@heyamiko/amiko-cli 0.9.9 → 0.10.0-beta.0

package/README.md

@@ -1,4 +1,4 @@
-# @heyamiko/amiko-cli (v0.9.9-beta.8)
+# @heyamiko/amiko-cli (v0.9.9)
 
 Manage wallets, credits, swaps, MPP marketplace services, and your Amiko twin (identity, documents, voice, avatar, friends, feed, Composio apps) from the terminal. Works for both human users and AI agents running on OpenClaw.
 
@@ -86,7 +86,7 @@ amiko credits topup 10000 --wallet Gu2b...QVya        # specific wallet (else de
 ```
 
 **Supported tokens:** AMIKO, SOL, USDC, USDT
-**Supported chains:** Solana, Base, Ethereum, Tempo
+**Supported chains:** Solana, Base, Ethereum
 
 **After every paid command, the CLI prints a `Balance: N credits (~$X.XX)` line** so agents can relay the remaining balance to the user without a separate `credits balance` call.
 
@@ -152,7 +152,7 @@ amiko wallets bridge routes                      # available bridge routes
 amiko wallets bridge limits                      # min/max limits per route
 ```
 
-Default route: Solana → Tempo. Use `--from` and `--to` flags for other chains. Like `swap send`, `bridge send` refuses to run in a non-interactive shell without `--yes` so agents must quote the Across fee + gas to the user before executing.
+Default route: Solana → Base. Use `--from` and `--to` flags for other chains. Like `swap send`, `bridge send` refuses to run in a non-interactive shell without `--yes` so agents must quote the Across fee + gas to the user before executing.
 
 ## MPP Services
 
@@ -313,8 +313,7 @@ src/
     ├── format.ts          # terminal output helpers + renderOutput(--json)
     ├── confirm.ts         # requireApproval + confirmDestructive
     ├── mpp-topup.ts       # MPP SDK topup helper
-    ├── across.ts          # Across Protocol bridge
-    └── tempo.ts           # Tempo chain helpers
+    └── across.ts          # Across Protocol bridge
 ```
 
 ## Twin & Social Commands (v0.8.0)
@@ -392,6 +391,12 @@ npm publish
 
 ## Changelog
 
+### 0.9.9
+
+- **Tempo support removed (breaking).** `wallets bridge` default destination is now Base instead of Tempo (see "Default route: Solana → Base" above and the existing `--from`/`--to` flags). The `tempo` entry is gone from `across.ts` and `lib/tempo.ts` is deleted, so `--to tempo` will now error with an unknown-chain message — there is no escape hatch. **Update any scripts or agents that relied on the old default**: pass `--to base` (or another supported chain) explicitly. `search` no longer falls back to the Tempo explorer either.
+- `lib/api.ts` fetches now wrap an `AbortController` with a 30 s default timeout — a stalled MPP endpoint no longer hangs the agent process. `markets service call` adds a 60 s timeout on the paid call and 15 s on the openapi.json price probe.
+- **Security fix.** `markets service call <method> <path>` now rejects any `path` that doesn't start with `/`, closing a credential-leakage hole. The previous behavior treated `http(s)://…` paths as full URLs, which let a caller redirect the paid request — including the `X-Payment-Tx` and `X-Twin-Id` headers — to an arbitrary external host, leaking the on-chain payment proof + twin identity.
+
 ### 0.9.9-beta.8
 
 - `friends reports request --pay` now does a **free preflight** (`POST /v1/friend-reports/preflight`) before signing the on-chain AMIKO transfer. Validates User → Friendship → consent → personality profile against amiko-web. If anything's wrong (wrong id shape, missing consent, missing profile), the CLI aborts with a targeted tip — no AMIKO is transferred. Closes a hole where every retry against a bad `--id` burned ~3 AMIKO via the irreversible X-Payment-Tx flow.

