@vultisig/cli 2.3.0 → 2.3.3

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @vultisig/cli
 
+## 2.3.3
+
+### Patch Changes
+
+- [#750](https://github.com/vultisig/vultisig-sdk/pull/750) [`0f6adc3`](https://github.com/vultisig/vultisig-sdk/commit/0f6adc3c73d06eb6da3758987dfaafb29d599019) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - security: bump transitive deps to fix 5 high-severity advisories
+
+  - form-data: 4.0.5 -> 4.0.6 (CRLF injection, GHSA-hmw2-7cc7-3qxx)
+  - protobufjs: 7.5.8 -> 7.6.4, 8.3.0 -> 8.6.3 (DoS via unbounded Any expansion, GHSA-wcpc-wj8m-hjx6)
+  - tmp: 0.2.6 -> 0.2.7 (path traversal via type confusion, GHSA-7c78-jf6q-g5cm)
+  - vite: 8.0.10 -> 8.0.16 (server.fs.deny bypass on Windows, GHSA-fx2h-pf6j-xcff)
+  - ws: 7.5.10 -> 7.5.11, 8.17.1/8.20.x -> 8.21.0 (memory exhaustion DoS, GHSA-96hv-2xvq-fx4p)
+
+  all bumped via yarn resolutions; no direct dep changes.
+
+- Updated dependencies [[`b544eea`](https://github.com/vultisig/vultisig-sdk/commit/b544eea2bd6f30aef59d6465d89784c763b13c11), [`c78c10d`](https://github.com/vultisig/vultisig-sdk/commit/c78c10d2b43f9ddd13b2c912a71f7d902f2694cc), [`0f6adc3`](https://github.com/vultisig/vultisig-sdk/commit/0f6adc3c73d06eb6da3758987dfaafb29d599019)]:
+  - @vultisig/core-chain@2.16.3
+  - @vultisig/sdk@2.3.3
+
+## 2.3.1
+
+### Patch Changes
+
+- [#701](https://github.com/vultisig/vultisig-sdk/pull/701) [`1bcb195`](https://github.com/vultisig/vultisig-sdk/commit/1bcb195013b9730bf6ed0e2c42209d2285a357e8) Thanks [@neavra](https://github.com/neavra)! - Fix EIP-712 domain hashing for domains that omit standard fields. The agent executor's `sign_typed_data` hardcoded the `EIP712Domain` type to all four standard fields while skipping absent values during data encoding, producing non-canonical hashes for domains without `verifyingContract` (e.g. Polymarket's `ClobAuthDomain`) — CLOB rejected every auto-submitted order with `401 Invalid L1 Request headers`. The domain type is now derived from the fields actually present, matching viem/ethers canonical hashing (verified live against the Polymarket CLOB: L1 auth now accepted and L2 API credentials derived).
+
+- Updated dependencies [[`cb2e8f0`](https://github.com/vultisig/vultisig-sdk/commit/cb2e8f00861daff26ac8b04a34e22be9b243235c)]:
+  - @vultisig/core-chain@2.16.1
+  - @vultisig/sdk@2.3.1
+
 ## 2.3.0
 
