@vultisig/cli 1.8.1 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @vultisig/cli
 
+## 2.0.0
+
+### Major Changes
+
+- [#682](https://github.com/vultisig/vultisig-sdk/pull/682) [`341245e`](https://github.com/vultisig/vultisig-sdk/commit/341245e2d6d49348e38d61bc42805c35ac8d3052) Thanks [@neavra](https://github.com/neavra)! - Gate signing in `agent ask` mode behind explicit confirmation (security fix, **breaking**).
+
+  Previously `vsig agent ask` auto-signed and broadcast any transaction envelope the
+  backend returned, gated only by whether a password was present. Because the backend
+  routes read-only swap intents (e.g. "list swap routes from USDC to ETH") to the
+  fund-moving `execute_swap` tool, a query could broadcast a real on-chain swap.
+
+  `runPasswordGatedTool` now calls `ui.requestConfirmation` before any `sign_tx` /
+  `sign_typed_data` (the single chokepoint for both the tx_ready path and client-side
+  dispatch, covering both legs of a multi-leg swap). In ask mode this defaults to
+  **deny**: signing/broadcast now requires the new `agent ask --yes` flag. Without it,
+  the proposed transaction is reported (`CONFIRMATION_REQUIRED`) and nothing is signed.
+  Interactive (TUI) and pipe (`--via-agent`) modes already prompt/defer for confirmation.
+
+  **BREAKING — migration for unattended pipelines:** any automation that relied on
+  `agent ask` auto-signing must now pass `--yes`. A denied signing still exits **0**
+  (a misrouted read-only prompt remains a successful query); detect it via the new
+  top-level `confirmation_required: true` field in `--output json` mode, the
+  `confirmation-required:` line in text mode, or `tool_calls[].code ===
+"CONFIRMATION_REQUIRED"`. Do not infer "broadcast happened" from exit code alone —
+  check the `transactions` array. With `--yes`, each authorization is logged to stderr
+  (`[confirm] auto-approved (--yes): <summary>`).
+
+### Patch Changes
+
+- Updated dependencies [[`dc75595`](https://github.com/vultisig/vultisig-sdk/commit/dc75595e83360f5bda84b2d91cae177bc7c8c966)]:
+  - @vultisig/sdk@2.0.0
+  - @vultisig/rujira@33.0.0
+  - @vultisig/client-shared@0.2.15
+
+## 1.8.10
+
+### Patch Changes
+
+- [#683](https://github.com/vultisig/vultisig-sdk/pull/683) [`4561129`](https://github.com/vultisig/vultisig-sdk/commit/45611297a55da72d3c56b1a2ffe6522da1b64d7b) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Update SDK package dependencies and Yarn tooling.
+
+- Updated dependencies [[`4561129`](https://github.com/vultisig/vultisig-sdk/commit/45611297a55da72d3c56b1a2ffe6522da1b64d7b)]:
+  - @vultisig/client-shared@0.2.14
+  - @vultisig/core-chain@2.14.1
+  - @vultisig/rujira@32.0.1
+  - @vultisig/sdk@1.8.10
+
 ## 1.8.1
 
 ### Patch Changes

package/dist/index.js

@@ -1102,7 +1102,7 @@ var require_main = __commonJS({
   }
 });
 
-// ../../node_modules/@noble/hashes/esm/_u64.js
+// node_modules/@noble/hashes/_u64.js
 function fromBig(n, le = false) {
   if (le)
     return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
@@ -1120,7 +1120,7 @@ function split(lst, le = false) {
 }
 var U32_MASK64, _32n, rotlSH, rotlSL, rotlBH, rotlBL;
 var init_u64 = __esm({
-  "../../node_modules/@noble/hashes/esm/_u64.js"() {
+  "node_modules/@noble/hashes/_u64.js"() {
     U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
     _32n = /* @__PURE__ */ BigInt(32);
     rotlSH = (h, l, s) => h << s | l >>> 32 - s;
@@ -1130,19 +1130,34 @@ var init_u64 = __esm({
   }
 });
 
-// ../../node_modules/@noble/hashes/esm/utils.js
+// node_modules/@noble/hashes/utils.js
 function isBytes(a) {
-  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
-function anumber(n) {
-  if (!Number.isSafeInteger(n) || n < 0)
-    throw new Error("positive integer expected, got " + n);
+function anumber(n, title = "") {
+  if (typeof n !== "number") {
+    const prefix = title && `"${title}" `;
+    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
+  }
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
+  }
 }
-function abytes(b, ...lengths) {
-  if (!isBytes(b))
-    throw new Error("Uint8Array expected");
