@rozoai/checkout 0.1.6 → 0.1.10

package/README.md

@@ -33,7 +33,7 @@ npx @rozoai/checkout pay <coinbase-link> --with usdt-solana
 | Base | `usdc-base` | `8453` | 6 decimals |
 | Solana | `usdt-solana` `usdc-solana` | `900` | SPL; native SOL not supported |
 | Stellar | `usdc-stellar` | `1500` | `MEMO_TEXT` memo required — shown in the deposit block |
-| Bitcoin Lightning | `btc-lightning` | `lightning` | BOLT11; amounts in satoshis |
+| Bitcoin Lightning | `btc-lightning` | `lightning` | BOLT11; amounts in satoshis. Any wallet that can pay an invoice works, including Cashu/ecash wallets — the mint melts your ecash into the Lightning payment. |
 
 Native gas coins (SOL, BNB, ETH, MATIC) and on-chain BTC are not accepted.
 
@@ -52,7 +52,10 @@ already hold and pay from wherever it already lives.
   address plus `receiverMemo`, so whatever you send from — exchange or wallet —
   must let you set a memo. Omit it and the payment is lost.
 - **Lightning pays an invoice, not an address.** Scan or paste
-  `deposit.lnInvoice`; there is no address to send to.
+  `deposit.lnInvoice`; there is no address to send to. A Cashu/ecash wallet
+  works here too — paying the invoice melts the ecash on your behalf, and this
+  route settles against ROZO's own Lightning node rather than a third-party
+  swap, so no special handling is needed on our side.
 - **Only `--send` needs a private key**, read from `ROZO_CHECKOUT_EVM_KEY` or
   `ROZO_CHECKOUT_SOL_KEY`, and it covers EVM chains and Solana only. Everything
   else is keyless.
@@ -70,6 +73,8 @@ environment (or a gitignored `.env`) still works for unattended automation.
 <details>
 <summary><b>Set up a local wallet for <code>--send</code></b> — .env template and per-wallet export steps</summary>
 
+You very likely do not need any of this: the default path needs no key, and for Stellar the `stellar-agent-wallet` skill sends with its own key handling — this `.env` setup is only for unattended EVM/Solana automation with a dedicated low-balance hot wallet.
+
 **None of this is needed for the default path.** Paying from your own wallet
 needs no key and no configuration, and works with wallets that can never be
 used here — including hardware wallets and exchange accounts.

package/docs/QUICKSTART.es.md

@@ -224,6 +224,8 @@ Un archivo de claves o un `.env` no debe ser legible por otros usuarios
 <details>
 <summary><b>Configurar una billetera local para <code>--send</code></b> — plantilla .env y pasos de exportación por billetera</summary>
 
+Muy probablemente no necesites nada de esto: la ruta por defecto no requiere ninguna clave, y para Stellar la skill `stellar-agent-wallet` envía con su propio manejo de claves — esta configuración `.env` es solo para automatización desatendida en EVM/Solana con una billetera caliente dedicada de saldo bajo.
+
 **Nada de esto hace falta para la ruta por defecto.** Pagar desde la propia
 billetera no necesita clave ni configuración, y funciona con billeteras que aquí
 nunca se pueden usar, incluidas las de hardware y las cuentas de exchange.

package/docs/QUICKSTART.ja.md

@@ -202,6 +202,8 @@ ROZO_CHECKOUT_EVM_KEYSTORE=~/wallets/hot.json \
 <details>
 <summary><b><code>--send</code> 用のローカルウォレット設定</b> — .env テンプレートとウォレット別の書き出し手順</summary>
 
+おそらくこれらは一切不要です。既定の経路に鍵は不要で、Stellar なら `stellar-agent-wallet` スキルが独自の鍵管理で送金します — この `.env` 設定は、残高を低く抑えた専用ホットウォレットによる EVM/Solana の無人自動化専用です。
+
 **既定の経路ではここに書かれたものは一切不要です。** 自分のウォレットから支払う場合、
 鍵も設定も要りません。しかもここでは決して使えないウォレット — ハードウェアウォレットや
 取引所アカウントを含む — でも支払えます。

package/docs/QUICKSTART.md

@@ -217,6 +217,8 @@ not be tracked by git. Both are refused rather than warned about.
 <details>
 <summary><b>Set up a local wallet for <code>--send</code></b> — .env template and per-wallet export steps</summary>
 
+You very likely do not need any of this: the default path needs no key, and for Stellar the `stellar-agent-wallet` skill sends with its own key handling — this `.env` setup is only for unattended EVM/Solana automation with a dedicated low-balance hot wallet.
+
 **None of this is needed for the default path.** Paying from your own wallet
 needs no key and no configuration, and works with wallets that can never be
 used here — including hardware wallets and exchange accounts.

package/docs/QUICKSTART.zh.md

@@ -185,6 +185,8 @@ ROZO_CHECKOUT_EVM_KEYSTORE=~/wallets/hot.json \
 <details>
 <summary><b>为 <code>--send</code> 配置本地钱包</b> —— .env 模板与各钱包导出步骤</summary>
 
