@oracle-agent/oracle 0.4.0 → 0.4.2

package/README.md

@@ -20,11 +20,11 @@ alongside it — same split we run ourselves.
 
 ## Start in 5 steps
 
-Latest: **oracle `0.3.6`** · **operator `0.6.1`**
+Latest: **oracle `0.4.1`** · **operator `0.13.6`**
 
 ```bash
 # 1) install both packages
-npm i @oracle-agent/oracle@0.3.6 @oracle-agent/operator@0.6.1
+npm i @oracle-agent/oracle@latest @oracle-agent/operator@latest
 
 # 2) put keys ONLY on your machine (example: HL/EVM hex key file)
 mkdir -p ~/.config/oracle/keys && chmod 700 ~/.config/oracle/keys
@@ -47,9 +47,13 @@ await hlSignAndSubmit(prepared, {
 ```
 
 ```bash
-# 5) unattended desk (no click each trade) — HL/Poly capped
+# 5) unattended desk (no click each trade) — capped, opt-in
 export ORACLE_AUTONOMOUS_TRADING=1
-# or: npx oracle-signer
+# or run the signer daemon: npx oracle-signer
+#
+# Daemon signing requires the SAME HMAC secret in the preparer and the signer,
+# otherwise every sign fails with "ORACLE_STAMP_HMAC_SECRET missing in signer":
+export ORACLE_STAMP_HMAC_SECRET='long-random-secret'
 ```
 
 Full vault / multi-chain / daemon detail → operator [SETUP](https://github.com/demi-hl/oracle-operator/blob/main/SETUP.md).
@@ -262,7 +266,7 @@ owner-local source lane.** The short version:
 Oracle keeps capability and authorization separate:
 
 - Public Oracle reads, quotes, simulates, and prepares unsigned artifacts.
-- The generic unattended signer remains limited to `hl` and `poly`.
+- The generic unattended signer exposes six bounded surfaces: `hl`, `poly`, `evm-swap`, `evm-bridge`, `btc`, `sol`. Each decodes its own envelope and refuses while its allowlists are empty.
 - Ordinary EVM preparation remains user-wallet signed.
 - A deployment may separately install a same-host, owner-gated EVM executor. Oracle must verify that executor before describing bounded EVM execution as available. Missing deployment capability means "unavailable here," not "Oracle can never execute EVM."
 - `watch`, `watch this`, and `ping me` always create `active: true, actionMode: alert_only`.
@@ -408,8 +412,9 @@ it — verified in practice when Odos sunset their public API mid-development
 ## Examples
 
 ```bash
-node examples/add-a-chain.mjs          # register an unseen chain, no code
-node examples/research-a-token.mjs     # honest token research on live data
+node examples/add-a-chain.mjs             # register an unseen chain, no code
+node examples/research-a-token.mjs        # honest token research on live data
+node examples/oracle-pack-template.mjs    # skeleton for a safe Oracle protocol pack
 ```
 
 ## MCP
@@ -449,7 +454,7 @@ don't imply endorsement by an official deployment when shipping a fork.
 Prefer the local signer daemon so the agent never sees the vault passphrase:
 
 ```bash
-npx oracle-signer   # has ORACLE_VAULT_PASSPHRASE
+npx oracle-signer   # reads the passphrase from the OS credential store
 # agent: ORACLE_SIGNER_URL + ORACLE_SIGNER_TOKEN only
 ```
 

package/SETUP.md

@@ -45,7 +45,7 @@ The public Oracle profile must report these as separate planes:
 | Plane | Default capability |
 |---|---|
 | Public Oracle package | read, quote, simulate, unsigned prepare |
-| Generic `oracle-signer` daemon | policy-bounded `hl` and `poly` only |
+| Generic `oracle-signer` daemon | six bounded surfaces: `hl`, `poly`, `evm-swap`, `evm-bridge`, `btc`, `sol` (each fails closed on empty allowlists) |
 | Ordinary EVM | unsigned preparation, user-wallet signature |
 | Optional owner-gated EVM executor | one exact bounded action after explicit `arm` |
 
