@oracle-agent/oracle 0.13.1 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "description": "Oracle: standalone prepare-only multichain agent control plane with optional Hermes integration. Policy-bounded intents for a user-signed wallet; the public package never takes your key.",
   "license": "BUSL-1.1",
   "type": "module",
@@ -26,36 +26,62 @@
     "node": ">=20.19.0"
   },
   "bin": {
-    "oracle": "./dist/bin/oracle.mjs",
-    "oracle-data": "./dist/bin/desk-server.mjs",
-    "oracle-public": "./dist/bin/oracle-public-server.mjs",
-    "oracle-data-mcp": "./dist/bin/oracle-data-mcp.mjs",
-    "oracle-init": "./dist/bin/oracle-init.mjs",
-    "oracle-upgrade": "./dist/bin/oracle-upgrade.mjs",
-    "oracle-scan": "./dist/bin/oracle-scan.mjs",
-    "oracle-route": "./dist/bin/oracle-route.mjs",
-    "oracle-equities": "./dist/bin/oracle-equities.mjs"
+    "oracle": "./bin/oracle.mjs",
+    "oracle-data": "./bin/desk-server.mjs",
+    "oracle-public": "./bin/oracle-public-server.mjs",
+    "oracle-data-mcp": "./bin/oracle-data-mcp.mjs",
+    "oracle-init": "./bin/oracle-init.mjs",
+    "oracle-upgrade": "./bin/oracle-upgrade.mjs",
+    "oracle-scan": "./bin/oracle-scan.mjs",
+    "oracle-route": "./bin/oracle-route.mjs",
+    "oracle-equities": "./bin/oracle-equities.mjs"
   },
   "exports": {
-    ".": "./dist/index.mjs",
-    "./farming": "./dist/data/providers/farming.mjs",
-    "./data": "./dist/data/desk-data.mjs",
-    "./policy": "./dist/public-control/policy-schema.mjs",
-    "./chains": "./dist/chains.mjs",
-    "./scanner": "./dist/scanner/index.mjs",
-    "./router": "./dist/router/index.mjs",
-    "./equities": "./dist/equities/index.mjs",
-    "./action-semantics": "./dist/action-semantics.mjs",
-    "./address-book": "./dist/address-book.mjs",
-    "./names": "./dist/data/names.mjs",
-    "./nft-gas-war": "./dist/nft-gas-war-guard.mjs",
-    "./prepare-envelope": "./dist/prepare-envelope.mjs",
-    "./connect": "./dist/onboarding/harness-configs.mjs",
-    "./receipts": "./dist/action-receipts.mjs",
-    "./risk": "./dist/portfolio-risk.mjs",
-    "./watch": "./dist/watch-preferences.mjs",
-    "./signals": "./dist/signals/index.mjs",
-    "./agent-grants": "./dist/public-api/agent-grants.mjs"
+    ".": "./src/index.mjs",
+    "./farming": "./src/data/providers/farming.mjs",
+    "./data": "./src/data/desk-data.mjs",
+    "./policy": "./src/public-control/policy-schema.mjs",
+    "./chains": "./src/chains.mjs",
+    "./scanner": "./src/scanner/index.mjs",
+    "./router": "./src/router/index.mjs",
+    "./equities": "./src/equities/index.mjs",
+    "./action-semantics": "./src/action-semantics.mjs",
+    "./address-book": "./src/address-book.mjs",
+    "./names": "./src/data/names.mjs",
+    "./nft-gas-war": "./src/nft-gas-war-guard.mjs",
+    "./prepare-envelope": "./src/prepare-envelope.mjs",
+    "./connect": "./src/onboarding/harness-configs.mjs",
+    "./receipts": "./src/action-receipts.mjs",
+    "./risk": "./src/portfolio-risk.mjs",
+    "./watch": "./src/watch-preferences.mjs",
+    "./signals": "./src/signals/index.mjs",
+    "./agent-grants": "./src/public-api/agent-grants.mjs"
+  },
+  "scripts": {
+    "test": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/*.test.mjs",
+    "test:boundary": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/custody-boundary.test.mjs",
+    "e2e:solana-bitcoin": "node scripts/e2e-solana-bitcoin.mjs",
+    "e2e:hypercore-staking": "node scripts/e2e-hypercore-staking.mjs",
+    "start:data": "node bin/desk-server.mjs",
+    "start:public": "node bin/oracle-public-server.mjs",
+    "scan:public-apis": "node scripts/public-api-scan.mjs",
+    "health": "node -e \"import('./src/data/desk-data.mjs').then(m=>m.data.health().then(h=>console.log(JSON.stringify(h,null,2))))\"",
+    "init": "node bin/oracle-init.mjs",
+    "init:apply": "node bin/oracle-init.mjs --apply",
+    "scan": "node bin/oracle-scan.mjs",
+    "verify:venues": "node scripts/verify-v3-venues.mjs",
+    "route": "node bin/oracle-route.mjs",
+    "scan:secrets": "node scripts/secret-scan.mjs",
+    "test:count": "node scripts/check-test-count.mjs",
+    "test:count:update": "node scripts/check-test-count.mjs --update",
+    "test:protocol-templates": "RUN_PROTOCOL_TEMPLATE_TESTS=1 node --test test/protocol-templates.test.mjs",
+    "protocol:gate": "node scripts/protocol-template-gate.mjs",
+    "gate:docs": "node scripts/check-doc-drift.mjs",
+    "gate:release": "npm run gate:docs && node --test test/flag-polarity.test.mjs",
+    "build:dist": "node scripts/build-dist.mjs",
+    "verify:dist": "node scripts/verify-dist.mjs",
+    "publish:dist": "ORACLE_PUBLISH_STAGED=1 node scripts/publish-dist.mjs",
+    "prepublishOnly": "node scripts/guard-publish.mjs"
   },
   "dependencies": {
     "@msgpack/msgpack": "^3.1.3",
@@ -66,12 +92,32 @@
     "viem": "^2.55.8"
   },
   "files": [
-    "dist/",
+    "bin/",
+    "src/",
+    "!src/**/__pycache__/**",
+    "profiles/",
+    "skills/",
+    "skins/",
+    "plugins/",
     "public/",
     "artifacts/",
     "README.md",
     "SETUP.md",
     "LICENSE",
-    "SECURITY.md"
-  ]
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "docs/",
+    "examples/",
+    "scripts/",
+    "protocols/templates/**/src/**",
+    "protocols/templates/**/test/**",
+    "protocols/templates/**/foundry.toml",
+    "protocols/templates/**/remappings.txt",
+    "protocols/templates/**/SECURITY.md",
+    "src/protocol-templates/**"
+  ],
+  "devDependencies": {
+    "@scure/bip39": "^1.6.0",
+    "esbuild": "^0.28.1"
+  }
 }