package/dist/index.js

@@ -7146,7 +7146,7 @@ function getRpcTransportWithRequestCoalescing(transport, getDeduplicationKey) {
     coalescedRequest.numConsumers++;
     if (signal) {
       const responsePromise = coalescedRequest.responsePromise;
-      return await new Promise((resolve2, reject) => {
+      return await new Promise((resolve, reject) => {
         const handleAbort = (e22) => {
           signal.removeEventListener("abort", handleAbort);
           coalescedRequest.numConsumers -= 1;
@@ -7159,7 +7159,7 @@ function getRpcTransportWithRequestCoalescing(transport, getDeduplicationKey) {
           reject(e22.target.reason);
         };
         signal.addEventListener("abort", handleAbort);
-        responsePromise.then(resolve2).catch(reject).finally(() => {
+        responsePromise.then(resolve).catch(reject).finally(() => {
           signal.removeEventListener("abort", handleAbort);
         });
       });
@@ -25831,51 +25831,71 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/lib/agent-config.ts
-import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-var OPENCLAW_FALLBACK_PATH = "/data/.openclaw/workspace/.amiko.json";
-function tryRead(filePath) {
-  if (!existsSync(filePath))
-    return null;
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+var OPENCLAW_ROOT = "/data/.openclaw";
+var OPENCLAW_WORKSPACE_PREFIX = "/data/.openclaw/workspace";
+var OPENCLAW_AMIKO_JSON = "/data/.openclaw/workspace/.amiko.json";
+function isOpenclawEnvironment() {
   try {
-    return JSON.parse(readFileSync(filePath, "utf-8"));
+    if (!statSync(OPENCLAW_ROOT).isDirectory())
+      return false;
   } catch {
-    return null;
+    return false;
   }
+  return process.cwd().startsWith(OPENCLAW_WORKSPACE_PREFIX);
 }
-function findAmikoJson() {
-  let dir = process.cwd();
-  const root = resolve("/");
-  while (dir !== root) {
-    const parsed = tryRead(join(dir, ".amiko.json"));
-    if (parsed)
-      return parsed;
-    dir = resolve(dir, "..");
+function findAmikoJsonPath() {
+  const cwdPath = join(process.cwd(), ".amiko.json");
+  if (existsSync(cwdPath))
+    return cwdPath;
+  if (isOpenclawEnvironment() && existsSync(OPENCLAW_AMIKO_JSON)) {
+    return OPENCLAW_AMIKO_JSON;
   }
-  return tryRead(OPENCLAW_FALLBACK_PATH);
+  return null;
 }
 function asString(v) {
   return typeof v === "string" && v.length > 0 ? v : undefined;
 }
-function resolveAuth() {
-  const parsed = findAmikoJson();
-  if (!parsed)
-    return {};
+function readFromFile(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return {
+      twinToken: asString(parsed.amikoTwinToken) ?? asString(parsed.AMIKO_TWIN_TOKEN) ?? asString(parsed.AMIKO_USER_TOKEN),
+      twinId: asString(parsed.amikoTwinId) ?? asString(parsed.AMIKO_TWIN_ID),
+      userId: asString(parsed.amikoUserId) ?? asString(parsed.AMIKO_USER_ID),
+      platformUrl: asString(parsed.amikoPlatformUrl) ?? asString(parsed.AMIKO_PLATFORM_URL),
+      apiBase: asString(parsed.amikoApiBase) ?? asString(parsed.AMIKO_API_BASE) ?? asString(parsed.apiBase)
+    };
+  } catch {
+    return null;
+  }
+}
+function readFromEnv() {
   return {
-    twinToken: asString(parsed.amikoTwinToken) ?? asString(parsed.AMIKO_TWIN_TOKEN) ?? asString(parsed.AMIKO_USER_TOKEN),
-    twinId: asString(parsed.amikoTwinId) ?? asString(parsed.AMIKO_TWIN_ID),
-    userId: asString(parsed.amikoUserId) ?? asString(parsed.AMIKO_USER_ID),
-    platformUrl: asString(parsed.amikoPlatformUrl) ?? asString(parsed.AMIKO_PLATFORM_URL),
-    apiBase: asString(parsed.apiBase)
+    twinToken: asString(process.env.AMIKO_TWIN_TOKEN) ?? asString(process.env.AMIKO_USER_TOKEN),
+    twinId: asString(process.env.AMIKO_TWIN_ID),
+    userId: asString(process.env.AMIKO_USER_ID),
+    platformUrl: asString(process.env.AMIKO_PLATFORM_URL),
+    apiBase: asString(process.env.AMIKO_API_BASE)
   };
 }
+function resolveAuth() {
+  const filePath = findAmikoJsonPath();
+  if (filePath) {