@@ -302,7 +302,7 @@ router that knows which brain to use for which job.
 Prefer the local signer daemon so the agent never sees the vault passphrase:
 
 ```bash
-npx oracle-signer   # has ORACLE_VAULT_PASSPHRASE
+npx oracle-signer   # reads the passphrase from the OS credential store
 # agent: ORACLE_SIGNER_URL + ORACLE_SIGNER_TOKEN only
 ```
 

package/bin/oracle-data-mcp.mjs

@@ -263,7 +263,7 @@ const tools = [
   {
     name: "nft_prepare_list",
     description:
-      "Prepare an NFT listing for OpenSea EVM, Magic Eden Solana, or Satflow Bitcoin after explicit user review. Requires userConfirmed=true plus asset, marketplace, price, currency where applicable, and future expiry. Returns approval/signing actions, an unsigned Solana transaction, or an unsigned Bitcoin PSBT. Never signs, submits, or broadcasts.",
+      "Prepare an NFT listing for OpenSea EVM, Magic Eden Solana, or Satflow Bitcoin after explicit user review. Requires userConfirmed=true plus asset, marketplace, price, currency where applicable, and future expiry. Magic Eden Solana also requires confirmation exactly: list <tokenMint> on magiceden-sol for <priceSol> SOL until <expiry>. Returns approval/signing actions, an unsigned Solana transaction, or an unsigned Bitcoin PSBT. Never signs, submits, or broadcasts.",
     inputSchema: {
       type: "object",
       required: ["marketplace", "userConfirmed"],
@@ -284,7 +284,8 @@ const tools = [
         tokenATA: { type: "string" },
         auctionHouse: { type: "string" },
         priceSol: { type: "string" },
-        expiry: { description: "Future ISO 8601 timestamp or Unix seconds." },
+        expiry: { description: "Future ISO 8601 timestamp or Unix seconds. Magic Eden Solana listings require finite future expiry; no-expiry is refused." },
+        confirmation: { type: "string", description: "Required for Magic Eden Solana listings. Exact phrase: list <tokenMint> on magiceden-sol for <priceSol> SOL until <expiry>." },
         inscriptionId: { type: "string" },
         runesOutput: { type: "string" },
         ordAddress: { type: "string" },

package/docs/oracle-pack-standard.md

@@ -0,0 +1,29 @@
+# Oracle protocol pack standard
+
+An Oracle protocol pack is a package-safe ESM module that turns an intent into an unsigned action and decodes independently obtained receipts. A pack is an adapter, not a wallet, signer, broadcaster, or authority. See `examples/oracle-pack-template.mjs` for the smallest complete shape.
+
+## Required surface
+
+Every pack exports a default object with these members (named exports may mirror them):
+
+- `provider`: stable provider identity, semantic version, supported chain IDs, and provenance/trust metadata. Remote token names, symbols, descriptions, image fields, URLs, and NFT metadata remain untrusted data.
+- `prepare(intent)`: validates the intent and returns an unsigned transaction or typed action. It must not accept keys, sign, submit, broadcast, or report execution success.
+- `decode(receipt)`: validates and converts a chain/provider receipt into a documented result. Unknown or malformed receipts fail closed.
+- `riskRules`: an array or function describing enforceable limits and refusal conditions. Human-readable warnings alone are not rules.
+- `tests`: non-empty metadata naming the local test command and covered properties. Tests must be deterministic and require no credentials or network.
+
+## Prompt-injection boundary
+
+Treat every provider response and token/NFT metadata string as inert data. Never concatenate metadata into system/developer instructions, interpret it as tool directions, or let it modify recipients, calldata, limits, and policy. Render or quote it through a data channel and retain its provenance. Packs should test adversarial values such as “ignore previous instructions,” requests for secrets, and demands to sign or invoke tools.
+
+## Custody boundary
+
+Pack exports must not expose signers, wallets, private keys, seed phrases, signing functions, transaction submission, or broadcasting. `prepare` returns data to a separately authorized custody surface. Environment variables and provider credentials must not appear in prepared output, logs, errors, fixtures, or metadata. Imports should be side-effect free; merely loading a pack must not make network calls.
+
+## Receipt gate
+
+Preparation is not execution. A prepared result declares a `receiptGate` and consumers must not mark an action successful until `decode` receives a receipt from an independent, trusted transport and verifies its chain, transaction identity, status, and required confirmations. Timeouts, pending receipts, mismatches, reverts, and undecodable responses are not success.
+
+## Local adversarial benchmark
+
+Run `node scripts/adversarial-bench.mjs <pack.mjs> [...]`. It imports only the named local modules, invokes no pack functions, emits one deterministic JSON summary, and exits `1` when a gate fails (`2` for usage/load errors). It checks required surface fields, forbidden custody exports, missing test metadata, and prompt-injection strings nested in provider or pack metadata. This static public gate complements, rather than replaces, behavioral tests of preparation and receipt verification.