package/plugins/oracle-owner-gate/__init__.py

@@ -0,0 +1,288 @@
+"""Hermes owner and raw-message intent gate for Oracle execution tools.
+
+This is a routing guard, not a signer.  Local Operator policy remains the
+final authority for every signature and broadcast.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from collections import OrderedDict
+from pathlib import Path
+from typing import Any, Dict, Optional, Tuple
+
+_MAX_SESSIONS = 256
+_TURNS: "OrderedDict[str, Dict[str, Any]]" = OrderedDict()
+
+_PROTECTED = {
+    "oracle_watch_create": "alert_only",
+    "oracle_control_arm": "execute",
+    "oracle_control_confirm": "execute",
+    "oracle_action_cancel": "cancel",
+    "oracle_action_list": "owner_read",
+    "oracle_action_status": "owner_read",
+    "oracle_operator_sign": "sign",
+    "oracle_operator_send": "send",
+    "oracle_operator_execute": "send",
+    "exec_arm": "execute",
+    "exec_disarm": "cancel",
+    "evm_sign": "sign",
+    "evm_send": "send",
+    "bitcoin_sign": "sign",
+    "bitcoin_send": "send",
+    "bitcoin_inscribe_sign_commit": "sign",
+    "bitcoin_inscribe_sign_reveal": "sign",
+    "bitcoin_satflow_broadcast_purchase": "send",
+    "solana_sign": "sign",
+    "solana_send": "send",
+    "evm_cow_order_sign": "sign",
+    "evm_cow_order_submit": "send",
+    "evm_cow_order_cancel_sign": "sign",
+    "evm_cow_order_cancel_submit": "send",
+    # The address book is durable state a later send can be routed against, so
+    # writes are owner-only. Reads stay open to the owner's own sessions.
+    "address_book_remember": "owner_write",
+    "address_book_forget": "owner_write",
+    "address_book_list": "owner_read",
+    "address_book_lookup": "owner_read",
+}
+
+_EXEC_NAMESPACE_MARKERS = ("mad_exec_", "oracle_exec_", "oracle_control_")
+_EXEC_OWNER_READ_OPERATIONS = {
+    "bitcoin_decode",
+    "bitcoin_exec_status",
+    "bitcoin_inscribe_prepare",
+    "bitcoin_inscribe_status",
+    "bitcoin_prepare",
+    "bitcoin_runes_prepare_transfer",
+    "bitcoin_satflow_prepare_list",
+    "bitcoin_satflow_prepare_purchase",
+    "evm_chains",
+    "evm_cow_order_cancel_prepare",
+    "evm_cow_order_prepare",
+    "evm_cow_order_status",
+    "evm_cow_order_verify",
+    "evm_erc20_allowance",
+    "evm_erc20_revoke_prepare",
+    "evm_gmx_order_prepare",
+    "evm_gmx_order_verify",
+    "evm_morpho_vault_prepare",
+    "evm_prepare",
+    "evm_protocol_prepare",
+    "evm_protocol_quote",
+    "evm_quote",
+    "evm_simulate",
+    "evm_status",
+    "evm_verify_tx",
+    "solana_decode",
+    "solana_exec_status",
+}
+
+_LEADING_INTENT = re.compile(
+    r"^\s*(watch|ping|arm\s+confirm|arm|cancel|disarm|sign|send|execute)(?=$|[\s:,.!?;\-])",
+    re.IGNORECASE,
+)
+
+
+def _config_path() -> Path:
+    override = os.environ.get("ORACLE_CONFIG_DIR")
+    root = Path(override).expanduser() if override else Path.home() / ".config" / "oracle"
+    return root / "owner.json"
+
+
+def _read_config() -> Optional[Dict[str, Any]]:
+    path = _config_path()
+    try:
+        if path.stat().st_mode & 0o077:
+            return None
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError, TypeError):
+        return None
+    return value if isinstance(value, dict) else None
+
+
+def _strings(value: Any) -> set[str]:
+    if isinstance(value, str):
+        return {value.strip()} if value.strip() else set()
+    if isinstance(value, (list, tuple, set)):
+        return {str(item).strip() for item in value if str(item).strip()}