+    const fromFile = readFromFile(filePath);
+    if (fromFile)
+      return fromFile;
+  }
+  return readFromEnv();
+}
+var NO_TOKEN_HINT = "No twin token found. Set AMIKO_TWIN_TOKEN env var, or place .amiko.json with amikoTwinToken in the current directory.";
 function requireAuth() {
   const auth = resolveAuth();
-  if (!auth.twinToken) {
-    throw new Error("No twin token found. Place an .amiko.json file with amikoTwinToken in the current directory or any parent (or at /data/.openclaw/workspace/.amiko.json).");
-  }
+  if (!auth.twinToken)
+    throw new Error(NO_TOKEN_HINT);
   if (!auth.twinId) {
-    throw new Error("No twin id in .amiko.json. Add amikoTwinId alongside amikoTwinToken.");
+    throw new Error("No twin id found. Set AMIKO_TWIN_ID env var, or add amikoTwinId to .amiko.json.");
   }
   return auth;
 }
@@ -26855,13 +26875,26 @@ function ora(options) {
 }
 
 // src/lib/api.ts
+var DEFAULT_TIMEOUT_MS = 30000;
 function mppBase() {
   return trimBase(loadConfig().apiBase);
 }
-async function get(path) {
-  const res = await fetch(`${mppBase()}${path}`, {
-    headers: { "Content-Type": "application/json" }
-  });
+async function fetchWithTimeout(url, init = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs}ms: ${url}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function get(path, timeoutMs) {
+  const res = await fetchWithTimeout(`${mppBase()}${path}`, { headers: { "Content-Type": "application/json" } }, timeoutMs);
   await assertOk(res);
   return res.json();
 }
@@ -26962,46 +26995,6 @@ function registerDiscoveryCommand(program2) {
   });
 }
 
-// src/lib/tempo.ts
-import { execFile, execFileSync } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join2 } from "node:path";
-var TEMPO_PATHS = [join2(homedir(), ".tempo", "bin", "tempo"), "tempo"];
-function findTempo() {
-  for (const p of TEMPO_PATHS) {
-    if (p === "tempo") {
-      try {
-        execFileSync(p, ["--version"], { stdio: "pipe", timeout: 3000 });
-        return p;
-      } catch {
-        continue;
-      }
-    } else if (existsSync2(p)) {
-      return p;
-    }
-  }
-  return null;
-}
-function hasTempo() {
-  return findTempo() !== null;
-}
-function runTempo(args, timeoutMs = 60000) {
-  const bin = findTempo();
-  if (!bin)
-    throw new Error("Tempo CLI not installed. Install: curl -fsSL https://tempo.xyz/install | bash");
-  return new Promise((resolve2, reject) => {
-    execFile(bin, args, { timeout: timeoutMs, maxBuffer: 1024 * 1024 * 10 }, (err, stdout, stderr) => {
-      if (err) {
-        const msg = stderr?.trim() || stdout?.trim() || err.message;
-        reject(new Error(msg));
-        return;
-      }
-      resolve2(stdout.trim() || stderr.trim());
-    });
-  });
-}
-
 // src/lib/confirm.ts
 import readline from "node:readline";
 function promptYesNo(question) {
@@ -27009,10 +27002,10 @@ function promptYesNo(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve2(/^y(es)?$/i.test(answer.trim()));
+      resolve(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -27074,7 +27067,7 @@ function baseUrl(auth) {
 function authHeader(auth) {
   if (auth.twinToken)
     return `Bearer ${auth.twinToken}`;
-  throw new Error("No twin token found. Place an .amiko.json file with amikoTwinToken in the current directory or any parent.");
+  throw new Error("No twin token found. Set AMIKO_TWIN_TOKEN env var, or place .amiko.json with amikoTwinToken in the current directory.");
 }
 async function amikoWebFetch(auth, path, opts = {}) {
   const url = new URL(`${baseUrl(auth)}${path}`);
@@ -27173,7 +27166,6 @@ var CHAINS = {
   optimism: 10,
   polygon: 137,
   arbitrum: 42161,
-  tempo: 4217,
   base: 8453,
   solana: 34268394551451,
   linea: 59144,
@@ -27184,7 +27176,6 @@ var CHAIN_NAMES = {
   [CHAINS.optimism]: "Optimism",
   [CHAINS.polygon]: "Polygon",
   [CHAINS.arbitrum]: "Arbitrum",
-  [CHAINS.tempo]: "Tempo",
   [CHAINS.base]: "Base",
   [CHAINS.solana]: "Solana",
   [CHAINS.linea]: "Linea",