package/docs/profiles.md

@@ -44,7 +44,7 @@ Three practical reasons, learned the hard way:
 | `protocol-builder` | scaffold, review, prepare chain-family token/NFT collections, gacha, DEX, and protocol deploys | prepare:deploy, prepare:mint, simulate |
 | `_template` | your new lane | you decide |
 
-These grants describe the public prepare plane, not every capability an operator may install beside it. The generic unattended signer remains limited to `hl` and `poly`. A separately installed, same-host, owner-gated EVM executor may expose one exact bounded action after explicit `arm`; profiles must verify it before claiming availability. `watch`, `watch this`, and `ping me` remain `alert_only` regardless of executor presence.
+These grants describe the public prepare plane, not every capability an operator may install beside it. The generic unattended signer exposes six bounded surfaces (`hl`, `poly`, `evm-swap`, `evm-bridge`, `btc`, `sol`), each of which decodes its own envelope and refuses while its allowlists are empty. A separately installed, same-host, owner-gated EVM executor may expose one exact bounded action after explicit `arm`; profiles must verify it before claiming availability. `watch`, `watch this`, and `ping me` remain `alert_only` regardless of executor presence.
 
 `protocol-builder` classifies each launch by chain family, then designs and
 prepares unsigned token, NFT collection, protocol, or mint-bot transactions. It

package/examples/oracle-pack-template.mjs

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+
+// Minimal Oracle protocol pack. It prepares unsigned actions; it never receives
+// keys, signs, broadcasts, or claims that untrusted metadata is an instruction.
+
+export const provider = Object.freeze({
+  id: "example-protocol",
+  version: "1.0.0",
+  chains: [8453],
+  metadata: { source: "on-chain", trust: "untrusted-data" },
+});
+
+export function prepare(intent) {
+  assert.ok(intent && provider.chains.includes(intent.chainId), "unsupported chain");
+  return {
+    kind: "unsigned-transaction",
+    chainId: intent.chainId,
+    transaction: { to: intent.to, data: intent.data ?? "0x", value: intent.value ?? "0" },
+    receiptGate: { required: true, confirmations: 1, match: ["chainId", "transaction.to"] },
+  };
+}
+
+export function decode(receipt) {
+  assert.ok(receipt && typeof receipt.status !== "undefined", "receipt required");
+  return { success: receipt.status === 1 || receipt.status === "0x1", transactionHash: receipt.transactionHash };
+}
+
+export const riskRules = Object.freeze([
+  { id: "explicit-recipient", field: "transaction.to", required: true },
+  { id: "receipt-before-success", field: "receiptGate.required", equals: true },
+]);
+
+export const tests = Object.freeze({
+  command: "node --test test/oracle-pack-standard.test.mjs",
+  covers: ["prepare-is-unsigned", "decode-requires-receipt", "metadata-is-untrusted"],
+});
+
+export default Object.freeze({ provider, prepare, decode, riskRules, tests });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle-agent/oracle",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Oracle: prepare-only multichain agent control plane. Policy-bounded intents for a user-signed wallet. Self-custody by default — the public package never takes your key. Built for Hermes; no model key required.",
   "license": "Apache-2.0",
   "type": "module",
@@ -44,7 +44,12 @@
     "./action-semantics": "./src/action-semantics.mjs",
     "./address-book": "./src/address-book.mjs",
     "./nft-gas-war": "./src/nft-gas-war-guard.mjs",
-    "./prepare-envelope": "./src/prepare-envelope.mjs"
+    "./prepare-envelope": "./src/prepare-envelope.mjs",
+    "./connect": "./src/onboarding/harness-configs.mjs",
+    "./receipts": "./src/action-receipts.mjs",
+    "./risk": "./src/portfolio-risk.mjs",
+    "./watch": "./src/watch-preferences.mjs",
+    "./signals": "./src/signals/index.mjs"
   },
   "scripts": {
     "test": "ORACLE_TEST_ISOLATE_SECRETS=1 ORACLE_ROUTE_ATTESTATION_SECRET=oracle-unit-test-secret node --test test/*.test.mjs",

