@inversealtruism/cairn-cli 0.3.5 → 0.3.6

package/dist/cli.js

@@ -7,7 +7,7 @@ import * as csd from "./lib/csd.js";
 import { buildCommitment } from "./lib/item.js";
 import { buildGatewayRecord, buildPeerRecord, buildIdentityCommit, buildIdentityReveal } from "@inversealtruism/csd-registry";
 import { canonicalJson } from "@inversealtruism/csd-codec";
-import { cairnxGet, activeCairnxBase, buildTransferRecord, humanToBase, baseToHuman, CAIRNX_DOMAIN, CAIRNX_ANCHOR_FEE, TICKER_RE, NAME_RE } from "./lib/cairnx.js";
+import { cairnxGet, activeCairnxBase, defaultBases, buildTransferRecord, humanToBase, baseToHuman, CAIRNX_DOMAIN, CAIRNX_ANCHOR_FEE, TICKER_RE, NAME_RE } from "./lib/cairnx.js";
 import { randomBytes } from "node:crypto";
 import { createInterface } from "node:readline";
 import { c, banner, bannerAnimated, rule, badge, bar, csd as csdFmt, ok, warn, err, key as kdim, pad, spinner, sleep, isTty, anim, clearScreen, cursorHome, san } from "./lib/ui.js";
@@ -53,8 +53,8 @@ function warnIfChangeCollapsed(inputValue, txValue, fee) {
         return; // pickInput already ensures coverage; defensive
     // a healthy spend leaves change ≫ fee unless the user genuinely picked a tight UTXO; flag the
     // case where the implied fee dwarfs the change (what an under-reporting proxy produces).
-    if (change > 0 && fee > change * 4) {
-        console.log(warn(`heads up: change (${csdToCoins(change)} CSD) is much smaller than the fee (${csdToCoins(fee)} CSD).`) +
+    if (change > 0 && fee > change) {
+        console.log(warn(`heads up: change (${csdToCoins(change)} CSD) is smaller than the fee (${csdToCoins(fee)} CSD).`) +
             c.gray(" If your proxy under-reports this input, extra value is burned as fee — verify with your own node, or use ") + c.cyan("--max-fee") + c.gray("."));
     }
 }
@@ -83,9 +83,19 @@ async function pickAndShow(addr, need, txValue, fee) {
     const verified = v.checked && v.ok === true;
     const inputValue = verified ? Number(v.value) : picked.value;
     const tag = verified ? c.green(" ✓ verified vs your node")
-        : (CAIRN_RPC ? c.gray(" (independent value check unavailable)") : c.gray(" (set CAIRN_RPC to your own node to independently verify this value)"));
+        : (CAIRN_RPC ? c.gray(" (independent value check unavailable — CAIRN_RPC unreachable)") : c.gray(" (UNVERIFIED — set CAIRN_RPC)"));
     console.log(`${kdim("input")}   ${csdToCoins(inputValue)} CSD ${c.gray("(one UTXO)")}${tag}   ${kdim("change")} ${csdToCoins(Math.max(0, inputValue - txValue - fee))} CSD ${c.gray("back to you")}`);
     warnIfChangeCollapsed(inputValue, txValue, fee);
+    // CLI-C1: cairn-cli is node-less and has no independent view of the picked UTXO's REAL value, so a
+    // hostile/MITM'd CAIRN_API that under-reports it makes `csd` compute a tiny change and silently burn
+    // the rest of YOUR coin as miner fee (the recipient still gets the signed amount; the loss is your
+    // change). The on-chain fee is implicit (Σin−Σout) with NO chain-enforced maximum. The only robust
+    // defense is an INDEPENDENT value source: set CAIRN_RPC to your own node. Make its absence un-missable.
+    if (!verified) {
+        console.log(warn("input value is NOT independently verified.") +
+            c.gray(" A hostile proxy that under-reports it can burn the difference as fee. Set ") + c.cyan("CAIRN_RPC") +
+            c.gray(" to your own node to verify this value cryptographically before spending."));
+    }
     return picked.input;
 }
 // Resolve the user's PUBLIC address (to fetch inputs from the proxy). Never reads the key
@@ -126,8 +136,15 @@ async function resolveAddr(a) {
     if (cfg?.default_privkey) {
         const real = await csd.deriveAddr(cfg.default_privkey);
         if (real && /^0x[0-9a-fA-F]{40}$/.test(real)) {
+            const cached2 = saveLocalConfig({ address: real });
             console.log(warn("derived your address from the wallet key once.") + c.gray(" " + csd.keyExposureWarning));
-            saveLocalConfig({ address: real });
+            // CLI-C2-DERIVEADDR: if the cache write FAILED (read-only HOME, unwritable CAIRN_CLI_CONFIG, …)
+            // the "derive at most once" guarantee is broken — every subsequent call would re-derive and
+            // re-expose the key on the csd argv. Surface it so the user can set a change address / CAIRN_ADDR.
