChainService = class {
   store;
   config;
   userKeys = {};
+  /** Vault key for encrypting/decrypting user keys. null = vault not yet unlocked. */
+  vaultKey = null;
   constructor(store) {
     this.store = store;
     this.config = getDefaultConfig();
   }
-  /** Load persisted config and user keys, rebuild chain endpoints. */
+  /**
+   * Load persisted config (non-sensitive).
+   * User keys are NOT loaded here — call `unlockUserKeys()` after the
+   * vault key becomes available.
+   */
   async init() {
-    this.userKeys = await this.store.load(USER_KEYS_KEY) ?? {};
     const saved = await this.store.load(STORAGE_KEY2);
     if (saved) {
       this.config = { ...getDefaultConfig(), ...saved };
     }
+    this.config.chains = buildChains(void 0, void 0);
+  }
+  /**
+   * Decrypt (or migrate) user API keys using the vault key.
+   * Call this after the vault key is available (post keyring.unlock).
+   *
+   * - If user-keys.json is encrypted (has `version` field): decrypt with vault key.
+   * - If user-keys.json is plaintext (legacy): load, encrypt, overwrite.
+   * - If user-keys.json is absent: no-op.
+   */
+  async unlockUserKeys(vaultKey) {
+    this.vaultKey = new Uint8Array(vaultKey);
+    const raw = await this.store.load(USER_KEYS_KEY);
+    if (!raw) {
+      this.config.chains = buildChains(void 0, void 0);
+      return;
+    }
+    if (isEncryptedData(raw)) {
+      this.userKeys = await decryptWithKey(vaultKey, raw);
+    } else {
+      this.userKeys = raw;
+      await this.persistUserKeys();
+    }
     this.config.chains = buildChains(this.userKeys.alchemyKey, this.userKeys.pimlicoKey);
   }
+  /** Clear vault key and plaintext user keys from memory. Called on CLI exit. */
+  lockUserKeys() {
+    if (this.vaultKey) {
+      this.vaultKey.fill(0);
+      this.vaultKey = null;
+    }
+    this.userKeys = {};
+  }
   // ─── User Keys ──────────────────────────────────────────────────
   /** Get current user keys (for display — values are masked). */
   getUserKeys() {
@@ -656,13 +748,13 @@ var ChainService = class {
   /** Set a user API key and rebuild chain endpoints. */
   async setUserKey(key, value) {
     this.userKeys[key] = value;
-    await this.store.save(USER_KEYS_KEY, this.userKeys);
+    await this.persistUserKeys();
     this.config.chains = buildChains(this.userKeys.alchemyKey, this.userKeys.pimlicoKey);
   }
   /** Remove a user API key and fall back to env / public endpoints. */
   async removeUserKey(key) {
     delete this.userKeys[key];
-    await this.store.save(USER_KEYS_KEY, this.userKeys);
+    await this.persistUserKeys();
     this.config.chains = buildChains(this.userKeys.alchemyKey, this.userKeys.pimlicoKey);
   }
   // ─── Getters ────────────────────────────────────────────────────
@@ -713,7 +805,29 @@ var ChainService = class {
   async persist() {
     await this.store.save(STORAGE_KEY2, this.config);
   }
+  /**
+   * Persist user keys — encrypted if vault key is available, plaintext otherwise.
+   * The plaintext path only applies before `elytro init` (no vault key yet).
+   */
+  async persistUserKeys() {
+    const hasKeys = this.userKeys.alchemyKey || this.userKeys.pimlicoKey;
+    if (!hasKeys) {
+      await this.store.remove(USER_KEYS_KEY);
+      return;
+    }
+    if (this.vaultKey) {
+      const encrypted = await encryptWithKey(this.vaultKey, this.userKeys);
+      await this.store.save(USER_KEYS_KEY, encrypted);
+    } else {
+      await this.store.save(USER_KEYS_KEY, this.userKeys);
+    }
+  }
 };
+function isEncryptedData(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const o = obj;
+  return typeof o.data === "string" && typeof o.iv === "string" && typeof o.version === "number";
+}
 
 // src/services/sdk.ts
 import { padHex, createPublicClient, http, toHex as toHex2, parseEther } from "viem";
@@ -2440,7 +2554,11 @@ or import a backup with \`elytro import\`.`
 The vault key may not match the encrypted keyring. Re-run \`elytro init\` or import a backup.`
       );
     }
+    await chain.unlockUserKeys(vaultKey);
     vaultKey.fill(0);
+    const unlockedChain = chain.currentChain;
+    walletClient.initForChain(unlockedChain);
+    await sdk.initForChain(unlockedChain);
   }
   const account = new AccountService({
     store,
@@ -2452,7 +2570,9 @@ The vault key may not match the encrypted keyring. Re-run \`elytro init\` or imp
   await account.init();
   const currentAccount = account.currentAccount;
   if (currentAccount) {
-    const acctInfo = account.resolveAccount(currentAccount.alias ?? currentAccount.address);
+    const acctInfo = account.resolveAccount(
+      currentAccount.alias ?? currentAccount.address
+    );
     if (acctInfo) {