package/profiles/oracle/SOUL.md

@@ -41,7 +41,9 @@ the data plane). If it stays ambiguous, ask. Do not guess a chain.
 1. **The public router never signs.** It prepares, simulates, and explains; ordinary
    EVM artifacts require the user's wallet signature. Do not turn that public-plane
    boundary into the false claim that EVM execution is universally impossible. The
-   generic unattended signer remains limited to `hl` and `poly`; a deployment may
+   generic unattended signer exposes six bounded surfaces (`hl`, `poly`, `evm-swap`,
+   `evm-bridge`, `btc`, `sol`), each of which decodes its own envelope and refuses
+   while its allowlists are empty; a deployment may also
    separately expose a same-host, owner-gated EVM executor. Verify that executor
    before describing it as available.
    `watch`, `watch this`, and `ping me` always mean `actionMode: alert_only`.

package/public/agent-connect/app.js

@@ -0,0 +1,81 @@
+(() => {
+  "use strict";
+
+  const apiUrl = document.querySelector("#api-url");
+  const apiKey = document.querySelector("#api-key");
+  const walletAddress = document.querySelector("#wallet-address");
+  const output = document.querySelector("#config-output");
+  const label = document.querySelector("#config-label");
+  const status = document.querySelector("#copy-status");
+  const tabs = [...document.querySelectorAll("[data-harness]")];
+  let selected = "hermes";
+
+  const cleanUrl = () => apiUrl.value.trim().replace(/\/+$/, "");
+  const env = () => {
+    const values = {
+      ORACLE_API_URL: cleanUrl() || "https://api.oracle-agent.dev",
+      ORACLE_READ_API_KEY: apiKey.value.trim() || "YOUR_READ_API_KEY"
+    };
+    if (walletAddress.value.trim()) values.ORACLE_WALLET_ADDRESS = walletAddress.value.trim();
+    return values;
+  };
+
+  const configs = {
+    hermes: () => ({
+      mcpServers: { oracle: { command: "npx", args: ["-y", "@oracle-agent/oracle-data-mcp"], env: env() } }
+    }),
+    claude: () => ({
+      mcpServers: { oracle: { command: "npx", args: ["-y", "@oracle-agent/oracle-data-mcp"], env: env() } }
+    }),
+    codex: () => {
+      const values = env();
+      const lines = [
+        "[mcp_servers.oracle]",
+        'command = "npx"',
+        'args = ["-y", "@oracle-agent/oracle-data-mcp"]',
+        "",
+        "[mcp_servers.oracle.env]",
+        ...Object.entries(values).map(([key, value]) => `${key} = ${JSON.stringify(value)}`)
+      ];
+      return lines.join("\n");
+    },
+    cursor: () => ({
+      mcpServers: { oracle: { command: "npx", args: ["-y", "@oracle-agent/oracle-data-mcp"], env: env() } }
+    }),
+    mcp: () => ({
+      name: "oracle",
+      transport: "stdio",
+      command: "npx",
+      args: ["-y", "@oracle-agent/oracle-data-mcp"],
+      env: env()
+    })
+  };
+
+  const names = { hermes: "Hermes", claude: "Claude Code", codex: "Codex", cursor: "Cursor", mcp: "Generic MCP" };
+
+  function render() {
+    const config = configs[selected]();
+    output.textContent = typeof config === "string" ? config : JSON.stringify(config, null, 2);
+    label.textContent = `${names[selected]} config`;
+    status.textContent = "";
+  }
+
+  async function copy(text, message) {
+    try {
+      await navigator.clipboard.writeText(text);
+      status.textContent = message;
+    } catch {
+      status.textContent = "Copy was blocked. Select the text and copy it manually.";
+    }
+  }
+
+  tabs.forEach((tab) => tab.addEventListener("click", () => {
+    selected = tab.dataset.harness;
+    tabs.forEach((item) => item.setAttribute("aria-selected", String(item === tab)));
+    render();
+  }));
+  [apiUrl, apiKey, walletAddress].forEach((input) => input.addEventListener("input", render));
+  document.querySelector("#copy-button").addEventListener("click", () => copy(output.textContent, `${names[selected]} config copied.`));
+  document.querySelector("#copy-install").addEventListener("click", () => copy("npx @oracle-agent/oracle init", "Local operator install command copied."));
+  render();
+})();

