@heyamiko/amiko-cli 0.9.9-beta.5 → 0.9.9-beta.7

package/README.md

@@ -1,4 +1,4 @@
-# @heyamiko/amiko-cli (v0.9.7)
+# @heyamiko/amiko-cli (v0.9.9-beta.7)
 
 Manage wallets, credits, swaps, MPP marketplace services, and your Amiko twin (identity, documents, voice, avatar, friends, feed, Composio apps) from the terminal. Works for both human users and AI agents running on OpenClaw.
 
@@ -392,6 +392,32 @@ npm publish
 
 ## Changelog
 
+### 0.9.9-beta.7
+
+- `amiko friends list` table now shows the friend's `User.id` as the primary `USER ID` column (what `friends reports request`, `matches`, etc. all need) and surfaces `friendship_id` as a separate `FRIENDSHIP` column (used by `friends accept/remove`). Mirrors how amiko-web's UI separates the two ids: person actions take `actor.id`, row actions take `friendship_id`. JSON output unchanged. Fixes a 404 from `/api/internal/friend-reports/regenerate` when an agent fed the friendship row id back as `--id` for a paid report.
+
+### 0.9.9-beta.6
+
+- Code-review followups across `friends`, `image`, `memory`, and the friend-report payment lib: explicit allowlists for `--size`/`--quality`/`--format`/`--background` on `markets image` (rejects unknown values before charging), `auto` quality maps to `high` for billing so we never under-bill, `memory` uses `lstatSync` + `path.relative` to skip symlinks and stop relying on string `startsWith` for sandboxing, and the friends-report transfer body now sets `chain: "solana"` explicitly.
+
+### 0.9.9-beta.5
+
+- `amiko friends reports request --pay` — pays the AMIKO friend-report fee from the agent's Crossmint-custodied Solana wallet (no keys held in CLI). Two-step flow: `amiko-web /transfer` signs the AMIKO charge to treasury, then `mpp-service /v1/friend-reports/generate` is called with `X-Payment-Tx`. Confirm prompt shows the exact AMIKO amount quoted from the live spot price.
+- `--json` output for friends-report includes `txHash` + `amikoAmount` payment metadata.
+- `did:privy:` prefix is stripped from user ids before the mpp call so amiko-web's `User` table lookup matches.
+- `markets image` pricing is now dynamic: charges OpenAI pass-through × 1.30 markup per model/quality/size, quoted in AMIKO from live `AMIKO/USD`. Confirm prompt shows the exact amount before any transfer.
+- Imports `Mppx` + Solana helpers from `@solana/mpp/client` subpath (root barrel only re-exports `charge`).
+
+### 0.9.9-beta.1 → 0.9.9-beta.4
+
+- `amiko memory add | list | search | rm | status | sync` — manage the twin's persistent memory store from the CLI.
+- `memory sync` now also walks `<workspace>/memory/` so memory written next to your project files gets picked up.
+- `SKILL.md` documents the memory commands and biases agents toward calling `memory search` before falling back to other context-discovery flows.
+
+### 0.9.8
+
+- `SKILL.md` defaults `platform=Amiko` and steers agents away from `sessions_*` lookups.
+
 ### 0.9.7
 
 - `composio connect` is now idempotent by default. Previously the CLI sent `forceReconnect: true` whenever `--force` was omitted, which caused every status probe to tear down the active Composio connection. The new default is `forceReconnect: false`: if the toolkit is already connected, the call returns `{ alreadyConnected: true }` without touching the connection. Pass `--force` explicitly to opt into a destructive reconnect.

