@vultisig/cli 1.8.10 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @vultisig/cli
 
+## 2.0.0
+
+### Major Changes
+
+- [#682](https://github.com/vultisig/vultisig-sdk/pull/682) [`341245e`](https://github.com/vultisig/vultisig-sdk/commit/341245e2d6d49348e38d61bc42805c35ac8d3052) Thanks [@neavra](https://github.com/neavra)! - Gate signing in `agent ask` mode behind explicit confirmation (security fix, **breaking**).
+
+  Previously `vsig agent ask` auto-signed and broadcast any transaction envelope the
+  backend returned, gated only by whether a password was present. Because the backend
+  routes read-only swap intents (e.g. "list swap routes from USDC to ETH") to the
+  fund-moving `execute_swap` tool, a query could broadcast a real on-chain swap.
+
+  `runPasswordGatedTool` now calls `ui.requestConfirmation` before any `sign_tx` /
+  `sign_typed_data` (the single chokepoint for both the tx_ready path and client-side
+  dispatch, covering both legs of a multi-leg swap). In ask mode this defaults to
+  **deny**: signing/broadcast now requires the new `agent ask --yes` flag. Without it,
+  the proposed transaction is reported (`CONFIRMATION_REQUIRED`) and nothing is signed.
+  Interactive (TUI) and pipe (`--via-agent`) modes already prompt/defer for confirmation.
+
+  **BREAKING — migration for unattended pipelines:** any automation that relied on
+  `agent ask` auto-signing must now pass `--yes`. A denied signing still exits **0**
+  (a misrouted read-only prompt remains a successful query); detect it via the new
+  top-level `confirmation_required: true` field in `--output json` mode, the
+  `confirmation-required:` line in text mode, or `tool_calls[].code ===
+"CONFIRMATION_REQUIRED"`. Do not infer "broadcast happened" from exit code alone —
+  check the `transactions` array. With `--yes`, each authorization is logged to stderr
+  (`[confirm] auto-approved (--yes): <summary>`).
+
+### Patch Changes
+
+- Updated dependencies [[`dc75595`](https://github.com/vultisig/vultisig-sdk/commit/dc75595e83360f5bda84b2d91cae177bc7c8c966)]:
+  - @vultisig/sdk@2.0.0
+  - @vultisig/rujira@33.0.0
+  - @vultisig/client-shared@0.2.15
+
 ## 1.8.10
 
 ### Patch Changes

package/dist/index.js

@@ -4797,12 +4797,14 @@ function normalizeAgentError(err) {
 var AskInterface = class {
   session;
   verbose;
+  autoApprove;
   responseParts = [];
   toolCalls = [];
   transactions = [];
-  constructor(session, verbose = false) {
+  constructor(session, verbose = false, autoApprove = false) {
     this.session = session;
     this.verbose = verbose;
+    this.autoApprove = autoApprove;
   }
   /**
    * Get UI callbacks that silently collect results.
@@ -4850,8 +4852,15 @@ var AskInterface = class {
       requestPassword: async () => {
         throw new Error("Password required but not provided. Use --password flag.");
       },
-      requestConfirmation: async (_message) => {
-        return true;
+      requestConfirmation: async (message) => {
+        if (!this.autoApprove) {
+          process.stderr.write(`[confirm] signing requires --yes \u2014 NOT broadcasting: ${message}
+`);
+        } else {
+          process.stderr.write(`[confirm] auto-approved (--yes): ${message}
+`);
+        }
+        return this.autoApprove;
       }
     };
   }
@@ -6192,6 +6201,7 @@ var AgentExecutor = class {
         const chain2 = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
         if (getChainKind(chain2) !== "evm") {
           this.pendingPayloads.clear();
+          this.pendingLegs = [];
           this.pendingPayloads.set("latest", {
             payload: { __serverTx: true, ...txReadyData },
             coin: { chain: chain2, address: "", decimals: 18, ticker: "" },
@@ -6215,6 +6225,7 @@ var AgentExecutor = class {
     }
     const chain = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
     this.pendingPayloads.clear();
+    this.pendingLegs = [];
     this.pendingPayloads.set("latest", {
       payload: { __serverTx: true, ...txReadyData },
       coin: { chain, address: "", decimals: 18, ticker: "" },
@@ -6231,6 +6242,43 @@ var AgentExecutor = class {
   hasPendingTransaction() {
     return this.pendingPayloads.has("latest");
   }
+  /**
+   * Drop the buffered server tx and any staged multi-leg state. Called when
+   * the user declines the pre-sign confirmation: the rejected envelope must
+   * not linger (a fresh tx_ready always overwrites, but stale legs/payloads
+   * would otherwise survive into later turns).