package/public/agent-connect/index.html

@@ -0,0 +1,83 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="Connect your agent harness to Oracle read tools without giving up custody." />
+  <title>Oracle Agent Connect</title>
+  <link rel="stylesheet" href="styles.css" />
+</head>
+<body>
+  <main class="shell">
+    <header class="hero">
+      <a class="wordmark" href="/">ORACLE</a>
+      <p class="eyebrow">AGENT CONNECT</p>
+      <h1>Give your agent market context.<br /><span>Keep custody local.</span></h1>
+      <p class="lede">Connect a read-only Oracle API to your preferred harness. The model proposes actions; you review and authorize them through your local operator.</p>
+    </header>
+
+    <section class="card setup" aria-labelledby="connection-title">
+      <div class="section-heading">
+        <span class="step">01</span>
+        <div>
+          <h2 id="connection-title">Your connection</h2>
+          <p>These values stay in this browser and are only used to build the config below.</p>
+        </div>
+      </div>
+      <div class="fields">
+        <label>Agent API URL
+          <input id="api-url" type="url" value="https://api.oracle-agent.dev" spellcheck="false" autocomplete="url" />
+        </label>
+        <label>Read API key
+          <input id="api-key" type="password" placeholder="Your read-only API key" spellcheck="false" autocomplete="off" />
+          <span class="hint">Use only a user-owned, read-only API credential.</span>
+        </label>
+        <label>Public wallet address <span class="optional">optional</span>
+          <input id="wallet-address" type="text" placeholder="0x... or a public Solana address" spellcheck="false" autocomplete="off" />
+          <span class="hint">Used to personalize portfolio reads. No wallet connection or signature.</span>
+        </label>
+      </div>
+    </section>
+
+    <section class="card config" aria-labelledby="config-title">
+      <div class="section-heading">
+        <span class="step">02</span>
+        <div>
+          <h2 id="config-title">Choose your harness</h2>
+          <p>Copy a ready-to-paste cloud/read MCP configuration.</p>
+        </div>
+      </div>
+      <div class="tabs" role="tablist" aria-label="Agent harness">
+        <button role="tab" aria-selected="true" data-harness="hermes">Hermes</button>
+        <button role="tab" aria-selected="false" data-harness="claude">Claude Code</button>
+        <button role="tab" aria-selected="false" data-harness="codex">Codex</button>
+        <button role="tab" aria-selected="false" data-harness="cursor">Cursor</button>
+        <button role="tab" aria-selected="false" data-harness="mcp">Generic MCP</button>
+      </div>
+      <div class="code-wrap">
+        <div class="code-bar">
+          <span id="config-label">Hermes config</span>
+          <button id="copy-button" class="copy" type="button">Copy config</button>
+        </div>
+        <pre><code id="config-output"></code></pre>
+      </div>
+      <p id="copy-status" class="status" aria-live="polite"></p>
+    </section>
+
+    <section class="operator" aria-labelledby="operator-title">
+      <div class="operator-mark" aria-hidden="true">LOCAL</div>
+      <div>
+        <p class="eyebrow">SEPARATE EXECUTION LANE</p>
+        <h2 id="operator-title">Install the local operator to execute</h2>
+        <p>The cloud/read MCP can research, quote, simulate, and prepare. Execution belongs in a separate local process under your policy and approval controls.</p>
+        <div class="command"><code>npx @oracle-agent/oracle init</code><button id="copy-install" type="button">Copy</button></div>
+      </div>
+    </section>
+
+    <footer>
+      <p><strong>Custody stays local.</strong> The model proposes; the owner authorizes. This page never connects a wallet, requests a signature, or sends the values you enter.</p>
+    </footer>
+  </main>
+  <script src="app.js"></script>
+</body>
+</html>

