@palmyr/cli 1.4.0 → 1.5.0

package/README.md

@@ -365,7 +365,11 @@ palmyr compute exec my-vps -- bash -c 'cloud-init clean && cloud-init init --all
 | `palmyr domain check --name example.dev` | free | Availability check. |
 | `palmyr domain pricing --name example.dev` | free | TLD pricing. |
 | `palmyr domain buy --name example.dev` | $20.00 | One-year registration. Renewals are charged annually. |
-| `palmyr domain dns --name example.dev` | free | View DNS records. |
+| `palmyr domain list` | $0.0001 *(ownership proof)* | List domains your wallet owns plus any shared with you. Each row tagged `access: owner | shared`. |
+| `palmyr domain dns --name example.dev` | $0.0001 *(ownership proof)* | View DNS records. Owners and shared wallets allowed. |
+| `palmyr domain transfer-ownership --name example.dev --to <wallet>` | $0.0001 *(ownership proof)* | Hand the domain to another wallet. Clears `shared_with` — the prior owner's collaborators don't travel with the domain. |
+| `palmyr domain share --name example.dev --with <wallet>` | $0.0001 *(ownership proof)* | Grant another wallet shared access (visible in `domain list`, can edit DNS). Owner-only. |
+| `palmyr domain unshare --name example.dev --from <wallet>` | $0.0001 *(ownership proof)* | Revoke a shared wallet's access. Owner-only. |
 
 ### Wallet
 
@@ -518,6 +522,10 @@ Local credentials are encrypted with AES-256-GCM (per-account session secret in
 | `palmyr twitter pfp <username> --file path.png` *(or `--url https://...`)* | $0.005 | PNG / JPG / WebP / GIF. Local file is base64-encoded; URL is fetched server-side with SSRF guard. |
 | `palmyr twitter banner <username> --file path.png` *(or `--url ...`)* | $0.005 | |
 | `palmyr twitter username <username> --to <new-handle>` | $0.005 | Pre-flight validates handle (4–15 chars, `[A-Za-z0-9_]`) before payment. May trigger X's password re-auth modal — handled automatically. |
+| `palmyr twitter transfer <username> --to <wallet> --confirm` | $0.0001 *(ownership proof)* | Atomically hand the X account to another wallet. Server rotates the password and revokes other sessions before flipping `sold_to`, so the local copy of credentials becomes useless. Requires `--confirm`. Local vault entry is removed on success — receiver picks up fresh creds with `palmyr twitter claim`. |
+| `palmyr twitter share <username> --with <wallet>` | $0.0001 *(ownership proof)* | Grant another wallet shared access — same login, no credential rotation. Both wallets see the account via `palmyr twitter claim`. Owner-only. |
+| `palmyr twitter unshare <username> --from <wallet> [--rotate]` | $0.0001 *(ownership proof; rotation runs through Playwright when `--rotate`)* | Revoke a wallet's shared access. Without `--rotate`, the wallet is removed from `shared_with` but their previously exported cookies / password remain valid until X-side expiry. With `--rotate`, the server also rotates the password and revokes other sessions, then the CLI updates the local vault in place. Owner-only. |
+| `palmyr twitter claim` | $0.0001 *(ownership proof)* | Pull every X account on the server bound to your wallet (owner or shared) into the local vault, with session cookies pre-warmed. The fast path for a wallet that just received a transferred account. |
 
 **Verification.** Operations are confirmed at the network layer — the server intercepts X's actual API responses (`CreateTweet`, `FavoriteTweet`, `update_profile`, etc.) before reporting success. No false positives.
 