       const acctChain = chain.chains.find((c) => c.id === acctInfo.chainId);
       if (acctChain && acctChain.id !== defaultChain.id) {
@@ -2461,7 +2581,15 @@ The vault key may not match the encrypted keyring. Re-run \`elytro init\` or imp
       }
     }
   }
-  return { store, keyring, chain, sdk, walletClient, account, secretProvider: loadProvider };
+  return {
+    store,
+    keyring,
+    chain,
+    sdk,
+    walletClient,
+    account,
+    secretProvider: loadProvider
+  };
 }
 function noProviderHint() {
   switch (process.platform) {
@@ -2560,10 +2688,7 @@ import ora2 from "ora";
 import { formatEther as formatEther2, padHex as padHex2 } from "viem";
 
 // src/utils/prompt.ts
-import { password, confirm, select, input } from "@inquirer/prompts";
-async function askConfirm(message, defaultValue = false) {
-  return confirm({ message, default: defaultValue });
-}
+import { password, select, input } from "@inquirer/prompts";
 async function askSelect(message, choices) {
   return select({ message, choices });
 }
@@ -3272,11 +3397,6 @@ function registerTxCommand(program2, ctx) {
           estimatedGas: estimatedGas.toString()
         }
       }, null, 2));
-      const confirmed = await askConfirm("Sign and send this transaction?");
-      if (!confirmed) {
-        outputResult({ status: "cancelled" });
-        return;
-      }
       const spinner = ora3("Signing UserOperation...").start();
       let opHash;
       try {
@@ -4175,13 +4295,6 @@ function registerSecurityCommand(program2, ctx) {
       if (![1, 2, 3].includes(capabilityFlags)) {
         throw new SecurityError(ERR_INTERNAL3, "Invalid capability flags. Use 1, 2, or 3.");
       }
-      const confirmed = await askConfirm(
-        `Install SecurityHook on ${account.alias} (${address(account.address)})? Capability: ${CAPABILITY_LABELS[capabilityFlags]}, Safety Delay: ${DEFAULT_SAFETY_DELAY}s`
-      );
-      if (!confirmed) {
-        outputResult({ status: "cancelled" });
-        return;
-      }
       const installTx = encodeInstallHook(account.address, hookAddress, DEFAULT_SAFETY_DELAY, capabilityFlags);
       const buildSpinner = ora5("Building UserOp...").start();
       try {
@@ -4312,11 +4425,6 @@ async function handleForceExecute(ctx, chainConfig, account, currentStatus) {
       `Safety delay not elapsed. Available after ${currentStatus.forceUninstall.availableAfter}.`
     );
   }
-  const confirmed = await askConfirm(`Execute force uninstall on ${account.alias} (${address(account.address)})? This will remove the SecurityHook.`);
-  if (!confirmed) {
-    outputResult({ status: "cancelled" });
-    return;
-  }
   const uninstallTx = encodeUninstallHook(account.address, currentStatus.hookAddress);
   const spinner = ora5("Executing force uninstall...").start();
   try {
@@ -4338,13 +4446,6 @@ async function handleForceStart(ctx, chainConfig, account, currentStatus, hookAd
     });
     return;
   }
-  const confirmed = await askConfirm(
-    `Start force-uninstall countdown on ${account.alias} (${address(account.address)})? You must wait ${DEFAULT_SAFETY_DELAY}s before executing.`
-  );
-  if (!confirmed) {
-    outputResult({ status: "cancelled" });
-    return;
-  }
   const preUninstallTx = encodeForcePreUninstall(hookAddress);
   const spinner = ora5("Starting force-uninstall countdown...").start();
   try {
@@ -4362,11 +4463,6 @@ async function handleForceStart(ctx, chainConfig, account, currentStatus, hookAd
   }
 }
 async function handleNormalUninstall(ctx, chainConfig, account, hookService, hookAddress) {
-  const confirmed = await askConfirm(`Uninstall SecurityHook from ${account.alias} (${address(account.address)})? (requires 2FA approval)`);
-  if (!confirmed) {
-    outputResult({ status: "cancelled" });
-    return;
-  }
   const uninstallTx = encodeUninstallHook(account.address, hookAddress);
   const spinner = ora5("Building UserOp...").start();
   try {
@@ -4716,7 +4812,7 @@ import { execSync } from "child_process";
 import { createRequire } from "module";
 function resolveVersion() {
   if (true) {
-    return "0.6.0";
+    return "0.6.2";
   }
   try {
     const require2 = createRequire(import.meta.url);
@@ -4898,6 +4994,7 @@ async function main() {
     outputError(-32e3, sanitizeErrorMessage(err.message));
   } finally {
     ctx?.keyring.lock();
+    ctx?.chain.lockUserKeys();
   }
 }
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elytro/cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Elytro ERC-4337 Smart Account Wallet CLI",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.5.4",
+    "esbuild": "^0.27.4",
     "tsup": "^8.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.5.3"