+            if (!cached2)
+                console.log(warn("could NOT cache your address (config write failed)") +
+                    c.gray(" — set a change address (") + c.cyan("csd wallet init --privkey <key>") + c.gray(") or ") + c.cyan("CAIRN_ADDR") +
+                    c.gray(", otherwise the key is re-derived (and briefly re-exposed on the csd argv) every run."));
             return real;
         }
     }
@@ -148,7 +165,7 @@ async function resolveAddr(a) {
 async function signAndSubmit(csdArgs) {
     const r = await csd.run(csdArgs);
     if (!r.ok)
-        return { ok: false, error: (r.stderr || r.stdout || "csd failed").trim().split("\n").slice(-1)[0] };
+        return { ok: false, error: san((r.stderr || r.stdout || "csd failed").trim().split("\n").slice(-1)[0]) };
     let out = null;
     try {
         out = JSON.parse(r.stdout);
@@ -158,15 +175,24 @@ async function signAndSubmit(csdArgs) {
         return { ok: false, error: "csd produced no signed transaction" };
     const txid = out.txid;
     const sub = await api.submitTx(out.tx).catch((e) => ({ ok: false, err: e.message }));
-    if (sub.ok)
-        return { ok: true, txid: sub.txid || txid };
+    // CLI-C3: the AUTHORITATIVE txid is the LOCALLY-signed one (csd computed it from the exact bytes
+    // it signed). NEVER adopt the proxy-reported sub.txid — a hostile/MITM'd proxy could drop our tx
+    // and ack a DIFFERENT, already-mined chain tx; that substituted txid would then pass confirmMined
+    // AND an independent chainTxMined (it IS a real tx) and falsely read "confirmed on-chain",
+    // defeating the H-7 evidence-based cure. A divergent proxy txid is a hard failure.
+    const norm = (t) => String(t ?? "").toLowerCase().replace(/^0x/, "");
+    if (sub.ok) {
+        if (sub.txid && txid && norm(sub.txid) !== norm(txid))
+            return { ok: false, error: "proxy reported a different txid than the one we signed — refusing", txid };
+        return { ok: true, txid: txid || sub.txid };
+    }
     // Submit was NOT acked. Don't trust the error STRING — a forged "already present" can hide a
     // rejected/conflicting tx. Confirm against the chain: only if the node reports OUR exact txid
     // as mined is this our own prior submit (a genuine "already in"); otherwise the conflict is a
     // DIFFERENT spend (a real double-spend / hostile reply) and we surface it as a failure.
     if (txid && await api.confirmTxMined(txid))
         return { ok: true, txid };
-    return { ok: false, error: sub.err || "submit rejected by node", txid };
+    return { ok: false, error: san(sub.err || "submit rejected by node"), txid };
 }
 // Freshness gate (R12): before building any value tx, consult the proxy's chain-view status so
 // we never sign against a FROZEN or forked tip (the proxy may be failing over to an honest-but-
@@ -237,7 +263,13 @@ function parse(argv) {
 // trustless independence we can't establish).
 function canonHost(h) {
     const x = h.toLowerCase().replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    return (x === "localhost" || x === "127.0.0.1" || x === "::1" || x === "0.0.0.0") ? "localhost" : x;
+    // CLI-C3-CANONHOST (M-15): the ENTIRE 127.0.0.0/8 range is loopback (one machine), so 127.0.0.1
+    // and 127.0.0.2 must canonicalize equal — else a two-loopback-alias setup (board on 127.0.0.1, a
+    // sham "independent node" on 127.0.0.2) would falsely earn the "trustless via independent CAIRN_RPC"
+    // badge. Map every loopback alias to "localhost".
