@senpi/runtime 3.0.72 → 3.0.74

package/dist/validate/wallet-binding-stage.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Does this recipe bind the wallet its package says it binds?
+ *
+ * Deploy's pre-money check, run here too — the SAME `unboundWalletInstances` `runDeploy` calls, not
+ * a second implementation. The author should never first learn about a package-derivable fault from
+ * the money path, which is what `senpi validate` green followed by `senpi deploy` refused means.
+ *
+ * ## Why this is a STATIC-depth check
+ *
+ * It reads the package's own bytes and nothing else: no exchange, no gateway, no credentials. That
+ * puts it at the shallowest depth, where `depthsUpTo` makes it run at every depth above — so an
+ * offline CI run with no MCP server reachable still catches it. The universe check next door is
+ * live-depth only because its verdict needs the exchange's instrument list; this one has no such
+ * excuse and should not borrow the latency.
+ *
+ * ## Why it never fires on a recipe an author is pinning deliberately
+ *
+ * `resolveWallet` accepts a well-formed address in `strategy.wallet` as a real wallet to validate
+ * against — pinning is how you make a live run read a real book instead of the empty placeholder
+ * one. That is a supported workflow and this check must not take it away. It cannot: the fault
+ * requires a manifest that declares `wallet_env` for THIS instance, which is exactly the state
+ * where a pinned address contradicts the package's own promise. A recipe with no package around it,
+ * or one the manifest does not declare, is silent here.
+ *
+ * ## The three states of "no package"
+ *
+ * Same rule as `universe-stage.ts`, for the same reason. `pkg` set is the checkable one.
+ * `packageUnreadable` means a `strategy.yaml` exists and would not load — the check could not run,
+ * which is reported rather than passed over, because "I could not read it" is never "there is
+ * nothing there". Neither set is the genuine no-package case (a recipe being authored before its
+ * manifest exists), and nothing is reported there.
+ */
+import type { ResolvedTarget } from "./target.js";
+import type { Finding } from "./types.js";
+/**
+ * The check, as findings.
+ *
+ * Scoped to the instance this run is validating, not to the whole package. `target.ts` resolves a
+ * package ROOT to a refusal ("pick an instance"), so every run that gets here is about exactly one
+ * recipe — and reporting a sibling's fault would be telling the author to edit a file this command
+ * did not look at.
+ */
+export declare function walletBindingFindings(target: ResolvedTarget): Finding[];
+//# sourceMappingURL=wallet-binding-stage.d.ts.map

package/dist/validate/wallet-binding-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-binding-stage.d.ts","sourceRoot":"","sources":["../../src/validate/wallet-binding-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,EAAE,CAgBvE"}

