@oracle-agent/oracle 0.13.1 → 0.14.1

package/scripts/e2e-solana-bitcoin.mjs

@@ -0,0 +1,183 @@
+// Oracle end-to-end LIVE lane probe: Solana + Bitcoin.
+// Read/quote/prepare/simulate only. No signing. No broadcast. No keys required.
+//
+// Run: node scripts/e2e-solana-bitcoin.mjs
+// Exit 0 = every mandatory lane answered live. Optional keyed lanes are reported, not failed.
+
+import { data as desk } from "../src/data/desk-data.mjs";
+import { jupiterQuote, jupiterPrepareSwap, SOL_MINT, USDC_MINT } from "../src/data/providers/jupiter.mjs";
+import { solanaSimulateTransaction } from "../src/data/providers/solana-rpc.mjs";
+import { magicEdenSolStats, magicEdenSolListings, magicEdenSolPrepareBuy } from "../src/data/providers/magiceden-sol.mjs";
+
+const PROBE_WALLET = process.env.ORACLE_E2E_SOL_PUBKEY || "DtM6A1ivwvFeT14f7ggTAGvpUTZA5LeutV3rLe8wR6U3";
+const PROBE_BTC = process.env.ORACLE_E2E_BTC_ADDRESS || "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq";
+
+const results = [];
+function record(lane, status, detail) {
+  results.push({ lane, status, detail });
+  const tag = status === "ok" ? "OK  " : status === "keyed" ? "KEY " : "FAIL";
+  console.log(`${tag} ${lane} :: ${detail}`);
+}
+
+async function run(lane, fn, { optional = false } = {}) {
+  try {
+    const detail = await fn();
+    record(lane, "ok", detail);
+    return true;
+  } catch (error) {
+    const message = String(error?.message || error).slice(0, 140);
+    record(lane, optional ? "keyed" : "fail", message);
+    return optional;
+  }
+}
+
+console.log("== SOLANA ==");
+
+await run("solana.rpc.health", async () => {
+  const health = await desk.solana.health();
+  if (!health?.ok) throw new Error(`rpc unhealthy ${JSON.stringify(health).slice(0, 80)}`);
+  return `cluster ok slot lane live`;
+});
+
+await run("solana.rpc.balance", async () => {
+  const bal = await desk.solana.balance(PROBE_WALLET);
+  return `lamports=${bal?.lamports ?? bal?.value ?? "n/a"}`;
+});
+
+await run("solana.rpc.tokenAccounts", async () => {
+  const accounts = await desk.solana.tokenAccounts({ owner: PROBE_WALLET });
+  return `accounts=${accounts?.accounts?.length ?? 0}`;
+});
+
+let jupQuote = null;
+await run("solana.jupiter.quote(SOL->USDC)", async () => {
+  jupQuote = await jupiterQuote({ inputMint: SOL_MINT, outputMint: USDC_MINT, amount: "10000000", slippageBps: 50 });
+  const g = jupQuote.solanaGuard;
+  if (jupQuote.executionReady !== false) throw new Error("quote must not be executionReady");
+  if (g.slippageBps > 100) throw new Error("slippage cap breached");
+  return `out=${jupQuote.quote.outAmount} bps=${g.slippageBps} expires=${g.expiresAtMs - g.quotedAtMs}ms execReady=false`;
+});
+
+await run("solana.jupiter.slippageCap", async () => {
+  try {
+    await jupiterQuote({ inputMint: SOL_MINT, outputMint: USDC_MINT, amount: "10000000", slippageBps: 500 });
+  } catch (error) {
+    return `rejected 500bps: ${String(error.message).slice(0, 60)}`;
+  }
+  throw new Error("500 bps was NOT rejected");
+});
+
+let jupPrepared = null;
+await run("solana.jupiter.prepareSwap", async () => {
+  jupPrepared = await jupiterPrepareSwap({
+    quoteResponse: jupQuote.quote,
+    userPublicKey: PROBE_WALLET,
+  });
+  if (jupPrepared.signingReady !== false || jupPrepared.broadcastReady !== false) throw new Error("prepare leaked signing/broadcast readiness");
+  if (!jupPrepared.requiresUserSignature) throw new Error("prepare must require user signature");
+  return `tx=${jupPrepared.swapTransaction.length}b64 requiresUserSig=true signingReady=false broadcastReady=false`;
+});
+
+await run("solana.rpc.simulate(preparedSwap)", async () => {
+  const sim = await solanaSimulateTransaction({ transaction: jupPrepared.swapTransaction, sigVerify: false });
