@vultisig/cli 6.2.0 → 6.3.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @vultisig/cli
 
+## 6.3.0
+
+### Patch Changes
+
+- [#2202](https://github.com/vultisig/vultisig-sdk/pull/2202) [`2d90f80`](https://github.com/vultisig/vultisig-sdk/commit/2d90f803055e7c1325ab1dc1966e17431740cb1f) Thanks [@neavra](https://github.com/neavra)! - Derive swap sell-token contracts from signed approval payloads and mark unresolved contract disclosures explicitly.
+
+- Updated dependencies [[`c0eafeb`](https://github.com/vultisig/vultisig-sdk/commit/c0eafeb12df42cffa70ef6951c081a74383e5fa2), [`b2f63b7`](https://github.com/vultisig/vultisig-sdk/commit/b2f63b70c4dac0001f0f40521efa4412f1d9e1cb), [`536c320`](https://github.com/vultisig/vultisig-sdk/commit/536c32028bf1f66897bf018c19f36c298545841a), [`78be14e`](https://github.com/vultisig/vultisig-sdk/commit/78be14ea9f1f011ded932ce6a9be5c19cf5694d0), [`76be65f`](https://github.com/vultisig/vultisig-sdk/commit/76be65fc297a43de6313b9dce3b096e6f764831a), [`e23780f`](https://github.com/vultisig/vultisig-sdk/commit/e23780f0b292cd76e80c72c5ccdcdafebd73a735), [`30499f8`](https://github.com/vultisig/vultisig-sdk/commit/30499f83f9909d8eb9bc1d310b25fdadb5c240e7), [`534154b`](https://github.com/vultisig/vultisig-sdk/commit/534154b6e9daaffad5d2e4958af3ead5fa940f21), [`3d40017`](https://github.com/vultisig/vultisig-sdk/commit/3d400171facf1107472e827c4ef48d7dd99843f1), [`c0c08f0`](https://github.com/vultisig/vultisig-sdk/commit/c0c08f0bd2337147d6b92ca7f391115edd7db62b), [`2869ae6`](https://github.com/vultisig/vultisig-sdk/commit/2869ae60bc157e2020a541e31a50afabef4e9edc), [`ef252e4`](https://github.com/vultisig/vultisig-sdk/commit/ef252e40b590a6cad9f303f7aba743c617442f90), [`4e23e92`](https://github.com/vultisig/vultisig-sdk/commit/4e23e9205310e46564bc1782b57499b2a39d7a5f), [`4561c65`](https://github.com/vultisig/vultisig-sdk/commit/4561c6584f62fa78d17546bcc119e31b6ea665cb), [`fc876a7`](https://github.com/vultisig/vultisig-sdk/commit/fc876a7fb561041539cb257a814d078304de6857), [`d08babd`](https://github.com/vultisig/vultisig-sdk/commit/d08babd96c36b193f8788605ed59871da1483ff3), [`4292e31`](https://github.com/vultisig/vultisig-sdk/commit/4292e3127e56bc2c92f2ac7b0a2886fcb0445043), [`d267ff6`](https://github.com/vultisig/vultisig-sdk/commit/d267ff66b9cf6d0b5898d40ec1f37cda6decb707), [`5f7dd00`](https://github.com/vultisig/vultisig-sdk/commit/5f7dd007cb5026d7c3ebe414fa5952f3419df570), [`bfe0292`](https://github.com/vultisig/vultisig-sdk/commit/bfe0292e3876fb7acc7044bac1b544c27aba8919), [`acd0b2e`](https://github.com/vultisig/vultisig-sdk/commit/acd0b2eaa882669a399fb378e51244ed4199ee47), [`f86320b`](https://github.com/vultisig/vultisig-sdk/commit/f86320bcfbee02b2f27473ac41a042db307596f6)]:
+  - @vultisig/core-chain@4.1.1
+  - @vultisig/sdk@6.3.0
+
 ## 6.2.0
 
 ### Minor Changes

package/dist/index.js

@@ -10610,32 +10610,6 @@ Use --add <contractAddress> to add or --remove <tokenId> to remove`));
   }
 }
 
-// ../../packages/core/chain/dist/chains/ripple/address.js
-import { classicAddressToXAddress, isValidXAddress, xAddressToClassicAddress } from "ripple-address-codec";
-var assertSupportedTag = (tag) => {
-  if (tag === false)
-    return void 0;
-  return tag;
-};
-var decodeRippleXAddress = (address) => {
-  const value = address.trim();
-  if (!isValidXAddress(value))
-    throw new Error("Invalid XRP X-address");
-  const decoded = xAddressToClassicAddress(value);
-  if (decoded.test)
-    throw new Error("XRP testnet X-addresses are not supported");