+你很可能完全不需要这些：默认路径不需要任何私钥；Stellar 来源可用 `stellar-agent-wallet` skill，它有自己的密钥管理来完成发送 —— 这份 `.env` 配置只用于无人值守的 EVM/Solana 自动化，且应使用余额很低的专用热钱包。
+
 **默认路径不需要这里的任何东西。** 用你自己的钱包付款既不需要私钥也不需要任何配置，
 而且支持那些在这里根本用不了的钱包 —— 包括硬件钱包和交易所账户。
 

package/docs/README.es.md

@@ -239,6 +239,8 @@ Billetera: cualquier billetera, **sin clave**. Solo `--send` la necesita: firma
 <details>
 <summary><b>Configurar una billetera local para <code>--send</code></b> — plantilla .env y pasos de exportación por billetera</summary>
 
+Muy probablemente no necesites nada de esto: la ruta por defecto no requiere ninguna clave, y para Stellar la skill `stellar-agent-wallet` envía con su propio manejo de claves — esta configuración `.env` es solo para automatización desatendida en EVM/Solana con una billetera caliente dedicada de saldo bajo.
+
 **Nada de esto hace falta para la ruta por defecto.** Pagar desde la propia
 billetera no necesita clave ni configuración, y funciona con billeteras que aquí
 nunca se pueden usar, incluidas las de hardware y las cuentas de exchange.

package/docs/README.ja.md

@@ -232,6 +232,8 @@ https://checkout.rozo.ai/llms.txt を自分のコンテキストに読み込み
 <details>
 <summary><b><code>--send</code> 用のローカルウォレット設定</b> — .env テンプレートとウォレット別の書き出し手順</summary>
 
+おそらくこれらは一切不要です。既定の経路に鍵は不要で、Stellar なら `stellar-agent-wallet` スキルが独自の鍵管理で送金します — この `.env` 設定は、残高を低く抑えた専用ホットウォレットによる EVM/Solana の無人自動化専用です。
+
 **既定の経路ではここに書かれたものは一切不要です。** 自分のウォレットから支払う場合、
 鍵も設定も要りません。しかもここでは決して使えないウォレット — ハードウェアウォレットや
 取引所アカウントを含む — でも支払えます。

package/docs/README.zh.md

@@ -214,6 +214,8 @@ node scripts/dist/status.js --rozo-payment-id <uuid> --watch
 <details>
 <summary><b>为 <code>--send</code> 配置本地钱包</b> —— .env 模板与各钱包导出步骤</summary>
 
+你很可能完全不需要这些：默认路径不需要任何私钥；Stellar 来源可用 `stellar-agent-wallet` skill，它有自己的密钥管理来完成发送 —— 这份 `.env` 配置只用于无人值守的 EVM/Solana 自动化，且应使用余额很低的专用热钱包。
+
 **默认路径不需要这里的任何东西。** 用你自己的钱包付款既不需要私钥也不需要任何配置，
 而且支持那些在这里根本用不了的钱包 —— 包括硬件钱包和交易所账户。
 

package/docs/security-audit-notes.md

@@ -0,0 +1,30 @@
+# Security-audit notes for scanners and reviewers
+
+What automated scans flag in this skill, and why each pattern is present.
+
+## `env_credential_access` — environment variable read + network send
+
+Real and by design, in exactly two places: `send-evm.js` reads
+`ROZO_CHECKOUT_EVM_KEY` (or an encrypted keystore) and `send-sol.js` reads
+`ROZO_CHECKOUT_SOL_KEY`, to sign a transfer the user has already confirmed
+twice (`--confirm` on the order, `--send` on the send). That is the entire
+optional hot-wallet mode ("Mode B" in SKILL.md); the default mode never
+touches a key. Mitigations, all enforced in code, not prose:
+
+- keys come from the environment or a named file only — never argv, never
+  printed, scrubbed from every output object (`forget()` in `lib/keys.mjs`);
+- a `.env` is only read from the working directory, this tool's own
+  `~/.rozo-checkout/.env`, or a path the user names with `--env-file`; a
+  generic `~/.env` is never read;
+- sends refuse if any `.env` here is git-tracked, refuse over the $1,100
+  per-payment cap, re-verify chain id and token decimals against the RPC, and
+  record the send locally before broadcast so the same order cannot pay twice.
+
+## `dangerous_exec` — subprocess execution
+
+Removed in 0.1.9. Earlier versions shelled out to `git rev-parse` /
+`git ls-files` for one purpose: refusing to use hot-wallet keys from a
+directory whose `.env` is git-tracked. The check now reads `.git/index`
+directly (`lib/keys.mjs`), so the published bundle contains no
+`child_process` usage at all. The fail-closed contract is unchanged — an
+unparseable index refuses rather than assumes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rozoai/checkout",
-  "version": "0.1.6",
+  "version": "0.1.10",
   "type": "module",
   "description": "Pay an OpenRouter Coinbase Payment Link with BTC Lightning, or USDT/USDC on Solana, BNB Chain, Ethereum, Polygon, Base or Stellar.",
   "license": "MIT",