package/dist/index.js

@@ -26283,8 +26283,29 @@ function registerImageCommand(program2) {
       console.error(error(`Unknown model "${opts.model}". Supported: ${SUPPORTED_MODELS.join(", ")}.`));
       process.exit(1);
     }
+    const ALLOWED_SIZES = ["1024x1024", "1024x1536", "1536x1024"];
+    const ALLOWED_QUALITIES = ["low", "medium", "high", "auto"];
+    const ALLOWED_FORMATS = ["png", "webp", "jpeg"];
+    const ALLOWED_BACKGROUNDS = ["transparent", "opaque", "auto"];
+    if (!ALLOWED_SIZES.includes(opts.size)) {
+      console.error(error(`Unknown --size "${opts.size}". Allowed: ${ALLOWED_SIZES.join(", ")}.`));
+      process.exit(1);
+    }
+    if (!ALLOWED_QUALITIES.includes(opts.quality)) {
+      console.error(error(`Unknown --quality "${opts.quality}". Allowed: ${ALLOWED_QUALITIES.join(", ")}.`));
+      process.exit(1);
+    }
+    if (opts.format && !ALLOWED_FORMATS.includes(opts.format)) {
+      console.error(error(`Unknown --format "${opts.format}". Allowed: ${ALLOWED_FORMATS.join(", ")}.`));
+      process.exit(1);
+    }
+    if (opts.background && !ALLOWED_BACKGROUNDS.includes(opts.background)) {
+      console.error(error(`Unknown --background "${opts.background}". Allowed: ${ALLOWED_BACKGROUNDS.join(", ")}.`));
+      process.exit(1);
+    }
+    const billedQuality = opts.quality === "auto" ? "high" : opts.quality;
     const n = Math.max(1, Math.min(Math.floor(Number(opts.n) || 1), 4));
-    const usdCost = computeImageUsd(opts.model, opts.quality, opts.size, n);
+    const usdCost = computeImageUsd(opts.model, billedQuality, opts.size, n);
     let auth;
     try {
       auth = requireAuth();
@@ -27372,6 +27393,17 @@ function registerAvatarCommand(program2) {
 // src/lib/mpp-friend-report.ts
 var AMIKO_TREASURY = "FPiZAf3jEnNfCwfvbv46jdPfHbmSepD4Q6iHiLJDQXvb";
 var PRICE_USD = "0.10";
+async function quoteFriendReport(auth) {
+  const amikoUsd = await getTokenUsdPrice(auth, "AMIKO");
+  if (!amikoUsd || amikoUsd <= 0) {
+    return { error: "Failed to fetch AMIKO/USD price" };
+  }
+  return {
+    amikoAmount: (Number(PRICE_USD) / amikoUsd).toFixed(6),
+    amikoUsd,
+    usdAnchor: PRICE_USD
+  };
+}
 async function mppFriendReportGenerate(auth, body, opts = {}) {
   const config2 = loadConfig();
   const mppBase2 = config2.apiBase.replace(/\/$/, "");
@@ -27407,7 +27439,8 @@ async function mppFriendReportGenerate(auth, body, opts = {}) {
       body: {
         to: AMIKO_TREASURY,
         amount: amikoAmount,
-        token: "AMIKO"
+        token: "AMIKO",
+        chain: "solana"
       }
     });
     const candidate = transferData.txHash ?? transferData.tx_hash ?? transferData.signature;
@@ -27480,8 +27513,10 @@ async function runPaidRegenerate(args) {
     console.error(error("Paid regenerate requires your user id. Add 'amikoUserId' to your .amiko.json (alongside amikoTwinToken/amikoTwinId)."));
     process.exit(1);
   }
+  const quote = await quoteFriendReport(auth);
+  const priceLine = "error" in quote ? "(price oracle down — actual amount computed at server)" : `${quote.amikoAmount} AMIKO ≈ $${quote.usdAnchor} (1 AMIKO = $${quote.amikoUsd.toFixed(4)})`;
   await confirmDestructive({
-    action: `Pay AMIKO to regenerate a ${args.type} matching report with user ${args.id} (~$0.10 USD-equivalent in AMIKO; signed by your agent's wallet via amiko-web)`,
+    action: `Pay ${priceLine} to regenerate a ${args.type} matching report with user ${args.id} (signed by your agent's wallet via amiko-web)`,
     yes: args.yes,
     commandExample: `amiko friends reports request --id ${args.id} --type ${args.type} --pay`
   });
@@ -27561,12 +27596,20 @@ function registerFriendsCommand(program2) {
         }
         console.log(heading(`Friends (${items.length})`));
         const rows = [
-          [dim("ID"), dim("NAME"), dim("HANDLE"), dim("TYPE"), dim("SINCE")],
+          [
+            dim("USER ID"),
+            dim("NAME"),
+            dim("HANDLE"),
+            dim("TYPE"),
+            dim("FRIENDSHIP"),
+            dim("SINCE")
+          ],
           ...items.map((f) => [
-            f.friendship_id,
+            f.friend.id,
             f.friend.name ?? "-",
             f.friend.handle ?? "-",
             f.friend.type,
+            f.friendship_id,
             f.since?.slice(0, 10) ?? "-"
           ])
         ];
@@ -27671,6 +27714,7 @@ Accept with: amiko friends accept <friendshipId>`));
   const reports = program2.command("reports").description("Friend matching reports");
   reports.command("list").description("List friend matching reports").option("--page <n>", "Page number", "1").option("--limit <n>", "Page size (1-50)", "20").option("--json", "Output as JSON").action(async (opts) => {
     const auth = resolveAuth();
+    const meId = (auth.userId ?? "").replace(/^did:privy:/, "");
     const spinner = opts.json ? null : ora("Loading reports...").start();
     try {
       const data = await amikoWebFetch(auth, "/api/friends/reports", {
@@ -27694,7 +27738,7 @@ Accept with: amiko friends accept <friendshipId>`));
             dim("CREATED")
           ],
           ...items.map((r) => {
-            const other = r.respondent ?? r.initiator;
+            const other = r.initiator?.id === meId ? r.respondent : r.respondent?.id === meId ? r.initiator : r.respondent ?? r.initiator;
             return [
               r.id,
               r.report_type ?? "-",
@@ -27715,6 +27759,7 @@ Accept with: amiko friends accept <friendshipId>`));
   });
   reports.command("view <id>").description("View a friend matching report").option("--json", "Output as JSON").action(async (id, opts) => {
     const auth = resolveAuth();
+    const meId = (auth.userId ?? "").replace(/^did:privy:/, "");
     const spinner = opts.json ? null : ora("Loading report...").start();
     try {
       const data = await amikoWebFetch(auth, `/api/friends/reports/${encodeURIComponent(id)}`);
@@ -27726,7 +27771,7 @@ Accept with: amiko friends accept <friendshipId>`));
           console.log(label("Type", r.report_type));
         if (r.status)
           console.log(label("Status", r.status));
-        const other = r.respondent ?? r.initiator;
+        const other = r.initiator?.id === meId ? r.respondent : r.respondent?.id === meId ? r.initiator : r.respondent ?? r.initiator;
         if (other)
           console.log(label("With", other.name ?? other.handle ?? other.id));
         if (r.created_at)
@@ -28599,8 +28644,12 @@ function registerNotificationsCommand(program2) {
 }
 
