@vultisig/cli 2.8.0 → 2.8.2

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @vultisig/cli
 
+## 2.8.2
+
+### Patch Changes
+
+- [#869](https://github.com/vultisig/vultisig-sdk/pull/869) [`2623ca0`](https://github.com/vultisig/vultisig-sdk/commit/2623ca0dd04c5ca3c65126b6008a93c1d7559793) Thanks [@neavra](https://github.com/neavra)! - Harden agent conversation auth across every path. A revoked-but-unexpired
+  cached token now recovers uniformly: a new `withAuthRetry` helper does
+  clear→reauth→retry-once and wraps the fresh-conversation `createConversation`
+  (previously unguarded — it hard-threw `Authentication failed`), the resume
+  `getConversation`, the send-message stream, and the `agent sessions
+list`/`delete` commands.
+
+  A `--session-id` resume whose 401 survives the single retry — or that fails for
+  any other reason — now falls back to a fresh conversation instead of throwing
+  uncaught, and emits a typed, non-fatal `SESSION_NOT_FOUND` signal carrying the
+  new conversation id so a headless caller knows prior context was dropped. In
+  `agent ask`, that initialize-time signal is now preserved into the first turn's
+  result envelope (it was previously cleared at turn start, so a stale-session
+  `ask --json` returned a false-success envelope instead of the promised non-zero
+  `SESSION_NOT_FOUND`).
+
+  Models the backend's `refresh_token`/`access_token` in `AuthTokenResponse` and
+  persists the refresh token in the token cache (0o600) for a future
+  `POST /auth/refresh` exchange; the retry path re-auths via MPC re-sign today.
+  The retry preserves a previously cached refresh token when the re-auth response
+  omits one, and the cache directory is chmod'd to 0o700 on every write (not only
+  on create) so a pre-existing `~/.vultisig` can't retain looser perms on upgrade.
+
+  Adds the first `auth.ts` unit tests (EIP-191 hash cross-checked against viem,
+  DER→65-byte formatting, signing-retry classification) plus session
+  auth-retry/fallback coverage.
+
+- Updated dependencies [[`0dc1620`](https://github.com/vultisig/vultisig-sdk/commit/0dc16206bedcdde8832a068b15383565a6b98896)]:
+  - @vultisig/sdk@2.8.2
+
+## 2.8.1
+
+### Patch Changes
+
+- [#867](https://github.com/vultisig/vultisig-sdk/pull/867) [`ddd08af`](https://github.com/vultisig/vultisig-sdk/commit/ddd08af883a1b2ee2f72dac4d406782de9090672) Thanks [@neavra](https://github.com/neavra)! - Agent: poll for final on-chain confirmation after broadcasting a signed tx
+  (audit F1). A `pending` `tx_status` only means "broadcast accepted" — the tx can
+  still revert, expire, or be dropped. After broadcast the session now polls
+  `vault.getTxStatus` until the tx reaches a final state and emits `confirmed` /
+  `failed`, or `timeout` when the bounded poll budget (~120s) is exhausted. The
+  `ask` result records the latest per-tx `status` (deduped by hash), and the pipe
+  `tx_status` event gains a `timeout` status. Best-effort and non-fatal: when the
+  chain can't be resolved or the vault can't poll status, the existing `pending`
+  status stands. The blocking confirmation wait is scoped to the top of the
+  message loop (depth 0 — the single-tx ask/pipe case); inside a multi-turn tool
+  loop a leg keeps its honest `pending` instead of stacking the poll budget per
+  tx. The shared `pending | confirmed | failed | timeout` union is now threaded
+  through the ask result, pipe event, and UI callback without unchecked casts.
+
 ## 2.8.0
 
 ### Patch Changes

package/dist/index.js

@@ -8074,6 +8074,7 @@ var AgentErrorCode = /* @__PURE__ */ ((AgentErrorCode3) => {
   AgentErrorCode3["TRANSACTION_FAILED"] = "TRANSACTION_FAILED";
   AgentErrorCode3["SIGNING_FAILED"] = "SIGNING_FAILED";
   AgentErrorCode3["SESSION_NOT_INITIALIZED"] = "SESSION_NOT_INITIALIZED";
+  AgentErrorCode3["SESSION_NOT_FOUND"] = "SESSION_NOT_FOUND";
   AgentErrorCode3["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
   return AgentErrorCode3;
 })(AgentErrorCode || {});
@@ -8185,6 +8186,11 @@ var AskInterface = class {
   transactions = [];
   cards = [];
   error;
+  // Whether ask() has run at least once. initialize() drives getCallbacks()
+  // BEFORE the first ask() — a stale --session fallback fires
+  // onError(SESSION_NOT_FOUND) there. ask() must NOT clear that initialize-time
+  // error on its first turn, or the result envelope reports false success.