 ### Patch Changes

package/dist/index.js

@@ -6727,7 +6727,11 @@ var AgentExecutor = class {
     if (this.verbose)
       process.stderr.write(`[sign_thor_msg_deposit_lp] chain=${chain}, memo='${memo}', amountBaseUnits=${amountRaw}
 `);
-    const result = await this.vault.signMsgDeposit({ chain, amountBaseUnits: amountRaw, memo });
+    const result = await this.vault.signMsgDeposit({
+      chain,
+      amountBaseUnits: amountRaw,
+      memo
+    });
     this.pendingPayloads.clear();
     const explorerUrl = VultisigSdk.getTxExplorerUrl(chain, result.txHash);
     return {
@@ -7509,8 +7513,12 @@ function resolveChainId(chainId) {
 }
 async function computeEIP712Hash(domain, types, primaryType, message) {
   const { keccak_256: keccak_2562 } = await Promise.resolve().then(() => (init_sha3(), sha3_exports));
-  const domainSeparator = hashStruct("EIP712Domain", domain, types, keccak_2562);
-  const messageHash = hashStruct(primaryType, message, types, keccak_2562);
+  const typesWithDomain = types["EIP712Domain"] ? types : {
+    ...types,
+    EIP712Domain: EIP712_DOMAIN_FIELDS.filter((f) => domain[f.name] !== void 0 && domain[f.name] !== null)
+  };
+  const domainSeparator = hashStruct("EIP712Domain", domain, typesWithDomain, keccak_2562);
+  const messageHash = hashStruct(primaryType, message, typesWithDomain, keccak_2562);
   const prefix = new Uint8Array([25, 1]);
   const combined = new Uint8Array(2 + 32 + 32);
   combined.set(prefix, 0);
@@ -7533,7 +7541,6 @@ function hashType(typeName, types, keccak) {
 }
 function encodeType(typeName, types) {
   const fields = getTypeFields(typeName, types);
-  if (!fields) return "";
   const refs = /* @__PURE__ */ new Set();
   findReferencedTypes(typeName, types, refs);
   refs.delete(typeName);
@@ -7541,16 +7548,13 @@ function encodeType(typeName, types) {
   let result = `${typeName}(${fields.map((f) => `${f.type} ${f.name}`).join(",")})`;
   for (const ref of sortedRefs) {
     const refFields = getTypeFields(ref, types);
-    if (refFields) {
-      result += `${ref}(${refFields.map((f) => `${f.type} ${f.name}`).join(",")})`;
-    }
+    result += `${ref}(${refFields.map((f) => `${f.type} ${f.name}`).join(",")})`;
   }
   return result;
 }
 function findReferencedTypes(typeName, types, refs) {
   if (refs.has(typeName)) return;
   const fields = getTypeFields(typeName, types);
-  if (!fields) return;
   refs.add(typeName);
   for (const field of fields) {
     const baseType = field.type.replace(/\[\d*\]$/, "");
@@ -7559,25 +7563,30 @@ function findReferencedTypes(typeName, types, refs) {
     }
   }
 }
+var EIP712_DOMAIN_FIELDS = [
+  { name: "name", type: "string" },
+  { name: "version", type: "string" },
+  { name: "chainId", type: "uint256" },
+  { name: "verifyingContract", type: "address" },
+  { name: "salt", type: "bytes32" }
+];
 function getTypeFields(typeName, types) {
-  if (types[typeName]) return types[typeName];
-  if (typeName === "EIP712Domain") {
-    return [
-      { name: "name", type: "string" },
-      { name: "version", type: "string" },
-      { name: "chainId", type: "uint256" },
-      { name: "verifyingContract", type: "address" }
-    ];
+  const fields = types[typeName];
+  if (!fields) {
+    throw new Error(`EIP-712 encode: missing type definition for struct "${typeName}"`);
   }
-  return void 0;
+  return fields;
 }
 function encodeData(typeName, data, types, keccak) {
   const fields = getTypeFields(typeName, types);
-  if (!fields) return new Uint8Array(0);
   const chunks = [];
   for (const field of fields) {
     const value = data[field.name];
-    if (value === void 0 || value === null) continue;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        `EIP-712 encode: missing value for declared field "${field.name}" (${field.type}) in struct "${typeName}"`
+      );
+    }
     chunks.push(encodeField(field.type, value, types, keccak));
   }
   const totalLen = chunks.reduce((sum, c) => sum + c.length, 0);
@@ -8912,7 +8921,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "2.3.0";
+    cachedVersion = "2.3.3";
     return cachedVersion;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "2.3.0",
+  "version": "2.3.3",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -74,9 +74,9 @@
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
     "@vultisig/client-shared": "^0.2.15",
-    "@vultisig/core-chain": "^2.16.0",
+    "@vultisig/core-chain": "^2.16.3",
     "@vultisig/rujira": "^36.0.0",
-    "@vultisig/sdk": "^2.3.0",
+    "@vultisig/sdk": "^2.3.3",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",