package/dist/cli.js

@@ -17,7 +17,7 @@ import { render as inkRender } from 'ink';
 import { ConfigScreen, Dashboard, DoctorScreen, DomainCheckScreen, DomainPricingScreen, ErrorScreen, HealthScreen, MenuScreen, PricingScreen, RecordsScreen, SetupScreen, StatusScreen, SuccessScreen, WalletCreateScreen, WalletStatusScreen, WalletListScreen } from './app.js';
 import { Palmyr } from './sdk.js';
 import { loadConfig, saveConfig, ensureDirs, log, addPhone, addDomain, addNote } from './config.js';
-import { theme as t, icon, Spinner, table, kv, section, setAgentMode as setUiAgentMode } from './ui.js';
+import { theme as t, icon, Spinner, warn, table, kv, section, setAgentMode as setUiAgentMode } from './ui.js';
 import { existsSync, readFileSync } from 'fs';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
@@ -1462,9 +1462,11 @@ async function main() {
                             { name: 'check', description: 'Check availability', hint: '--name example.dev' },
                             { name: 'pricing', description: 'Get TLD pricing', hint: '--name example' },
                             { name: 'buy', description: 'Register a domain', hint: '--name example.dev' },
-                            { name: 'list', description: 'List domains owned by your wallet', hint: '' },
+                            { name: 'list', description: 'List domains owned or shared with your wallet', hint: '' },
                             { name: 'dns', description: 'Get DNS records', hint: '--name example.dev' },
                             { name: 'transfer-ownership', description: 'Transfer domain to another wallet', hint: '--name example.dev --to <wallet>' },
+                            { name: 'share', description: 'Grant another wallet shared access', hint: '--name example.dev --with <wallet>' },
+                            { name: 'unshare', description: 'Revoke a wallet’s shared access', hint: '--name example.dev --from <wallet>' },
                         ],
                         fromHome,
                     });
@@ -1582,6 +1584,28 @@ async function main() {
                         const data = await ao.domainTransferOwnership(name, to);
                         return print(data);
                     }
+                    case 'share': {
+                        const name = flags.name || positional[0];
+                        const withWallet = flags.with || flags.wallet;
+                        if (!name)
+                            err('--name domain.dev required');
+                        if (!withWallet)
+                            err('--with <wallet> required');
+                        const data = await ao.domainShare(name, withWallet);
+                        log(`domain share: ${name} → ${withWallet}`);
+                        return print(data);
+                    }
+                    case 'unshare': {
+                        const name = flags.name || positional[0];
+                        const targetWallet = flags.from || flags.wallet;
+                        if (!name)
+                            err('--name domain.dev required');
+                        if (!targetWallet)
+                            err('--from <wallet> required');
+                        const data = await ao.domainUnshare(name, targetWallet);
+                        log(`domain unshare: ${name} ✗ ${targetWallet}`);
+                        return print(data);
+                    }
                     case 'dns': {
                         const name = flags.name || positional[0];
                         if (!name)
@@ -1600,7 +1624,7 @@ async function main() {
                         }));
                         break;
                     }
-                    default: err(`Unknown domain command: ${subcommand}. Try: check, pricing, buy, list, dns, transfer-ownership`);
+                    default: err(`Unknown domain command: ${subcommand}. Try: check, pricing, buy, list, dns, transfer-ownership, share, unshare`);
                 }
                 break;
             }
@@ -3993,6 +4017,10 @@ async function main() {
                             { name: 'login', description: 'Force a fresh server-side session (requires browser runtime)', hint: '<username>' },
                             { name: 'post', description: 'Post a tweet (requires server browser runtime)', hint: '<username> --body "..."' },
                             { name: 'status', description: 'Check if the account is alive / shadow-banned', hint: '<username>' },
+                            { name: 'transfer', description: 'Hand an account to another wallet (rotates password)', hint: '<username> --to <wallet>' },
+                            { name: 'share', description: 'Grant another wallet shared access', hint: '<username> --with <wallet>' },
+                            { name: 'unshare', description: 'Revoke a wallet’s shared access', hint: '<username> --from <wallet> [--rotate]' },
+                            { name: 'claim', description: 'Import server-side accounts owned by your wallet into the local vault' },
                         ],
                         fromHome,
                     });
@@ -4889,8 +4917,163 @@ async function main() {
                     case 'status': {
                         err(`twitter status: not wired yet. Phase 3 will add it.`, EXIT.GENERAL);
                     }
+                    case 'transfer': {
+                        // Hand the X account to another wallet. Server rotates the password
+                        // and revokes other sessions before flipping ownership, so the local
+                        // copy of credentials we keep is intentionally invalidated. After
+                        // success, we wipe the local vault entry — receiver will pick up
+                        // fresh credentials via `palmyr twitter claim`.
+                        const username = positional[0] || flags.username;
+                        const to = flags.to;
+                        if (!username)
+                            err('<username> required');
+                        if (!to)
+                            err('--to <wallet> required');
+                        const acc = sv.getAccount(platform, username);
+                        if (!acc)
+                            err(`twitter account "${username}" not found locally — can only transfer accounts you own`, EXIT.NOT_FOUND);
+                        if (!flags.confirm) {
+                            const tail = to.slice(-6);
+                            err(`This rotates @${username} on X and hands it to a wallet ending in …${tail}. ` +
+                                `You will lose access immediately and irreversibly. ` +
+                                `Re-run with --confirm:\n` +
+                                `  palmyr twitter transfer ${username} --to ${to} --confirm`);
+                        }
+                        const spin = new Spinner();
+                        spin.start(`Rotating @${username} password and transferring…`);
+                        let data;
+                        try {
+                            data = await ao.xAccountTransfer(acc.id, to);
+                        }
+                        catch (e) {
+                            spin.stop('Transfer failed', false);
+                            err(`Transfer failed: ${e.message}`, EXIT.GENERAL);
+                        }
+                        spin.stop('Transferred', true);
+                        // The local vault still holds the OLD password / cookies which are
+                        // now useless. Drop the entry so we don't confuse the user with a
+                        // ghost account they can't log into.
+                        try {
+                            sv.removeAccount(platform, username);
+                        }