@@ -27207,7 +27198,6 @@ var CHAIN_NAMES = {
 };
 var USDC_ADDRESSES = {
   [CHAINS.solana]: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
-  [CHAINS.tempo]: "0x20C000000000000000000000b9537d11c60E8b50",
   [CHAINS.ethereum]: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
   [CHAINS.optimism]: "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
   [CHAINS.arbitrum]: "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
@@ -27249,7 +27239,7 @@ async function getSwapQuote(opts) {
     depositor: opts.depositor,
     recipient: opts.recipient,
     slippage: opts.slippage ?? "auto",
-    skipOriginTxEstimation: false
+    skipOriginTxEstimation: "false"
   });
 }
 async function getDepositStatus(depositTxHash, originChainId) {
@@ -27288,7 +27278,6 @@ function resolveChainId(input) {
     arb: CHAINS.arbitrum,
     optimism: CHAINS.optimism,
     op: CHAINS.optimism,
-    tempo: CHAINS.tempo,
     base: CHAINS.base,
     polygon: CHAINS.polygon,
     matic: CHAINS.polygon,
@@ -27311,10 +27300,10 @@ function getUsdcAddress(chainId) {
 
 // src/commands/bridge.ts
 var DEFAULT_ORIGIN = CHAINS.solana;
-var DEFAULT_DESTINATION = CHAINS.tempo;
+var DEFAULT_DESTINATION = CHAINS.base;
 function registerBridgeCommand(program2) {
   const cmd = program2.command("bridge").description("Bridge USDC across chains via Across Protocol");
-  cmd.command("quote").description("Get a bridge quote for USDC transfer").argument("<amount>", "Amount of USDC to bridge (e.g., 10, 5.50)").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: tempo)", "tempo").option("--recipient <address>", "Recipient address on destination chain (required for Solana ↔ EVM)").option("--depositor <address>", "Depositor address on origin chain (defaults to your wallet on that chain)").action(async (amountStr, opts) => {
+  cmd.command("quote").description("Get a bridge quote for USDC transfer").argument("<amount>", "Amount of USDC to bridge (e.g., 10, 5.50)").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: base)", "base").option("--recipient <address>", "Recipient address on destination chain (required for Solana ↔ EVM)").option("--depositor <address>", "Depositor address on origin chain (defaults to your wallet on that chain)").action(async (amountStr, opts) => {
     const spinner = ora("Fetching bridge quote...").start();
     try {
       const originChainId = resolveChainId(opts.from);
@@ -27386,7 +27375,7 @@ function registerBridgeCommand(program2) {
       process.exit(1);
     }
   });
-  cmd.command("send").description("Execute a USDC bridge transfer via Across").argument("<amount>", "Amount of USDC to bridge (e.g., 10, 5.50)").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: tempo)", "tempo").option("--recipient <address>", "Recipient address on destination chain (required for Solana ↔ EVM)").option("--depositor <address>", "Depositor address on origin chain (defaults to your wallet on that chain)").option("--raw", "Output raw transaction JSON for manual signing").option("--yes", "Skip confirmation (only after the user has approved)").action(async (amountStr, opts) => {
+  cmd.command("send").description("Execute a USDC bridge transfer via Across").argument("<amount>", "Amount of USDC to bridge (e.g., 10, 5.50)").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: base)", "base").option("--recipient <address>", "Recipient address on destination chain (required for Solana ↔ EVM)").option("--depositor <address>", "Depositor address on origin chain (defaults to your wallet on that chain)").option("--raw", "Output raw transaction JSON for manual signing").option("--yes", "Skip confirmation (only after the user has approved)").action(async (amountStr, opts) => {
     const spinner = ora("Preparing bridge transaction...").start();
     try {
       const originChainId = resolveChainId(opts.from);
@@ -27456,14 +27445,6 @@ function registerBridgeCommand(program2) {
         console.log(label("Expires", new Date(quote.quoteExpiryTimestamp * 1000).toISOString()));