package/public/agent-connect/styles.css

@@ -0,0 +1,70 @@
+:root {
+  color-scheme: dark;
+  --ink: #07110f;
+  --panel: #0d1a17;
+  --panel-high: #12231f;
+  --line: #26443d;
+  --mint: #55e6c1;
+  --paper: #edf8f4;
+  --muted: #9bb8b0;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background:
+    radial-gradient(circle at 85% 8%, rgba(85, 230, 193, 0.12), transparent 25rem),
+    linear-gradient(rgba(85, 230, 193, 0.025) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(85, 230, 193, 0.025) 1px, transparent 1px),
+    var(--ink);
+  background-size: auto, 48px 48px, 48px 48px, auto;
+  color: var(--paper);
+  font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  min-height: 100vh;
+}
+
+button, input { font: inherit; }
+.shell { width: min(980px, calc(100% - 32px)); margin: auto; padding: 56px 0 32px; }
+.hero { max-width: 780px; margin-bottom: 42px; }
+.wordmark { color: var(--paper); text-decoration: none; font-size: 14px; font-weight: 800; letter-spacing: .28em; }
+.eyebrow { margin: 36px 0 10px; color: var(--mint); font: 700 11px/1.4 ui-monospace, SFMono-Regular, Menlo, monospace; letter-spacing: .18em; }
+h1 { margin: 0; font-size: clamp(40px, 7vw, 76px); line-height: .98; letter-spacing: -.055em; }
+h1 span { color: var(--mint); }
+.lede { max-width: 660px; margin: 24px 0 0; color: var(--muted); font-size: 18px; line-height: 1.65; }
+.card { background: rgba(13, 26, 23, .92); border: 1px solid var(--line); border-radius: 18px; padding: clamp(22px, 4vw, 38px); margin-top: 18px; box-shadow: 0 22px 70px rgba(0, 0, 0, .22); }
+.section-heading { display: flex; align-items: flex-start; gap: 18px; margin-bottom: 28px; }
+.step { display: grid; place-items: center; min-width: 42px; height: 42px; border: 1px solid var(--mint); border-radius: 50%; color: var(--mint); font: 700 12px ui-monospace, monospace; }
+h2 { margin: 0; font-size: 24px; letter-spacing: -.02em; }
+.section-heading p, .operator p { color: var(--muted); margin: 6px 0 0; line-height: 1.55; }
+.fields { display: grid; grid-template-columns: 1fr 1fr; gap: 20px; }
+label { display: flex; flex-direction: column; gap: 9px; color: var(--paper); font-size: 13px; font-weight: 700; }
+label:first-child { grid-column: 1 / -1; }
+.optional { color: var(--muted); font-weight: 400; }
+input { width: 100%; color: var(--paper); background: var(--ink); border: 1px solid var(--line); border-radius: 9px; padding: 13px 14px; outline: none; }
+input:focus { border-color: var(--mint); box-shadow: 0 0 0 3px rgba(85, 230, 193, .1); }
+.hint { color: var(--muted); font-size: 11px; font-weight: 400; line-height: 1.4; }
+.tabs { display: flex; gap: 8px; overflow-x: auto; padding-bottom: 4px; }
+.tabs button { flex: 0 0 auto; color: var(--muted); background: transparent; border: 1px solid var(--line); border-radius: 999px; padding: 9px 15px; cursor: pointer; }
+.tabs button[aria-selected="true"] { color: var(--ink); background: var(--mint); border-color: var(--mint); font-weight: 700; }
+.code-wrap { margin-top: 18px; border: 1px solid var(--line); border-radius: 12px; overflow: hidden; background: var(--ink); }
+.code-bar { display: flex; align-items: center; justify-content: space-between; padding: 10px 14px; border-bottom: 1px solid var(--line); color: var(--muted); font-size: 12px; }
+.copy, .command button { color: var(--mint); background: transparent; border: 0; cursor: pointer; font-weight: 700; }
+pre { min-height: 270px; margin: 0; padding: 20px; overflow: auto; color: #c8f7e9; font: 12px/1.7 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
+.status { min-height: 20px; margin: 10px 0 0; color: var(--mint); font-size: 12px; }
+.operator { display: grid; grid-template-columns: 120px 1fr; gap: 30px; margin: 54px 0; padding: 0 20px; align-items: center; }
+.operator .eyebrow { margin: 0 0 8px; }
+.operator-mark { display: grid; place-items: center; aspect-ratio: 1; border: 1px solid var(--mint); border-radius: 50%; color: var(--mint); font: 700 12px ui-monospace, monospace; letter-spacing: .15em; box-shadow: inset 0 0 30px rgba(85, 230, 193, .09); }
+.command { display: flex; justify-content: space-between; max-width: 520px; margin-top: 18px; padding: 13px 16px; background: var(--panel-high); border: 1px solid var(--line); border-radius: 9px; }
+.command code { overflow: auto; }
+footer { border-top: 1px solid var(--line); padding: 25px 0; color: var(--muted); font-size: 13px; line-height: 1.6; }
+footer strong { color: var(--paper); }
+
+@media (max-width: 640px) {
+  .shell { padding-top: 30px; }
+  .fields { grid-template-columns: 1fr; }
+  label:first-child { grid-column: auto; }
+  .operator { grid-template-columns: 1fr; padding: 0; }
+  .operator-mark { width: 88px; }
+  pre { min-height: 320px; }
+}