-  if (lengths.length > 0 && !lengths.includes(b.length))
-    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+function abytes(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
 }
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
@@ -1151,10 +1166,10 @@ function aexists(instance, checkFinished = true) {
     throw new Error("Hash#digest() has already been called");
 }
 function aoutput(out, instance) {
-  abytes(out);
+  abytes(out, void 0, "digestInto() output");
   const min = instance.outputLen;
   if (out.length < min) {
-    throw new Error("digestInto() expects output buffer of length at least " + min);
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
   }
 }
 function u32(arr) {
@@ -1174,44 +1189,30 @@ function byteSwap32(arr) {
   }
   return arr;
 }
-function utf8ToBytes(str) {
-  if (typeof str !== "string")
-    throw new Error("string expected");
-  return new Uint8Array(new TextEncoder().encode(str));
-}
-function toBytes(data) {
-  if (typeof data === "string")
-    data = utf8ToBytes(data);
-  abytes(data);
-  return data;
-}
-function createHasher(hashCons) {
-  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-  const tmp = hashCons();
-  hashC.outputLen = tmp.outputLen;
-  hashC.blockLen = tmp.blockLen;
-  hashC.create = () => hashCons();
-  return hashC;
-}
-function createXOFer(hashCons) {
-  const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();
-  const tmp = hashCons({});
+function createHasher(hashCons, info2 = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
   hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
   hashC.create = (opts) => hashCons(opts);
-  return hashC;
+  Object.assign(hashC, info2);
+  return Object.freeze(hashC);
 }
-var isLE, swap32IfBE, Hash;
+var isLE, swap32IfBE, oidNist;
 var init_utils = __esm({
-  "../../node_modules/@noble/hashes/esm/utils.js"() {
+  "node_modules/@noble/hashes/utils.js"() {
     isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
     swap32IfBE = isLE ? (u) => u : byteSwap32;
-    Hash = class {
-    };
+    oidNist = (suffix) => ({
+      // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+      // Larger suffix values would need base-128 OID encoding and a different length byte.
+      oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+    });
   }
 });
 
-// ../../node_modules/@noble/hashes/esm/sha3.js
+// node_modules/@noble/hashes/sha3.js
 var sha3_exports = {};
 __export(sha3_exports, {
   Keccak: () => Keccak,
@@ -1225,9 +1226,14 @@ __export(sha3_exports, {
   sha3_384: () => sha3_384,
   sha3_512: () => sha3_512,
   shake128: () => shake128,
-  shake256: () => shake256
+  shake128_32: () => shake128_32,
+  shake256: () => shake256,
+  shake256_64: () => shake256_64
 });
 function keccakP(s, rounds = 24) {
+  anumber(rounds, "rounds");
+  if (rounds < 1 || rounds > 24)
+    throw new Error('"rounds" expected integer 1..24');
   const B = new Uint32Array(5 * 2);
   for (let round = 24 - rounds; round < 24; round++) {
     for (let x = 0; x < 10; x++)
@@ -1257,19 +1263,26 @@ function keccakP(s, rounds = 24) {
       s[PI + 1] = Tl;
     }
     for (let y = 0; y < 50; y += 10) {
-      for (let x = 0; x < 10; x++)
-        B[x] = s[y + x];
-      for (let x = 0; x < 10; x++)
-        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+      const b0 = s[y], b1 = s[y + 1], b2 = s[y + 2], b3 = s[y + 3];
+      s[y] ^= ~s[y + 2] & s[y + 4];
+      s[y + 1] ^= ~s[y + 3] & s[y + 5];
+      s[y + 2] ^= ~s[y + 4] & s[y + 6];
+      s[y + 3] ^= ~s[y + 5] & s[y + 7];
+      s[y + 4] ^= ~s[y + 6] & s[y + 8];
+      s[y + 5] ^= ~s[y + 7] & s[y + 9];
+      s[y + 6] ^= ~s[y + 8] & b0;
+      s[y + 7] ^= ~s[y + 9] & b1;
+      s[y + 8] ^= ~b0 & b2;
+      s[y + 9] ^= ~b1 & b3;
     }
     s[0] ^= SHA3_IOTA_H[round];
     s[1] ^= SHA3_IOTA_L[round];
   }
   clean(B);
 }
-var _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, rotlH, rotlL, Keccak, gen, sha3_224, sha3_256, sha3_384, sha3_512, keccak_224, keccak_256, keccak_384, keccak_512, genShake, shake128, shake256;