+    return set()
+
+
+def _owner_ids(config: Dict[str, Any], platform: str) -> set[str]:
+    """Accept the public flat form plus convenient per-platform mappings."""
+    result = set()
+    canonical = config.get("owner")
+    if isinstance(canonical, str) and ":" in canonical:
+        owner_platform, owner_id = canonical.split(":", 1)
+        if owner_platform.strip().lower() == platform and owner_id.strip():
+            result.add(owner_id.strip())
+    for key in ("owner_ids", "ownerIds", "owners"):
+        value = config.get(key)
+        if isinstance(value, dict):
+            result |= _strings(value.get(platform))
+            result |= _strings(value.get("*"))
+        else:
+            result |= _strings(value)
+    platforms = config.get("platforms")
+    if isinstance(platforms, dict):
+        entry = platforms.get(platform)
+        if isinstance(entry, dict):
+            result |= _strings(entry.get("owner_ids"))
+            result |= _strings(entry.get("owners"))
+        else:
+            result |= _strings(entry)
+    return result
+
+
+def _local_cli_allowed(config: Dict[str, Any]) -> bool:
+    value = config.get("local_cli", config.get("localCli", config.get("allow_local_cli", False)))
+    if isinstance(value, dict):
+        value = value.get("allow", value.get("owner", value.get("enabled", False)))
+    return value is True or (isinstance(value, str) and value.lower() in {"allow", "owner", "enabled", "true"})
+
+
+def _intent(raw_message: Any) -> str:
+    if not isinstance(raw_message, str):
+        return "none"
+    match = _LEADING_INTENT.match(raw_message)
+    if not match:
+        return "none"
+    command = " ".join(match.group(1).lower().split())
+    if command in {"watch", "ping"}:
+        return "alert_only"
+    if command in {"arm", "arm confirm"}:
+        return "execute"
+    if command in {"cancel", "disarm"}:
+        return "cancel"
+    if command == "sign":
+        return "sign"
+    return "send"
+
+
+def _tool_class(tool_name: Any) -> Optional[str]:
+    # MCP adapters use several separators.  Collapsing all non-alphanumerics
+    # lets us compare the authoritative suffix without trusting the prefix.
+    normalized = re.sub(r"[^a-z0-9]+", "_", str(tool_name or "").lower()).strip("_")
+    for suffix, tool_class in _PROTECTED.items():
+        if normalized == suffix or normalized.endswith("_" + suffix):
+            return tool_class
+    # Tool catalogs grow faster than this plugin's explicit list. Once a tool
+    # is in a signer/executor namespace, an unknown operation must not become
+    # guest-accessible merely because its name is new. Only exact, reviewed
+    # read/quote/simulate/prepare operation names get frictionless OWNER access;
+    # every unknown operation requires owner send/execute intent and still
+    # faces the signer-owned final policy.
+    for marker in _EXEC_NAMESPACE_MARKERS:
+        marker_at = normalized.find(marker)
+        if marker_at < 0:
+            continue
+        operation = normalized[marker_at + len(marker):]
+        words = set(operation.split("_"))
+        if "sign" in words:
+            return "sign"
+        if words & {"send", "submit", "broadcast", "execute"}:
+            return "send"
+        if operation in _EXEC_OWNER_READ_OPERATIONS:
+            return "owner_read"
+        return "send"
+    return None
+
+
+def _identity(config: Optional[Dict[str, Any]], platform: str, sender_id: str) -> Tuple[bool, str]:
+    if config is None:
+        return False, "owner configuration is unavailable"
+    platform = platform.strip().lower()
+    sender_id = sender_id.strip()
+    if platform in {"cli", "local", "terminal"}:
+        if _local_cli_allowed(config):
+            return True, ""
+        return False, "local CLI is not authorized by owner policy"
+    if not sender_id:
+        return False, "gateway sender identity is missing"
+    if sender_id not in _owner_ids(config, platform):
+        return False, "sender is not an owner"
+    return True, ""
+
+
+def _block(reason: str) -> Dict[str, str]:
+    return {"action": "block", "message": "Oracle owner gate: " + reason + "."}
+
+
+def _on_pre_llm_call(
+    session_id: str = "",
+    sender_id: str = "",
+    platform: str = "",
+    user_message: Any = "",
+    parent_session_id: str = "",
+    **_: Any,
+) -> None:
+    """Snapshot only Hermes-trusted turn metadata and the original user input."""
+    session_id = str(session_id or "").strip()
+    if not session_id:
+        return None
+    _TURNS[session_id] = {
+        "session_id": session_id,
+        "parent_session_id": str(parent_session_id or "").strip(),
+        "sender_id": str(sender_id or "").strip(),
+        "platform": str(platform or "").strip().lower(),
+        "raw_message": user_message if isinstance(user_message, str) else "",
+        "intent": _intent(user_message),
+    }
+    _TURNS.move_to_end(session_id)
+    while len(_TURNS) > _MAX_SESSIONS:
+        _TURNS.popitem(last=False)
+    return None
+
+
+def _on_pre_tool_call(tool_name: str = "", session_id: str = "", **_: Any) -> Optional[Dict[str, str]]:
+    required = _tool_class(tool_name)
+    if required is None:
+        return None
+    session_id = str(session_id or "").strip()
+    turn = _TURNS.get(session_id)
+    if turn is None:
+        return _block("no trusted current-turn owner message exists for this session")
+    if turn["parent_session_id"]:
+        return _block("delegated and background sessions cannot execute or sign")
+    allowed, reason = _identity(_read_config(), turn["platform"], turn["sender_id"])
+    if not allowed:
+        return _block(reason)
+    if required == "owner_read":
+        return None
+    if required == "owner_write":
+        # Owner-authenticated bookkeeping. It records a label; it does not move
+        # value and does not need a leading execution verb like `arm`.
+        return None
+    intent = turn["intent"]
+    if intent != required:
+        labels = {
+            "alert_only": "watch or ping",
+            "execute": "arm",
+            "cancel": "cancel or disarm",
+            "sign": "sign",
+            "send": "send or execute",
+        }
+        return _block(f"raw owner intent does not authorize {required}; start the message with {labels[required]}")
+    return None
+
+
+def _on_session_end(session_id: str = "", **_: Any) -> None:
+    _TURNS.pop(str(session_id or "").strip(), None)
+
+
+def _on_session_reset(session_id: str = "", **_: Any) -> None:
+    session_id = str(session_id or "").strip()
+    if session_id:
+        _TURNS.pop(session_id, None)
+    else:
+        _TURNS.clear()
+
+
+def register(ctx: Any) -> None:
+    ctx.register_hook("pre_llm_call", _on_pre_llm_call)
+    ctx.register_hook("pre_tool_call", _on_pre_tool_call)
+    ctx.register_hook("on_session_end", _on_session_end)
+    ctx.register_hook("on_session_reset", _on_session_reset)

