@vultisig/cli 4.1.0 → 4.3.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @vultisig/cli
 
+## 4.3.0
+
+### Patch Changes
+
+- Updated dependencies [[`c0ff9b5`](https://github.com/vultisig/vultisig-sdk/commit/c0ff9b5f8fe477df10850b25cc0def27ee31b6b4)]:
+  - @vultisig/core-chain@2.34.0
+  - @vultisig/sdk@4.3.0
+  - @vultisig/rujira@62.0.0
+
+## 4.2.0
+
+### Patch Changes
+
+- [#1605](https://github.com/vultisig/vultisig-sdk/pull/1605) [`1a23da3`](https://github.com/vultisig/vultisig-sdk/commit/1a23da39c7b50649b213efab13e02590d35db1a1) Thanks [@neavra](https://github.com/neavra)! - fix(agent): `agent ask` without `--yes` now reports the proposed transaction instead of a failure
+
+  `agent ask --help` documents the no-`--yes` path as read-safe: "it reports the
+  proposed transaction so a read-only prompt can't move funds." It did not. The
+  transaction built fine, the confirm gate correctly denied signing, and the
+  refusal was then fed back into the model loop — which retried, failed, and ended
+  the turn with `transactions: []`, `cards: []`, no proposed transaction, and a
+  stated cause that was wrong: that the build had errored, that there was no send
+  tool, or that a broadcast could not be confirmed. Nothing had ever been
+  authorized to broadcast.
+
+  Refusing to sign without `--yes` was always right. Discarding the built
+  transaction and reporting the refusal as a failed build was the defect.
+
+  In ask mode a declined signing now ENDS the turn — the gate there is a fixed
+  policy, not something a retry can satisfy — and the built, unsigned transaction
+  is surfaced as the turn's result: `proposed_transaction` (tool, summary, chain)
+  plus `confirmation_required` on the JSON envelope, and `proposed:` /
+  `confirmation-required:` lines on the human output. The exit code stays 12
+  (`CONFIRMATION_REQUIRED`), the same slot `send` and `swap` already use for
+  "needs `--yes`", and the error message now states what actually happened. This
+  covers `sign_typed_data` (e.g. a Polymarket bet) as well as `sign_tx`.
+
+  Results of client-side tools that already RAN in the same turn (`vault_chain`,
+  `vault_coin`, `address_book`) stay queued across the decline, so a committed
+  local mutation is still reported to the backend on the next request.
+
+  The TUI and pipe mode are unchanged: the discriminator is policy-vs-decision, not
+  headless-vs-interactive. Ask mode's gate is a constant; the TUI prompts a live
+  user and pipe mode blocks on a live host answer over stdin — there a decline is a
+  real decision the model should still get to acknowledge.
+
+  Also maps a backend turn outcome of `confirmation_required` onto exit 12 rather
+  than the generic safety-block exit 10.
+
+- [#1604](https://github.com/vultisig/vultisig-sdk/pull/1604) [`9e88dcf`](https://github.com/vultisig/vultisig-sdk/commit/9e88dcf4875ebccfc7ea021707d99ec728a41eea) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - Export `DEFAULT_CHAINS` and `defaultChains` from the root and React Native SDK entrypoints so consumers can reuse the canonical onboarding/import default-chain set instead of maintaining local mirrors.
+
+- [#1613](https://github.com/vultisig/vultisig-sdk/pull/1613) [`68f8899`](https://github.com/vultisig/vultisig-sdk/commit/68f8899f6545b3876703e7a56b43d73a64217da2) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - Export canonical `ChainKind` helpers from the React Native SDK entrypoint.