+var _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, rotlH, rotlL, Keccak, genKeccak, sha3_224, sha3_256, sha3_384, sha3_512, keccak_224, keccak_256, keccak_384, keccak_512, genShake, shake128, shake256, shake128_32, shake256_64;
 var init_sha3 = __esm({
-  "../../node_modules/@noble/hashes/esm/sha3.js"() {
+  "node_modules/@noble/hashes/sha3.js"() {
     init_u64();
     init_utils();
     _0n = BigInt(0);
@@ -1289,7 +1302,7 @@ var init_sha3 = __esm({
       for (let j = 0; j < 7; j++) {
         R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
         if (R & _2n)
-          t ^= _1n << (_1n << /* @__PURE__ */ BigInt(j)) - _1n;
+          t ^= _1n << (_1n << BigInt(j)) - _1n;
       }
       _SHA3_IOTA.push(t);
     }
@@ -1298,21 +1311,28 @@ var init_sha3 = __esm({
     SHA3_IOTA_L = IOTAS[1];
     rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
     rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
-    Keccak = class _Keccak extends Hash {
+    Keccak = class _Keccak {
+      state;
+      pos = 0;
+      posOut = 0;
+      finished = false;
+      state32;
+      destroyed = false;
+      blockLen;
+      suffix;
+      outputLen;
+      canXOF;
+      enableXOF = false;
+      rounds;
       // NOTE: we accept arguments in bytes instead of bits here.
       constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
-        super();
-        this.pos = 0;
-        this.posOut = 0;
-        this.finished = false;
-        this.destroyed = false;
-        this.enableXOF = false;
         this.blockLen = blockLen;
         this.suffix = suffix;
         this.outputLen = outputLen;
         this.enableXOF = enableXOF;
+        this.canXOF = enableXOF;
         this.rounds = rounds;
-        anumber(outputLen);
+        anumber(outputLen, "outputLen");
         if (!(0 < blockLen && blockLen < 200))
           throw new Error("only keccak-f1600 function is supported");
         this.state = new Uint8Array(200);
@@ -1330,7 +1350,6 @@ var init_sha3 = __esm({
       }
       update(data) {
         aexists(this);
-        data = toBytes(data);
         abytes(data);
         const { blockLen, state } = this;
         const len = data.length;
@@ -1383,12 +1402,13 @@ var init_sha3 = __esm({
         aoutput(out, this);
         if (this.finished)
           throw new Error("digest() was already called");
-        this.writeInto(out);
+        this.writeInto(out.subarray(0, this.outputLen));
         this.destroy();
-        return out;
       }
       digest() {
-        return this.digestInto(new Uint8Array(this.outputLen));
+        const out = new Uint8Array(this.outputLen);
+        this.digestInto(out);
+        return out;
       }
       destroy() {
         this.destroyed = true;
@@ -1396,7 +1416,8 @@ var init_sha3 = __esm({
       }
       _cloneInto(to) {
         const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
-        to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+        to ||= new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+        to.blockLen = blockLen;
         to.state32.set(this.state32);
         to.pos = this.pos;
         to.posOut = this.posOut;
@@ -1405,22 +1426,45 @@ var init_sha3 = __esm({
         to.suffix = suffix;
         to.outputLen = outputLen;
         to.enableXOF = enableXOF;
+        to.canXOF = this.canXOF;
         to.destroyed = this.destroyed;
         return to;
       }
     };
-    gen = (suffix, blockLen, outputLen) => createHasher(() => new Keccak(blockLen, suffix, outputLen));
-    sha3_224 = /* @__PURE__ */ (() => gen(6, 144, 224 / 8))();
-    sha3_256 = /* @__PURE__ */ (() => gen(6, 136, 256 / 8))();
-    sha3_384 = /* @__PURE__ */ (() => gen(6, 104, 384 / 8))();
-    sha3_512 = /* @__PURE__ */ (() => gen(6, 72, 512 / 8))();
-    keccak_224 = /* @__PURE__ */ (() => gen(1, 144, 224 / 8))();
-    keccak_256 = /* @__PURE__ */ (() => gen(1, 136, 256 / 8))();
-    keccak_384 = /* @__PURE__ */ (() => gen(1, 104, 384 / 8))();
-    keccak_512 = /* @__PURE__ */ (() => gen(1, 72, 512 / 8))();
-    genShake = (suffix, blockLen, outputLen) => createXOFer((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === void 0 ? outputLen : opts.dkLen, true));