+  const err = sim?.err ?? sim?.value?.err ?? sim?.raw?.value?.err ?? null;
+  const units = sim?.unitsConsumed ?? sim?.value?.unitsConsumed ?? sim?.raw?.value?.unitsConsumed ?? null;
+  return `err=${JSON.stringify(err)} unitsConsumed=${units}`;
+});
+
+await run("solana.nft.magiceden.stats", async () => {
+  const stats = await magicEdenSolStats({ symbol: "mad_lads" });
+  if (!(stats.floorPriceSol > 0)) throw new Error("no floor");
+  return `floor=${stats.floorPriceSol} SOL listed=${stats.listedCount}`;
+});
+
+let meListing = null;
+await run("solana.nft.magiceden.listings", async () => {
+  const out = await magicEdenSolListings({ symbol: "mad_lads", limit: 1 });
+  meListing = out.listings[0];
+  if (!meListing?.tokenMint) throw new Error("no listing");
+  return `mint=${meListing.tokenMint.slice(0, 8)}.. price=${meListing.priceSol} SOL seller=${meListing.seller.slice(0, 6)}..`;
+});
+
+await run(
+  "solana.nft.magiceden.prepareBuy",
+  async () => {
+    const prep = await magicEdenSolPrepareBuy({
+      buyer: PROBE_WALLET,
+      seller: meListing.seller,
+      auctionHouse: meListing.auctionHouse,
+      tokenMint: meListing.tokenMint,
+      tokenATA: meListing.tokenATA,
+      priceSol: meListing.priceSol,
+    });
+    if (prep.broadcastReady !== false) throw new Error("prepare leaked broadcast readiness");
+    return `tx prepared bytes=${String(prep.transaction || "").length} requiresUserSig=${prep.requiresUserSignature}`;
+  },
+  { optional: true }
+);
+
+console.log("== BITCOIN ==");
+
+await run("bitcoin.esplora.health", async () => {
+  const h = await desk.bitcoin.health();
+  if (!h?.ok) throw new Error("esplora unhealthy");
+  return `ok tip lane live`;
+});
+
+await run("bitcoin.esplora.tipHeight", async () => {
+  const t = await desk.bitcoin.tipHeight();
+  const height = t?.height ?? t?.tipHeight ?? t;
+  if (!Number(height)) throw new Error("no tip height");
+  return `tip=${height}`;
+});
+
+await run("bitcoin.esplora.fees", async () => {
+  const f = await desk.bitcoin.fees();
+  const fast = f?.fastestFee ?? f?.fees?.fastestFee ?? f?.["1"] ?? null;
+  return `fastest=${JSON.stringify(fast)}`;
+});
+
+await run("bitcoin.esplora.address", async () => {
+  const a = await desk.bitcoin.address(PROBE_BTC);
+  const funded = a?.chainStats?.fundedTxoSum ?? a?.balanceSats ?? a?.raw?.chain_stats?.funded_txo_sum ?? null;
+  return `fundedSats=${funded}`;
+});
+
+await run("bitcoin.esplora.utxos", async () => {
+  const u = await desk.bitcoin.utxos(PROBE_BTC);
+  const n = u?.utxos?.length ?? u?.length ?? 0;
+  return `utxos=${n}`;
+});
+
+await run("bitcoin.meta.health", async () => {
+  const h = await desk.bitcoin.metaHealth();
+  return `ok=${h?.ok} tier=${h?.tier ?? h?.mode ?? "keyless"}`;
+});
+
+await run(
+  "bitcoin.meta.inscriptionInfo",
+  async () => {
+    const info = await desk.bitcoin.inscriptions(PROBE_BTC);
+    return `inscriptions=${info?.inscriptions?.length ?? "unknown"}`;
+  },
+  { optional: true }
+);
+
+await run(
+  "bitcoin.satflow.health",
+  async () => {
+    const h = await desk.bitcoin.satflowHealth();
+    if (!h?.ok) throw new Error(`satflow ${JSON.stringify(h).slice(0, 90)}`);
+    return `ok`;
+  },
+  { optional: true }
+);
+
+const failed = results.filter((r) => r.status === "fail");
+const keyed = results.filter((r) => r.status === "keyed");
+console.log(`\nlanes=${results.length} ok=${results.length - failed.length - keyed.length} keyed=${keyed.length} failed=${failed.length}`);
+if (failed.length) {
+  console.log(`FAILED: ${failed.map((f) => f.lane).join(", ")}`);
+  process.exit(1);
+}
+console.log("E2E OK: every mandatory Solana + Bitcoin lane answered live, prepare-only posture held.");

package/scripts/guard-publish.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// prepublishOnly guard.
