@jaw.id/cli 0.1.26 → 0.2.1

package/dist/commands/rpc/call.js

@@ -4,6 +4,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
 import WebSocket from 'ws';
+import { encodeFunctionData, maxUint256, erc20Abi } from 'viem';
 
 // src/commands/rpc/call.ts
 var JAW_DIR = path.join(os.homedir(), ".jaw");
@@ -13,7 +14,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/validation.ts
@@ -223,7 +226,18 @@ function bufferToBase64(buf) {
 }
 
 // src/lib/ws-bridge.ts
+function buildInitPayload(config) {
+  return {
+    type: "init",
+    apiKey: config.apiKey,
+    chainId: config.chainId,
+    ens: config.ens,
+    paymasterUrl: config.paymasterUrl,
+    ...config.paymasterUrl && config.paymasterContext ? { paymasterContext: config.paymasterContext } : {}
+  };
+}
 var DEFAULT_TIMEOUT_MS = 12e4;
+var DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
 var MAX_MESSAGE_BYTES = 5 * 1024 * 1024;
 var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
 var MAX_RECONNECT_ATTEMPTS = 3;
@@ -232,6 +246,7 @@ var WSBridge = class {
   relayUrl;
   session;
   timeout;
+  connectTimeout;
   config;
   privateKeyHex;
   publicKeyHex;
@@ -253,6 +268,7 @@ var WSBridge = class {
     this.relayUrl = options.relayUrl;
     this.session = options.session;
     this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    this.connectTimeout = options.connectTimeout ?? DEFAULT_CONNECT_TIMEOUT_MS;
     this.config = options.config;
     this.privateKeyHex = options.privateKeyHex;
     this.publicKeyHex = options.publicKeyHex;
@@ -281,17 +297,16 @@ var WSBridge = class {
       let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
-        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
-      }, 3e4);
+        reject(
+          new Error(
+            `Browser did not connect within ${Math.round(this.connectTimeout / 1e3)}s.
+Run \`jaw disconnect\` then try again, or raise JAW_BRIDGE_TIMEOUT_MS.`
+          )
+        );
+      }, this.connectTimeout);
       const sendEncryptedInit = async () => {
         if (!this.sharedSecret) return;
-        const envelope = await encryptMessage(this.sharedSecret, {
-          type: "init",
-          apiKey: this.config.apiKey,
-          chainId: this.config.chainId,
-          ens: this.config.ens,
-          paymasterUrl: this.config.paymasterUrl
-        });
+        const envelope = await encryptMessage(this.sharedSecret, buildInitPayload(this.config));
         this.sendRaw(ws, JSON.stringify({ type: "encrypted", ...envelope }));
       };
       const waitForReady = () => {
@@ -569,6 +584,10 @@ var DEFAULT_KEYS_URL = "https://keys.jaw.id";
 var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 async function getBridge(options) {
   const config = loadConfig();
+  const envTimeout = Number(process.env["JAW_BRIDGE_TIMEOUT_MS"]);
+  const fromEnv = Number.isFinite(envTimeout) && envTimeout > 0 ? envTimeout : void 0;
+  const timeout = options.timeout ?? fromEnv;
+  const connectTimeout = options.connectTimeout ?? fromEnv;
   const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
   const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;
   const chainId = options.chainId ?? config.defaultChain ?? 1;
@@ -581,7 +600,7 @@ async function getBridge(options) {
   let relaySession = loadRelaySession();
   if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
     try {
-      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
+      return await connectBridge({ ...options, timeout }, relaySession, chainId, keysUrl, relayUrl, false);
     } catch {
       deleteRelaySession();
       relaySession = null;
@@ -591,7 +610,7 @@ async function getBridge(options) {
   }
   const session = await createNewSession(relayUrl);
   saveRelaySession(session);
-  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
+  return await connectBridge({ ...options, timeout, connectTimeout }, session, chainId, keysUrl, relayUrl, true);
 }
 async function createNewSession(relayUrl) {
   const kp = await generateKeyPair();
@@ -606,17 +625,20 @@ async function createNewSession(relayUrl) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
+async function connectBridge(options, relaySession, chainId, keysUrl, relayUrl, openBrowser) {
   const config = loadConfig();
+  const paymaster = config.paymasters?.[chainId];
   const bridge = new WSBridge({
     relayUrl,
     session: relaySession.session,
     timeout: options.timeout,
+    connectTimeout: options.connectTimeout,
     config: {
       apiKey: options.apiKey,
       chainId,
       ens: options.ens ?? config.ens,
-      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
+      paymasterUrl: paymaster?.url,
+      paymasterContext: paymaster?.context
     },
     privateKeyHex: relaySession.privateKey,
     publicKeyHex: relaySession.publicKey,
@@ -626,6 +648,12 @@ async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl,
     // onBrowserNeeded — only open a browser for new sessions
     openBrowser ? async () => {
       const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
+      if (process.env["JAW_NO_BROWSER"]) {
+        process.stderr.write(`Open this URL to approve:
+${bridgeUrl}
+`);
+        return;
+      }
       const { default: open } = await import('open');
       await open(bridgeUrl);
     } : void 0,
@@ -668,9 +696,7 @@ var SESSION_SUPPORTED_METHODS = /* @__PURE__ */ new Set([
   "eth_requestAccounts",
   "eth_accounts",
   "wallet_sendCalls",
-  "wallet_getCallsStatus",
-  "personal_sign",
-  "eth_signTypedData_v4"
+  "wallet_getCallsStatus"
 ]);
 function supportsSessionMode(method) {
   return SESSION_SUPPORTED_METHODS.has(method);
@@ -688,6 +714,9 @@ function loadSessionKey() {
   }
   return parsed.privateKey;
 }
+function isLegacySession(config) {
+  return config.mode !== "eip7702";
+}
 function loadSessionConfig() {
   if (!fs.existsSync(PATHS.sessionConfig)) {
     throw new Error("No session configured. Run `jaw session setup` first.");
@@ -700,20 +729,86 @@ function loadSessionConfig() {
   }
 }
 
