@vainplex/shieldapi-cli 1.2.0 → 1.2.2

package/README.md

@@ -109,18 +109,42 @@ if [ $? -eq 1 ]; then
 fi
 ```
 
-## Security
+## Security & Privacy
 
-- **Passwords are hashed locally** with SHA-1 before any network request. Plaintext never leaves your machine.
-- **Private keys are never persisted** to disk, logs, or displayed in output.
-- **No telemetry** — zero phone-home, zero analytics.
-- **Shell history warning** — the CLI warns when passwords are passed as arguments (use `--stdin` for sensitive passwords).
+### Your password never leaves your machine in plaintext
+
+1. Your password is **SHA-1 hashed locally** on your machine — plaintext never touches the network.
+2. The SHA-1 hash is sent over **HTTPS** to the ShieldAPI server.
+3. The server uses the [HIBP k-Anonymity protocol](https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange) — only the **first 5 characters** of the hash go to the upstream breach database. The full hash never leaves ShieldAPI.
+
+**Want true end-to-end k-Anonymity?** Use the `check-password-range` endpoint directly via the API — it only accepts a 5-character prefix and returns all matching suffixes, so you can check locally.
+
+### Avoiding shell history exposure
+
+Passing a password as a CLI argument stores it in your shell history (`~/.bash_history`). Use these safer alternatives:
 
 ```bash
-# Secure password checking (avoids shell history)
-echo "mysecretpassword" | shieldapi password dummy --stdin
+# Option 1: Read from stdin (recommended)
+read -sp "Password: " PW && echo -n "$PW" | shieldapi password dummy --stdin --demo
+
+# Option 2: Pipe directly
+echo -n "mypassword" | shieldapi password dummy --stdin --demo
+
+# Option 3: Hash first, then check the hash
+shieldapi hash "mypassword"           # → shows SHA-1 locally
+shieldapi password "7C6A18..." --hash --demo  # check by hash, not password
+
+# Option 4: Clear history after
+shieldapi password "test" --demo && history -d $(history 1 | awk '{print $1}')
 ```
 
+### Other security guarantees
+
+- **Private keys are never persisted** to disk, logs, or displayed in output.
+- **No telemetry** — zero phone-home, zero analytics.
+- **HTTPS only** — all API communication is encrypted.
+- **Shell history warning** — the CLI warns when passwords are passed as arguments.
+
 ## How x402 Works
 
 [x402](https://x402.org) is an open protocol for HTTP payments. Instead of API keys:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vainplex/shieldapi-cli",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Security intelligence from your terminal. Pay-per-request with USDC.",
   "type": "module",
   "bin": {

package/src/index.js

@@ -14,7 +14,7 @@ export function run(argv) {
   program
     .name('shieldapi')
     .description('🛡️  ShieldAPI CLI — Security intelligence from your terminal. Pay-per-request with USDC.')
-    .version('1.2.0')
+    .version('1.2.2')
     .option('--wallet <key>', 'Private key for x402 payments (or set SHIELDAPI_WALLET_KEY)')
     .option('--json', 'Output raw JSON instead of formatted output')
     .option('--no-color', 'Disable colors')

package/src/lib/api.js

@@ -7,7 +7,7 @@ const BASE_URL = 'https://shield.vainplex.dev/api';
  * @param {Record<string, string>} params - Query parameters
  * @param {object} options
  * @param {boolean} options.demo - Use demo mode
- * @param {{ client: object }|null} options.wallet - Wallet with viem client
+ * @param {{ signer: object }|null} options.wallet - Wallet with x402 ClientEvmSigner
  * @returns {Promise<object>} Parsed JSON response
  */
 export async function apiRequest(endpoint, params = {}, { demo = false, wallet = null } = {}) {
@@ -28,8 +28,8 @@ export async function apiRequest(endpoint, params = {}, { demo = false, wallet =
     return res.json();
   }
 
-  // Paid endpoint — need wallet
-  if (!wallet?.client) {
+  // Paid endpoint — need wallet with signer
+  if (!wallet?.signer) {
     throw new Error(
       'No wallet configured. Use --wallet <key> or set SHIELDAPI_WALLET_KEY environment variable.'
     );
@@ -41,8 +41,9 @@ export async function apiRequest(endpoint, params = {}, { demo = false, wallet =
   const { wrapFetchWithPayment } = await import('@x402/fetch');
 
   // Create x402 client with EVM scheme registered
+  // wallet.signer is a ClientEvmSigner (from toClientEvmSigner) with .address + .signTypedData + .readContract
   const client = new x402Client();
-  registerExactEvmScheme(client, { signer: wallet.client });
+  registerExactEvmScheme(client, { signer: wallet.signer });
 
   // Wrap fetch with x402 payment handling
   const paidFetch = wrapFetchWithPayment(fetch, client);

package/src/lib/wallet.js

@@ -1,13 +1,17 @@
-import { createWalletClient, http, publicActions } from 'viem';
+import { createWalletClient, createPublicClient, http } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { base } from 'viem/chains';
+import { toClientEvmSigner } from '@x402/evm';
 
 /**
- * Create a viem wallet client from a private key.
- * Returns a wallet client with publicActions (needed for readContract in x402).
+ * Create a wallet + x402-compatible signer from a private key.
+ * 
+ * Uses toClientEvmSigner to compose an account (for signing) with
+ * a publicClient (for readContract), producing a ClientEvmSigner
+ * that has both `.address` and `.signTypedData` + `.readContract`.
  * 
  * @param {string} privateKey - Hex private key (with or without 0x prefix)
- * @returns {{ client: import('viem').WalletClient, address: string }}
+ * @returns {{ signer: object, address: string }}
  */
 export function createWallet(privateKey) {
   if (!privateKey) return null;
@@ -16,23 +20,26 @@ export function createWallet(privateKey) {
 
   try {
     const account = privateKeyToAccount(key);
-    const client = createWalletClient({
-      account,
+    const publicClient = createPublicClient({
       chain: base,
       transport: http(),
-    }).extend(publicActions);
+    });
+
+    // toClientEvmSigner composes account.signTypedData + publicClient.readContract
+    // and exposes .address correctly
+    const signer = toClientEvmSigner(account, publicClient);
 
-    return { client, address: account.address };
+    return { signer, address: account.address };
   } catch (err) {
     throw new Error(`Invalid private key: ${err.message}`);
   }
 }
 
 /**
- * Resolve wallet client from CLI option or environment variable.
+ * Resolve wallet/signer from CLI option or environment variable.
  * 
  * @param {object} opts - Commander options
- * @returns {{ client: object, address: string }|null}
+ * @returns {{ signer: object, address: string }|null}
  */
 export function resolveWallet(opts) {
   const key = opts?.wallet || process.env.SHIELDAPI_WALLET_KEY;