package/plugins/oracle-owner-gate/plugin.yaml

@@ -0,0 +1,9 @@
+name: oracle-owner-gate
+version: "0.1.0"
+description: "Owner-identity and raw-turn intent gate for Oracle execution tools."
+author: "Oracle contributors"
+hooks:
+  - pre_llm_call
+  - pre_tool_call
+  - on_session_end
+  - on_session_reset

package/{dist/assets/profiles → profiles}/oracle/SOUL.md

@@ -8,20 +8,6 @@ You are the owner. This is your private instance. All other senders are denied.
 
 To add other users as senders, configure your Telegram/Discord allowed chats.
 
-## Tool safety gates
-
-These tools modify state that persists across sessions. Never use them
-unless you explicitly direct yourself to:
-
-- `skill_manage` — creates, edits, or deletes skills. Only act when you name
-  the exact skill and action in your message.
-- `cronjob` — creates, updates, or removes scheduled jobs. Only act when you
-  name the exact job and schedule in your message.
-- `memory` — writes to persistent memory. Only save facts you explicitly state.
-
-Never create, edit, or delete skills/cron jobs speculatively
-or as part of a \"cleanup\" pass without your explicit direction.
-
 ## What you own
 
 Deciding *which lane* handles a request, then synthesizing what comes back. You

package/protocols/templates/safe-erc20/SECURITY.md

@@ -0,0 +1,16 @@
+# SafeERC20 template security notice
+
+**Not a paid security-firm audit.**
+
+This template is:
+- fixed-supply ERC20
+- Ownable2Step + pause
+- no tax / blacklist / upgrade proxy
+- covered by Foundry unit tests in `test/`
+
+Before mainnet capital:
+1. Keep or expand Foundry tests green
+2. Run static analysis (Slither/Aderyn) if available
+3. Book an independent Solidity auditor for any real TVL
+
+Oracle only prepares unsigned deploys after the JS gate confirms `forge test` passes.

package/protocols/templates/safe-erc20/foundry.toml

@@ -0,0 +1,12 @@
+[profile.default]
+src = "src"
+out = "out"
+libs = ["lib"]
+solc = "0.8.24"
+optimizer = true
+optimizer_runs = 200
+ffi = false
+fs_permissions = [{ access = "read", path = "./" }]
+
+[fmt]
+line_length = 100

package/protocols/templates/safe-erc20/remappings.txt

@@ -0,0 +1,2 @@
+@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/
+forge-std/=lib/forge-std/src/