-  return {
-    address: decoded.classicAddress,
-    destinationTag: assertSupportedTag(decoded.tag)
-  };
-};
-var normalizeRippleDestination = (address) => {
-  const value = address.trim();
-  if (value.startsWith("X") || value.startsWith("T"))
-    return decodeRippleXAddress(value);
-  return { address: value };
-};
-
 // ../../packages/core/mpc/dist/keysign/error.js
 var BuildKeysignPayloadError = class extends Error {
   type;
@@ -10667,7 +10641,7 @@ var resolveDestinationTag = ({ destinationTag, memo }) => {
 };
 
 // src/commands/transaction.ts
-import { Chain as Chain3, Vultisig as Vultisig2 } from "@vultisig/sdk";
+import { Chain as Chain3, normalizeRippleDestination, Vultisig as Vultisig2 } from "@vultisig/sdk";
 var getSendPreviewDetails = (chain, keysignPayload) => {
   let memo = keysignPayload.memo || void 0;
   if (chain !== Chain3.Ripple) {
@@ -14493,13 +14467,177 @@ var ERC20_TRANSFER_ABI = parseAbi(["function transfer(address to, uint256 value)
 function decodeErc20Transfer(calldata) {
   if (calldata.slice(0, ERC20_TRANSFER_SELECTOR.length).toLowerCase() !== ERC20_TRANSFER_SELECTOR) return null;
   try {
-    const decoded = decodeFunctionData({ abi: ERC20_TRANSFER_ABI, data: calldata });
+    const decoded = decodeFunctionData({
+      abi: ERC20_TRANSFER_ABI,
+      data: calldata
+    });
     const [recipient, amount] = decoded.args;
     return { recipient, amount };
   } catch {
     throw new Error("Invalid ERC-20 transfer calldata \u2014 refusing to sign");
   }
 }
+var tokenLabel = (value) => typeof value === "string" ? value : "";
+var MAX_TOKEN_SYMBOL_LENGTH = 32;
+var MAX_TOKEN_LABEL_LENGTH = 512;
+function safeTokenSymbol(symbol) {
+  const defaultDisplaySymbol = symbol.match(/^[\p{L}\p{N}][\p{L}\p{N}._+-]{0,31}/u)?.[0] ?? "token";
+  if (symbol.length > MAX_TOKEN_SYMBOL_LENGTH) {
+    return { displaySymbol: defaultDisplaySymbol, suspicious: true };
+  }
+  const suspiciousAt = symbol.search(/0x[0-9a-f]{40}|\([^)]*\bon\b[^)]*\)/iu);
+  const candidate = (suspiciousAt < 0 ? symbol : symbol.slice(0, suspiciousAt)).trim();
+  const displaySymbol = candidate.match(/^[\p{L}\p{N}][\p{L}\p{N}._+-]*/u)?.[0] ?? "token";
+  if (suspiciousAt < 0 && candidate === displaySymbol) {
+    return { displaySymbol, suspicious: false };
+  }
+  return { displaySymbol, suspicious: true };
+}
+function unresolvedTokenIdentity(label) {
+  if (typeof label !== "string" || label.length > MAX_TOKEN_LABEL_LENGTH) {
+    return { rawSymbol: "", displaySymbol: "", kind: "unresolved" };
+  }
+  const suffixAt = label.lastIndexOf(" (");
+  const rawSymbol = (suffixAt > 0 ? label.slice(0, suffixAt) : label).trim();
+  return {
+    rawSymbol,
+    displaySymbol: safeTokenSymbol(rawSymbol).displaySymbol,
+    kind: "unresolved"
+  };
+}
+function untrustedSymbolIdentity(symbol) {
+  const rawSymbol = tokenLabel(symbol);
+  return {
+    rawSymbol,
+    displaySymbol: safeTokenSymbol(rawSymbol).displaySymbol,
+    kind: "unresolved"
+  };
+}
+function resolvedTokenIdentity(label, expectedChain) {
+  const unresolved = unresolvedTokenIdentity(label);
+  if (typeof label !== "string" || label.length > MAX_TOKEN_LABEL_LENGTH) return unresolved;
+  const match = label.match(/^([\s\S]*) \(([\s\S]*?) on ([^,]+), \d+ dec, source: [^)]+\)$/u);
+  if (!match) return unresolved;
+  const [, rawSymbol, rawAssetId, descriptorChain] = match;
+  const { displaySymbol, suspicious } = safeTokenSymbol(rawSymbol);