         return;
       }
-      if (!hasTempo()) {
-        console.log("");
-        console.log(warn("Tempo CLI not installed — cannot auto-sign transaction."));
-        console.log(dim("Install Tempo: curl -fsSL https://tempo.xyz/install | bash"));
-        console.log("");
-        console.log(dim("Or use --raw to get transaction data for manual signing."));
-        process.exit(1);
-      }
       if (!quote.swapTx) {
         console.log("");
         console.log(warn("No swap transaction returned — the route may require manual steps."));
@@ -27471,55 +27452,13 @@ function registerBridgeCommand(program2) {
         process.exit(1);
       }
       if (quote.approvalTxns && quote.approvalTxns.length > 0) {
-        for (let i = 0;i < quote.approvalTxns.length; i++) {
-          const approvalSpinner = ora(`Submitting approval ${i + 1}/${quote.approvalTxns.length}...`).start();
-          try {
-            const txn = quote.approvalTxns[i];
-            await runTempo([
-              "tx",
-              "send",
-              "--chain",
-              String(txn.chainId),
-              "--to",
-              txn.to,
-              "--data",
-              txn.data
-            ], 120000);
-            approvalSpinner.succeed(`Approval ${i + 1}/${quote.approvalTxns.length} confirmed`);
-          } catch (err) {
-            approvalSpinner.fail(`Approval ${i + 1} failed`);
-            console.error(error(err instanceof Error ? err.message : "Approval transaction failed"));
-            process.exit(1);
-          }
-        }
-      }
-      const bridgeSpinner = ora("Submitting bridge transaction...").start();
-      try {
-        const tx = quote.swapTx;
-        const output = await runTempo([
-          "tx",
-          "send",
-          "--chain",
-          String(tx.chainId),
-          "--to",
-          tx.to,
-          "--data",
-          tx.data,
-          ...tx.value && tx.value !== "0" ? ["--value", tx.value] : []
-        ], 180000);
-        bridgeSpinner.stop();
         console.log("");
-        console.log(success("Bridge transaction submitted"));
-        console.log("");
-        console.log(dim(output.trim()));
-        console.log("");
-        console.log(dim("Track status:"));
-        console.log(dim(`  amiko wallets bridge status <txHash> --chain ${originChainId}`));
-      } catch (err) {
-        bridgeSpinner.fail("Bridge transaction failed");
-        console.error(error(err instanceof Error ? err.message : "Transaction failed"));
-        process.exit(1);
+        console.log(warn("Approval transaction data is required before bridging."));
       }
+      console.log("");
+      console.log(warn("Automatic bridge signing is not available in this CLI build."));
+      console.log(dim("Run the same command with --raw and sign the returned transaction data with your wallet."));
+      process.exit(1);
     } catch (err) {
       spinner.stop();
       console.error(error(err instanceof Error ? err.message : "Bridge failed"));
@@ -27627,7 +27566,7 @@ function registerBridgeCommand(program2) {
       process.exit(1);
     }
   });
-  cmd.command("limits").description("Check transfer limits for a USDC bridge route").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: tempo)", "tempo").action(async (opts) => {
+  cmd.command("limits").description("Check transfer limits for a USDC bridge route").option("--from <chain>", "Origin chain (default: solana)", "solana").option("--to <chain>", "Destination chain (default: base)", "base").action(async (opts) => {
     const spinner = ora("Fetching limits...").start();
     try {
       const originChainId = resolveChainId(opts.from);
@@ -27763,10 +27702,10 @@ function promptYesNo2(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve2(/^y(es)?$/i.test(answer.trim()));
+      resolve(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -27871,7 +27810,7 @@ function registerCreditsCommand(program2) {