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+function usdcForNetwork(network) {
+  return Object.hasOwn(USDC_BY_NETWORK, network) ? USDC_BY_NETWORK[network] : void 0;
+}
+
+// src/x402/permit2.ts
+var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+
 // src/lib/session-bridge.ts
+var JAW_ERC20_PAYMASTER_URL = "https://api.justaname.id/proxy/v1/rpc/erc20-paymaster";
+function resolvePaymaster(options) {
+  if (options.paymasterUrl) {
+    return { paymasterUrl: options.paymasterUrl, paymasterContext: options.paymasterContext };
+  }
+  const configured = loadConfig().paymasters?.[options.chainId];
+  if (configured) {
+    return { paymasterUrl: configured.url, paymasterContext: configured.context };
+  }
+  if (!options.apiKey) return {};
+  const asset = usdcForNetwork(`eip155:${options.chainId}`);
+  if (!asset) {
+    console.warn(
+      `[jaw] No USDC in the x402 asset registry for chain ${options.chainId}, so no ERC-20 paymaster can be engaged. Gas will come out of the account\u2019s native balance. Set \`paymasters\` in your config to sponsor this chain.`
+    );
+    return {};
+  }
+  const url = new URL(JAW_ERC20_PAYMASTER_URL);
+  url.searchParams.set("chainId", String(options.chainId));
+  url.searchParams.set("api-key", options.apiKey);
+  return { paymasterUrl: url.toString(), paymasterContext: { token: asset.address } };
+}
+function explainUnchargeableSender(err, sessionAddress) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (!message.includes("Could not size the ERC-20 paymaster approval")) return err;
+  return new Error(
+    `${message}
+
+If ${sessionAddress} holds no USDC, that is why: it pays for its own gas and cannot be charged with an empty balance. Send it 0.1 USDC, or run \`jaw session setup\` again.`,
+    { cause: err }
+  );
+}
 var SessionBridge = class {
   options;
   session = null;
   constructor(options) {
-    this.options = { ...options };
-    if (!this.options.paymasterUrl) {
-      const config = loadConfig();
-      const pm = config.paymasters?.[this.options.chainId];
-      if (pm) {
-        this.options.paymasterUrl = pm.url;
-        this.options.paymasterContext = pm.context;
-      }
-    }
+    this.options = { ...options, ...resolvePaymaster(options) };
   }
   async getSession() {
     if (this.session) {
@@ -722,6 +817,11 @@ var SessionBridge = class {
     }
     const config = loadSessionConfig();
     this.checkExpiry(config);
+    if (isLegacySession(config)) {
+      throw new Error(
+        "This session was created by an older CLI and uses a session address separate from the session key. Run `jaw session setup` to recreate it, which offers to revoke the old permission first. `jaw session status` still shows the old session, and `jaw session revoke` still revokes it."
+      );
+    }
     if (config.chainId !== this.options.chainId) {
       throw new Error(
         `Session was created for chain ${config.chainId}, but --chain ${this.options.chainId} was requested. Run \`jaw session setup --chain ${this.options.chainId}\` to create a session for that chain.`
@@ -739,8 +839,14 @@ var SessionBridge = class {
         paymasterUrl: this.options.paymasterUrl,
         paymasterContext: this.options.paymasterContext
       },
-      localAccount
+      localAccount,
+      { eip7702: true }
     );
+    if (account.address.toLowerCase() !== config.sessionAddress.toLowerCase()) {
+      throw new Error(
+        `Session key derives ${account.address}, but the stored session address is ${config.sessionAddress}. The keystore and session config are out of sync. Run \`jaw session setup\` to recreate the session.`
+      );
+    }
     this.session = { account, config };
     return this.session;
   }
@@ -750,6 +856,46 @@ var SessionBridge = class {
       throw new Error(`Session expired on ${expiryDate}. Run \`jaw session setup\` to create a new session.`);
     }
   }
+  /**
+   * Approve Permit2 to move one of the payer's tokens, and return the batch id.
+   *
+   * The only call this session sends outside its permission, and the only one
+   * that can be: `JustaPermissionManager` checks every call's selector against
+   * the grant, and the x402 grant permits `transfer` alone, so an approval
+   * routed through the permission reverts before anything else happens. Sent by
+   * the session on its own balance it never reaches the manager at all, whose
+   * approval revocation and Permit2 lockdown act on the granting account and
+   * only within their own execution.
+   *
+   * Being outside the permission is exactly why it is not a general send. It
+   * takes a token and nothing else: the spender is Permit2 and the amount is