+    if (x === "localhost" || x === "::1" || x === "0.0.0.0" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(x))
+        return "localhost";
+    return x;
 }
 function sameHost(a, b) {
     try {
@@ -534,8 +566,13 @@ async function confirmMined(txid, label, wait) {
         console.log(warn(`${label} submitted — not mined yet; re-check with `) + c.cyan(`cairn show`) + warn(" once a block lands"));
         return;
     }
+    // CLI-C3-CONFIRM-SAMEHOST: only call it an INDEPENDENT confirmation when CAIRN_RPC is a different
+    // machine than CAIRN_API (a same-host node is the same operator, not an independent check) — the
+    // same discipline cmdVerify already applies to its trustless badge.
     if (indep === true)
-        console.log(ok(`${label} confirmed on-chain`) + c.gray("  (verified against your independent node)"));
+        console.log(ok(`${label} confirmed on-chain`) + (sameHost(CAIRN_RPC, CAIRN_API)
+            ? c.gray("  ⚠ CAIRN_RPC shares a host with CAIRN_API — point it at an independent node for a trustless check")
+            : c.gray("  (verified against your independent node)")));
     else if (indep === false)
         console.log(err(`${label}: the proxy reports it mined but your node (CAIRN_RPC) does NOT — treat as UNCONFIRMED.`) + c.gray(" A hostile proxy can forge a 'mined' reply; trust your own node."));
     else
@@ -558,11 +595,11 @@ async function cmdPropose(a) {
         try {
             const r = await api.apiPropose({ domain, title, body, links, fee });
             sp.stop();
-            console.log(r.ok ? ok(`proposed  ${c.cyan(r.id)}`) + c.gray("  (operator)") : err(r.error || "failed"));
+            console.log(r.ok ? ok(`proposed  ${c.cyan(san(r.id))}`) + c.gray("  (operator)") : err(san(r.error || "failed")));
         }
         catch (e) {
             sp.stop();
-            console.log(err(e.message));
+            console.log(err(san(e.message)));
         }
         return;
     }
@@ -626,11 +663,11 @@ async function cmdSupport(a) {
         try {
             const r = await api.apiSupport({ id, fee, score, confidence });
             sp.stop();
-            console.log(r.ok ? ok(`supported  ${c.cyan(r.id)}`) + c.gray("  (operator)") : err(r.error || "failed"));
+            console.log(r.ok ? ok(`supported  ${c.cyan(san(r.id))}`) + c.gray("  (operator)") : err(san(r.error || "failed")));
         }
         catch (e) {
             sp.stop();
-            console.log(err(e.message));
+            console.log(err(san(e.message)));
         }
         return;
     }
@@ -869,12 +906,16 @@ async function main() {
 // ── L3 registry publish commands (build a signed record → anchor Propose → serve bytes) ──
 // Anchor a built registry record: Propose{domain, payloadHash} signed by the csd wallet,
 // then publish the EXACT canonical bytes to the content origin (self-certified on arrival).
-async function anchorRecord(rec, addr, fee, days, label) {
+async function anchorRecord(a, rec, addr, fee, days, label) {
     // max-fee sanity: a fixed-floor record anchor should never burn more than the 1 CSD abs cap.
     if (fee > MAX_FEE_ABS) {
         console.log(err(`fee ${csdToCoins(fee)} CSD looks abnormally high for a ${label} record (cap ${csdToCoins(MAX_FEE_ABS)} CSD).`) + c.gray(" Lower ") + c.cyan("--fee") + c.gray("."));
         return false;
     }
+    // CLI-C6-ANCHOR-FRESHTIP: registry writes move value (the propose fee) + are in-process-signed, so
+    // they must NOT skip the stale/forked-tip gate every other value-write enforces.