     }
     if (options2.method === "mpp") {
       if (!auth.userId) {
-        console.error(error("--method mpp requires amikoUserId in .amiko.json."));
+        console.error(error("--method mpp requires user id. Set AMIKO_USER_ID env var, or add amikoUserId to .amiko.json."));
         process.exit(1);
       }
       if (!options2.keyId) {
@@ -28177,12 +28116,12 @@ function registerSwapCommand(program2) {
 }
 
 // src/commands/update.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 function detectPackageManager() {
   try {
-    execFileSync2("bun", ["--version"], { stdio: "ignore" });
+    execFileSync("bun", ["--version"], { stdio: "ignore" });
     return "bun";
   } catch {
     return "npm";
@@ -28253,34 +28192,39 @@ async function resolveTargetVersion(pkg, currentVersion) {
     return { version: latest, channel: "latest" };
   return { version: "latest", channel: "latest" };
 }
-var DATA_CLI = "/data/.amiko-cli";
-var NPM_GLOBAL_CANDIDATES = [
+var OPENCLAW_DATA_CLI = "/data/.amiko-cli";
+var OPENCLAW_NPM_GLOBAL_CANDIDATES = [
   "/usr/local/lib/node_modules/@heyamiko/amiko-cli",
   "/usr/lib/node_modules/@heyamiko/amiko-cli"
 ];
-var BIN_TARGET = "/usr/local/bin/amiko";
-var TWIN_SKILL_DIRS = [
+var OPENCLAW_BIN_TARGET = "/usr/local/bin/amiko";
+var OPENCLAW_SKILL_DIRS = [
   "/data/.openclaw/skills/amiko-cli",
   "/data/.openclaw/workspace/skills/amiko-cli"
 ];
-function syncTwinInstall() {
-  if (!fs.existsSync(DATA_CLI))
+function syncOpenclawInstall() {
+  if (!isOpenclawEnvironment())
+    return false;
+  if (!fs.existsSync(OPENCLAW_DATA_CLI))
     return false;
-  const src = NPM_GLOBAL_CANDIDATES.find((p) => fs.existsSync(p));
+  const src = OPENCLAW_NPM_GLOBAL_CANDIDATES.find((p) => fs.existsSync(p));
   if (!src)
     return false;
-  fs.rmSync(DATA_CLI, { recursive: true, force: true });
-  execFileSync2("cp", ["-rL", src, DATA_CLI]);
+  const tmp = `${OPENCLAW_DATA_CLI}.tmp`;
+  fs.rmSync(tmp, { recursive: true, force: true });
+  execFileSync("cp", ["-rL", src, tmp]);
+  fs.rmSync(OPENCLAW_DATA_CLI, { recursive: true, force: true });
+  fs.renameSync(tmp, OPENCLAW_DATA_CLI);
   try {
-    fs.unlinkSync(BIN_TARGET);
+    fs.unlinkSync(OPENCLAW_BIN_TARGET);
   } catch {}
-  fs.symlinkSync(path.join(DATA_CLI, "dist/index.js"), BIN_TARGET);
+  fs.symlinkSync(path.join(OPENCLAW_DATA_CLI, "dist/index.js"), OPENCLAW_BIN_TARGET);
   try {
-    fs.chmodSync(BIN_TARGET, 493);
+    fs.chmodSync(OPENCLAW_BIN_TARGET, 493);
   } catch {}
-  const skillSrc = path.join(DATA_CLI, "skills/SKILL.md");
+  const skillSrc = path.join(OPENCLAW_DATA_CLI, "skills/SKILL.md");
   if (fs.existsSync(skillSrc)) {
-    for (const dir of TWIN_SKILL_DIRS) {
+    for (const dir of OPENCLAW_SKILL_DIRS) {
       const parent = path.dirname(dir);
       if (!fs.existsSync(parent))
         continue;
@@ -28310,25 +28254,28 @@ function registerUpdateCommand(program2) {
     const spinner = ora(`Installing ${installSpec}...`).start();
     try {
       if (pm === "bun") {
-        execFileSync2("bun", ["install", "-g", installSpec], { stdio: "pipe" });
+        execFileSync("bun", ["install", "-g", installSpec], { stdio: "pipe" });
       } else {
-        execFileSync2("npm", ["install", "-g", installSpec], { stdio: "pipe" });
+        execFileSync("npm", ["install", "-g", installSpec], { stdio: "pipe" });
       }
       spinner.stop();
-      let syncedTwin = false;
-      try {
-        const twinSpinner = ora("Refreshing twin install...").start();
-        syncedTwin = syncTwinInstall();
-        twinSpinner.stop();
-        if (syncedTwin) {
+      if (isOpenclawEnvironment()) {
+        const twinSpinner = ora("Refreshing openclaw install...").start();
+        let synced = false;
+        try {
+          synced = syncOpenclawInstall();
+        } catch (err) {
+          console.log(dim(`Openclaw sync failed: ${err instanceof Error ? err.message : String(err)}. Container restart will apply the update.`));