+//
+// `npm publish` run directly in packages/oracle would ship src/ — 36k lines of
+// readable source. Publishing must go through scripts/publish-dist.mjs, which
+// packs the bundled stage instead. That script sets ORACLE_PUBLISH_STAGED=1.
+//
+// This is a guard, not a policy decision: it fails closed on the accident.
+
+if (process.env.ORACLE_PUBLISH_STAGED === "1") process.exit(0);
+
+console.error(`
+REFUSING to publish from the source tree.
+
+  Publishing here would ship src/ (readable source) to npm.
+
+  Use:  npm run publish:dist -- --publish
+
+  That builds the bundle, verifies export parity, stages a clean directory
+  with a rewritten manifest, and publishes that instead.
+`);
+process.exit(1);

package/scripts/protocol-template-gate.mjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { listProtocolTemplates, runProtocolTemplateGate } from "../src/protocol-templates/gate.mjs";
+
+const id = process.argv[2];
+if (!id || id === "list") {
+  console.log(JSON.stringify(listProtocolTemplates(), null, 2));
+  process.exit(0);
+}
+try {
+  const r = runProtocolTemplateGate(id, { allowSkipStatic: process.env.REQUIRE_SLITHER !== "1" });
+  console.log(JSON.stringify(r, null, 2));
+} catch (e) {
+  console.error(String(e.message || e));
+  process.exit(1);
+}

package/scripts/public-api-scan.mjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import path from "node:path";
+import { scanPublicApis } from "../src/data/public-api-scan.mjs";
+
+const args = process.argv.slice(2);
+const value = (flag) => {
+  const i = args.indexOf(flag);
+  return i >= 0 ? args[i + 1] : null;
+};
+const outPath = value("--out");
+const timeoutMs = Number(value("--timeout-ms") || 12_000);
+const providers = value("--providers")?.split(",").map((x) => x.trim()).filter(Boolean);
+
+const report = await scanPublicApis({ providers, timeoutMs });
+const json = `${JSON.stringify(report, null, 2)}\n`;
+if (outPath) {
+  const target = path.resolve(outPath);
+  await fs.mkdir(path.dirname(target), { recursive: true });
+  await fs.writeFile(target, json, "utf8");
+  console.error(`wrote ${target}`);
+}
+process.stdout.write(json);

package/scripts/publish-dist.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// Stage and publish the BUNDLED package.
+//
+// Publishing from packages/oracle directly would ship src/ (36k readable lines).
+// This builds dist/, verifies export parity against source, stages a clean
+// directory with a rewritten manifest, and publishes from there. The source
+// tree is never the thing that gets packed.
+//
+//   node scripts/publish-dist.mjs            # pack only, leaves the tarball
+//   node scripts/publish-dist.mjs --publish  # actually publish to npm
+
+import { execFileSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const STAGE = join(ROOT, ".publish-stage");
+const doPublish = process.argv.includes("--publish");
+
+const run = (cmd, args, cwd = ROOT) =>
+  execFileSync(cmd, args, { cwd, stdio: "inherit", env: { ...process.env } });
+
+console.log("→ building bundle");
+run("node", [join(ROOT, "scripts/build-dist.mjs")]);
+
+console.log("→ verifying export parity against source");
+run("node", [join(ROOT, "scripts/verify-dist.mjs")]);
+
+console.log("→ staging");
+if (existsSync(STAGE)) rmSync(STAGE, { recursive: true });
+mkdirSync(STAGE, { recursive: true });
+
+const manifest = JSON.parse(readFileSync(join(ROOT, "dist/package.publish.json"), "utf8"));
+cpSync(join(ROOT, "dist"), join(STAGE, "dist"), { recursive: true });
+rmSync(join(STAGE, "dist/package.publish.json"), { force: true });
+
+for (const asset of ["public", "artifacts"]) {
+  if (existsSync(join(ROOT, asset))) {
+    cpSync(join(ROOT, asset), join(STAGE, asset), { recursive: true });
+  }
+}
+for (const doc of ["README.md", "SETUP.md", "LICENSE", "SECURITY.md"]) {
+  if (existsSync(join(ROOT, doc))) cpSync(join(ROOT, doc), join(STAGE, doc));
+}
+writeFileSync(join(STAGE, "package.json"), JSON.stringify(manifest, null, 2) + "\n");
+
+// Fail closed: if source somehow reached the stage, do not publish it.