+   * the maximum, neither reachable by a caller, and the token has to be the
+   * registry's USDC for this session's chain. There is no shape of argument
+   * that turns this into an arbitrary transfer, which matters because an agent
+   * reaches the tools that reach this.
+   */
+  async approvePermit2(token) {
+    const { account, config } = await this.getSession();
+    const usdc = usdcForNetwork(`eip155:${config.chainId}`);
+    if (!usdc || token.toLowerCase() !== usdc.address.toLowerCase()) {
+      throw new Error(
+        `Refusing to approve Permit2 for ${token}: only the registry USDC on chain ${config.chainId} is allowed.`
+      );
+    }
+    const data = encodeFunctionData({
+      abi: erc20Abi,
+      functionName: "approve",
+      args: [PERMIT2_ADDRESS, maxUint256]
+    });
+    try {
+      const sent = await account.sendCalls([{ to: usdc.address, data }]);
+      const id = typeof sent === "string" ? sent : sent?.id;
+      if (!id) throw new Error("approval submitted but no call id was returned");
+      return id;
+    } catch (err) {
+      throw explainUnchargeableSender(err, config.sessionAddress);
+    }
+  }
   async request(method, params) {
     const { account, config } = await this.getSession();
     switch (method) {
@@ -759,24 +905,25 @@ var SessionBridge = class {
       case "wallet_sendCalls": {
         const payload = Array.isArray(params) ? params[0] : params;
         const { calls } = payload;
-        return account.sendCalls(calls, {
-          permissionId: config.permissionId
-        });
+        const sendOptions = { permissionId: config.permissionId };
+        try {
+          return await account.sendCalls(calls, sendOptions);
+        } catch (err) {
+          throw explainUnchargeableSender(err, config.sessionAddress);
+        }
       }
       case "wallet_getCallsStatus": {
         const batchId = Array.isArray(params) ? params[0] : params;
         return account.getCallStatus(batchId);
       }
-      case "personal_sign": {
-        const message = Array.isArray(params) ? params[0] : params;
-        return account.signMessage(message);
-      }
-      case "eth_signTypedData_v4": {
-        const asArray = Array.isArray(params) ? params : [params];
-        const raw = asArray.length > 1 ? asArray[1] : asArray[0];
-        const typedData = typeof raw === "string" ? JSON.parse(raw) : raw;
-        return account.signTypedData(typedData);
-      }
+      // Refused rather than absent, so the reason is on screen instead of a
+      // caller reading "not supported in auto mode" and looking for a flag. See
+      // `supportsSessionMode` in rpc-classifier.ts for why.
+      case "personal_sign":
+      case "eth_signTypedData_v4":
+        throw new Error(
+          `${method} is not available in auto mode: a signature the session makes is not a call, so it never reaches the spend caps or the ledger. Run it through the browser instead.`
+        );
       case "wallet_grantPermissions":
         throw new Error("Requires browser \u2014 run `jaw session setup`.");
       case "wallet_revokePermissions":
@@ -814,8 +961,13 @@ var RpcCall = class _RpcCall extends BaseCommand {
     ...BaseCommand.baseFlags,
     timeout: Flags.integer({
       char: "t",
-      description: "Request timeout in seconds",
-      default: 120
+      // No default. A default is indistinguishable from an explicit value, and
+      // this one was passed to getBridge on every run, which made
+      // JAW_BRIDGE_TIMEOUT_MS dead here: the env only applies when no caller
+      // named a timeout. The error text tells people to raise that knob, so it
+      // has to work in the command most likely to hit it. Unset falls through
+      // to the env, then to the built-in 120 seconds.
+      description: "Request timeout in seconds (default 120, or JAW_BRIDGE_TIMEOUT_MS)"
     }),
     session: Flags.boolean({
       char: "s",
@@ -851,14 +1003,14 @@ var RpcCall = class _RpcCall extends BaseCommand {
         this.log(`Sending ${method} (session mode)...`);
       }
     } else {
-      const pm = config.paymasters?.[chainId];
       bridge = await getBridge({
         keysUrl: config.keysUrl,
         apiKey,
         chainId,
         ens: config.ens,
-        paymasterUrl: pm?.url,
-        timeout: flags.timeout * 1e3
+        // Undefined when the flag was not given, so getBridge falls through to
+        // the env knob and then to its own default.
+        timeout: flags.timeout === void 0 ? void 0 : flags.timeout * 1e3
       });
       if (!flags.quiet) {
         if (requiresBrowser(method)) {