package/dist/validate/wallet-binding-stage.js

@@ -0,0 +1,92 @@
+/**
+ * Does this recipe bind the wallet its package says it binds?
+ *
+ * Deploy's pre-money check, run here too — the SAME `unboundWalletInstances` `runDeploy` calls, not
+ * a second implementation. The author should never first learn about a package-derivable fault from
+ * the money path, which is what `senpi validate` green followed by `senpi deploy` refused means.
+ *
+ * ## Why this is a STATIC-depth check
+ *
+ * It reads the package's own bytes and nothing else: no exchange, no gateway, no credentials. That
+ * puts it at the shallowest depth, where `depthsUpTo` makes it run at every depth above — so an
+ * offline CI run with no MCP server reachable still catches it. The universe check next door is
+ * live-depth only because its verdict needs the exchange's instrument list; this one has no such
+ * excuse and should not borrow the latency.
+ *
+ * ## Why it never fires on a recipe an author is pinning deliberately
+ *
+ * `resolveWallet` accepts a well-formed address in `strategy.wallet` as a real wallet to validate
+ * against — pinning is how you make a live run read a real book instead of the empty placeholder
+ * one. That is a supported workflow and this check must not take it away. It cannot: the fault
+ * requires a manifest that declares `wallet_env` for THIS instance, which is exactly the state
+ * where a pinned address contradicts the package's own promise. A recipe with no package around it,
+ * or one the manifest does not declare, is silent here.
+ *
+ * ## The three states of "no package"
+ *
+ * Same rule as `universe-stage.ts`, for the same reason. `pkg` set is the checkable one.
+ * `packageUnreadable` means a `strategy.yaml` exists and would not load — the check could not run,
+ * which is reported rather than passed over, because "I could not read it" is never "there is
+ * nothing there". Neither set is the genuine no-package case (a recipe being authored before its
+ * manifest exists), and nothing is reported there.
+ */
+import { isAbsolute, relative } from "node:path";
+import { unboundWalletInstances } from "../deploy/package.js";
+import { VALIDATE_CODE } from "./codes.js";
+import { taxonomyFinding } from "./taxonomy-finding.js";
+/**
+ * The check, as findings.
+ *
+ * Scoped to the instance this run is validating, not to the whole package. `target.ts` resolves a
+ * package ROOT to a refusal ("pick an instance"), so every run that gets here is about exactly one
+ * recipe — and reporting a sibling's fault would be telling the author to edit a file this command
+ * did not look at.
+ */
+export function walletBindingFindings(target) {
+    if (target.packageUnreadable !== undefined) {
+        // Deliberately silent. The manifest is what declares `wallet_env`, so an unreadable one means
+        // this check has no question to ask — and `target.ts` already raises
+        // `E_VALIDATE_UNREADABLE_MANIFEST` at the package root, while below the root the universe check
+        // reports the same unreadable file. A third voice on one fault is noise, not fail-open: no
+        // reading of a manifest nobody can read could clear a package for funding.
+        return [];
+    }
+    const pkg = target.pkg;
+    if (pkg === undefined || target.recipePath === undefined)
+        return [];
+    const fault = unboundWalletInstances(pkg).find((candidate) => candidate.instance.runtimeYamlPath === target.recipePath);
+    return fault === undefined ? [] : [walletUnboundFinding(fault, pkg)];
+}
+function walletUnboundFinding(fault, pkg) {
+    const file = asPath(pkg.dir, fault.instance.runtimeYamlPath);
+    const binds = fault.declared === undefined
+        ? "declares no `strategy.wallet` at all"
+        : `binds \`strategy.wallet: ${fault.declared}\``;
+    return taxonomyFinding(VALIDATE_CODE.walletUnbound, {
+        where: { file, yaml_path: "strategy.wallet" },
+        what: `This recipe ${binds}, but strategy.yaml declares \`wallet_env: ${fault.instance.walletEnv}\` ` +
+            `for instance "${fault.instance.name}"`,
+        why: "`senpi deploy` creates and funds a wallet for this instance and passes it in by substituting " +
+            `\`${fault.expected}\` into this file. Nothing here carries that token, so nothing would be ` +
+            "substituted — silently, because the unresolved-placeholder check only looks for `${...}` " +
+            "left over. The deploy would fund a new wallet and then install this strategy, exit engine " +
+            "included, against a different account: the funded wallet left with nothing watching it, and " +
+            "the install reporting the address in this file.",
+        fix: `Set \`strategy.wallet\` in ${file} to \`"${fault.expected}"\`. Deploy substitutes the wallet ` +
+            `it creates; a literal address is never what you want for an instance the manifest funds. ` +
+            `\`senpi deploy\` reads the same two files and refuses for the same reason.`,
+        evidence: {
+            instance: fault.instance.name,
+            wallet_env: fault.instance.walletEnv,
+            expected: fault.expected,
+            declared: fault.declared,
+            file,
+        },
+    });
+}
+/** Package-relative where it sits underneath, absolute otherwise — as `universe-stage.ts` renders. */
+function asPath(base, absolute) {
+    const rel = relative(base, absolute);
+    return rel === "" || rel.startsWith("..") || isAbsolute(rel) ? absolute : rel;
+}
+//# sourceMappingURL=wallet-binding-stage.js.map

package/dist/validate/wallet-binding-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-binding-stage.js","sourceRoot":"","sources":["../../src/validate/wallet-binding-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAA+C,MAAM,sBAAsB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,8FAA8F;QAC9F,qEAAqE;QACrE,gGAAgG;QAChG,2FAA2F;QAC3F,2EAA2E;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEpE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,UAAU,CACxE,CAAC;IACF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,GAAkB;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC1B,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,4BAA4B,KAAK,CAAC,QAAQ,IAAI,CAAC;IACrD,OAAO,eAAe,CAAC,aAAa,CAAC,aAAa,EAAE;QAClD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE;QAC7C,IAAI,EACF,eAAe,KAAK,8CAA8C,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK;YAC/F,iBAAiB,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;QACzC,GAAG,EACD,+FAA+F;YAC/F,KAAK,KAAK,CAAC,QAAQ,0EAA0E;YAC7F,2FAA2F;YAC3F,4FAA4F;YAC5F,8FAA8F;YAC9F,iDAAiD;QACnD,GAAG,EACD,8BAA8B,IAAI,UAAU,KAAK,CAAC,QAAQ,qCAAqC;YAC/F,2FAA2F;YAC3F,4EAA4E;QAC9E,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC7B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;SACL;KACF,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AAChF,CAAC"}

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "runtime",
   "name": "Senpi Runtime",
   "description": "Senpi runtime plugin for OpenClaw. Orchestrates scanners, LLM-based trade decisions, and a DSL trailing stop-loss exit engine.",
-  "version": "3.0.72",
+  "version": "3.0.74",
   "commandAliases": [
     {
       "name": "senpi"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senpi/runtime",
-  "version": "3.0.72",
+  "version": "3.0.74",
   "description": "Senpi runtime plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",