+const leaked = [];
+for (const forbidden of ["src", "scripts", "skills", "profiles", "test"]) {
+  if (existsSync(join(STAGE, forbidden))) leaked.push(forbidden);
+}
+if (leaked.length) {
+  console.error(`\nREFUSING: source directories reached the publish stage: ${leaked.join(", ")}`);
+  process.exit(1);
+}
+
+// Export parity proves the modules exist. It does NOT prove a bin can start:
+// 0.12.0 passed parity and still shipped two bins that crashed on first line
+// because they resolved assets relative to the wrong layout. Smoke the stage.
+console.log("→ smoking staged bins");
+run("node", [join(ROOT, "scripts/smoke-dist-bins.mjs"), STAGE]);
+
+console.log(doPublish ? "→ publishing" : "→ packing (dry, no publish)");
+run("npm", doPublish ? ["publish", "--access", "public"] : ["pack"], STAGE);
+
+console.log(`\n${doPublish ? "published" : "packed"} from ${STAGE}`);

package/scripts/record-hero-cli.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Re-record the hero CLI session. Deterministic: types a fixed script of REAL
+# commands against the REAL CLI, so the hero can never drift from what Oracle
+# actually does (the previous recording outlived a capability change and was
+# still showing hyperevm 999 as fail-closed after it started routing).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+OUT=public/oracle-splash/assets/hero
+CAST=/tmp/oracle-hero.cast
+
+type_line() {
+  local text="$1"
+  printf '%s' "$text"
+  sleep 0.5
+  printf '\n'
+}
+
+prompt() { printf '\033[38;5;110moracle\033[0m \033[38;5;245m›\033[0m '; }
+
+# ONE source of truth per command: typed on screen AND executed.
+CMD_CHAINS='scan chains'
+CMD_QUOTE='scan quote hyperevm 0x5555555555555555555555555555555555555555 0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb 1000000000000000000'
+
+run_demo() {
+  clear
+  prompt
+  type_line "$CMD_CHAINS"
+  node bin/oracle.mjs $CMD_CHAINS 2>&1 | head -20
+  echo
+  sleep 2.5
+  prompt
+  type_line "$CMD_QUOTE"
+  node bin/oracle.mjs $CMD_QUOTE 2>&1 | tail -14 || true
+  echo
+  sleep 2.5
+  prompt
+  sleep 1.5
+}
+export -f type_line prompt run_demo
+export CMD_CHAINS CMD_QUOTE
+
+rm -f "$CAST"
+asciinema rec "$CAST" --cols 104 --rows 30 --overwrite \
+  --command "bash -c run_demo" --quiet
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+agg "$CAST" "$TMP/cli.gif" \
+  --theme 0d1117,c9d1d9,000000,ff7b72,3fb950,d29922,58a6ff,bc8cff,39c5cf,b1bac4,6e7681,ffa198,56d364,e3b341,79c0ff,d2a8ff,56d4dd,f0f6fc \
+  --font-size 16 --line-height 1.4 --speed 1.0 --fps-cap 30
+
+# Two constraints, both mandatory:
+#  - format=yuv420p: agg's GIF decodes as `gbrap` (planar RGB+alpha) and
+#    libvpx-vp9 flatly refuses that pixel format. This is what actually broke the
+#    earlier encode, not the dimensions.
+#  - even width/height: yuv420p chroma subsampling requires it.
+SCALE="scale=868:-2:flags=lanczos,crop=trunc(iw/2)*2:trunc(ih/2)*2,format=yuv420p"
+
+ffmpeg -y -v error -i "$TMP/cli.gif" -vf "$SCALE" \
+  -c:v libvpx-vp9 -crf 34 -b:v 0 -an "$TMP/cli.webm"
+
+ffmpeg -y -v error -i "$TMP/cli.gif" -vf "$SCALE" \
+  -c:v libx264 -pix_fmt yuv420p -crf 24 -movflags +faststart -an "$TMP/cli.mp4"
+
+ffmpeg -y -v error -ss 6 -i "$TMP/cli.webm" -frames:v 1 -q:v 3 "$TMP/cli.jpg"
+
+# Prove every artifact before it is allowed near the shipped tree.