+    if (!(await freshTip(a)))
+        return false;
     const uri = "csd:" + rec.domain.replace(/[^a-z]/gi, "").slice(0, 6) + ":v1:" + rec.payloadHash.slice(2, 14);
     const input = await pickAndShow(addr, fee, 0, fee);
     if (!input)
@@ -932,7 +973,7 @@ async function cmdGateway(a) {
         console.log(c.gray("\n[dry-run] not signed or submitted"));
         return;
     }
-    await anchorRecord(rec, p.addr, fee, 10, "gateway");
+    await anchorRecord(a, rec, p.addr, fee, 10, "gateway");
 }
 async function cmdPeer(a) {
     if (a._[1] !== "announce") {
@@ -956,7 +997,7 @@ async function cmdPeer(a) {
         console.log(c.gray("\n[dry-run] not signed or submitted"));
         return;
     }
-    await anchorRecord(rec, p.addr, fee, 10, "peer");
+    await anchorRecord(a, rec, p.addr, fee, 10, "peer");
 }
 async function cmdIdentity(a) {
     const sub = a._[1];
@@ -986,7 +1027,7 @@ async function cmdIdentity(a) {
             console.log(c.gray("\n[dry-run] not signed"));
             return;
         }
-        await anchorRecord(rec, p.addr, fee, 90, "identity reveal");
+        await anchorRecord(a, rec, p.addr, fee, 90, "identity reveal");
         return;
     }
     // default / --commit-only: step 1
@@ -997,7 +1038,7 @@ async function cmdIdentity(a) {
         console.log(c.gray("\n[dry-run] not signed"));
         return;
     }
-    const okc = await anchorRecord(rec, p.addr, fee, 90, "identity commit");
+    const okc = await anchorRecord(a, rec, p.addr, fee, 90, "identity commit");
     if (okc)
         console.log(c.gray("\n  save this salt — reveal NEXT epoch (~1h):  ") + c.cyan(`cairn identity claim ${handle} --reveal --salt ${salt}`));
 }
@@ -1006,11 +1047,25 @@ async function cmdIdentity(a) {
 // Display: base units → human, with thousands grouping. decimals===undefined (a ticker the
 // API doesn't know) falls back to raw base units rather than guessing a scale.
 const group = (s) => s.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+// CLI-C4-AMOUNTDOS: read-API amounts are attacker-controlled strings; a non-numeric one would throw
+// inside BigInt()/baseToHuman() and crash the whole read/display. Parse defensively (0n on garbage)
+// so one hostile balance can't take down `tokens`/`token-info`.
+const big = (x) => { try {
+    return BigInt(String(x ?? "0"));
+}
+catch {
+    return 0n;
+} };
 function tokAmt(base, decimals) {
     if (decimals === undefined)
         return `${group(String(base))} (base units)`;
-    const [i, f] = baseToHuman(String(base), decimals).split(".");
-    return group(i) + (f ? "." + f : "");
+    try {
+        const [i, f] = baseToHuman(big(base), decimals).split(".");
+        return group(i) + (f ? "." + f : "");
+    }
+    catch {
+        return `${group(big(base).toString())} (base units)`;
+    }
 }
 // The address a CairnX read targets: positional arg → --address/CAIRN_ADDR/csd wallet.
 async function resolveCairnxAddr(a, positional) {
@@ -1050,7 +1105,7 @@ async function cmdTokens(a) {
     if (!bals.length)
         console.log(c.gray("  no token balances"));
     for (const [ticker, b] of bals) {
-        const locked = BigInt(String(b.locked ?? "0"));
+        const locked = big(b.locked);
         console.log(`  ${c.cyan(pad(san(ticker), 14))} ${c.white(tokAmt(String(b.available ?? "0"), dec[ticker]))}${locked > 0n ? c.gray(` · ${tokAmt(String(b.locked), dec[ticker])} locked in open offers`) : ""}`);
     }
     const names = acct.names ?? [];
@@ -1062,7 +1117,7 @@ async function cmdTokenInfo(a) {
         console.log(warn("usage: ") + c.cyan("cairn token-info <TICKER>"));
         return;
     }
-    const t = await cairnxGet(`/token/${encodeURIComponent(ticker)}`).catch((e) => { console.log(e.status === 404 ? err(`unknown token ${ticker}`) : err(e.message)); return null; });
+    const t = await cairnxGet(`/token/${encodeURIComponent(ticker)}`).catch((e) => { console.log(e.status === 404 ? err(`unknown token ${san(ticker)}`) : err(san(e.message))); return null; });
     if (!t)
         return;
     banner();
@@ -1071,13 +1126,13 @@ async function cmdTokenInfo(a) {
     row("name", c.white(san(t.name ?? t.ticker)));
     row("decimals", c.white(String(t.decimals)));
     row("supply", `${c.white(tokAmt(String(t.supply), t.decimals))} ${c.gray("max")}`);
-    const minted = BigInt(String(t.minted ?? "0")), supply = BigInt(String(t.supply ?? "0"));
+    const minted = big(t.minted), supply = big(t.supply);
     row("minted", `${c.white(tokAmt(String(t.minted), t.decimals))}${supply > 0n ? c.gray(` · ${Number((minted * 10000n) / supply) / 100}% of supply`) : ""}`);
     row("mint", t.mint === "open" ? c.green("open") + c.gray(` · up to ${tokAmt(String(t.mintLimit ?? "0"), t.decimals)} per mint`) : c.gray("issuer-only"));