+                        catch { /* best effort */ }
+                        return print({ ...data, local_vault_cleared: true });
+                    }
+                    case 'share': {
+                        const username = positional[0] || flags.username;
+                        const withWallet = flags.with || flags.wallet;
+                        if (!username)
+                            err('<username> required');
+                        if (!withWallet)
+                            err('--with <wallet> required');
+                        const acc = sv.getAccount(platform, username);
+                        if (!acc)
+                            err(`twitter account "${username}" not found locally`, EXIT.NOT_FOUND);
+                        const data = await ao.xAccountShare(acc.id, withWallet);
+                        log(`twitter share: @${username} → ${withWallet}`);
+                        return print(data);
+                    }
+                    case 'unshare': {
+                        const username = positional[0] || flags.username;
+                        const targetWallet = flags.from || flags.wallet;
+                        const rotate = !!flags.rotate;
+                        if (!username)
+                            err('<username> required');
+                        if (!targetWallet)
+                            err('--from <wallet> required');
+                        const acc = sv.getAccount(platform, username);
+                        if (!acc)
+                            err(`twitter account "${username}" not found locally`, EXIT.NOT_FOUND);
+                        const spin = rotate ? new Spinner() : null;
+                        if (spin)
+                            spin.start(`Unsharing @${username} and rotating password…`);
+                        let data;
+                        try {
+                            data = await ao.xAccountUnshare(acc.id, targetWallet, { rotate });
+                        }
+                        catch (e) {
+                            if (spin)
+                                spin.stop('Unshare failed', false);
+                            err(`Unshare failed: ${e.message}`, EXIT.GENERAL);
+                        }
+                        if (spin)
+                            spin.stop(data?.rotated ? 'Unshared and rotated' : 'Unshared (rotation skipped)', !!data?.rotated);
+                        // If rotation succeeded, sync the local vault so the next op
+                        // doesn't try to log in with the now-defunct password / cookies.
+                        if (rotate && data?.rotated && data?.credentials) {
+                            try {
+                                const existing = sv.unlockCredentials(platform, username);
+                                const next = {
+                                    ...existing,
+                                    password: data.credentials.password,
+                                    auth_token: data.credentials.auth_token || undefined,
+                                    ct0: (data.credentials.cookies || []).find((c) => c.name === 'ct0')?.value || existing.ct0,
+                                };
+                                sv.replaceCredentials(platform, username, next);
+                                if (Array.isArray(data.credentials.cookies) && data.credentials.cookies.length > 0) {
+                                    sv.saveSession(acc.id, platform, data.credentials.cookies);
+                                }
+                                // Don't leak the new password into the printed JSON output —
+                                // it's already persisted locally.
+                                data = { ...data, credentials: { rotated: true, persisted_locally: true } };
+                            }
+                            catch (e) {
+                                warn(`Local vault sync failed: ${e.message}. Run 'palmyr twitter claim' to refresh from server.`);
+                            }
+                        }
+                        log(`twitter unshare: @${username} ✗ ${targetWallet}${rotate ? ' (rotated)' : ''}`);
+                        return print(data);
+                    }
+                    case 'claim': {
+                        // Fetch every server-side X account this wallet owns or has shared
+                        // access to. Optionally import any not yet in the local vault —
+                        // typical use is the new owner of a transferred account picking it
+                        // up for the first time.
+                        const data = await ao.xAccountsMine();
+                        const accounts = data?.accounts || [];
+                        if (accounts.length === 0) {
+                            log('No X accounts associated with your wallet on the server.');
+                            return print({ count: 0, claimed: 0, accounts: [] });
+                        }
+                        const imported = [];
+                        const skipped = [];
+                        for (const a of accounts) {
+                            const existing = sv.getAccount(platform, a.username);
+                            if (existing) {
+                                skipped.push({ username: a.username, reason: 'already in local vault' });
+                                continue;
+                            }
+                            try {
+                                const ct0 = (a.cookies || []).find((c) => c.name === 'ct0')?.value;
+                                const creds = {
+                                    login: a.email || a.username,
+                                    password: a.password,
+                                    email: a.email,
+                                    auth_token: a.auth_token || undefined,
+                                    ct0,
+                                };
+                                const summary = sv.importAccount(platform, a.username, creds, { source: 'claim' });
+                                // Save the cookies so `palmyr twitter login` can use the
+                                // cookie-fast-path instead of re-driving the login form.
+                                if (Array.isArray(a.cookies) && a.cookies.length > 0) {
+                                    sv.saveSession(summary.id, platform, a.cookies);
+                                }
+                                imported.push({ username: a.username, id: summary.id, access: a.access });
+                            }
+                            catch (e) {
+                                skipped.push({ username: a.username, reason: e.message });
+                            }
+                        }
+                        log(`twitter claim: imported ${imported.length}, skipped ${skipped.length} (of ${accounts.length})`);
+                        return print({
+                            count: accounts.length,
+                            claimed: imported.length,
+                            imported,
+                            skipped,
+                        });
+                    }
                     default:
-                        err(`Unknown twitter command: ${subcommand}. Try: import, list, info, rename, remove, totp, login, manual-login, session, post, reply, like, retweet, follow, unfollow, delete, list-tweets, bio, name, location, website, pfp, banner, username, buy`);
+                        err(`Unknown twitter command: ${subcommand}. Try: import, list, info, rename, remove, totp, login, manual-login, session, post, reply, like, retweet, follow, unfollow, delete, list-tweets, bio, name, location, website, pfp, banner, username, buy, transfer, share, unshare, claim`);
                 }
                 break;
             }