 // src/commands/memory.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { dirname, isAbsolute, normalize, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, lstatSync, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { dirname, isAbsolute, normalize, relative, resolve as resolve2 } from "node:path";
+function isInsideRoot(abs, root) {
+  const rel = relative(root, abs);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
 var VALID_CATEGORIES = ["fact", "preference", "pattern", "decision", "context"];
 var VALID_SOURCES = ["chat", "file", "manual"];
 var DEFAULT_WORKSPACE = "/data/.openclaw/workspace";
@@ -28878,7 +28927,7 @@ function collectMemoryFiles(root, indexPaths, memoryDir) {
       if (isExternal(ref))
         continue;
       const abs = normalize(isAbsolute(ref) ? ref : resolve2(indexDir, ref));
-      if (!abs.startsWith(root)) {
+      if (!isInsideRoot(abs, root)) {
         errors3.push(`Skipping ${ref}: outside workspace ${root}`);
         continue;
       }
@@ -28886,7 +28935,11 @@ function collectMemoryFiles(root, indexPaths, memoryDir) {
         errors3.push(`Referenced file missing: ${ref}`);
         continue;
       }
-      const st = statSync(abs);
+      const st = lstatSync(abs);
+      if (st.isSymbolicLink()) {
+        errors3.push(`Skipping ${ref}: symlinks not followed`);
+        continue;
+      }
       if (!st.isFile())
         continue;
       const content = safeRead(abs, errors3);
@@ -28918,10 +28971,12 @@ function walkMarkdown(dir, errors3) {
     const abs = resolve2(dir, name);
     let st;
     try {
-      st = statSync(abs);
+      st = lstatSync(abs);
     } catch {
       continue;
     }
+    if (st.isSymbolicLink())
+      continue;
     if (st.isDirectory()) {
       out.push(...walkMarkdown(abs, errors3));
     } else if (st.isFile() && name.toLowerCase().endsWith(".md")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyamiko/amiko-cli",
-  "version": "0.9.9-beta.5",
+  "version": "0.9.9-beta.7",
   "description": "Amiko CLI — swap tokens, manage credits, bridge cross-chain, and call marketplace agents",
   "type": "module",
   "bin": {