package/protocols/templates/safe-erc20/src/SafeERC20.sol

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+
+import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
+import {ERC20Pausable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Pausable.sol";
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
+
+/**
+ * @title SafeERC20
+ * @notice Opinionated fixed-supply ERC20 for Oracle protocol-builder v1.
+ *
+ * Security posture (templates, NOT a firm audit):
+ * - Fixed supply minted once to `initialHolder` in constructor (no hidden mint).
+ * - Ownable2Step ownership (no single-tx accidental transfer).
+ * - Pausable emergency stop (owner only).
+ * - No transfer tax, no blacklist, no max-tx, no trading cooldown.
+ * - No upgradeability / no proxy.
+ * - Burn optional by holders only (ERC20Burnable).
+ *
+ * This is a reviewed starter template with Foundry tests. It is NOT a paid
+ * security-firm audit. Do not put mainnet TVL on custom forks without one.
+ */
+contract SafeERC20 is ERC20, ERC20Burnable, ERC20Pausable, Ownable2Step {
+    constructor(
+        string memory name_,
+        string memory symbol_,
+        uint256 initialSupply,
+        address initialHolder,
+        address initialOwner
+    ) ERC20(name_, symbol_) Ownable(initialOwner) {
+        require(initialHolder != address(0), "SafeERC20: holder zero");
+        require(initialOwner != address(0), "SafeERC20: owner zero");
+        require(initialSupply > 0, "SafeERC20: supply zero");
+        _mint(initialHolder, initialSupply);
+    }
+
+    function pause() external onlyOwner {
+        _pause();
+    }
+
+    function unpause() external onlyOwner {
+        _unpause();
+    }
+
+    function _update(address from, address to, uint256 value)
+        internal
+        override(ERC20, ERC20Pausable)
+    {
+        super._update(from, to, value);
+    }
+}

package/protocols/templates/safe-erc20/test/SafeERC20.t.sol

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+
+import {Test} from "forge-std/Test.sol";
+import {SafeERC20} from "../src/SafeERC20.sol";
+
+contract SafeERC20Test is Test {
+    SafeERC20 internal token;
+    address internal owner = makeAddr("owner");
+    address internal holder = makeAddr("holder");
+    address internal alice = makeAddr("alice");
+    address internal bob = makeAddr("bob");
+
+    uint256 internal constant SUPPLY = 1_000_000 ether;
+
+    function setUp() public {
+        token = new SafeERC20("Safe", "SAFE", SUPPLY, holder, owner);
+    }
+
+    function test_fixedSupply_noHiddenMint() public view {
+        assertEq(token.totalSupply(), SUPPLY);
+        assertEq(token.balanceOf(holder), SUPPLY);
+        assertEq(token.balanceOf(owner), 0);
+    }
+
+    function test_transfer_noTax() public {
+        vm.prank(holder);
+        token.transfer(alice, 100 ether);
+        assertEq(token.balanceOf(alice), 100 ether);
+        assertEq(token.balanceOf(holder), SUPPLY - 100 ether);
+    }
+
+    function test_pause_blocksTransfers() public {
+        vm.prank(owner);
+        token.pause();
+        vm.prank(holder);
+        vm.expectRevert();
+        token.transfer(alice, 1 ether);
+    }
+
+    function test_onlyOwner_canPause() public {
+        vm.prank(alice);
+        vm.expectRevert();
+        token.pause();
+    }
+
+    function test_ownable2Step_requiresAccept() public {
+        vm.prank(owner);
+        token.transferOwnership(alice);
+        // still owner until accept
+        assertEq(token.owner(), owner);
+        vm.prank(alice);
+        token.acceptOwnership();
+        assertEq(token.owner(), alice);
+    }
+
+    function test_burn_reducesSupply() public {
+        vm.prank(holder);
+        token.burn(10 ether);
+        assertEq(token.totalSupply(), SUPPLY - 10 ether);
+    }
+
+    function test_rejectZeroHolder() public {
+        vm.expectRevert(bytes("SafeERC20: holder zero"));
+        new SafeERC20("X", "X", SUPPLY, address(0), owner);
+    }
+
+    function test_rejectZeroSupply() public {
+        vm.expectRevert(bytes("SafeERC20: supply zero"));
+        new SafeERC20("X", "X", 0, holder, owner);
+    }
+}