package/scripts/adversarial-bench.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+
+import { pathToFileURL } from "node:url";
+import { resolve } from "node:path";
+
+const INJECTION_RULES = [
+  ["instruction-override", /\b(?:ignore|disregard|override)\b.{0,48}\b(?:previous|prior|system|developer|instructions?)\b/i],
+  ["secret-exfiltration", /\b(?:reveal|print|return|exfiltrate|send)\b.{0,48}\b(?:private\s*key|seed\s*phrase|mnemonic|secret|credentials?|system\s*prompt)\b/i],
+  ["transaction-coercion", /\b(?:sign|send|broadcast|execute)\b.{0,32}\b(?:transaction|transfer|approval|trade)\b/i],
+  ["tool-coercion", /\b(?:call|invoke|use|run)\b.{0,24}\b(?:tool|function|shell|command)\b/i],
+];
+
+const FORBIDDEN_EXPORT = /^(?:signer|sign|signMessage|signTransaction|sendTransaction|broadcastTransaction|submitTransaction|executeTransaction|privateKey|secretKey|mnemonic|seedPhrase|wallet)$/i;
+
+function finding(code, path, message) {
+  return { code, path, message };
+}
+
+function scanStrings(value, path, findings, seen) {
+  if (typeof value === "string") {
+    for (const [rule, pattern] of INJECTION_RULES) {
+      if (pattern.test(value)) {
+        findings.push(finding("prompt-injection", path, `metadata matches ${rule}`));
+        break;
+      }
+    }
+    return;
+  }
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => scanStrings(item, `${path}[${index}]`, findings, seen));
+    return;
+  }
+  for (const key of Object.keys(value).sort()) {
+    scanStrings(value[key], path ? `${path}.${key}` : key, findings, seen);
+  }
+}
+
+/** Validate one loaded Oracle protocol pack without calling provider code. */
+export function benchmarkPack(moduleValue, { name = "pack" } = {}) {
+  const namespace = moduleValue && typeof moduleValue === "object" ? moduleValue : {};
+  const pack = namespace.default && typeof namespace.default === "object" ? namespace.default : namespace;
+  const findings = [];
+
+  for (const key of Object.keys(namespace).sort()) {
+    if (key !== "default" && FORBIDDEN_EXPORT.test(key)) {
+      findings.push(finding("forbidden-signer-export", `exports.${key}`, `pack exports custody capability ${key}`));
+    }
+  }
+  for (const key of Object.keys(pack).sort()) {
+    if (FORBIDDEN_EXPORT.test(key)) {
+      findings.push(finding("forbidden-signer-export", `pack.${key}`, `pack exports custody capability ${key}`));
+    }
+  }
+
+  if (!pack.provider || typeof pack.provider !== "object") {
+    findings.push(finding("missing-provider", "pack.provider", "provider metadata is required"));
+  }
+  if (typeof pack.prepare !== "function") {
+    findings.push(finding("missing-prepare", "pack.prepare", "prepare must be a function"));
+  }
+  if (typeof pack.decode !== "function") {
+    findings.push(finding("missing-decoder", "pack.decode", "decode must be a function"));
+  }
+  if (!(Array.isArray(pack.riskRules) || typeof pack.riskRules === "function")) {
+    findings.push(finding("missing-risk-rules", "pack.riskRules", "riskRules must be an array or function"));
+  }