     row("deployer", c.gray(san(t.deployer)));
     row("deployed", c.gray(`height ${Number(t.height)} · id ${san(String(t.deployId ?? "")).slice(0, 22)}…`));
     // top-10 holders by total (available + locked) — the same reading the explorer shows
-    const holders = Object.entries(t.holders ?? {}).map(([h, b]) => ({ h, total: BigInt(String(b.available ?? "0")) + BigInt(String(b.locked ?? "0")) }))
+    const holders = Object.entries(t.holders ?? {}).map(([h, b]) => ({ h, total: big(b.available) + big(b.locked) }))
         .filter((x) => x.total > 0n).sort((x, y) => (y.total > x.total ? 1 : y.total < x.total ? -1 : 0));
     console.log(`\n  ${kdim("holders")}    ${c.white(String(holders.length))}${holders.length > 10 ? c.gray(" · top 10") : ""}`);
     const max = holders[0]?.total ?? 1n;
@@ -1112,16 +1167,30 @@ async function cmdTokenSend(a) {
         console.log(err(`bad recipient: ${san(to)}`));
         return;
     }
-    // decimals are AUTHORITATIVE from the token's deploy record — never guessed
-    const t = await cairnxGet(`/token/${encodeURIComponent(ticker)}`).catch((e) => { console.log(e.status === 404 ? err(`unknown token ${ticker}`) : err(e.message)); return null; });
+    // CLI-C5-DECIMALS: `decimals` drives the human→base scale but is reported by an UNauthenticated
+    // CairnX read API (no signature/SPV) — a hostile gateway over-reporting it silently inflates the
+    // MAGNITUDE of your transfer. So: (1) when not pinned to a single CAIRNX_API, cross-check decimals
+    // across the default bases and refuse on disagreement (dual-source discipline); (2) always show +
+    // confirm the exact base-unit integer so a wrong scale is visible before signing.
+    const t = await cairnxGet(`/token/${encodeURIComponent(ticker)}`).catch((e) => { console.log(e.status === 404 ? err(`unknown token ${ticker}`) : err(san(e.message))); return null; });
     if (!t)
         return;
+    const decimals = Number(t.decimals);
+    const bases = defaultBases();
+    if (bases.length > 1) {
+        const seen = await Promise.all(bases.map((b) => cairnxGet(`/token/${encodeURIComponent(ticker)}`, [b]).then((x) => Number(x?.decimals)).catch(() => null)));
+        const consistent = seen.filter((d) => Number.isInteger(d));
+        if (consistent.length >= 2 && new Set(consistent).size > 1) {
+            console.log(err(`CairnX sources DISAGREE on ${ticker} decimals (${[...new Set(consistent)].join(" vs ")}) — refusing to scale the amount against an ambiguous decimals (pin CAIRNX_API to a trusted base).`));
+            return;
+        }
+    }
     let amount;
     try {
-        amount = humanToBase(amountStr, Number(t.decimals));
+        amount = humanToBase(amountStr, decimals);
     }
     catch (e) {
-        console.log(err(e.message));
+        console.log(err(san(e.message)));
         return;
     }
     if (amount <= 0n) {
@@ -1135,9 +1204,9 @@ async function cmdTokenSend(a) {
     }
     // balance check against the same state the resolver will apply the transfer to
     const acct = await cairnxGet(`/address/${encodeURIComponent(from.toLowerCase())}`);
-    const avail = BigInt(String(acct.balances?.[ticker]?.available ?? "0"));
+    const avail = big(acct.balances?.[ticker]?.available);
     if (avail < amount) {
-        console.log(err(`insufficient ${ticker}: balance ${tokAmt(avail.toString(), t.decimals)}, tried to send ${tokAmt(amount.toString(), t.decimals)}${BigInt(String(acct.balances?.[ticker]?.locked ?? "0")) > 0n ? ` (${tokAmt(String(acct.balances[ticker].locked), t.decimals)} more is locked in open offers)` : ""}`));
+        console.log(err(`insufficient ${ticker}: balance ${tokAmt(avail.toString(), decimals)}, tried to send ${tokAmt(amount.toString(), decimals)}${big(acct.balances?.[ticker]?.locked) > 0n ? ` (${tokAmt(String(acct.balances[ticker].locked), decimals)} more is locked in open offers)` : ""}`));
         return;
     }
     let built;
@@ -1145,14 +1214,16 @@ async function cmdTokenSend(a) {
         built = buildTransferRecord({ ticker, to, amount });
     }
     catch (e) {
-        console.log(err(e.message));
+        console.log(err(san(e.message)));
         return;
     }
-    // clear-print exactly what will be anchored before anything signs
-    console.log(`${kdim("send")}    ${c.white(tokAmt(amount.toString(), t.decimals))} ${c.cyan(ticker)} ${c.gray(`(${amount} base units · ${t.decimals} decimals)`)}`);
+    // clear-print exactly what will be anchored before anything signs — the EXACT base-unit integer is
+    // emphasized on its own line (CLI-C5: a wrong API-reported `decimals` shows up here as a magnitude).
