@vultisig/cli 2.19.14 → 2.19.18

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vultisig/cli
 
+## 2.19.18
+
+### Patch Changes
+
+- [#1223](https://github.com/vultisig/vultisig-sdk/pull/1223) [`6296248`](https://github.com/vultisig/vultisig-sdk/commit/62962482d8499f697e0634260a2e6083b944e649) Thanks [@neavra](https://github.com/neavra)! - Fix `agent ask` headless signing so a vault unlocked via `VAULT_PASSWORD` (or the OS keyring) can sign without also passing `--password`. The sign-time gate now keys off whether a password is actually needed — an encrypted vault that is still locked with no password in hand — and retries the same non-interactive chain (cache → keyring → `VAULT_PASSWORDS`/`VAULT_PASSWORD`) before prompting, instead of always re-prompting when `--password` was absent. Unencrypted vaults skip the gate entirely. The transaction confirmation gate is unchanged. Also corrects the `VAULT_PASSWORD` help text.
+
 ## 2.19.14
 
 ### Patch Changes

package/dist/index.js

@@ -10496,6 +10496,14 @@ var AgentExecutor = class {
   setPassword(password) {
     this.password = password;
   }
+  /**
+   * Whether a password is already held (set at unlock via the keyring/env chain
+   * or `--password`). The sign gate consults this so a session unlocked
+   * non-interactively doesn't get re-prompted for a secret it already has.
+   */
+  hasPassword() {
+    return this.password != null;
+  }
   /** Opt out of the persistent broadcast-journal duplicate guard (`--force`). */
   setForceBroadcast(force) {
     this.forceBroadcast = force;
@@ -13833,28 +13841,37 @@ var AgentSession = class {
     }
     let promptedPassword;
     if (PASSWORD_REQUIRED_TOOLS.has(toolName) && !this.config.password) {
-      try {
-        promptedPassword = await ui.requestPassword();
-        this.executor.setPassword(promptedPassword);
-      } catch {
-        const failure = {
-          tool: toolName,
-          success: false,
-          data: {
-            error: "Password not provided",
-            code: "PASSWORD_REQUIRED" /* PASSWORD_REQUIRED */
+      const vaultLocked = this.vault.isEncrypted && !this.vault.isUnlocked();
+      const needsPassword = vaultLocked && !this.executor.hasPassword();
+      if (needsPassword) {
+        const resolved = await resolvePasswordNonInteractive(this.vault.id, this.vault.name);
+        if (resolved) {
+          this.executor.setPassword(resolved);
+        } else {
+          try {
+            promptedPassword = await ui.requestPassword();
+            this.executor.setPassword(promptedPassword);
+          } catch {
+            const failure = {
+              tool: toolName,
+              success: false,
+              data: {
+                error: "Password not provided",
+                code: "PASSWORD_REQUIRED" /* PASSWORD_REQUIRED */
+              }
+            };
+            ui.onToolCall(toolCallId, toolName, input);
+            ui.onToolResult(
+              toolCallId,
+              toolName,
+              false,
+              failure.data,
+              "Password not provided",
+              "PASSWORD_REQUIRED" /* PASSWORD_REQUIRED */
+            );
+            return failure;
           }
-        };
-        ui.onToolCall(toolCallId, toolName, input);
-        ui.onToolResult(
-          toolCallId,
-          toolName,
-          false,
-          failure.data,
-          "Password not provided",
-          "PASSWORD_REQUIRED" /* PASSWORD_REQUIRED */
-        );
-        return failure;
+        }
       }
     }
     ui.onToolCall(toolCallId, toolName, input);
@@ -14671,7 +14688,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "2.19.14";
+    cachedVersion = "2.19.18";
     return cachedVersion;
   }
   try {
@@ -16718,7 +16735,7 @@ program.name("vultisig").description("Vultisig CLI - Secure multi-party crypto w
   process.stdout.isTTY ? "table" : "json"
 ).option("-q, --quiet", "Strip empty/zero fields from output").option("--fields <fields>", "Comma-separated list of fields to include in output").option("--non-interactive", "Disable interactive prompts (fail instead of asking)").option("--ci", "CI/automation mode (equivalent to --output json --non-interactive --quiet)").option("-i, --interactive", "Start interactive shell mode").option("--vault <nameOrId>", "Specify vault by name or ID").option("--server-url <url>", "Base Vultisig API URL for FastVault and relay endpoints").addHelpText(
   "after",
-  "\nExit codes:\n" + Object.entries(EXIT_CODE_DESCRIPTIONS).map(([k, v]) => `  ${k}  ${v}`).join("\n") + "\n\nEnvironment variables:\n  VAULT_PASSWORD          Vault password for signing (bypasses prompt)\n  VULTISIG_PASSWORD       Alias for VAULT_PASSWORD\n  VAULT_PASSWORDS         Space-separated VaultName:password pairs\n  VULTISIG_VAULT          Default vault name or ID\n  VULTISIG_CONFIG_DIR     Override config directory (~/.vultisig)\n  VULTISIG_SILENT         Set to 1 for silent mode\n  VULTISIG_HTTP_TIMEOUT_MS  Agent-backend request timeout in ms (default 30000)\n  NO_COLOR                Disable colored output"
+  "\nExit codes:\n" + Object.entries(EXIT_CODE_DESCRIPTIONS).map(([k, v]) => `  ${k}  ${v}`).join("\n") + "\n\nEnvironment variables:\n  VAULT_PASSWORD          Vault password \u2014 unlocks the vault for reads and signing (no prompt)\n  VULTISIG_PASSWORD       Alias for VAULT_PASSWORD\n  VAULT_PASSWORDS         Space-separated VaultName:password pairs\n  VULTISIG_VAULT          Default vault name or ID\n  VULTISIG_CONFIG_DIR     Override config directory (~/.vultisig)\n  VULTISIG_SILENT         Set to 1 for silent mode\n  VULTISIG_HTTP_TIMEOUT_MS  Agent-backend request timeout in ms (default 30000)\n  NO_COLOR                Disable colored output"
 ).hook("preAction", (thisCommand) => {
   const opts = thisCommand.opts();
   if (opts.ci) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "2.19.14",
+  "version": "2.19.18",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -74,9 +74,9 @@
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
     "@vultisig/client-shared": "^0.2.17",
-    "@vultisig/core-chain": "^2.24.3",
+    "@vultisig/core-chain": "^2.25.1",
     "@vultisig/rujira": "^52.0.0",
-    "@vultisig/sdk": "^2.19.14",
+    "@vultisig/sdk": "^2.19.17",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",