+  if (!pack.tests || typeof pack.tests !== "object" || Array.isArray(pack.tests) || Object.keys(pack.tests).length === 0) {
+    findings.push(finding("missing-tests", "pack.tests", "non-empty tests metadata is required"));
+  }
+
+  // Metadata is untrusted even when nested below token/NFT records. Scan data only;
+  // functions are deliberately never invoked by this local harness.
+  scanStrings(pack.metadata, "pack.metadata", findings, new Set());
+  scanStrings(pack.provider, "pack.provider", findings, new Set());
+
+  findings.sort((a, b) => `${a.code}\0${a.path}\0${a.message}`.localeCompare(`${b.code}\0${b.path}\0${b.message}`));
+  return { name, ok: findings.length === 0, findings };
+}
+
+/** Run a stable summary over already-loaded fixture/module records. */
+export function runAdversarialBenchmark(entries) {
+  const results = entries
+    .map((entry, index) => benchmarkPack(entry.module ?? entry, { name: entry.name ?? `pack-${index + 1}` }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    ok: results.every((result) => result.ok),
+    packs: results.length,
+    passed: results.filter((result) => result.ok).length,
+    failed: results.filter((result) => !result.ok).length,
+    findings: results.reduce((count, result) => count + result.findings.length, 0),
+    results,
+  };
+}
+
+async function main(paths) {
+  if (paths.length === 0) throw new Error("usage: node scripts/adversarial-bench.mjs <pack.mjs> [...]");
+  const entries = [];
+  for (const input of paths) {
+    const absolute = resolve(input);
+    entries.push({ name: input, module: await import(pathToFileURL(absolute).href) });
+  }
+  const summary = runAdversarialBenchmark(entries);
+  process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+  if (!summary.ok) process.exitCode = 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  main(process.argv.slice(2)).catch((error) => {
+    process.stdout.write(`${JSON.stringify({ ok: false, error: String(error.message || error) }, null, 2)}\n`);
+    process.exitCode = 2;
+  });
+}

package/skills/oracle-action-semantics/SKILL.md

@@ -8,7 +8,7 @@ description: Use for watch, ping, prepare, arm, sign, send, or execution-capabil
 Keep these planes distinct:
 
 1. **Public prepare plane**: reads, quotes, simulates, and prepares unsigned artifacts. It never signs or broadcasts.
-2. **Generic Oracle signer**: the unattended daemon surfaces remain `hl` and `poly`. This does not grant EVM authority.
+2. **Generic Oracle signer**: the unattended daemon exposes six *bounded* surfaces — `hl`, `poly`, `evm-swap`, `evm-bridge`, `btc`, `sol`. Bounded is not generic chain authority: each surface decodes and validates its own envelope shape and refuses while its allowlists are empty. Enablement is never authority; every signature still needs one exact owner-confirmed grant.
 3. **User-wallet EVM**: ordinary EVM preparations require the user's wallet signature.
 4. **Optional bounded EVM execution**: a deployment may expose a separate same-host, owner-gated EVM executor such as MAD. Verify its status and policy before saying it is available. Never infer it from the public package or the generic signer.