-    shake128 = /* @__PURE__ */ (() => genShake(31, 168, 128 / 8))();
-    shake256 = /* @__PURE__ */ (() => genShake(31, 136, 256 / 8))();
+    genKeccak = (suffix, blockLen, outputLen, info2 = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info2);
+    sha3_224 = /* @__PURE__ */ genKeccak(
+      6,
+      144,
+      28,
+      /* @__PURE__ */ oidNist(7)
+    );
+    sha3_256 = /* @__PURE__ */ genKeccak(
+      6,
+      136,
+      32,
+      /* @__PURE__ */ oidNist(8)
+    );
+    sha3_384 = /* @__PURE__ */ genKeccak(
+      6,
+      104,
+      48,
+      /* @__PURE__ */ oidNist(9)
+    );
+    sha3_512 = /* @__PURE__ */ genKeccak(
+      6,
+      72,
+      64,
+      /* @__PURE__ */ oidNist(10)
+    );
+    keccak_224 = /* @__PURE__ */ genKeccak(1, 144, 28);
+    keccak_256 = /* @__PURE__ */ genKeccak(1, 136, 32);
+    keccak_384 = /* @__PURE__ */ genKeccak(1, 104, 48);
+    keccak_512 = /* @__PURE__ */ genKeccak(1, 72, 64);
+    genShake = (suffix, blockLen, outputLen, info2 = {}) => createHasher((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === void 0 ? outputLen : opts.dkLen, true), info2);
+    shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
+    shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
+    shake128_32 = /* @__PURE__ */ genShake(31, 168, 32, /* @__PURE__ */ oidNist(11));
+    shake256_64 = /* @__PURE__ */ genShake(31, 136, 64, /* @__PURE__ */ oidNist(12));
   }
 });
 
@@ -4753,12 +4797,14 @@ function normalizeAgentError(err) {
 var AskInterface = class {
   session;
   verbose;
+  autoApprove;
   responseParts = [];
   toolCalls = [];
   transactions = [];
-  constructor(session, verbose = false) {
+  constructor(session, verbose = false, autoApprove = false) {
     this.session = session;
     this.verbose = verbose;
+    this.autoApprove = autoApprove;
   }
   /**
    * Get UI callbacks that silently collect results.
@@ -4806,8 +4852,15 @@ var AskInterface = class {
       requestPassword: async () => {
         throw new Error("Password required but not provided. Use --password flag.");
       },
-      requestConfirmation: async (_message) => {
-        return true;
+      requestConfirmation: async (message) => {
+        if (!this.autoApprove) {
+          process.stderr.write(`[confirm] signing requires --yes \u2014 NOT broadcasting: ${message}
+`);
+        } else {
+          process.stderr.write(`[confirm] auto-approved (--yes): ${message}
+`);
+        }
+        return this.autoApprove;
       }
     };
   }
@@ -6148,6 +6201,7 @@ var AgentExecutor = class {
         const chain2 = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
         if (getChainKind(chain2) !== "evm") {
           this.pendingPayloads.clear();
+          this.pendingLegs = [];
           this.pendingPayloads.set("latest", {
             payload: { __serverTx: true, ...txReadyData },
             coin: { chain: chain2, address: "", decimals: 18, ticker: "" },
@@ -6171,6 +6225,7 @@ var AgentExecutor = class {
     }
     const chain = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
     this.pendingPayloads.clear();
+    this.pendingLegs = [];
     this.pendingPayloads.set("latest", {
       payload: { __serverTx: true, ...txReadyData },
       coin: { chain, address: "", decimals: 18, ticker: "" },
@@ -6187,6 +6242,43 @@ var AgentExecutor = class {
   hasPendingTransaction() {
     return this.pendingPayloads.has("latest");
   }
+  /**
+   * Drop the buffered server tx and any staged multi-leg state. Called when
+   * the user declines the pre-sign confirmation: the rejected envelope must
+   * not linger (a fresh tx_ready always overwrites, but stale legs/payloads
+   * would otherwise survive into later turns).
+   */
+  clearPendingTransaction() {
+    this.pendingPayloads.clear();
+    this.pendingLegs = [];
+  }
+  /**
+   * Human-readable one-line summary of the currently-buffered server tx
+   * (set by storeServerTransaction), for the pre-sign confirmation prompt.
+   * Returns null when nothing is buffered (e.g. sign_typed_data, which has
+   * no tx_ready payload — callers fall back to the tool input).