+  const parsedChain = resolveChainReference(descriptorChain);
+  const routedChain = typeof expectedChain === "string" || typeof expectedChain === "number" ? resolveChainReference(expectedChain) : void 0;
+  if (suspicious || !parsedChain || !routedChain || parsedChain !== routedChain) {
+    return { rawSymbol, displaySymbol, kind: "unresolved" };
+  }
+  const assetId = rawAssetId.trim();
+  if (!assetId) return { rawSymbol, displaySymbol, kind: "unresolved" };
+  if (assetId.toLowerCase() === "native") return { rawSymbol, displaySymbol, kind: "native" };
+  if (getChainKind4(routedChain) === "evm") {
+    if (!/^0x[0-9a-f]{40}$/iu.test(assetId)) return { rawSymbol, displaySymbol, kind: "unresolved" };
+  } else if (!/^[\p{L}\p{N}:._/-]{1,128}$/u.test(assetId)) {
+    return { rawSymbol, displaySymbol, kind: "unresolved" };
+  }
+  return { rawSymbol, displaySymbol, kind: "token", contract: assetId };
+}
+function replaceUnsafeSymbol(text, identity) {
+  if (!identity.rawSymbol || identity.rawSymbol === identity.displaySymbol) return text;
+  return text.split(identity.rawSymbol).join(identity.displaySymbol);
+}
+function anchorEnd(text, label) {
+  if (!label) return -1;
+  const tokenChar = /[\p{L}\p{N}._+-]/u;
+  const trimmedLength = text.trimEnd().length;
+  const index = trimmedLength - label.length;
+  if (index < 0 || !text.startsWith(label, index)) return -1;
+  const before = text[index - 1];
+  if (before && tokenChar.test(before)) return -1;
+  return trimmedLength;
+}
+function hasAnchor(text, anchors) {
+  return anchors.some((anchor) => anchorEnd(text, anchor) >= 0);
+}
+function hasSingleSwapDelimiter(summary, labels) {
+  const identities = [
+    unresolvedTokenIdentity(labels.from_token),
+    untrustedSymbolIdentity(labels.from_token_symbol),
+    unresolvedTokenIdentity(labels.to_token),
+    untrustedSymbolIdentity(labels.to_token_symbol)
+  ];
+  const structuralSummary = identities.reduce((text, identity) => replaceUnsafeSymbol(text, identity), summary);
+  const firstArrow = structuralSummary.indexOf("\u2192");
+  return firstArrow >= 0 && structuralSummary.indexOf("\u2192", firstArrow + 1) < 0;
+}
+function splitSwapHead(head, sellAnchors, buyAnchors) {
+  let best;
+  let arrowAt = head.indexOf("\u2192");
+  while (arrowAt >= 0) {
+    const left = head.slice(0, arrowAt);
+    const right = head.slice(arrowAt + 1);
+    const viaAt = right.indexOf(" via ");
+    const buy = viaAt >= 0 ? right.slice(0, viaAt) : right;
+    const provider = viaAt >= 0 ? right.slice(viaAt) : "";
+    const score = Number(hasAnchor(left, sellAnchors)) + Number(hasAnchor(buy, buyAnchors));
+    if (!best || score > best.score) {
+      best = { left, buy, provider, score };
+    }
+    arrowAt = head.indexOf("\u2192", arrowAt + 1);
+  }
+  return best;
+}
+function terminalAnchorSymbol(anchor) {
+  return anchor.trim().match(/[\p{L}\p{N}][\p{L}\p{N}._+-]*$/u)?.[0] ?? "";
+}
+function discloseSwapSide(side, anchors, suffix, expectedSymbol) {
+  if (!expectedSymbol) {
+    return `${side.trimEnd()} (contract unavailable)${side.slice(side.trimEnd().length)}`;
+  }
+  for (const anchor of anchors) {
+    const end = anchorEnd(side, anchor);
+    if (end < 0) continue;
+    const visibleSymbol = terminalAnchorSymbol(anchor);
+    if (expectedSymbol && visibleSymbol && visibleSymbol !== expectedSymbol) break;
+    if (!suffix) return side;
+    return `${side.slice(0, end)}${suffix}${side.slice(end)}`;
+  }