+
+- [#1783](https://github.com/vultisig/vultisig-sdk/pull/1783) [`59c4b6d`](https://github.com/vultisig/vultisig-sdk/commit/59c4b6dcda667cf8f7e482ab1ec9666723d7f5c8) Thanks [@neavra](https://github.com/neavra)! - Emit an auditable signing summary in agent output after --yes approves signing
+
+- Updated dependencies [[`5ce75b5`](https://github.com/vultisig/vultisig-sdk/commit/5ce75b53c527b373eb9ccacceac6edbaacf4ebec), [`eb7d862`](https://github.com/vultisig/vultisig-sdk/commit/eb7d86260a2ea5cdd661951d15677ec4db3517b0), [`9e88dcf`](https://github.com/vultisig/vultisig-sdk/commit/9e88dcf4875ebccfc7ea021707d99ec728a41eea), [`68f8899`](https://github.com/vultisig/vultisig-sdk/commit/68f8899f6545b3876703e7a56b43d73a64217da2), [`80b19bd`](https://github.com/vultisig/vultisig-sdk/commit/80b19bdbfbcb6af875a0b145bb02306552adac27), [`a812367`](https://github.com/vultisig/vultisig-sdk/commit/a812367923ac3781dc240d00124232c6f0cc3348)]:
+  - @vultisig/sdk@4.2.0
+  - @vultisig/core-chain@2.33.0
+  - @vultisig/rujira@61.0.0
+
 ## 4.1.0
 
 ### Patch Changes

package/dist/index.js

@@ -10186,6 +10186,8 @@ var AskInterface = class {
   polymarketCards = [];
   warnings = [];
   outcome;
+  proposedTransaction;
+  signingRecords = [];
   error;
   // Tracks whether the currently-latched `error` is a terminal one (e.g. the
   // depth cap). A terminal error may overwrite a prior non-terminal one; once a
@@ -10245,6 +10247,12 @@ var AskInterface = class {
       onTurnOutcome: (outcome) => {
         this.outcome = outcome;
       },
+      onProposedTransaction: (proposed) => {
+        this.proposedTransaction = proposed;
+      },
+      onSigningRecord: (record) => {
+        this.signingRecords.push(record);
+      },
       onSuggestions: (_suggestions) => {
       },
       onTxStatus: (txHash, chain, status, explorerUrl) => {
@@ -10304,6 +10312,8 @@ var AskInterface = class {
     this.polymarketCards = [];
     this.warnings = [];
     this.outcome = void 0;
+    this.proposedTransaction = void 0;
+    this.signingRecords = [];
     this.error = void 0;
     this.errorIsTerminal = false;
     const callbacks = this.getCallbacks();
@@ -10328,8 +10338,10 @@ var AskInterface = class {
       yieldCards: this.yieldCards,
       polymarketCards: this.polymarketCards,
       warnings: this.warnings,
+      signingRecords: this.signingRecords,
       error: this.error,
-      ...this.outcome ? { outcome: this.outcome } : {}
+      ...this.outcome ? { outcome: this.outcome } : {},
+      ...this.proposedTransaction ? { proposedTransaction: this.proposedTransaction } : {}
     };
   }
 };
@@ -11103,6 +11115,16 @@ var AgentExecutor = class {
     this.pendingPayloads.clear();
     this.pendingLegs = [];
   }
+  /**
+   * The chain the currently-buffered server tx targets, or null when nothing is
+   * buffered. Read alongside {@link getPendingSummary} so a declined signing can
+   * report the proposed transaction as a machine-readable surface — a read-safe
+   * `agent ask` (no `--yes`) is documented to REPORT the proposed transaction,
+   * and a prose summary alone is not something an integrator can branch on.
+   */
+  getPendingChain() {
+    return this.pendingPayloads.get("latest")?.chain ?? null;
+  }
   /**
    * Human-readable one-line summary of the currently-buffered server tx
    * (set by storeServerTransaction), for the pre-sign confirmation prompt.
