@sherwoodagent/cli 0.58.3 → 0.58.6

package/dist/{price-H4X2AAAQ.js → price-MUILXUC4.js}

@@ -1,7 +1,7 @@
 import {
   SYNTHRA,
   UNISWAP
-} from "./chunk-3M6K2MNV.js";
+} from "./chunk-3UETTXXU.js";
 import {
   getPublicClient
 } from "./chunk-XDBRKW7I.js";
@@ -155,4 +155,4 @@ export {
   getTokenPriceInAsset,
   getTokenPricesInAsset
 };
-//# sourceMappingURL=price-H4X2AAAQ.js.map
+//# sourceMappingURL=price-MUILXUC4.js.map

package/dist/{research-PYUIY4VC.js → research-AR4TABCF.js}

@@ -16,7 +16,7 @@ import ora from "ora";
 import { confirm } from "@inquirer/prompts";
 import { isAddress } from "viem";
 async function loadXmtp() {
-  return import("./xmtp-SQIOIRCX.js");
+  return import("./xmtp-IVDHDORA.js");
 }
 var COST_ESTIMATES = {
   messari: MESSARI_COST_ESTIMATE,
@@ -83,7 +83,7 @@ function formatValue(value) {
 }
 async function postResearch(syndicateName, result, prompt) {
   const { pinJSON } = await import("./ipfs-IGXLLJCF.js");
-  const { createResearchAttestation, getEasScanUrl } = await import("./eas-6HFFZZ52.js");
+  const { createResearchAttestation, getEasScanUrl } = await import("./eas-OEBIB5RW.js");
   const xmtp = await loadXmtp();
   const pinSpinner = ora("Pinning research result to IPFS...").start();
   let resultUri;
@@ -312,4 +312,4 @@ function registerResearchCommands(program) {
 export {
   registerResearchCommands
 };
-//# sourceMappingURL=research-PYUIY4VC.js.map
+//# sourceMappingURL=research-AR4TABCF.js.map

package/dist/{session-AZKLV2T7.js → session-ISY5VAUS.js}

@@ -6,14 +6,14 @@ import {
 } from "./chunk-W2ZUPR3W.js";
 import {
   resolveSyndicate
-} from "./chunk-EWKFWF3G.js";
+} from "./chunk-V5DYFQCQ.js";
 import {
   PROPOSAL_STATES,
   getProposal
-} from "./chunk-KG7BGVBR.js";
+} from "./chunk-ZORVNIGX.js";
 import {
   SHERWOOD
-} from "./chunk-3M6K2MNV.js";
+} from "./chunk-3UETTXXU.js";
 import {
   getPublicClient
 } from "./chunk-XDBRKW7I.js";
@@ -187,7 +187,7 @@ async function enrichProposalEvents(events, metadataCache) {
 
 // src/commands/session.ts
 async function loadXmtp() {
-  return import("./xmtp-SQIOIRCX.js");
+  return import("./xmtp-IVDHDORA.js");
 }
 async function resolveGovernor(vaultAddress) {
   const client = getPublicClient();
@@ -477,4 +477,4 @@ function registerSessionCommands(program) {
 export {
   registerSessionCommands
 };
-//# sourceMappingURL=session-AZKLV2T7.js.map
+//# sourceMappingURL=session-ISY5VAUS.js.map

package/dist/{trade-P2LBGWVY.js → trade-VTRYXGP4.js}

@@ -4,13 +4,13 @@ import {
 import {
   UniswapProvider,
   getQuote
-} from "./chunk-XHNSF4NV.js";
+} from "./chunk-XFVLEE5S.js";
 import {
   chatCompletion
 } from "./chunk-7HJXZ4NM.js";
 import {
   TOKENS
-} from "./chunk-3M6K2MNV.js";
+} from "./chunk-3UETTXXU.js";
 import {
   formatContractError,
   getAccount,
@@ -334,7 +334,7 @@ async function getCurrentPrice(tokenAddress, tokenDecimals, feeTier) {
 // src/commands/trade.ts
 var uniswap = new UniswapProvider();
 async function loadXmtp() {
-  return import("./xmtp-SQIOIRCX.js");
+  return import("./xmtp-IVDHDORA.js");
 }
 var ETH_ADDRESS = "0x0000000000000000000000000000000000000000";
 var KNOWN_MEMECOINS = {
@@ -641,7 +641,7 @@ function registerTradeCommands(program) {
     }
     console.log(`  Tx:       ${chalk.dim(getExplorerUrl(txHash))}`);
     try {
-      const { createTradeAttestation, getEasScanUrl } = await import("./eas-6HFFZZ52.js");
+      const { createTradeAttestation, getEasScanUrl } = await import("./eas-OEBIB5RW.js");
       const { getChainContracts } = await import("./config-REASKDIK.js");
       const { getChain: getActiveChain } = await import("./network-3ZU7UBDU.js");
       const vaultRecipient = getChainContracts(getActiveChain().id).vault;
@@ -769,7 +769,7 @@ function registerTradeCommands(program) {
     }
     console.log(`  Tx:       ${chalk.dim(getExplorerUrl(txHash))}`);
     try {
-      const { createTradeAttestation, getEasScanUrl } = await import("./eas-6HFFZZ52.js");
+      const { createTradeAttestation, getEasScanUrl } = await import("./eas-OEBIB5RW.js");
       const { getChainContracts } = await import("./config-REASKDIK.js");
       const { getChain: getActiveChain } = await import("./network-3ZU7UBDU.js");
       const vaultRecipient = getChainContracts(getActiveChain().id).vault;
@@ -946,4 +946,4 @@ function sleep(ms) {
 export {
   registerTradeCommands
 };
-//# sourceMappingURL=trade-P2LBGWVY.js.map
+//# sourceMappingURL=trade-VTRYXGP4.js.map