+    console.log(`${kdim("send")}    ${c.white(tokAmt(amount.toString(), decimals))} ${c.cyan(ticker)}`);
+    console.log(`${kdim("amount")}  ${c.white(c.bold(amount.toString()))} ${c.gray(`base units · ${decimals} decimals (from the CairnX read API — verify this magnitude)`)}`);
     console.log(`${kdim("to")}      ${c.cyan(to.toLowerCase())}`);
-    console.log(`${kdim("from")}    ${c.cyan(from.toLowerCase())} ${c.gray(`· ${ticker} balance ${tokAmt(avail.toString(), t.decimals)}`)}`);
-    console.log(`${kdim("record")}  ${c.white(built.uri)}`);
+    console.log(`${kdim("from")}    ${c.cyan(from.toLowerCase())} ${c.gray(`· ${ticker} balance ${tokAmt(avail.toString(), decimals)}`)}`);
+    console.log(`${kdim("record")}  ${c.white(san(built.uri))}`);
     console.log(`${kdim("hash")}    ${c.magenta(built.payloadHash)}`);
     console.log(`${kdim("anchor")}  ${c.gray(`Propose on ${CAIRNX_DOMAIN} — costs `)}${c.white(csdToCoins(CAIRNX_ANCHOR_FEE) + " CSD")}${c.gray(" (the chain fee; the tokens themselves move by record)")}`);
     if (a.flags["dry-run"]) {
@@ -1161,7 +1232,7 @@ async function cmdTokenSend(a) {
     }
     if (!(await requireCsd()))
         return;
-    if (!a.flags.yes && !(await confirmSend(`\nsend ${tokAmt(amount.toString(), t.decimals)} ${ticker} for ${csdToCoins(CAIRNX_ANCHOR_FEE)} CSD? [y/N] `))) {
+    if (!a.flags.yes && !(await confirmSend(`\nsend ${tokAmt(amount.toString(), decimals)} ${ticker} (${amount} base units) for ${csdToCoins(CAIRNX_ANCHOR_FEE)} CSD? [y/N] `))) {
         console.log(c.gray("aborted"));
         return;
     }
@@ -1202,7 +1273,7 @@ async function cmdName(a) {
         console.log(warn("usage: ") + c.cyan("cairn name <name>") + c.gray("  (lowercase, 3–32 chars [a-z0-9-])"));
         return;
     }
-    const r = await cairnxGet(`/name/${encodeURIComponent(n)}`).catch((e) => { console.log(e.status === 404 ? err(`unregistered name "${n}"`) + c.gray(" — claimable via commit-reveal on /trade") : err(e.message)); return null; });
+    const r = await cairnxGet(`/name/${encodeURIComponent(n)}`).catch((e) => { console.log(e.status === 404 ? err(`unregistered name "${san(n)}"`) + c.gray(" — claimable via commit-reveal on /trade") : err(san(e.message))); return null; });
     if (!r)
         return;
     banner();
@@ -1230,4 +1301,4 @@ async function cmdName(a) {
     else
         row("offer", c.gray("no open offer"));
 }
-main().catch((e) => { console.error(err(String(e?.message ?? e))); process.exit(1); });
+main().catch((e) => { console.error(err(san(String(e?.message ?? e)))); process.exit(1); });

package/dist/lib/cairnx.js

@@ -2,13 +2,15 @@
 // `cairnx:v1` domain. This file is the CLI's complete CairnX surface:
 //   • a READ client for the CairnX state API (resolution order: $CAIRNX_API → the local
 //     service → the public gateway, GET-only) with automatic fallback on network failure
-//   • the canonical TRANSFER record builder — hand-rolled on the repo's own
-//     stableStringify/sha256 (byte-exact-tested against cairnx-core's ground truth) so the
-//     CLI takes NO dependency on the private cairnx repo.