+        } finally {
+          twinSpinner.stop();
+        }
+        if (synced) {
           console.log(dim("Refreshed /data/.amiko-cli, symlink, and skill files."));
         }
-      } catch (err) {
-        console.log(dim(`Twin sync failed: ${err instanceof Error ? err.message : String(err)}. Container restart will apply the update.`));
       }
       let newVersion = "latest";
       try {
-        newVersion = execFileSync2("amiko", ["--version"], {
+        newVersion = execFileSync("amiko", ["--version"], {
           encoding: "utf-8"
         }).trim();
       } catch {}
@@ -28428,8 +28375,7 @@ function registerSearchCommand(program2) {
       spinner.stop();
       if (!res.ok) {
         await reportHttpError(res, "Search");
-        const explorer = chain === "solana" ? `https://solscan.io/tx/${txHash}` : `https://explorer.tempo.xyz/tx/${txHash}`;
-        console.log(dim(`Payment tx: ${explorer}`));
+        console.log(dim(`Payment tx: https://solscan.io/tx/${txHash}`));
         process.exit(1);
       }
       const data = await res.json();
@@ -28798,11 +28744,14 @@ function usdToAmiko(usd2, pricePerAmiko) {
   return Math.ceil(amount2 * 100) / 100 + "";
 }
 async function payAndCall(mppBase2, method, path2, auth, wallet, amountOrAuto, body, onProgress, token = "AMIKO") {
+  if (!path2.startsWith("/")) {
+    throw new Error(`path must start with "/" — got: ${path2}`);
+  }
   let amount2 = amountOrAuto;
   if (amount2 === "auto") {
     onProgress?.("Fetching price...");
     try {
-      const specRes = await fetch(`${mppBase2}/openapi.json`);
+      const specRes = await fetchWithTimeout2(`${mppBase2}/openapi.json`, {}, 15000);
       if (specRes.ok) {
         const spec = await specRes.json();
         const pathSpec = spec.paths?.[path2];
@@ -28839,10 +28788,24 @@ async function payAndCall(mppBase2, method, path2, auth, wallet, amountOrAuto, b
   if (body && method !== "GET") {
     fetchOpts.body = JSON.stringify(body);
   }
-  const url2 = path2.startsWith("http") ? path2 : `${mppBase2}${path2}`;
-  const res = await fetch(url2, fetchOpts);
+  const url2 = `${mppBase2}${path2}`;
+  const res = await fetchWithTimeout2(url2, fetchOpts, 60000);
   return { res, txHash, amikoSpent: amount2 };
 }
+async function fetchWithTimeout2(url2, init = {}, timeoutMs) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url2, { ...init, signal: controller.signal });
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs}ms: ${url2}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function registerServicesCommand(program2) {
   const svc = program2.command("service").alias("svc").description("Call any MPP service — pays with AMIKO tokens");
   svc.command("tts <voiceId> <text>").description("Text-to-speech — 1 AMIKO").option("--raw", "Output raw response").option("--wallet <address>", "Wallet to pay from (defaults to your Solana wallet — run `amiko wallets create --chain solana` if none)").option("--yes", "Skip the pre-spend confirmation (required in non-interactive shells)").action(async (voiceId, text, opts) => {
@@ -29063,7 +29026,7 @@ function registerAccountsCommand(program2) {
         console.log(label("Active twin", d.activeTwinId));
       if (!d.authenticated) {
         console.log("");
-        console.log(error("No credentials found. Place .amiko.json with amikoTwinToken."));
+        console.log(error("No credentials found. Set AMIKO_TWIN_TOKEN env var, or place .amiko.json with amikoTwinToken in the current directory."));
       }
     }, { json: opts.json });
   });
@@ -29750,7 +29713,7 @@ async function runPaidRegenerate(args) {
     process.exit(1);
   }
   if (!auth.userId) {
-    console.error(error("Paid regenerate requires your user id. Add 'amikoUserId' to your .amiko.json (alongside amikoTwinToken/amikoTwinId)."));
+    console.error(error("Paid regenerate requires your user id. Set AMIKO_USER_ID env var, or add 'amikoUserId' to your .amiko.json."));