package/dist/{xmtp-SQIOIRCX.js → xmtp-IVDHDORA.js}

@@ -1,7 +1,7 @@
 import {
   getTextRecord
-} from "./chunk-EWKFWF3G.js";
-import "./chunk-3M6K2MNV.js";
+} from "./chunk-V5DYFQCQ.js";
+import "./chunk-3UETTXXU.js";
 import {
   getAccount
 } from "./chunk-XDBRKW7I.js";
@@ -281,4 +281,4 @@ export {
   sendReaction,
   streamMessages
 };
-//# sourceMappingURL=xmtp-SQIOIRCX.js.map
+//# sourceMappingURL=xmtp-IVDHDORA.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sherwoodagent/cli",
-  "version": "0.58.3",
+  "version": "0.58.6",
   "description": "CLI for agent-managed investment syndicates — onchain DeFi syndicates with XMTP chat",
   "type": "module",
   "bin": {

package/scripts/pin-xmtp-bindings.cjs

@@ -17,10 +17,20 @@
  *
  *   This postinstall forcibly replaces the installed binding with the dev
  *   version. --no-save keeps package.json unchanged. --force tells npm to
- *   ignore the semver conflict with @xmtp/node-sdk's own dep range (the
- *   dev pre-release doesn't satisfy `^1.10.0` under npm's strict semver).
- *   After the force-install, `npm dedupe` collapses any nested copies
- *   inside @xmtp/node-sdk's own node_modules.
+ *   ignore the semver conflict with @xmtp/node-sdk's own dep declaration
+ *   (the dev pre-release doesn't satisfy `1.10.0` under npm's strict
+ *   semver — pre-releases only match an explicitly named version).
+ *
+ *   The force-install hoists the dev binding to <cli>/node_modules/@xmtp/
+ *   node-bindings, but @xmtp/node-sdk's own nested copy at <cli>/
+ *   node_modules/@xmtp/node-sdk/node_modules/@xmtp/node-bindings persists
+ *   — `npm dedupe` won't collapse it because the pre-release fails the
+ *   SDK's strict `1.10.0` dep check. Node's `require()` from inside
+ *   @xmtp/node-sdk then resolves the nested glibc-2.38 binding before
+ *   walking up to the hoisted dev one.
+ *
+ *   To force resolution back to the hoisted dev binding we recursively
+ *   delete every nested @xmtp/node-bindings copy in the install tree.
  *
  *   If npm isn't available or the network is unreachable at postinstall
  *   time, this script exits quietly with status 0. Runtime XMTP calls
@@ -36,10 +46,14 @@
 "use strict";
 
 const { execSync } = require("node:child_process");
-const { existsSync } = require("node:fs");
+const fs = require("node:fs");
 const path = require("node:path");
 
-const PINNED = "@xmtp/node-bindings@1.10.0-dev.97e86c6";
+const PINNED_VERSION = "1.10.0-dev.97e86c6";
+const PINNED = `@xmtp/node-bindings@${PINNED_VERSION}`;
+const MANUAL_RECOVERY =
+  `cd $(dirname $(readlink -f $(which sherwood)))/../lib/node_modules/@sherwoodagent/cli && ` +
+  `npm install --no-save --force ${PINNED}`;
 
 // Skip in CI / test / sandbox envs where network is unavailable or unwanted.
 if (process.env.SHERWOOD_SKIP_XMTP_BINDING_PIN === "1") {
@@ -51,8 +65,12 @@ if (process.env.SHERWOOD_SKIP_XMTP_BINDING_PIN === "1") {
 