-//     TODO: swap to @inversealtruism/cairnx-core once it is published to npm.
+//   • the canonical TRANSFER record builder — canonicalised with the SAME @inversealtruism/csd-codec
+//     `canonicalJson` the resolver uses (single source of truth), so the CLI's on-chain payload_hash
+//     is byte-identical to the resolver's by construction (CLI-C7: was a hand-rolled stableStringify,
+//     proven byte-identical to canonicalJson for the transfer-record shape, now consolidated to remove
+//     the latent dual-canonicaliser seam).
 //   • exact human↔base-unit amount math as STRING/BigInt arithmetic — floats never touch
 //     token amounts (no "1.1 * 1e8 = 110000000.00000001" class of bug, no silent truncation).
-import { stableStringify, sha256Hex } from "./item.js";
+import { sha256Hex } from "./item.js";
+import { canonicalJson } from "@inversealtruism/csd-codec";
 export const CAIRNX_DOMAIN = "cairnx:v1";
 export const CAIRNX_ANCHOR_FEE = 25_000_000; // 0.25 CSD — the consensus min Propose fee that anchors a record
 export const MAX_AMOUNT = (1n << 96n) - 1n; // CONVENTION.md: token amounts are ≤ 96-bit
@@ -28,7 +30,7 @@ export function buildTransferRecord(p) {
     if (p.amount > MAX_AMOUNT)
         throw new Error("amount exceeds the 96-bit token-amount limit");
     const record = { amount: p.amount.toString(), t: "transfer", ticker: p.ticker, to, v: 1 };
-    const uri = stableStringify(record);
+    const uri = canonicalJson(record);
     if (Buffer.byteLength(uri, "utf8") > MAX_RECORD_BYTES)
         throw new Error("record exceeds 512 bytes"); // unreachable for a transfer, kept as a guard
     return { record, uri, payloadHash: sha256Hex(uri) };

package/dist/lib/config.js

@@ -23,11 +23,18 @@ export function loadLocalConfig() { try {
 catch {
     return {};
 } }
+// Returns true iff the address was durably persisted. CLI-C2: a SILENT failure here breaks the
+// H-2 "derive the key-on-argv address at most once" guarantee — a read-only HOME / unwritable
+// CAIRN_CLI_CONFIG / full disk would make every subsequent call re-derive (re-exposing the key on
+// the csd argv). Callers surface a warning on false so the user can fix the cache (or stop deriving).
 export function saveLocalConfig(patch) {
     try {
         mkdirSync(dirname(CFG_PATH), { recursive: true, mode: 0o700 });
         writeFileSync(CFG_PATH, JSON.stringify({ ...loadLocalConfig(), ...patch }, null, 2) + "\n", { mode: 0o600 });
         chmodSync(CFG_PATH, 0o600); // tighten even if the file pre-existed (writeFileSync mode is create-only)
+        return true;
+    }
+    catch {
+        return false;
     }
-    catch { /* best-effort */ }
 }

package/dist/lib/csd.js

@@ -41,7 +41,10 @@ function insecureReason(abs) {
     const dir = dirname(abs);
     try {
         const dst = statSync(dir);
-        if ((dst.mode & 0o002) && !(dst.mode & 0o1000))
+        // CLI-C2-STICKY: a trusted signing binary must never live in a world-writable directory —
+        // the sticky bit stops OTHER users deleting your file, but the dir's owner (the attacker, if
+        // they own the planted binary) is unaffected, so do NOT exempt sticky 1777 dirs from the check.