+for f in "$TMP/cli.webm" "$TMP/cli.mp4" "$TMP/cli.jpg"; do
+  [ -s "$f" ] || { echo "REFUSING: $f is empty, shipped assets untouched" >&2; exit 1; }
+  ffprobe -v error -show_entries stream=width,height -of csv=p=0 "$f" >/dev/null \
+    || { echo "REFUSING: $f is not decodable, shipped assets untouched" >&2; exit 1; }
+done
+
+mv "$TMP/cli.webm" "$OUT/cli-session.webm"
+mv "$TMP/cli.mp4"  "$OUT/cli-session.mp4"
+mv "$TMP/cli.jpg"  "$OUT/cli-session-poster.jpg"
+
+ffprobe -v error -show_entries format=duration,size -show_entries stream=width,height \
+  -of default=noprint_wrappers=1 "$OUT/cli-session.webm"

package/scripts/secret-scan.mjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+// Pre-publication secret scan. Fails CLOSED: any hit is an error.
+//
+// Checks the working tree and every blob reachable from HEAD. Set
+// ORACLE_SCAN_ALL_REFS=1 for an explicit audit of every fetched ref.
+
+import { execFileSync } from "node:child_process";
+import { validateMnemonic } from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english";
+
+const ROOT = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: process.cwd(), encoding: "utf8" }).trim();
+
+// Live values that must never appear. Sourced from the environment at scan
+// time so the scanner itself contains no secrets.
+function liveSecrets() {
+  const out = [];
+  const push = (label, value) => {
+    const v = String(value || "").trim();
+    if (v.length >= 8) out.push({ label, value: v });
+  };
+  for (const k of Object.keys(process.env)) {
+    if (/(_KEY|_SECRET|_TOKEN|_PASSPHRASE|_WIF|PRIVATE_KEY)$/i.test(k)) {
+      push(`env:${k}`, process.env[k]);
+    }
+  }
+  return out;
+}
+
+function isBip39Mnemonic(match) {
+  const words = match[0].trim().toLowerCase().split(/\s+/);
+  if (words.length !== 12 && words.length !== 24) return false;
+  return validateMnemonic(words.join(" "), wordlist);
+}
+
+const PATTERNS = [
+  { name: "private key (hex 64)", re: /\b(?:0x)?[0-9a-fA-F]{64}\b/, refine: (m, line) =>
+      /priv|secret|wif|seed|mnemonic|signer|wallet/i.test(line) && !/hash|digest|sha256|txid|commit|blob|sha1|0x0{40,}/i.test(line) },
+  { name: "BTC WIF", re: /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/ },
+  { name: "BIP39 seed phrase", re: /\b(?:[a-z]{3,8} ){11}(?:[a-z]{3,8})\b|\b(?:[a-z]{3,8} ){23}(?:[a-z]{3,8})\b/i, refine: isBip39Mnemonic },
+  { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "OpenAI key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/ },
+  { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+  { name: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/ },
+  { name: "PEM private key", re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { name: "Solana keypair array", re: /\[\s*(?:\d{1,3}\s*,\s*){63}\d{1,3}\s*\]/ },
+];
+
+// Paths whose matches are known-safe test fixtures.
+const ALLOWED_PATHS = [
+  /^scripts\/secret-scan\.mjs$/,
+  /^package-lock\.json$/,
+];
+
+// Literal strings that are documented, synthetic, or public by nature.