+  return `${side.trimEnd()} (contract unavailable)${side.slice(side.trimEnd().length)}`;
+}
+function discloseSwapTokenContracts(head, labels, payload, sourceChain) {
+  const destinationChain = Object.hasOwn(labels, "to_chain") ? labels.to_chain ?? null : typeof payload?.to_chain === "string" || typeof payload?.to_chain === "number" ? payload.to_chain : void 0;
+  const fromToken = resolvedTokenIdentity(labels.from_token, sourceChain);
+  const toToken = resolvedTokenIdentity(labels.to_token, destinationChain);
+  const fromSymbol = untrustedSymbolIdentity(labels.from_token_symbol);
+  const toSymbol = untrustedSymbolIdentity(labels.to_token_symbol);
+  const approvalArgs = payload?.approvalTxArgs;
+  const rawApprovalTarget = tokenLabel(
+    approvalArgs && typeof approvalArgs === "object" ? approvalArgs.tx?.to : void 0
+  );
+  const approvalTarget = /^0x[0-9a-f]{40}$/iu.test(rawApprovalTarget) ? rawApprovalTarget : "";
+  const symbolIdentities = [fromToken, fromSymbol, toToken, toSymbol];
+  const sanitizeText = (value) => symbolIdentities.reduce((text, identity) => replaceUnsafeSymbol(text, identity), tokenLabel(value));
+  const sanitizedHead = sanitizeText(head);
+  const sellAnchors = [sanitizeText(labels.amount_in), fromSymbol.displaySymbol, fromToken.displaySymbol].filter(
+    Boolean
+  );
+  const buyAnchors = [sanitizeText(labels.expected_output), toSymbol.displaySymbol, toToken.displaySymbol].filter(
+    Boolean
+  );
+  const approvalMatchesResolvedSellToken = fromToken.kind === "token" && !!fromToken.contract && !!approvalTarget && fromToken.contract.toLowerCase() === approvalTarget.toLowerCase();
+  const sellSuffix = payload?.approvalTxArgs ? approvalMatchesResolvedSellToken ? ` (${approvalTarget})` : " (contract unavailable)" : fromToken.kind === "native" ? "" : fromToken.kind === "token" && fromToken.contract ? ` (${fromToken.contract})` : " (contract unavailable)";
+  const buySuffix = toToken.kind === "native" ? "" : toToken.kind === "token" && toToken.contract ? ` (${toToken.contract})` : " (contract unavailable)";
+  const halves = splitSwapHead(sanitizedHead, sellAnchors, buyAnchors);
+  if (!halves) return `${sanitizedHead} (contract unavailable)`;
+  const sellResolved = fromToken.kind !== "unresolved";
+  const buyResolved = toToken.kind !== "unresolved";
+  const sell = discloseSwapSide(
+    halves.left,
+    sellAnchors,
+    sellResolved ? sellSuffix : "",
+    sellResolved ? fromToken.displaySymbol : void 0
+  );
+  const buy = discloseSwapSide(
+    halves.buy,
+    buyAnchors,
+    buyResolved ? buySuffix : "",
+    buyResolved ? toToken.displaySymbol : void 0
+  );
+  return `${sell}\u2192${buy}${halves.provider}`;
+}
 var isEvmChain = (chain) => EVM_CHAINS.has(chain);
 function stripEmbeddedPayloadContract(value, disclosedContract) {
   if (!disclosedContract) return value;
@@ -14885,12 +15023,22 @@ var AgentExecutor = class {
     }
     const isSwap = !!(p?.approvalTxArgs || p?.swap_tx || labels.quote_summary || labels.to_token_symbol);
     if (isSwap) {
-      const usedQuoteSummary = !!labels.quote_summary;
-      const head = labels.quote_summary || `swap ${labels.amount_in ?? p?.txArgs?.amount ?? "?"} ${labels.from_token_symbol ?? ""} \u2192 ${labels.to_token_symbol ?? ""}`.trim();
+      const rawQuoteSummary = tokenLabel(labels.quote_summary);
+      const quoteSummary = hasSingleSwapDelimiter(rawQuoteSummary, labels) ? rawQuoteSummary : "";
+      const usedQuoteSummary = !!quoteSummary;