+        if (dst.mode & 0o002)
             return `is in a world-writable directory (${dir})`;
     }
     catch { /* dir unreadable — fall through */ }
@@ -81,20 +84,27 @@ export function resolveCsdBin() {
             abs = realpathSync(env);
         }
         catch { /* may legitimately not exist yet — surfaced at run/available */ }
+        // CLI-C2-EXPLICIT-DIR: warn (don't refuse — it's the user's explicit choice) on ANY insecurity
+        // of the resolved path, not just a world-writable FILE: a world-writable / transient / cwd
+        // DIRECTORY is just as plantable. "does not exist" is normal (surfaced later), so skip it.
         let warning;
-        try {
-            if (statSync(abs).mode & 0o002)
-                warning = `CAIRN_CSD (${abs}) is world-writable — anyone could replace it with a key-stealing binary`;
-        }
-        catch { /* */ }
+        const reason = insecureReason(abs);
+        if (reason && reason !== "does not exist")
+            warning = `CAIRN_CSD (${abs}) ${reason} — anyone could replace it with a key-stealing binary`;
         return (_resolved = { path: abs, explicit: true, warning });
     }
     // Implicit resolution: canonical locations first (defeats PATH-order hijack), then PATH.
     for (const cand of CANONICAL) {
+        // CLI-C2-SYMLINK-TOCTOU: resolve the symlink FIRST, then run the security check on the REAL
+        // target (insecureReason on a symlink validates the link's parent dir, not the target's) — so a
+        // canonical-path symlink can't point at a world-writable binary that slips the check.
         try {
             const st = statSync(cand);
-            if (st.isFile() && (st.mode & 0o111) && !insecureReason(cand))
-                return (_resolved = { path: realpathSync(cand), explicit: false });
+            if (!st.isFile() || !(st.mode & 0o111))
+                continue;
+            const real = realpathSync(cand);
+            if (!insecureReason(real))
+                return (_resolved = { path: real, explicit: false });
         }
         catch { /* next */ }
     }

package/dist/lib/ui.js

@@ -66,12 +66,17 @@ export function bar(value, max, width = 16) {
 export function csd(base) {
     return c.green(`${(base / 1e8).toLocaleString(undefined, { maximumFractionDigits: 4 })}`) + c.gray(" CSD");
 }
-// Strip C0/C1 control chars (incl. ESC) from UNTRUSTED strings before printing them to a
-// TTY, so a hostile server/chain field (title, body, message, handle, bio, domain, id…)
-// can't inject ANSI/OSC escapes to spoof output — e.g. cursor-up + repaint to overwrite a
-// "✗ MISMATCH" verdict with "✓ VERIFIED", rewrite the window title, or hijack the terminal.
-// Display-only: NEVER apply to bytes that get hashed/verified (it would change the hash).
-const CTRL = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f]", "g");
+// Strip dangerous characters from UNTRUSTED strings before printing them to a TTY, so a
+// hostile server/chain field (title, body, message, ERROR string, txid/id, handle, bio,
+// domain…) can't (a) inject ANSI/OSC escapes to spoof output — cursor-up + repaint to
+// overwrite a "✗ MISMATCH" with "✓ VERIFIED", rewrite the window title, OSC-8 link spoof,
+// OSC-52 clipboard write — or (b) use Unicode bidi-overrides / zero-width chars to spoof
+// a displayed address/name/amount (CLI-9). Display-only: NEVER apply to bytes that get
+// hashed/verified (it would change the hash).
+//   • C0/C1 control + DEL (incl. ESC 0x1b — the ANSI/OSC lead-in)
+//   • bidi controls: LRM/RLM U+200E/F, ALM U+061C, LRE..RLO U+202A-E, LRI..PDI U+2066-9
+//   • zero-width / joiners / BOM: ZWSP/ZWNJ/ZWJ U+200B-D, WJ U+2060, BOM U+FEFF
+const CTRL = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u061c\\u200b-\\u200f\\u2060\\u2066-\\u2069\\u202a-\\u202e\\ufeff]", "g");
 export function san(s) { return String(s ?? "").replace(CTRL, ""); }
 export function ok(s) { return c.green("✓ ") + s; }
 export function warn(s) { return c.gray("⚠ ") + s; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inversealtruism/cairn-cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "CLI for Compute Substrate / Cairn — browse the board/wall/network, and send CSD, propose, attest, and place stones non-custodially by driving your own installed `csd` wallet (cairn never holds your key; works node-less via the Cairn proxy).",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
     "typescript": "^5.7.2"
   },
   "dependencies": {
-    "@inversealtruism/csd-codec": "0.1.3",
-    "@inversealtruism/csd-registry": "0.1.3"
+    "@inversealtruism/csd-codec": "0.1.14",
+    "@inversealtruism/csd-registry": "0.1.14"
   }
 }