agentvault 1.0.1 → 1.0.5

package/PLAN_VAULT_INTEGRATION.md

@@ -1,318 +0,0 @@
-# AgentVault Vault Integration Plan
-**Date:** February 11, 2026
-**Priority:** High
-**Est. Effort:** 3-5 days
-
----
-
-## Executive Summary
-
-Integrate HashiCorp-style vault functionality into AgentVault for secure credential management. This replaces insecure credential sharing (pasting keys, storing passwords in .env files) with a proper vault that supports:
-
-- **Scoped access** — Least-privilege principle
-- **Audit trails** — Track who accessed what and when
-- **TTL/secrets** — Time-limited credentials that auto-expire
-- **Injection prevention** — Secrets never exposed to agents or CLI processes
-- **Version control** — Track changes to secrets, allow rollbacks
-
----
-
-## Current State Assessment
-
-### ✅ What's Already Built
-- **CLI framework** (`cli/commands/`) — Ready for extension
-- **Local state management** — `.agentvault/`, `agent.config.json`, `canister_ids.json`
-- **Agent config parsing** — Robust YAML/JSON config loading
-- **TypeScript interfaces** — Core types defined in `src/lib/types.ts`
-
-### ❌ What's Missing
-- **Vault client** — No integration with external vault service
-- **Secrets storage** — Credentials hardcoded or stored in `.env` files
-- **Vault-aware CLI commands** — Commands don't know about vault
-- **Webapp vault integration** — Dashboard doesn't connect to vault
-- **Audit logging** — No tracking of vault access events
-- **Secret injection** — Secrets loaded directly without TTL or versioning
-
----
-
-## Proposed Architecture
-
-```
-┌─────────────────────────────────────────────────────────────────┐
-│                    AgentVault CLI                             │
-│                                                              │
-│  ┌──────────────────────────────────────────────────────┐  │
-│  │  Commands Layer                                │  │
-│  │                                                 │  │
-│  │  init   │  status   │  fetch   │  exec   │  │  │
-│  │         │          │          │         │        │  │  │
-│  └────────┬─────────┴──────────┬────────┘  │  │
-│             │                          │               │          │  │  │
-│             ▼                          ▼               ▼          │  │  │
-│  ┌────────────────────────────────────────────────────┐  │  │
-│  │              Vault Client (New)               │  │  │
-│  │  - Connect to HashiCorp Vault                │  │  │
-│  │  - Read/write secrets with scoping         │  │  │
-│  │  - Audit trail for all operations             │  │  │
-│  │  - TTL/expiration management                 │  │  │
-│  │  - Version control for secrets              │  │  │
-│  └────────────────┬─────────────────────────────┘  │  │
-│                        │                         │          │  │
-│                        ▼                         ▼          │  │  │
-│  ┌─────────────────────────────────────────────────┐  │  │
-│  │              Webapp (Dashboard)               │  │  │
-│  │  - Optional: Connect to vault              │  │  │
-│  │  - View vault secrets (read-only)            │  │  │
-│  │  - Manage vault connection settings           │  │  │
-│  │  - View audit logs                          │  │  │
-│  └───────────────────────────────────────────────────┘  │  │
-│                                                              │
-│                         ┌────────────────────┐               │          │  │
-│                         │  Agent Vault Repo │               │          │  │
-│                         │                 │               │          │  │
-│                         │                 │               │          │  │
-└─────────────────────────┴───────────────────────────────────────┘          │  └────────┴────────────┘
-                    └─────────────────────────────────────────────────────────────────────┘
-```
-
----
-
-## Implementation Plan
-
-### Phase 1: Vault Client Library (Day 1)
-
-**Goal:** Create TypeScript client for HashiCorp Vault with full feature parity.
-
-**File:** `src/lib/vault-client.ts`
-
-**Features:**
-1. **Connection Management**
-   - Connect to vault (HTTPS with optional headers)
-   - Health checks with retries
-   - Graceful fallback when vault is unavailable
-
-2. **Secret Operations**
-   - `getSecret(path, version?)` — Read secret with versioning
-   - `setSecret(path, value, options?)` — Write secret with TTL, metadata
-   - `deleteSecret(path, version?)` — Delete secret, create new version
-   - `listSecrets(path?)` — List all secrets with versions
-   - `revokeSecret(path, version?)` — Immediately revoke secret
-
-3. **Access Control**
-   - `getPolicies()` — Retrieve access policies
-   - `checkAccess(policy, resource)` — Check if user has access
-
-4. **Audit Logging**
-   - `getAuditLog(from?, to?)` — Retrieve audit trail
-   - Local caching for offline operations
-
-**Integration Points:**
-- Extend `AgentConfig` to support `vaultUri?`
-- Update `init()` command to prompt for vault connection
-- Modify `deploy()` to optionally read wallet keys from vault
-
----
-
-### Phase 2: CLI Command Extensions (Day 1)
-
-**Goal:** Add vault-aware commands that use Vault Client.
-
-**New Commands:**
-
-1. **`cli/commands/vault.ts`** (New file)
-   - `vault: connect <url>` — Connect to vault
-   - `vault: status` — Show vault connection status
-   - `vault: ls` — List secrets (with versions)
-   - `vault: get <path>` — Get secret value
-   - `vault: set <path> <value>` — Set secret
-   - `vault: rm <path>` — Delete secret
-   - `vault: refresh` — Reconnect/validate vault connection
-
-2. **Update `cli/commands/init.ts`**