package/public/oracle-splash/_variants/ice.html

@@ -958,7 +958,7 @@ footer{margin-top:clamp(72px,12vh,120px);border-top:1px solid var(--line);paddin
      <a class="enter-cta primary" href="/downloads/">Download beta</a>
      <a class="enter-cta ghost" href="#cli">See the CLI</a>
     </div>
-    <p class="hero-note-line">macOS · Windows · Linux &nbsp;/&nbsp; desktop app or holder-gated CLI</p>
+    <p class="hero-note-line">macOS · Windows · Linux &nbsp;/&nbsp; public CLI and desktop beta</p>
    </div>
 
    <figure class="hero-product">
@@ -997,8 +997,8 @@ footer{margin-top:clamp(72px,12vh,120px);border-top:1px solid var(--line);paddin
  <p class="section-label rv">Oracle CLI</p>
  <h2 class="section-title rv">One surface. <em>Every chain.</em></h2>
  <div class="cli-install rv">
-  <div class="cli-install-cmd"><code>oracle gate status</code></div>
-  <p class="cli-install-gate"><b>Locals Only access</b> The CLI checks your agent wallet, or a wallet you import, for a <a href="https://opensea.io/collection/locals-only-hyperevm" target="_blank" rel="noopener noreferrer">Locals Only</a> NFT. It is a client-side check on software you run, so treat it as who the build is for, not as a security boundary. Keys and signing never live in the public package.</p>
+  <div class="cli-install-cmd"><code>npm i -g @oracle-agent/oracle</code></div>
+  <p class="cli-install-gate"><b>Locals Only</b> holders get 0% Oracle integrator fees. Everyone gets the same public CLI, desktop, source, and prepare-only product access.</p>
  </div>
  <p class="section-lede rv">The real Oracle shell, isolated from desktop chrome. Pin the active surface with <code style="color:var(--blue2)">/chain hyperliquid</code>, switch models with <code style="color:var(--blue2)">/model</code>, then ask naturally.</p>
  <div class="convert-grid rv">

package/public/oracle-splash/_variants/ivory.html

@@ -960,7 +960,7 @@ footer{margin-top:clamp(72px,12vh,120px);border-top:1px solid var(--line);paddin
      <a class="enter-cta primary" href="/downloads/">Download beta</a>
      <a class="enter-cta ghost" href="#cli">See the CLI</a>
     </div>
-    <p class="hero-note-line">macOS · Windows · Linux &nbsp;/&nbsp; desktop app or holder-gated CLI</p>
+    <p class="hero-note-line">macOS · Windows · Linux &nbsp;/&nbsp; public CLI and desktop beta</p>
    </div>
 
    <figure class="hero-product">
@@ -999,8 +999,8 @@ footer{margin-top:clamp(72px,12vh,120px);border-top:1px solid var(--line);paddin
  <p class="section-label rv">Oracle CLI</p>
  <h2 class="section-title rv">One surface. <em>Every chain.</em></h2>
  <div class="cli-install rv">
-  <div class="cli-install-cmd"><code>oracle gate status</code></div>
-  <p class="cli-install-gate"><b>Locals Only access</b> The CLI checks your agent wallet, or a wallet you import, for a <a href="https://opensea.io/collection/locals-only-hyperevm" target="_blank" rel="noopener noreferrer">Locals Only</a> NFT. It is a client-side check on software you run, so treat it as who the build is for, not as a security boundary. Keys and signing never live in the public package.</p>
+  <div class="cli-install-cmd"><code>npm i -g @oracle-agent/oracle</code></div>
+  <p class="cli-install-gate"><b>Locals Only</b> holders get 0% Oracle integrator fees. Everyone gets the same public CLI, desktop, source, and prepare-only product access.</p>
  </div>
  <p class="section-lede rv">The real Oracle shell, isolated from desktop chrome. Pin the active surface with <code style="color:var(--blue2)">/chain hyperliquid</code>, switch models with <code style="color:var(--blue2)">/model</code>, then ask naturally.</p>
  <div class="convert-grid rv">