@@ -11140,7 +11162,11 @@ var AgentExecutor = class {
     const symbol = labels.token_resolved || labels.token_symbol || "";
     const amountWithSymbol = symbol && !amount.endsWith(` ${symbol}`) ? `${amount} ${symbol}` : amount;
     const to = p?.txArgs?.to || labels.recipient_echo || "?";
-    return `send ${amountWithSymbol} on ${stored.chain} to ${to}`;
+    const contractTo = typeof p?.txArgs?.tx?.to === "string" ? p.txArgs.tx.to : "";
+    const calldata = typeof p?.txArgs?.tx?.data === "string" ? p.txArgs.tx.data : "";
+    const isContractSend = !!contractTo && calldata !== "" && calldata !== "0x";
+    const contractPart = isContractSend && contractTo.toLowerCase() !== to.toLowerCase() ? ` (token contract ${contractTo})` : "";
+    return `send ${amountWithSymbol} on ${stored.chain} to ${to}${contractPart}`;
   }
   /**
    * Wrap a per-tool handler body with normalised success/failure → RecentAction
@@ -13697,6 +13723,9 @@ var PipeInterface = class {
           explorer_url: explorerUrl
         });
       },
+      onSigningRecord: (record) => {
+        this.emit({ type: "signing_record", record });
+      },
       onError: (message, code) => {
         this.emit({ type: "error", message, code });
       },
@@ -13960,6 +13989,10 @@ var CLIENT_SIDE_DISPATCH_TOOL_NAMES = /* @__PURE__ */ new Set([
   ...Object.keys(CLIENT_SIDE_TOOL_DISPATCH)
 ]);
 var MAX_MESSAGE_LOOP_DEPTH = 16;
+var PROPOSED_SUMMARY_MAX_CHARS = 500;
+function capSigningSummary(summary) {
+  return summary.length > PROPOSED_SUMMARY_MAX_CHARS ? `${summary.slice(0, PROPOSED_SUMMARY_MAX_CHARS)}\u2026` : summary;
+}
 var RECOVERY_POLL_INTERVAL_MS = 2e3;
 var RECOVERY_MAX_POLLS = 90;
 var TX_CONFIRM_POLL_INTERVAL_MS = 3e3;
@@ -13971,6 +14004,55 @@ function hasUnacknowledgedBroadcastResult(results) {
     return typeof hash === "string" && hash.length > 0;
   });
 }
+function reportDeclinedSigning(executor, toolName, toolCallId, summary, input, ui) {
+  const proposedChain = toolName === "sign_tx" ? executor.getPendingChain() : null;
+  if (toolName === "sign_tx") executor.clearPendingTransaction();
+  const proposed = capSigningSummary(summary);
+  const declined = {
+    tool: toolName,
+    success: false,
+    data: {
+      error: "Transaction not confirmed",
+      code: "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */,
+      proposed,
+      ...proposedChain ? { proposed_chain: proposedChain } : {}
+    }
+  };
+  ui.onProposedTransaction?.({
+    tool: toolName,
+    summary: proposed,
+    ...proposedChain ? { chain: proposedChain } : {}
+  });
+  ui.onToolCall(toolCallId, toolName, input);
+  ui.onToolResult(
+    toolCallId,
+    toolName,
+    false,
+    declined.data,
+    "Transaction not confirmed",
+    "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */
+  );
+  return declined;
+}
+function isAskModeDecline(askMode, recent) {
+  return !!askMode && !!recent && !recent.success && recent.data?.code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */;
+}
+function takeQueuedAskModeDeclines(askMode, pending) {
+  if (!askMode) return false;
+  const kept = pending.filter((r) => !isAskModeDecline(askMode, r));
+  if (kept.length === pending.length) return false;
+  pending.splice(0, pending.length, ...kept);
+  return true;
+}
+function finishDeclinedTurn(verbose, pendingCount, ui) {
+  if (verbose) {
+    process.stderr.write(
+      `[session] signing declined and ask mode is non-interactive; ending turn with the proposed transaction (${pendingCount} already-executed result(s) stay queued)
+`
+    );
+  }
+  ui.onDone();
+}
 var AgentSession = class {
   client;
   vault;
@@ -14412,10 +14494,16 @@ var AgentSession = class {
         ui,
         () => this.executor.signTxFromBuffer(signToolCallId)
       );
-      this.pendingToolResults.push(recent);
+      const declinedInAskMode = isAskModeDecline(this.config.askMode, recent);
+      if (!declinedInAskMode) this.pendingToolResults.push(recent);
       if (!recent.success && recent.data?.code === "DUPLICATE_BROADCAST" /* DUPLICATE_BROADCAST */) {
         ui.onError(String(recent.data.error ?? "duplicate broadcast refused"), "DUPLICATE_BROADCAST" /* DUPLICATE_BROADCAST */);
       }
+      if (declinedInAskMode) {
+        takeQueuedAskModeDeclines(this.config.askMode, this.pendingToolResults);
+        finishDeclinedTurn(this.config.verbose, this.pendingToolResults.length, ui);
+        return;
+      }
       if (recent.success && recent.data) {
         const txHash = recent.data.tx_hash;
         const chain = recent.data.chain;
@@ -14427,6 +14515,10 @@ var AgentSession = class {
       await this.processMessageLoop(null, ui, depth + 1);
       return;
     }
+    if (takeQueuedAskModeDeclines(this.config.askMode, this.pendingToolResults)) {
+      finishDeclinedTurn(this.config.verbose, this.pendingToolResults.length, ui);
+      return;
+    }
     if (this.pendingToolResults.length > 0) {
       await this.processMessageLoop(null, ui, depth + 1);
       return;
@@ -14696,33 +14788,15 @@ var AgentSession = class {
    * prompt was declined).