 // Skip when running from the monorepo (cli/ is itself the root during dev;
 // overrides work and this would create a redundant nested copy).
+const cliRoot = path.resolve(__dirname, "..");
 const parentDir = path.resolve(__dirname, "..", "..");
-if (existsSync(path.join(parentDir, "contracts")) && existsSync(path.join(parentDir, "cli"))) {
+if (
+  fs.existsSync(path.join(parentDir, "contracts")) &&
+  fs.existsSync(path.join(parentDir, "cli"))
+) {
   process.stderr.write(
     "[sherwood-cli] postinstall: monorepo dev install detected — skipping binding pin\n",
   );
@@ -65,18 +83,55 @@ try {
   );
   execSync(`npm install --no-save --force ${PINNED}`, {
     stdio: ["ignore", "pipe", "pipe"],
-    cwd: path.resolve(__dirname, ".."),
+    cwd: cliRoot,
   });
-  // Collapse any nested copies that @xmtp/node-sdk installed separately
-  // (its own deps range `^1.10.0` rejects our pre-release by strict semver).
-  try {
-    execSync("npm dedupe @xmtp/node-bindings", {
-      stdio: ["ignore", "pipe", "pipe"],
-      cwd: path.resolve(__dirname, ".."),
-    });
-  } catch {
-    // dedupe is best-effort; failure doesn't mean the primary install failed.
+
+  const rootNodeModules = path.join(cliRoot, "node_modules");
+  const hoistedBinding = path.join(rootNodeModules, "@xmtp", "node-bindings");
+
+  const allBindings = findBindingDirs(rootNodeModules);
+  const nested = allBindings.filter(
+    (p) => path.resolve(p) !== path.resolve(hoistedBinding),
+  );
+  for (const p of nested) {
+    try {
+      fs.rmSync(p, { recursive: true, force: true });
+      process.stderr.write(
+        `[sherwood-cli] postinstall: removed nested binding ${p}\n`,
+      );
+    } catch (rmErr) {
+      process.stderr.write(
+        `[sherwood-cli] postinstall: WARN failed to remove nested binding ${p} ` +
+          `(${rmErr && rmErr.message ? rmErr.message : rmErr}). ` +
+          "XMTP features may load the nested glibc-2.38 binding instead. To retry manually:\n" +
+          `  ${MANUAL_RECOVERY}\n`,
+      );
+    }
+  }
+
+  const hoistedPkgJson = path.join(hoistedBinding, "package.json");
+  if (fs.existsSync(hoistedPkgJson)) {
+    let installed;
+    try {
+      installed = JSON.parse(fs.readFileSync(hoistedPkgJson, "utf8")).version;
+    } catch {
+      installed = "<unparseable>";
+    }
+    if (installed !== PINNED_VERSION) {
+      process.stderr.write(
+        `[sherwood-cli] postinstall: WARN @xmtp/node-bindings is ${installed}, expected ${PINNED_VERSION}. ` +
+          "XMTP features may fail with GLIBC_2.38 errors. To retry manually:\n" +
+          `  ${MANUAL_RECOVERY}\n`,
+      );
+    }
+  } else {
+    process.stderr.write(
+      `[sherwood-cli] postinstall: WARN hoisted @xmtp/node-bindings missing at ${hoistedBinding}. ` +
+        "XMTP features may fail. To retry manually:\n" +
+        `  ${MANUAL_RECOVERY}\n`,
+    );
   }
+
   process.stderr.write("[sherwood-cli] postinstall: binding pin applied\n");
 } catch (err) {
   // Don't fail the install — non-XMTP commands still work. The error
@@ -85,7 +140,54 @@ try {
   process.stderr.write(
     `[sherwood-cli] postinstall: binding pin failed (${err && err.message ? err.message : err}). ` +
       "XMTP features may fail at runtime. To retry manually:\n" +
-      `  cd $(dirname $(readlink -f $(which sherwood)))/../lib/node_modules/@sherwoodagent/cli && npm install --no-save --force ${PINNED}\n`,
+      `  ${MANUAL_RECOVERY}\n`,
   );
   process.exit(0);
 }
+
+/**
+ * Walk a node_modules tree and return absolute paths of every directory
+ * that is an installed @xmtp/node-bindings package. Includes the hoisted
+ * copy at the root — caller filters that one out.
+ */
+function findBindingDirs(rootNodeModules) {
+  const found = [];
+  walkNodeModules(rootNodeModules);
+  return found;
+
+  function walkNodeModules(nm) {
+    let entries;
+    try {
+      entries = fs.readdirSync(nm, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const entryPath = path.join(nm, entry.name);
+      if (entry.name.startsWith("@")) {
+        let scoped;
+        try {
+          scoped = fs.readdirSync(entryPath, { withFileTypes: true });
+        } catch {
+          continue;
+        }
+        for (const pkg of scoped) {
+          if (!pkg.isDirectory()) continue;
+          const pkgPath = path.join(entryPath, pkg.name);
+          if (entry.name === "@xmtp" && pkg.name === "node-bindings") {
+            found.push(pkgPath);
+          }
+          recurseInto(pkgPath);
+        }
+      } else {
+        recurseInto(entryPath);
+      }
+    }
+  }
+
+  function recurseInto(pkgPath) {
+    const nested = path.join(pkgPath, "node_modules");
+    if (fs.existsSync(nested)) walkNodeModules(nested);
+  }
+}