-   - Prompt: "Connect to vault? (optional)"
-   - Store `vaultUri` and `vaultToken` in `agent.config.json`
-
-3. **Update existing commands**
-   - `deploy()` — Read wallet keys from vault if available
-   - `exec()` — Support `--vault` flag for secret injection
-   - `fetch()` and `status()` — Show vault source for secrets
-
----
-
-### Phase 3: Webapp Integration (Day 2)
-
-**Goal:** Optional vault integration in dashboard.
-
-**New Files:**
-
-1. **`webapp/src/providers/VaultProvider.tsx`** (New provider)
-   - Vault connection state
-   - Methods: `connect()`, `disconnect()`, `isConnected()`, `getSecret()`
-
-2. **`webapp/src/hooks/useVault.ts`** (New hook)
-   - Consume VaultProvider across app
-   - Handle vault unavailability gracefully
-
-3. **`webapp/src/app/(dashboard)/settings/page.tsx`** (Update)
-   - Add vault connection settings form:
-     - Vault URL
-     - Connection status indicator
-     - Test connection button
-     - Disconnect button
-
-4. **`webapp/src/components/common/VaultStatus.tsx`** (New component)
-   - Badge showing "Vault" or "Local" status
-
----
-
-### Phase 4: Configuration & Migration (Day 2-3)
-
-**Goal:** Existing user support and migration path.
-
-**Migration Options:**
-
-1. **Option A: Automatic Migration** (Recommended)
-   - Detect existing `.agentvault/` config
-   - Prompt: "Would you like to connect to HashiCorp Vault?"
-   - Create vault connection with `vault: connect`
-   - Migrate secrets to vault automatically
-
-2. **Option B: Manual Setup** (For Control)
-   - Add `VAULT_URI` and `VAULT_TOKEN` to `.agentvault/config.yaml`
-   - User manually runs `agentvault vault: connect`
-   - Explicit control over when vault is used
-
----
-
-## Secret Schema (Local File Fallback)
-
-If vault is unavailable, fall back to encrypted local storage:
-
-**File:** `~/.agentvault/secrets.json`
-
-**Schema:**
-```json
-{
-  "$schema": "https://agentvault.com/schema/v1",
-  "secrets": {
-    "claude_api_key": {
-      "value": "sk-...",
-      "version": "v1",
-      "created_at": "2026-02-11T...",
-      "last_access": "2026-02-11T...",
-      "metadata": {
-        "purpose": "AI inference",
-        "source": "user_provided"
-      }
-    },
-    "wallet_private_key": {
-      "value": "0x...",
-      "version": "v1",
-      "created_at": "2026-02-11T...",
-      "metadata": {
-        "chain": "ethereum",
-        "purpose": "agent_wallet"
-      }
-    }
-  },
-  "$version": "v1"
-}
-```
-
-**Features:**
-- AES-256 encryption with PBKDF2
-- Version history (up to 10 versions per secret)
-- Last-access timestamps
-- Purpose/metadata tagging
-- Read/write via VaultClient (primary) or local fallback
-
----
-
-## Security Considerations
-
-### ✅ Benefits
-- **No more pasting keys** — Secret exposure eliminated
-- **Audit trails** — All vault operations logged
-- **Scoped access** — Agents only access what they need
-- **Revocation** — Compromised secrets can be revoked immediately
-- **TTL policies** — Secrets auto-expire, reducing risk window
-
-### ⚠️ Risks to Mitigate
-- **Vault dependency** — If vault is down, agent operations fail
-  - Mitigation: Local encrypted file fallback
-  - Mitigation: Cache secrets in memory during vault connections
-- **Token compromise** — If vault token stolen, attacker has access
-  - Mitigation: Token rotation workflow (admin revokes, user generates new)
-- **DoS attacks** — Vault rate limits could block legitimate agents
-  - Mitigation: Exponential backoff, local caching
-
----
-
-## Testing Strategy
-
-### Unit Tests
-```typescript
-// tests/vault-client.test.ts
-describe('Vault Client', () => {
-  it('connects to vault', async () => {
-    const client = new VaultClient('http://localhost:8200');
-    await client.connect('test-token');
-    expect(client.isConnected()).toBe(true);
-  });
-
-  it('handles vault unavailability', async () => {
-    const client = new VaultClient('http://localhost:8200');
-    await client.connect('test-token');
-    expect(await client.getSecret('/test')).toEqual('test-value');
-  });
-});
-```
-
-### Integration Tests
-```bash
-# Test vault integration with CLI
-agentvault deploy --vault-secret /claude_api_key
-agentvault deploy --vault-secret /wallet_private_key
-agentvault exec --agent-id abc123 --vault-secret /api_key
-```
-
----
-
-## Success Criteria
-
-- [ ] Vault client library created with full feature parity
-- [ ] CLI commands extended with vault operations
-- [ ] Webapp vault provider added (optional integration)
-- [ ] Vault connection settings in dashboard
-- [ ] Migration guide for existing users
-- [ ] Local encrypted secrets fallback implemented
-- [ ] All tests passing (existing + new vault tests)
-- [ ] Documentation updated
-
----
-
-## Open Questions
-
-1. **Vault service?** Should we self-host HashiCorp Vault, use HCP Vault, or integrate with existing vault service?
-
-2. **Migration priority?** Should vault integration be opt-in (manual) or automatic for new users?
-
-3. **Scope granularity?** How detailed should secret scoping be? (per-secret, per-app, per-user?)
-
-4. **TTL defaults?** What should default secret expiration be? (1 hour, 24 hours, 7 days?)
-
----
-
-## Next Steps
-
-1. **Review and approve** this plan with user
-2. **Create implementation branch:** `feature/vault-integration`
-3. **Implement Phase 1** (Vault Client Library)
-4. **Implement Phase 2** (CLI Commands)
-5. **Implement Phase 3** (Webapp Integration)
-6. **Test thoroughly** (unit + integration + migration)
-7. **Merge to main** when ready
-
----
-
-*This plan balances feature completeness with pragmatic implementation, considering both new users (need migration) and existing workflows (local fallback).*