+const ALLOWED_VALUES = [
+  "0x0123456789012345678901234567890123456789012345678901234567890123", // HL SDK public test vector
+  "L1aW4aubDFB7yfras2S1mN3bqg9nwySY8nkoLmJebSLD5BWv3ENZ",
+  "/-----BEGIN[A-Z ]*PRIVATE KEY-----/",
+  '{ value: "-----BEGIN EC PRIVATE KEY-----" }',
+  "0x0000000000000000000000000000000000000000",
+];
+
+const PUBLIC_EMAIL_RE = /^(?:[0-9]+\+)?[a-z0-9_.-]+\[?bot\]?@users\.noreply\.github\.com$|^oracle@users\.noreply\.github\.com$|^noreply@github\.com$/i;
+const PRIVATE_EMAIL_RE = /@(gmail|icloud|me|yahoo|outlook|hotmail|protonmail)\.com$|@(local|gmk)$|^fleet@|^agent@/i;
+const HISTORY_SCOPE = process.env.ORACLE_SCAN_ALL_REFS === "1" ? "--all" : "HEAD";
+
+function sh(cmd, args) {
+  return execFileSync(cmd, args, { cwd: ROOT, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+}
+
+function redactSample(kind) {
+  return kind.startsWith("LIVE SECRET") ? "[REDACTED — real credential]" : "[REDACTED]";
+}
+
+function scanText(text, origin, findings) {
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length > 4000) continue;
+    for (const p of PATTERNS) {
+      const m = p.re.exec(line);
+      if (!m) continue;
+      if (ALLOWED_VALUES.some((v) => line.includes(v))) continue;
+      if (p.refine && !p.refine(m, line)) continue;
+      findings.push({ origin, line: i + 1, kind: p.name, sample: redactSample(p.name) });
+    }
+    for (const s of LIVE) {
+      if (line.includes(s.value)) {
+        findings.push({ origin, line: i + 1, kind: `LIVE SECRET ${s.label}`, sample: redactSample("LIVE SECRET") });
+      }
+    }
+  }
+}
+
+function parseEmail(identity) {
+  const match = /<([^<>\s]+)>$/.exec(identity.trim());
+  return match ? match[1].toLowerCase() : "";
+}
+
+function scanIdentities(findings) {
+  const identities = new Set(sh("git", ["log", HISTORY_SCOPE, "--format=%an <%ae>|%cn <%ce>"]).split(/[\n|]/).filter(Boolean));
+  for (const identity of identities) {
+    const email = parseEmail(identity);
+    if (!email) continue;
+    if (PRIVATE_EMAIL_RE.test(email) || !PUBLIC_EMAIL_RE.test(email)) {
+      findings.push({ origin: "git-history", line: 0, kind: "non-public git identity", sample: "[REDACTED]" });
+    }
+  }
+  return identities;
+}
+
+const LIVE = liveSecrets();
+const findings = [];
+
+// --- 1. working tree (tracked files only) ---
+const tracked = sh("git", ["ls-files"]).split("\n").filter(Boolean);
+for (const rel of tracked) {
+  if (ALLOWED_PATHS.some((r) => r.test(rel))) continue;
+  let content;
+  try {
+    content = sh("git", ["show", `:${rel}`]);
+  } catch {
+    continue; // binary or unreadable
+  }
+  if (content.includes("\u0000")) continue;
+  scanText(content, rel, findings);
+}
+
+// --- 2. every blob in history ---
+const revs = sh("git", ["rev-list", HISTORY_SCOPE]).split("\n").filter(Boolean);
+const seen = new Set();
+let historyBlobs = 0;
+for (const rev of revs) {
+  const entries = sh("git", ["ls-tree", "-r", rev]).split("\n").filter(Boolean);
+  for (const entry of entries) {
+    const [meta, path] = entry.split("\t");
+    const sha = meta.split(/\s+/)[2];
+    if (!sha || seen.has(sha)) continue;
+    seen.add(sha);
+    if (ALLOWED_PATHS.some((r) => r.test(path))) continue;
+    let content;
+    try {
+      content = sh("git", ["cat-file", "-p", sha]);
+    } catch {
+      continue;
+    }
+    if (content.includes("\u0000")) continue;
+    historyBlobs++;
+    scanText(content, `history:${rev.slice(0, 8)}:${path}`, findings);
+  }
+}
+
+// --- 3. author identity leakage ---
+const identities = scanIdentities(findings);
+
+console.log(`scanned ${tracked.length} tracked files, ${historyBlobs} historical blobs, ${revs.length} commits`);
+console.log(`live env secrets checked: ${LIVE.length}`);
+console.log(`git identities checked: ${identities.size}`);
+
+if (findings.length) {
+  console.error(`\nFAIL — ${findings.length} finding(s):`);
+  for (const f of findings.slice(0, 40)) {
+    console.error(`  ${f.origin}:${f.line}  [${f.kind}]  ${f.sample}`);
+  }
+  process.exit(1);
+}
+console.log("\nPASS — no secrets found in tree or history");

package/scripts/smoke-dist-bins.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// Spawn every published bin from the STAGED layout and fail on a startup crash.