+      const amountIn = tokenLabel(labels.amount_in) || tokenLabel(p?.txArgs?.amount) || "?";
+      const fromSymbol = tokenLabel(labels.from_token_symbol);
+      const sellHead = fromSymbol && !amountIn.endsWith(` ${fromSymbol}`) ? `${amountIn} ${fromSymbol}` : amountIn;
+      const head = discloseSwapTokenContracts(
+        quoteSummary || `swap ${sellHead} \u2192 ${tokenLabel(labels.to_token_symbol) || "?"}`,
+        labels,
+        p,
+        stored.chain
+      );
       const parts = [head, `on ${stored.chain}`];
-      if (!usedQuoteSummary && labels.provider) parts.push(`via ${labels.provider}`);
+      if (!usedQuoteSummary && tokenLabel(labels.provider)) parts.push(`via ${tokenLabel(labels.provider)}`);
       if (p?.__multiLeg) parts.push("(+ token approval \u2014 2 transactions)");
-      if (labels.estimated_fee) parts.push(`est. fee ${labels.estimated_fee}`);
+      if (tokenLabel(labels.estimated_fee)) parts.push(`est. fee ${tokenLabel(labels.estimated_fee)}`);
       return parts.join(" ");
     }
     const signedTx = extractNestedTx(p);
@@ -14914,18 +15062,18 @@ var AgentExecutor = class {
    */
   renderLabelSendSummary(p, labels, chain, to, disclosedContract) {
     const amount = stripEmbeddedPayloadContract(labels.resolved_amount ?? p?.txArgs?.amount ?? "?", disclosedContract);
-    const tokenLabel = stripEmbeddedPayloadContract(
+    const tokenLabel2 = stripEmbeddedPayloadContract(
       (labels.token_resolved || labels.token_symbol || "").trim(),
       disclosedContract
     );
-    const symbol = tokenLabel.split(/\s+/, 1)[0];
+    const symbol = tokenLabel2.split(/\s+/, 1)[0];
     const escapedChain = String(chain).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const routedChainPattern = new RegExp(`(?:^|\\s)(?:not\\s+)?on ${escapedChain}(?=\\s|$)`);
     const positiveRoutedChainPattern = new RegExp(`(?:^|\\s)(?<!\\bnot\\s+)on ${escapedChain}(?=\\s|$)`);
-    const tokenContext = tokenLabel.slice(symbol.length);
+    const tokenContext = tokenLabel2.slice(symbol.length);
     const labelCarriesRoutedChain = positiveRoutedChainPattern.test(tokenContext);
     const tokenDetail = tokenContext.replace(routedChainPattern, "").trim();
-    const amountEmbedsTokenLabel = tokenLabel.length > 0 && amount.endsWith(` ${tokenLabel}`);
+    const amountEmbedsTokenLabel = tokenLabel2.length > 0 && amount.endsWith(` ${tokenLabel2}`);
     const amountWithSymbol = symbol && !amount.endsWith(` ${symbol}`) && !amountEmbedsTokenLabel ? `${amount} ${symbol}` : amount;
     const tokenDetailSuffix = amountEmbedsTokenLabel || !tokenDetail ? "" : ` ${tokenDetail}`;
     const location = amountEmbedsTokenLabel && labelCarriesRoutedChain ? "" : `on ${chain}${tokenDetailSuffix}`;
@@ -19480,7 +19628,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "6.2.0";
+    cachedVersion = "6.3.0";
     return cachedVersion;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -74,9 +74,9 @@
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
     "@vultisig/client-shared": "^0.3.5",
-    "@vultisig/core-chain": "^4.1.0",
+    "@vultisig/core-chain": "^4.1.1",
     "@vultisig/rujira": "^70.0.0",
-    "@vultisig/sdk": "^6.2.0",
+    "@vultisig/sdk": "^6.3.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",
@@ -94,7 +94,7 @@
     "@types/node": "^26.1.1",
     "@types/tabtab": "^3.0.4",
     "@types/ws": "^8.18.1",
-    "@vultisig/core-mpc": "^2.1.0",
+    "@vultisig/core-mpc": "^2.1.1",
     "esbuild": "^0.28.1",
     "ethers": "^6.17.0",
     "node-pty": "^1.1.0",