+  hasAsked = false;
   constructor(session, verbose = false, autoApprove = false) {
     this.session = session;
     this.verbose = verbose;
@@ -8224,9 +8230,15 @@ var AskInterface = class {
       onSuggestions: (_suggestions) => {
       },
       onTxStatus: (txHash, chain, status, explorerUrl) => {
-        this.transactions.push({ hash: txHash, chain, ...status ? { status } : {}, explorerUrl });
+        const existing = this.transactions.find((t) => t.hash === txHash);
+        if (existing) {
+          existing.status = status;
+          if (explorerUrl) existing.explorerUrl = explorerUrl;
+        } else {
+          this.transactions.push({ hash: txHash, chain, explorerUrl, status });
+        }
         if (this.verbose) {
-          process.stderr.write(`[tx] ${chain}: ${txHash}
+          process.stderr.write(`[tx] ${chain}: ${txHash} (${status})
 `);
         }
       },
@@ -8263,7 +8275,10 @@ var AskInterface = class {
     this.toolCalls = [];
     this.transactions = [];
     this.cards = [];
-    this.error = void 0;
+    if (this.hasAsked) {
+      this.error = void 0;
+    }
+    this.hasAsked = true;
     const callbacks = this.getCallbacks();
     await this.session.sendMessage(message, callbacks);
     return this.partialResult();
@@ -8618,7 +8633,13 @@ async function authenticateVault(client, vault, password, maxAttempts = 3) {
       });
       return {
         token: authResponse.token,
-        expiresAt: authResponse.expires_at
+        expiresAt: authResponse.expires_at,
+        // Captured + persisted by the session token cache. The backend exposes
+        // POST /auth/refresh to exchange it for a fresh access token without a
+        // new MPC round; wiring that exchange is a future enhancement — today
+        // the CLI re-auths via a full MPC re-sign (authenticateVault), which is
+        // always available and avoids depending on refresh-token rotation.
+        refreshToken: authResponse.refresh_token
       };
     } catch (err) {
       lastError = err;
@@ -12066,7 +12087,7 @@ var PipeInterface = class {
 };
 
 // src/agent/session.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
 import { MemoryStorage, PushNotificationService } from "@vultisig/sdk";
@@ -12080,6 +12101,8 @@ var CLIENT_SIDE_TOOL_DISPATCH = {
 var MAX_MESSAGE_LOOP_DEPTH = 16;
 var RECOVERY_POLL_INTERVAL_MS = 2e3;
 var RECOVERY_MAX_POLLS = 90;
+var TX_CONFIRM_POLL_INTERVAL_MS = 3e3;
+var TX_CONFIRM_MAX_POLLS = 40;
 var AgentSession = class {
   client;
   vault;
@@ -12097,6 +12120,10 @@ var AgentSession = class {
   // poll loop without real 2s waits.
   recoveryPollIntervalMs = RECOVERY_POLL_INTERVAL_MS;
   recoveryMaxPolls = RECOVERY_MAX_POLLS;
+  // Post-broadcast confirmation poll cadence — instance fields so tests can
+  // drive the loop without real waits.