+//
+// This gate exists because 0.12.0 shipped two bins that died at module load:
+// `oracle-data` read dist/package.json and `oracle init` read dist/profiles/,
+// neither of which exists once the package is staged. Nothing caught it because
+// verify-dist only compares export names, and every local run resolved the
+// source tree where ../package.json happens to be real. Only the staged layout
+// reproduces what a user installs, so the smoke has to run there.
+//
+//   node scripts/smoke-dist-bins.mjs <stage-dir>
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const stage = resolve(process.argv[2] || ".publish-stage");
+const manifest = JSON.parse(readFileSync(join(stage, "package.json"), "utf8"));
+
+// Servers block forever on purpose; a bounded run that reaches "listening"
+// without crashing is the pass condition for those.
+const SERVER_BINS = new Set(["oracle-data", "oracle-public"]);
+const ARGS = { "oracle-upgrade": ["--json"] };
+const FATAL = /ENOENT|Cannot find module|ERR_MODULE_NOT_FOUND|is not a function|is not defined/;
+
+let failed = 0;
+for (const [name, target] of Object.entries(manifest.bin || {})) {
+  const entry = join(stage, target);
+  if (!existsSync(entry)) {
+    console.log(`  FAIL ${name.padEnd(18)} missing entry ${target}`);
+    failed += 1;
+    continue;
+  }
+  const args = ARGS[name] || ["--help"];
+  const run = spawnSync(process.execPath, [entry, ...args], {
+    encoding: "utf8",
+    timeout: SERVER_BINS.has(name) ? 6000 : 30000,
+    env: {
+      ...process.env,
+      // A server that binds a live port would collide with a real one.
+      ORACLE_DATA_PORT: "8791",
+      ORACLE_PUBLIC_PORT: "8792",
+    },
+  });
+  const output = `${run.stdout || ""}${run.stderr || ""}`;
+  const crashed = FATAL.test(output);
+  const died = !SERVER_BINS.has(name) && run.status === null && !run.error?.code?.includes("TIMEDOUT");
+  if (crashed || died) {
+    const first = output.split("\n").filter(Boolean).slice(0, 4).join(" | ").slice(0, 200);
+    console.log(`  FAIL ${name.padEnd(18)} ${first}`);
+    failed += 1;
+    continue;
+  }
+  console.log(`  OK   ${name.padEnd(18)} started clean`);
+}
+
+// Spawning each bin directly is NOT enough. The `oracle` dispatcher resolves
+// sibling bins through its own path helper, and that helper computed
+// `<root>/bin/` — correct in the source tree, absent in the bundle. So
+// `oracle-init` started clean while `oracle init` died with MODULE_NOT_FOUND
+// for every installer. Exercise the routed form too.
+const DISPATCHED = [
+  ["init", ["init"], /Cannot find module|MODULE_NOT_FOUND/],
+  ["scan", ["scan", "chains"], /Cannot find module|MODULE_NOT_FOUND/],
+  ["route", ["route"], /Cannot find module|MODULE_NOT_FOUND/],
+  ["upgrade", ["upgrade", "--json"], /Cannot find module|MODULE_NOT_FOUND/],
+  ["fees", ["fees", "status"], /Cannot find module|MODULE_NOT_FOUND/],
+];
+const dispatcher = join(stage, (manifest.bin || {}).oracle || "");
+for (const [label, argv, fatal] of DISPATCHED) {
+  const run = spawnSync(process.execPath, [dispatcher, ...argv], {
+    encoding: "utf8",
+    timeout: 45_000,
+    env: {
+      ...process.env,
+      ORACLE_FAKE_HOME: join(stage, ".smoke-home"),
+    },
+  });
+  const output = `${run.stdout || ""}${run.stderr || ""}`;
+  if (fatal.test(output)) {
+    console.log(`  FAIL oracle ${label.padEnd(11)} ${output.split("\n").filter(Boolean).slice(0, 3).join(" | ").slice(0, 200)}`);
+    failed += 1;
+    continue;
+  }
+  console.log(`  OK   oracle ${label.padEnd(11)} dispatched clean`);
+}
+
+console.log(`\n${Object.keys(manifest.bin || {}).length} bins + ${DISPATCHED.length} dispatched commands, ${failed} broken`);
+process.exitCode = failed ? 1 : 0;