    */
   async runPasswordGatedTool(toolName, toolCallId, ui, body, input) {
+    let signingRecord;
     if (PASSWORD_REQUIRED_TOOLS.has(toolName)) {
       const summary = (toolName === "sign_tx" ? this.executor.getPendingSummary() : null) ?? `${toolName}${input ? ` ${JSON.stringify(input)}` : ""}`;
       const approved = await ui.requestConfirmation(summary);
       if (!approved) {
-        if (toolName === "sign_tx") {
-          this.executor.clearPendingTransaction();
-        }
-        const declined = {
-          tool: toolName,
-          success: false,
-          data: {
-            error: "Transaction not confirmed",
-            code: "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */,
-            proposed: summary
-          }
-        };
-        ui.onToolCall(toolCallId, toolName, input);
-        ui.onToolResult(
-          toolCallId,
-          toolName,
-          false,
-          declined.data,
-          "Transaction not confirmed",
-          "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */
-        );
-        return declined;
+        return reportDeclinedSigning(this.executor, toolName, toolCallId, summary, input, ui);
       }
+      const chain = ui.onSigningRecord && toolName === "sign_tx" ? this.executor.getPendingChain() : null;
+      signingRecord = { tool: toolName, summary: capSigningSummary(summary), ...chain ? { chain } : {} };
     }
     let promptedPassword;
     if (PASSWORD_REQUIRED_TOOLS.has(toolName) && !this.config.password) {
@@ -14767,6 +14841,7 @@ var AgentSession = class {
       const message = err instanceof Error ? err.message : String(err);
       recent = { tool: toolName, success: false, data: { error: message } };
     }
+    if (signingRecord) ui.onSigningRecord?.({ ...signingRecord, success: recent.success });
     const errorMsg = recent.data?.error ?? void 0;
     const errorCode = recent.data?.code ?? void 0;
     ui.onToolResult(toolCallId, toolName, recent.success, recent.data, errorMsg, errorCode);
@@ -15049,6 +15124,13 @@ var ChatTUI = class {
           console.log(`     ${chalk9.blue.underline(explorerUrl)}`);
         }
       },
+      onSigningRecord: (record) => {
+        if (record.success) {
+          console.log(`  ${chalk9.green("\u2713")} ${chalk9.bold("Signing approved")}: ${record.summary}`);
+        } else {
+          console.log(`  ${chalk9.red("\u2717")} ${chalk9.bold("Signing approved but not completed")}: ${record.summary}`);
+        }
+      },
       onError: (message, code) => {
         if (this.isStreaming) {
           process.stdout.write("\n");
@@ -15297,14 +15379,29 @@ async function executeAgent(ctx2, options) {
     }
   }
 }
+function signingRecordsField(result) {
+  return result?.signingRecords?.length ? { signing_records: result.signingRecords } : {};
+}
+function writeSigningRecordLines(records, write) {
+  for (const record of records ?? []) {
+    write(`signing-record:${record.success ? "signed" : "not-signed"}:${record.summary}
+`);
+  }
+}
 function outputAskError(wantsJson, message, code, conversationId, result) {
   if (wantsJson) {
     const data = {};
     if (result?.transactions.length) data.transactions = result.transactions;
+    Object.assign(data, signingRecordsField(result));
     if (result?.toolCalls.length) data.tool_calls = result.toolCalls;
     if (result?.response) data.response = result.response;
     if (result?.warnings.length) data.warnings = result.warnings;
     if (result?.outcome) data.outcome = result.outcome;
+    if (result?.proposedTransaction) {
+      data.confirmation_required = true;
+      data.proposed_transaction = result.proposedTransaction;
+      data.proposed = result.proposedTransaction.summary;
+    }
     outputErrorJson({
       success: false,
       v: 1,
@@ -15322,6 +15419,12 @@ function outputAskError(wantsJson, message, code, conversationId, result) {
       }
       if (result.response) process.stderr.write(`${result.response}
 `);
+      if (result.proposedTransaction) {
+        process.stderr.write("confirmation-required:pass --yes to authorize signing\n");
+        process.stderr.write(`proposed:${result.proposedTransaction.summary}
+`);