+  txConfirmPollIntervalMs = TX_CONFIRM_POLL_INTERVAL_MS;
+  txConfirmMaxPolls = TX_CONFIRM_MAX_POLLS;
   constructor(vault, config) {
     this.vault = vault;
     this.config = config;
@@ -12132,7 +12159,7 @@ var AgentSession = class {
       } else {
         const auth = await authenticateVault(this.client, this.vault, this.config.password);
         this.client.setAuthToken(auth.token);
-        saveCachedToken(this.publicKey, auth.token, auth.expiresAt);
+        saveCachedToken(this.publicKey, auth.token, auth.expiresAt, auth.refreshToken);
       }
     } catch (err) {
       throw new Error(`Authentication failed: ${err.message}`);
@@ -12140,25 +12167,20 @@ var AgentSession = class {
     if (this.config.sessionId) {
       this.conversationId = this.config.sessionId;
       try {
-        const conv = await this.client.getConversation(this.conversationId, this.publicKey);
+        const conv = await this.withAuthRetry(() => this.client.getConversation(this.conversationId, this.publicKey));
         this.historyMessages = conv.messages || [];
       } catch (err) {
-        if (err.message?.includes("401") || err.message?.includes("403")) {
-          clearCachedToken(this.publicKey);
-          const auth = await authenticateVault(this.client, this.vault, this.config.password);
-          this.client.setAuthToken(auth.token);
-          saveCachedToken(this.publicKey, auth.token, auth.expiresAt);
-          const conv = await this.client.getConversation(this.conversationId, this.publicKey);
-          this.historyMessages = conv.messages || [];
-        } else {
-          this.conversationId = null;
-          this.historyMessages = [];
-          const conv = await this.client.createConversation(this.publicKey);
-          this.conversationId = conv.id;
-        }
+        this.conversationId = null;
+        this.historyMessages = [];
+        const conv = await this.withAuthRetry(() => this.client.createConversation(this.publicKey));
+        this.conversationId = conv.id;
+        ui.onError(
+          `Session ${this.config.sessionId} could not be resumed (${err?.message ?? "unknown error"}); started a new conversation ${conv.id}`,
+          "SESSION_NOT_FOUND" /* SESSION_NOT_FOUND */
+        );
       }
     } else {
-      const conv = await this.client.createConversation(this.publicKey);
+      const conv = await this.withAuthRetry(() => this.client.createConversation(this.publicKey));
       this.conversationId = conv.id;
     }
     this.cachedContext = this.config.viaAgent || this.config.askMode ? await buildMinimalContext(this.vault) : await buildMessageContext(this.vault);
@@ -12192,6 +12214,40 @@ var AgentSession = class {
       }
     }
   }
+  /**
+   * Run an authenticated backend request and, on a 401/403, do a single
+   * clear → re-auth → retry. This is the ONE chokepoint every conversation
+   * request shares (resume fetch, fresh-convo create, error-fallback create,
+   * and the send-message stream) so a revoked-but-unexpired cached token
+   * recovers identically everywhere instead of throwing on some paths.
+   *
+   * The retry replays the EXACT same `request` closure, which matters for the
+   * send-message path: the replayed body must carry the same content +
+   * recent_actions or the LLM re-emits tool calls (runaway loop). Re-auth is a
+   * full MPC re-sign via authenticateVault — the backend also exposes
+   * POST /auth/refresh, but exchanging the refresh token is a future
+   * enhancement (see auth.ts); the re-sign is always available.
+   *
+   * `onReauth` (optional) fires the instant a re-auth is committed to — BEFORE
+   * authenticateVault runs — so a caller in a retry loop (recoverDisconnectedTurn)
+   * can record that its single re-auth has been spent even if the MPC re-sign
+   * itself then throws. Without this hook a re-auth that fails with a non-auth
+   * error would let the caller re-enter and re-sign on every iteration.
+   */
+  async withAuthRetry(request, onReauth) {
+    try {
+      return await request();
+    } catch (err) {
+      if (!isAuthError(err)) throw err;
+      onReauth?.();
+      const previousRefreshToken = readTokenStore()[this.publicKey]?.refreshToken;
+      clearCachedToken(this.publicKey);
+      const auth = await authenticateVault(this.client, this.vault, this.config.password);
+      this.client.setAuthToken(auth.token);
+      saveCachedToken(this.publicKey, auth.token, auth.expiresAt, auth.refreshToken ?? previousRefreshToken);
+      return await request();
+    }
+  }
   getConversationId() {
     return this.conversationId;
   }
@@ -12316,31 +12372,15 @@ var AgentSession = class {
       }
     };
     let streamResult;
-    let authRetried = false;
-    while (true) {
-      try {
-        streamResult = await this.client.sendMessageStream(
-          this.conversationId,
-          request,
-          callbacks,
-          this.abortController?.signal