+   */
+  clearPendingTransaction() {
+    this.pendingPayloads.clear();
+    this.pendingLegs = [];
+  }
+  /**
+   * Human-readable one-line summary of the currently-buffered server tx
+   * (set by storeServerTransaction), for the pre-sign confirmation prompt.
+   * Returns null when nothing is buffered (e.g. sign_typed_data, which has
+   * no tx_ready payload — callers fall back to the tool input).
+   */
+  getPendingSummary() {
+    const stored = this.pendingPayloads.get("latest");
+    if (!stored) return null;
+    const p = stored.payload;
+    const labels = p?.resolved?.labels ?? {};
+    const isSwap = !!(p?.approvalTxArgs || p?.swap_tx || labels.quote_summary || labels.to_token_symbol);
+    if (isSwap) {
+      const usedQuoteSummary = !!labels.quote_summary;
+      const head = labels.quote_summary || `swap ${labels.amount_in ?? p?.txArgs?.amount ?? "?"} ${labels.from_token_symbol ?? ""} \u2192 ${labels.to_token_symbol ?? ""}`.trim();
+      const parts = [head, `on ${stored.chain}`];
+      if (!usedQuoteSummary && labels.provider) parts.push(`via ${labels.provider}`);
+      if (p?.__multiLeg) parts.push("(+ token approval \u2014 2 transactions)");
+      if (labels.estimated_fee) parts.push(`est. fee ${labels.estimated_fee}`);
+      return parts.join(" ");
+    }
+    const amount = labels.resolved_amount ?? p?.txArgs?.amount ?? "?";
+    const symbol = labels.token_resolved || labels.token_symbol || "";
+    const amountWithSymbol = symbol && !amount.endsWith(` ${symbol}`) ? `${amount} ${symbol}` : amount;
+    const to = p?.txArgs?.to || labels.recipient_echo || "?";
+    return `send ${amountWithSymbol} on ${stored.chain} to ${to}`;
+  }
   /**
    * Wrap a per-tool handler body with normalised success/failure → RecentAction
    * conversion. Replaces the legacy executeAction → ActionResult adapter that
@@ -8121,6 +8169,34 @@ var AgentSession = class {
    * prompt was declined).
    */
   async runPasswordGatedTool(toolName, toolCallId, ui, body, input) {
+    if (PASSWORD_REQUIRED_TOOLS.has(toolName)) {
+      const summary = (toolName === "sign_tx" ? this.executor.getPendingSummary() : null) ?? `${toolName}${input ? ` ${JSON.stringify(input)}` : ""}`;
+      const approved = await ui.requestConfirmation(summary);
+      if (!approved) {
+        if (toolName === "sign_tx") {
+          this.executor.clearPendingTransaction();
+        }
+        const declined = {
+          tool: toolName,
+          success: false,
+          data: {
+            error: "Transaction not confirmed",
+            code: "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */,
+            proposed: summary
+          }
+        };
+        ui.onToolCall(toolCallId, toolName, input);
+        ui.onToolResult(
+          toolCallId,
+          toolName,
+          false,
+          declined.data,
+          "Transaction not confirmed",
+          "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */
+        );
+        return declined;
+      }
+    }
     let promptedPassword;
     if (PASSWORD_REQUIRED_TOOLS.has(toolName) && !this.config.password) {
       try {
@@ -8685,20 +8761,35 @@ async function executeAgentAsk(ctx2, message, options) {
       profile: options.profile ?? process.env.VULTISIG_AGENT_PROFILE ?? ""
     };
     const session = new AgentSession(vault, config);
-    const ask = new AskInterface(session, !!config.verbose);
+    const ask = new AskInterface(session, !!config.verbose, !!options.autoApprove);
     const callbacks = ask.getCallbacks();
     await session.initialize(callbacks);
     const result = await ask.ask(message);
+    const confirmationRequired = result.toolCalls.some((tc) => tc.code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */);
+    const proposedCall = result.toolCalls.find(
+      (tc) => tc.code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */ && typeof tc.data?.proposed === "string"
+    );
+    const proposed = proposedCall?.data?.proposed;