+      }
+      writeSigningRecordLines(result.signingRecords, (line) => process.stderr.write(line));
     }
     process.stderr.write(`Error: ${message} [${code}]
 `);
@@ -15333,12 +15436,16 @@ function hasCommittedBroadcast(result) {
   return !!result?.transactions.some((tx) => tx.hash.trim().length > 0 && tx.status !== "failed");
 }
 var SIGNING_TOOLS = /* @__PURE__ */ new Set(["sign_tx", "sign_typed_data"]);
+var CONFIRMATION_REQUIRED_MESSAGE = "The transaction was built but signing was not authorized, so nothing was signed or broadcast. Re-run with --yes to authorize signing.";
 function failedSigningError(result) {
   const failed = [...result.toolCalls].reverse().find((call) => SIGNING_TOOLS.has(call.action));
   if (!failed || failed.success) return void 0;
   const message = failed.error ?? (typeof failed.data?.error === "string" ? failed.data.error : void 0) ?? `${failed.action} failed`;
   const dataCode = failed.data?.code;
   const code = failed.code ?? (typeof dataCode === "string" && isAgentErrorCode(dataCode) ? dataCode : inferAgentErrorCodeFromMessage(message));
+  if (code === "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */) {
+    return { message: CONFIRMATION_REQUIRED_MESSAGE, code };
+  }
   return { message, code };
 }
 function outputPostBroadcastFailure(wantsJson, result, conversationId, classification, originalError) {
@@ -15346,6 +15453,7 @@ function outputPostBroadcastFailure(wantsJson, result, conversationId, classific
   if (wantsJson) {
     const data = {
       transactions: result.transactions,
+      ...signingRecordsField(result),
       tool_calls: result.toolCalls,
       response: result.response,
       ...result.warnings.length ? { warnings: result.warnings } : {},
@@ -15382,6 +15490,7 @@ function outputPostBroadcastFailure(wantsJson, result, conversationId, classific
     if (tx.explorerUrl) process.stderr.write(`explorer:${tx.explorerUrl}
 `);
   }
+  writeSigningRecordLines(result.signingRecords, (line) => process.stderr.write(line));
   process.stderr.write(
     "WARNING: DO NOT blindly retry. Verify each transaction hash and continue only the incomplete step.\n"
   );
@@ -15402,6 +15511,7 @@ function outputAskHuman(result, confirmationRequired, proposed) {
 `);
     }
   }
+  writeSigningRecordLines(result.signingRecords, (line) => process.stdout.write(line));
   for (const card of result.cards) {
     process.stdout.write(`
 ${renderBalanceSummaryCard(card)}
@@ -15445,6 +15555,7 @@ function outputAskSuccess(wantsJson, result, conversationId) {
       response: result.response,
       tool_calls: result.toolCalls,
       transactions: result.transactions,
+      ...signingRecordsField(result),
       ...result.cards.length > 0 ? { cards: result.cards } : {},
       ...result.yieldCards.length > 0 ? { yield_cards: result.yieldCards } : {},
       ...result.polymarketCards.length > 0 ? { polymarket_cards: result.polymarketCards } : {},
@@ -15462,6 +15573,9 @@ function outputAskSuccess(wantsJson, result, conversationId) {
   outputAskHuman(result, confirmationRequired, proposed);
 }
 function outcomeError(outcome) {
+  if (outcome?.code === "confirmation_required") {
+    return { message: CONFIRMATION_REQUIRED_MESSAGE, code: "CONFIRMATION_REQUIRED" /* CONFIRMATION_REQUIRED */ };
+  }
   switch (outcome?.kind) {
     case "blocked":
       return {
@@ -15651,7 +15765,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "4.1.0";
+    cachedVersion = "4.3.0";
     return cachedVersion;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -74,9 +74,9 @@
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
     "@vultisig/client-shared": "^0.3.3",
-    "@vultisig/core-chain": "^2.32.0",
-    "@vultisig/rujira": "^60.0.0",
-    "@vultisig/sdk": "^4.1.0",
+    "@vultisig/core-chain": "^2.34.0",
+    "@vultisig/rujira": "^62.0.0",
+    "@vultisig/sdk": "^4.3.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",
@@ -94,7 +94,7 @@
     "@types/node": "^26.1.1",
     "@types/tabtab": "^3.0.4",
     "@types/ws": "^8.18.1",
-    "@vultisig/core-mpc": "^1.17.0",
+    "@vultisig/core-mpc": "^1.19.0",
     "esbuild": "^0.28.1",
     "ethers": "^6.17.0",
     "node-pty": "^1.1.0",