-        );
-        break;
-      } catch (err) {
-        const isAuthErr = err.message?.includes("401") || err.message?.includes("403");
-        if (isAuthErr && !authRetried) {
-          authRetried = true;
-          clearCachedToken(this.publicKey);
-          const auth = await authenticateVault(this.client, this.vault, this.config.password);
-          this.client.setAuthToken(auth.token);
-          saveCachedToken(this.publicKey, auth.token, auth.expiresAt);
-          continue;
-        }
-        if (flushedThisCall.length > 0) {
-          this.pendingToolResults = [...flushedThisCall, ...this.pendingToolResults];
-        }
-        throw err;
+    try {
+      streamResult = await this.withAuthRetry(
+        () => this.client.sendMessageStream(this.conversationId, request, callbacks, this.abortController?.signal)
+      );
+    } catch (err) {
+      if (flushedThisCall.length > 0) {
+        this.pendingToolResults = [...flushedThisCall, ...this.pendingToolResults];
       }
+      throw err;
     }
     if (pendingDispatches.length > 0) {
       await Promise.all(pendingDispatches);
@@ -12375,7 +12415,9 @@ var AgentSession = class {
         const txHash = recent.data.tx_hash;
         const chain = recent.data.chain;
         const explorerUrl = recent.data.explorer_url;
-        if (txHash) ui.onTxStatus(txHash, chain || "", "pending", explorerUrl);
+        if (txHash) {
+          await this.emitAndConfirmTx(txHash, chain, explorerUrl, depth, ui);
+        }
       }
       await this.processMessageLoop(null, ui, depth + 1);
       return;
@@ -12401,10 +12443,16 @@ var AgentSession = class {
     const since = serverAnchor ?? new Date(Date.now() - 2e3).toISOString();
     const replaySignableCards = serverAnchor !== null;
     let cursor;
+    let authRecovered = false;
     for (let attempt = 0; attempt < this.recoveryMaxPolls; attempt++) {
       let resp;
       try {
-        resp = await this.client.messagesSince(this.conversationId, cursor ? { cursor } : { since });
+        resp = authRecovered ? await this.client.messagesSince(this.conversationId, cursor ? { cursor } : { since }) : await this.withAuthRetry(
+          () => this.client.messagesSince(this.conversationId, cursor ? { cursor } : { since }),
+          () => {
+            authRecovered = true;
+          }
+        );
       } catch (err) {
         if (this.config.verbose) {
           process.stderr.write(`[session] recovery poll ${attempt + 1} failed: ${err?.message ?? err}
@@ -12434,6 +12482,75 @@ var AgentSession = class {
   recoverySleep() {
     return new Promise((resolve) => setTimeout(resolve, this.recoveryPollIntervalMs));
   }
+  /**
+   * Post-broadcast confirmation polling (audit F1). A bare `pending` status only
+   * means "broadcast accepted"; the tx can still revert, expire, or be dropped,
+   * so a headless caller that stops at `pending` may mark a later-reverted
+   * operation complete. Poll vault.getTxStatus until the tx reaches a final
+   * state and emit the matching lifecycle status (`confirmed`/`failed`), or
+   * `timeout` when the bounded poll budget is exhausted (the tx may still
+   * confirm later — callers can re-check with `vultisig tx-status`).
+   *
+   * Transient RPC/network errors are treated as "not final yet" and retried
+   * until the budget is spent. Best-effort and non-fatal: if the chain can't be
+   * resolved or the vault doesn't expose getTxStatus, the caller's already-
+   * emitted `pending` status stands and this returns quietly.
+   *
+   * Scoped to headless callers (ask/pipe) that need machine-readable finality.
+   * The interactive TUI already shows `pending` + an explorer link immediately
+   * and has the dedicated `vultisig tx-status` command, so blocking its prompt
+   * for the full poll budget would be a UX regression the audit didn't scope.
+   * The poll also bails on cancel (Ctrl-C aborts the controller) so a long wait
+   * is interruptible.
+   *
+   * The caller only invokes this at message-loop depth 0 (see the call site):
+   * inside a multi-turn tool loop the broadcast result already drives the next
+   * turn, so blocking here would stack the poll budget per leg without feeding
+   * the server any extra signal. Those deeper legs keep their honest `pending`.
+   */
+  async emitAndConfirmTx(txHash, chain, explorerUrl, depth, ui) {
+    ui.onTxStatus(txHash, chain || "", "pending", explorerUrl);
+    if (depth === 0) {
+      await this.confirmBroadcastedTx(txHash, chain, explorerUrl, ui);
+    }
+  }
+  async confirmBroadcastedTx(txHash, chainName, explorerUrl, ui) {
+    if (!this.config.askMode && !this.config.viaAgent) return;
+    const chain = resolveChain(chainName ?? "");
+    if (!chain || typeof this.vault?.getTxStatus !== "function") return;
+    for (let attempt = 0; attempt < this.txConfirmMaxPolls; attempt++) {
+      if (this.abortController?.signal?.aborted) return;
+      try {