     if (options.json || isJsonOutput()) {
       outputJson({
         session_id: result.sessionId,
         response: result.response,
         tool_calls: result.toolCalls,
-        transactions: result.transactions
+        transactions: result.transactions,
+        ...confirmationRequired ? { confirmation_required: true } : {},
+        ...proposed ? { proposed } : {}
       });
     } else {
       process.stdout.write(`session:${result.sessionId}
 `);
+      if (confirmationRequired) {
+        process.stdout.write(`confirmation-required:pass --yes to authorize signing
+`);
+        if (proposed) {
+          process.stdout.write(`proposed:${proposed}
+`);
+        }
+      }
       if (result.response) {
         process.stdout.write(`
 ${result.response}
@@ -8812,7 +8903,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "1.8.10";
+    cachedVersion = "2.0.0";
     return cachedVersion;
   }
   try {
@@ -11532,13 +11623,21 @@ var agentCmd = program.command("agent").description("AI-powered chat interface f
     });
   }
 );
-agentCmd.command("ask <message>").description("Send a single message and get the response (for AI agent integration)").option("--session <id>", "Continue an existing conversation").option("--backend-url <url>", "Agent backend URL (default: https://abe.vultisig.com)").option("--password <password>", "Vault password for signing operations").option("--verbose", "Show tool calls and debug info on stderr").option("--json", "Output structured JSON (deprecated: use --output json)").option("--profile <api_id>", "Billing profile slug sent as X-Vultisig-Abe-Profile header").addHelpText(
+agentCmd.command("ask <message>").description("Send a single message and get the response (for AI agent integration)").option("--session <id>", "Continue an existing conversation").option("--backend-url <url>", "Agent backend URL (default: https://abe.vultisig.com)").option("--password <password>", "Vault password for signing operations").option("--verbose", "Show tool calls and debug info on stderr").option("--json", "Output structured JSON (deprecated: use --output json)").option("--profile <api_id>", "Billing profile slug sent as X-Vultisig-Abe-Profile header").option(
+  "--yes",
+  "Auto-approve signing/broadcast. Required for unattended signing; default is to NOT broadcast and report the proposed transaction instead."
+).addHelpText(
   "after",
   `
 Examples:
   vultisig agent ask "What is my ETH balance?" --output json
-  vultisig agent ask "Send 0.1 ETH to 0x..." --session abc123
-  vultisig agent ask "..." --profile station-wallet`
+  vultisig agent ask "Send 0.1 ETH to 0x..." --session abc123 --yes
+  vultisig agent ask "..." --profile station-wallet
+
+Signing safety:
+  Without --yes, ask mode never signs or broadcasts \u2014 it reports the proposed
+  transaction so a read-only prompt can't move funds. Pass --yes to opt in to
+  unattended signing.`
 ).action(
   async (message, options) => {
     const parentOpts = agentCmd.opts();
@@ -11548,7 +11647,8 @@ Examples:
       backendUrl: options.backendUrl || parentOpts.backendUrl,
       password: options.password || parentOpts.password,
       verbose: options.verbose || parentOpts.verbose,
-      profile: options.profile ?? parentOpts.profile
+      profile: options.profile ?? parentOpts.profile,
+      autoApprove: options.yes
     });
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "1.8.10",
+  "version": "2.0.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -73,10 +73,10 @@
     "@cosmjs/stargate": "^0.39.0",
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
-    "@vultisig/client-shared": "^0.2.14",
-    "@vultisig/core-chain": "^2.14.1",
-    "@vultisig/rujira": "^32.0.1",
-    "@vultisig/sdk": "^1.8.10",
+    "@vultisig/client-shared": "^0.2.15",
+    "@vultisig/core-chain": "^2.15.0",
+    "@vultisig/rujira": "^33.0.0",
+    "@vultisig/sdk": "^2.0.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",