+   */
+  getPendingSummary() {
+    const stored = this.pendingPayloads.get("latest");
+    if (!stored) return null;
+    const p = stored.payload;
+    const labels = p?.resolved?.labels ?? {};
+    const isSwap = !!(p?.approvalTxArgs || p?.swap_tx || labels.quote_summary || labels.to_token_symbol);
+    if (isSwap) {
+      const usedQuoteSummary = !!labels.quote_summary;
+      const head = labels.quote_summary || `swap ${labels.amount_in ?? p?.txArgs?.amount ?? "?"} ${labels.from_token_symbol ?? ""} \u2192 ${labels.to_token_symbol ?? ""}`.trim();
+      const parts = [head, `on ${stored.chain}`];
+      if (!usedQuoteSummary && labels.provider) parts.push(`via ${labels.provider}`);
+      if (p?.__multiLeg) parts.push("(+ token approval \u2014 2 transactions)");
+      if (labels.estimated_fee) parts.push(`est. fee ${labels.estimated_fee}`);
+      return parts.join(" ");
+    }
+    const amount = labels.resolved_amount ?? p?.txArgs?.amount ?? "?";
+    const symbol = labels.token_resolved || labels.token_symbol || "";
+    const amountWithSymbol = symbol && !amount.endsWith(` ${symbol}`) ? `${amount} ${symbol}` : amount;
+    const to = p?.txArgs?.to || labels.recipient_echo || "?";
+    return `send ${amountWithSymbol} on ${stored.chain} to ${to}`;
+  }
   /**
    * Wrap a per-tool handler body with normalised success/failure → RecentAction
    * conversion. Replaces the legacy executeAction → ActionResult adapter that
@@ -8077,6 +8169,34 @@ var AgentSession = class {
    * prompt was declined).
    */
   async runPasswordGatedTool(toolName, toolCallId, ui, body, input) {
+    if (PASSWORD_REQUIRED_TOOLS.has(toolName)) {
+      const summary = (toolName === "sign_tx" ? this.executor.getPendingSummary() : null) ?? `${toolName}${input ? ` ${JSON.stringify(input)}` : ""}`;
+      const approved = await ui.requestConfirmation(summary);
+      if (!approved) {
+        if (toolName === "sign_tx") {
+          this.executor.clearPendingTransaction();
+        }
+        const declined = {
+          tool: toolName,
+          success: false,
+          data: {
+            error: "Transaction not confirmed",
+            code: "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */,
+            proposed: summary
+          }
+        };
+        ui.onToolCall(toolCallId, toolName, input);
+        ui.onToolResult(
+          toolCallId,
+          toolName,
+          false,
+          declined.data,
+          "Transaction not confirmed",
+          "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */
+        );
+        return declined;
+      }
+    }
     let promptedPassword;
     if (PASSWORD_REQUIRED_TOOLS.has(toolName) && !this.config.password) {
       try {
@@ -8641,20 +8761,35 @@ async function executeAgentAsk(ctx2, message, options) {
       profile: options.profile ?? process.env.VULTISIG_AGENT_PROFILE ?? ""
     };
     const session = new AgentSession(vault, config);
-    const ask = new AskInterface(session, !!config.verbose);
+    const ask = new AskInterface(session, !!config.verbose, !!options.autoApprove);
     const callbacks = ask.getCallbacks();
     await session.initialize(callbacks);
     const result = await ask.ask(message);
+    const confirmationRequired = result.toolCalls.some((tc) => tc.code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */);
+    const proposedCall = result.toolCalls.find(
+      (tc) => tc.code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */ && typeof tc.data?.proposed === "string"
+    );
+    const proposed = proposedCall?.data?.proposed;
     if (options.json || isJsonOutput()) {
       outputJson({
         session_id: result.sessionId,
         response: result.response,
         tool_calls: result.toolCalls,
-        transactions: result.transactions
+        transactions: result.transactions,
+        ...confirmationRequired ? { confirmation_required: true } : {},
+        ...proposed ? { proposed } : {}
       });
     } else {
       process.stdout.write(`session:${result.sessionId}
 `);
+      if (confirmationRequired) {
+        process.stdout.write(`confirmation-required:pass --yes to authorize signing
+`);
+        if (proposed) {
+          process.stdout.write(`proposed:${proposed}
+`);
+        }
+      }
       if (result.response) {
         process.stdout.write(`
 ${result.response}
@@ -8768,7 +8903,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "1.8.1";
+    cachedVersion = "2.0.0";
     return cachedVersion;
   }
   try {
@@ -11488,13 +11623,21 @@ var agentCmd = program.command("agent").description("AI-powered chat interface f
     });
   }
 );
-agentCmd.command("ask <message>").description("Send a single message and get the response (for AI agent integration)").option("--session <id>", "Continue an existing conversation").option("--backend-url <url>", "Agent backend URL (default: https://abe.vultisig.com)").option("--password <password>", "Vault password for signing operations").option("--verbose", "Show tool calls and debug info on stderr").option("--json", "Output structured JSON (deprecated: use --output json)").option("--profile <api_id>", "Billing profile slug sent as X-Vultisig-Abe-Profile header").addHelpText(
+agentCmd.command("ask <message>").description("Send a single message and get the response (for AI agent integration)").option("--session <id>", "Continue an existing conversation").option("--backend-url <url>", "Agent backend URL (default: https://abe.vultisig.com)").option("--password <password>", "Vault password for signing operations").option("--verbose", "Show tool calls and debug info on stderr").option("--json", "Output structured JSON (deprecated: use --output json)").option("--profile <api_id>", "Billing profile slug sent as X-Vultisig-Abe-Profile header").option(
+  "--yes",
+  "Auto-approve signing/broadcast. Required for unattended signing; default is to NOT broadcast and report the proposed transaction instead."