+        const result = await this.vault.getTxStatus({ chain, txHash });
+        if (result.status === "success") {
+          ui.onTxStatus(txHash, chainName ?? "", "confirmed", explorerUrl);
+          return;
+        }
+        if (result.status === "error") {
+          ui.onTxStatus(txHash, chainName ?? "", "failed", explorerUrl);
+          return;
+        }
+      } catch (err) {
+        if (this.config.verbose) {
+          process.stderr.write(`[session] tx confirm poll ${attempt + 1} failed: ${err?.message ?? err}
+`);
+        }
+      }
+      if (attempt < this.txConfirmMaxPolls - 1) await this.txConfirmSleep();
+    }
+    if (this.abortController?.signal?.aborted) return;
+    if (this.config.verbose) {
+      process.stderr.write(
+        `[session] tx ${txHash} not confirmed within ${this.txConfirmMaxPolls} polls; emitting timeout
+`
+      );
+    }
+    ui.onTxStatus(txHash, chainName ?? "", "timeout", explorerUrl);
+  }
+  /** Sleep between confirmation polls. Separate method so tests can stub it out. */
+  txConfirmSleep() {
+    return new Promise((resolve) => setTimeout(resolve, this.txConfirmPollIntervalMs));
+  }
   /**
    * Fold a recovered assistant message back into the live stream result: the
    * authoritative message wins over any partial deltas, and any persisted
@@ -12625,6 +12742,10 @@ function serverNowToIso(serverNow) {
 function hasTxReadyPart(parts) {
   return !!parts?.some((p) => p.type === "data-tx_ready" && !!p.data);
 }
+function isAuthError(err) {
+  const msg = err instanceof Error ? err.message : String(err ?? "");
+  return /\b(401|403)\b/.test(msg);
+}
 function getTokenCachePath() {
   const dir = process.env.VULTISIG_CONFIG_DIR ?? join2(homedir2(), ".vultisig");
   return join2(dir, "agent-tokens.json");
@@ -12641,8 +12762,16 @@ function readTokenStore() {
 function writeTokenStore(store) {
   const path4 = getTokenCachePath();
   const dir = join2(path4, "..");
-  if (!existsSync(dir)) mkdirSync2(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
   writeFileSync2(path4, JSON.stringify(store, null, 2), { mode: 384 });
+  try {
+    chmodSync(path4, 384);
+  } catch {
+  }
 }
 function loadCachedToken(publicKey) {
   const store = readTokenStore();
@@ -12660,9 +12789,13 @@ function loadCachedToken(publicKey) {
   }
   return entry.token;
 }
-function saveCachedToken(publicKey, token, expiresAt) {
+function saveCachedToken(publicKey, token, expiresAt, refreshToken) {
   const store = readTokenStore();
-  store[publicKey] = { token, expiresAt };
+  store[publicKey] = {
+    token,
+    expiresAt,
+    refreshToken: refreshToken ?? store[publicKey]?.refreshToken
+  };
   try {
     writeTokenStore(store);
   } catch {
@@ -13210,7 +13343,12 @@ async function executeAgentSessionsList(ctx2, options) {
   let totalCount = 0;
   let skip = 0;
   while (true) {
-    const page = await client.listConversations(publicKey, skip, PAGE_SIZE);
+    const page = await withClientAuthRetry(
+      client,
+      vault,
+      options.password,
+      () => client.listConversations(publicKey, skip, PAGE_SIZE)
+    );
     totalCount = page.total_count;
     allConversations.push(...page.conversations);
     if (allConversations.length >= totalCount || page.conversations.length < PAGE_SIZE) break;
@@ -13252,7 +13390,7 @@ async function executeAgentSessionsDelete(ctx2, sessionId, options) {
   const backendUrl = options.backendUrl || process.env.VULTISIG_AGENT_URL || "https://abe.vultisig.com";
   const client = await createAuthenticatedClient(backendUrl, vault, options.password);
   const publicKey = vault.publicKeys.ecdsa;
-  await client.deleteConversation(sessionId, publicKey);
+  await withClientAuthRetry(client, vault, options.password, () => client.deleteConversation(sessionId, publicKey));
   if (isJsonOutput()) {
     outputJson({ deleted: sessionId });
     return;
@@ -13265,6 +13403,16 @@ async function createAuthenticatedClient(backendUrl, vault, password) {
   client.setAuthToken(auth.token);
   return client;
 }
+async function withClientAuthRetry(client, vault, password, request) {
+  try {
+    return await request();
+  } catch (err) {
+    if (!isAuthError(err)) throw err;
+    const auth = await authenticateVault(client, vault, password);
+    client.setAuthToken(auth.token);
+    return await request();
+  }
+}
 function formatDate(iso) {
   try {
     const d = new Date(iso);
@@ -13283,7 +13431,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "2.8.0";
+    cachedVersion = "2.8.2";
     return cachedVersion;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "2.8.0",
+  "version": "2.8.2",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -76,7 +76,7 @@
     "@vultisig/client-shared": "^0.2.16",
     "@vultisig/core-chain": "^2.17.8",
     "@vultisig/rujira": "^41.0.0",
-    "@vultisig/sdk": "^2.8.0",
+    "@vultisig/sdk": "^2.8.2",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",