     process.exit(1);
   }
   const preflightSpinner = args.json ? null : ora("Validating request (no charge)...").start();
@@ -30913,8 +30876,8 @@ function registerNotificationsCommand(program2) {
 }
 
 // src/commands/memory.ts
-import { existsSync as existsSync3, lstatSync, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { dirname, isAbsolute, normalize, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { dirname, isAbsolute, normalize, relative, resolve } from "node:path";
 function isInsideRoot(abs, root) {
   const rel = relative(root, abs);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
@@ -31089,13 +31052,13 @@ function registerMemoryCommand(program2) {
     }
   });
   memory.command("sync").description("Sync MEMORY.md, its referenced files, and every .md under <workspace>/memory/ (one-way: local → server)").option("--path <dir>", `Workspace dir (default ${DEFAULT_WORKSPACE}). Looks for MEMORY.md, memory/MEMORY.md, and memory/**/*.md`).option("--dry-run", "Print what would be synced without uploading").option("--prune", "Delete server-side memory files that no longer exist locally").option("--json", "Output as JSON").action(async (opts) => {
-    const root = resolve2(opts.path || DEFAULT_WORKSPACE);
+    const root = resolve(opts.path || DEFAULT_WORKSPACE);
     const candidateIndexes = [
-      resolve2(root, "MEMORY.md"),
-      resolve2(root, "memory", "MEMORY.md")
-    ].filter((p) => existsSync3(p));
-    const memoryDir = resolve2(root, "memory");
-    const memoryDirExists = existsSync3(memoryDir) && statSync(memoryDir).isDirectory();
+      resolve(root, "MEMORY.md"),
+      resolve(root, "memory", "MEMORY.md")
+    ].filter((p) => existsSync2(p));
+    const memoryDir = resolve(root, "memory");
+    const memoryDirExists = existsSync2(memoryDir) && statSync2(memoryDir).isDirectory();
     if (!candidateIndexes.length && !memoryDirExists) {
       fail(`No MEMORY.md or memory/ folder found under ${root}. Expected ${root}/MEMORY.md or ${root}/memory/.`);
     }
@@ -31195,12 +31158,12 @@ function collectMemoryFiles(root, indexPaths, memoryDir) {
     for (const ref of extractMarkdownLinks(indexContent)) {
       if (isExternal(ref))
         continue;
-      const abs = normalize(isAbsolute(ref) ? ref : resolve2(indexDir, ref));
+      const abs = normalize(isAbsolute(ref) ? ref : resolve(indexDir, ref));
       if (!isInsideRoot(abs, root)) {
         errors3.push(`Skipping ${ref}: outside workspace ${root}`);
         continue;
       }
-      if (!existsSync3(abs)) {
+      if (!existsSync2(abs)) {
         errors3.push(`Referenced file missing: ${ref}`);
         continue;
       }
@@ -31237,7 +31200,7 @@ function walkMarkdown(dir, errors3) {
     return out;
   }
   for (const name of names) {
-    const abs = resolve2(dir, name);
+    const abs = resolve(dir, name);
     let st;
     try {
       st = lstatSync(abs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyamiko/amiko-cli",
-  "version": "0.9.9",
+  "version": "0.10.0-beta.0",
   "description": "Amiko CLI — swap tokens, manage credits, bridge cross-chain, and call marketplace agents",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -116,8 +116,8 @@ amiko wallets transfer --to <addr> --amount 100 --token amiko --yes  # send toke
 amiko wallets swap quote 1.0 SOL USDC                # Jupiter quote (free)
 amiko wallets swap send 1.0 SOL USDC --yes           # --wallet defaults to your Solana wallet
 amiko wallets swap tokens                            # supported tokens list
-amiko wallets bridge quote 10 --from solana --to tempo --recipient <addr>
-amiko wallets bridge send 10 --from solana --to tempo --recipient <addr> --yes
+amiko wallets bridge quote 10 --from solana --to base --recipient <addr>
+amiko wallets bridge send 10 --from solana --to base --recipient <addr> --yes
 amiko wallets bridge status <txHash>
 amiko wallets bridge routes
 amiko wallets bridge limits