+).addHelpText(
   "after",
   `
 Examples:
   vultisig agent ask "What is my ETH balance?" --output json
-  vultisig agent ask "Send 0.1 ETH to 0x..." --session abc123
-  vultisig agent ask "..." --profile station-wallet`
+  vultisig agent ask "Send 0.1 ETH to 0x..." --session abc123 --yes
+  vultisig agent ask "..." --profile station-wallet
+
+Signing safety:
+  Without --yes, ask mode never signs or broadcasts \u2014 it reports the proposed
+  transaction so a read-only prompt can't move funds. Pass --yes to opt in to
+  unattended signing.`
 ).action(
   async (message, options) => {
     const parentOpts = agentCmd.opts();
@@ -11504,7 +11647,8 @@ Examples:
       backendUrl: options.backendUrl || parentOpts.backendUrl,
       password: options.password || parentOpts.password,
       verbose: options.verbose || parentOpts.verbose,
-      profile: options.profile ?? parentOpts.profile
+      profile: options.profile ?? parentOpts.profile,
+      autoApprove: options.yes
     });
   }
 );
@@ -11649,8 +11793,3 @@ if (isInteractiveMode) {
 } else {
   program.parse();
 }
-/*! Bundled license information:
-
-@noble/hashes/esm/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-*/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "1.8.1",
+  "version": "2.0.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -67,35 +67,35 @@
   },
   "homepage": "https://vultisig.com",
   "dependencies": {
-    "@cosmjs/cosmwasm-stargate": "^0.38.1",
+    "@cosmjs/cosmwasm-stargate": "^0.39.0",
     "@cosmjs/encoding": "^0.39.0",
-    "@cosmjs/proto-signing": "^0.38.1",
-    "@cosmjs/stargate": "^0.38.1",
+    "@cosmjs/proto-signing": "^0.39.0",
+    "@cosmjs/stargate": "^0.39.0",
     "@napi-rs/keyring": "^1.3.0",
-    "@noble/hashes": "^2.0.1",
-    "@vultisig/client-shared": "^0.2.13",
-    "@vultisig/core-chain": "^2.10.1",
-    "@vultisig/rujira": "^32.0.0",
-    "@vultisig/sdk": "^1.8.1",
+    "@noble/hashes": "^2.2.0",
+    "@vultisig/client-shared": "^0.2.15",
+    "@vultisig/core-chain": "^2.15.0",
+    "@vultisig/rujira": "^33.0.0",
+    "@vultisig/sdk": "^2.0.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
-    "commander": "^14.0.3",
-    "dotenv": "^17.3.1",
+    "commander": "^15.0.0",
+    "dotenv": "^17.4.2",
     "ora": "^9.4.0",
     "qrcode-terminal": "^0.12.0",
     "tabtab": "^3.0.2",
-    "viem": "^2.51.0",
+    "viem": "^2.52.2",
     "ws": "^8.21.0"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.9",
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.9.2",
     "@types/tabtab": "^3.0.4",
     "@types/ws": "^8.18.1",
-    "esbuild": "^0.27.4",
-    "tsx": "^4.22.3",
+    "esbuild": "^0.28.0",
+    "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.8"
   },
   "engines": {
     "node": ">=20.0.0"