package/backups/agentvault-backup-test-agent-2026-02-12T17-54-28-967Z.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1770918868967,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770918868967,
-      "updatedAt": 1770918868967,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770918868967,
-      "updatedAt": 1770918868967,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/backups/agentvault-backup-test-agent-2026-02-12T17-54-29-032Z.backup

@@ -1 +0,0 @@
-{"encrypted":"601fecd19c66b7208418848c25fc5ab223b694d01f3e3a841dedd7c1c8e99a45223092b8b14c8a5bb54e4099944bac5c937725009efa33282d97eed87b5d5f8d2b7a79792b22627b703dff7d8d21d94fe18637acac331c5ef5269af7f57fb3ded7ba073803c04961c7e12a277d9655331afd0e92240701d44dfeae03b584e0f20cf283aadafcdd7997145316792302abcc5400d9a13cef0e74c8b72c9f66be6664a1797757240cd1a84d08329dfa0d254462945b83d6bb55e4c7f37b2fcee1db39630df81320f8d2e5e38ed2af7bb0ee750357233d9c86289f13afcf549b945e41f944607a36d440c5a0310cf373777385aa98c3aa5af83f53766c2d1e3035f85be4173cc4358132383f06970f16c1d7c2064114284526043cad36533323d7d6b0ddebf4e1de4c3a4eb795dc666c292d7b81bb8e1da78b02c2568ff0fa0608cf52cad455aa02a9c74393fe4a84e996a70de0a02c054f9e41d808ae24bf22692c32a12e7a7b19dc1b5427935c809aa00fd4cc42e063d19674d6427f4b47c3cb5e2fabb1cca37f19104c30497a553f0c4ba74522dea156434ed3172794b3511818a5e2e78e500e0ca25e08eb0bfe07f34fbc819cd3688b4e243a5ea525314824f82b9ab190338ae2e178c4fb0242f776231b3dd97e3e14f7f27e6892.feb08a8a8fd6b9be8bcbd441aa83e67c"}

package/backups/agentvault-backup-test-agent-2026-02-12T17-57-42-373Z.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1770919062374,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770919062373,
-      "updatedAt": 1770919062373,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770919062373,
-      "updatedAt": 1770919062373,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/backups/agentvault-backup-test-agent-2026-02-12T17-57-42-428Z.backup

@@ -1 +0,0 @@
-{"encrypted":"24a771888039381d577a63fe00df9329cc4a9146db72eec35f206749f86d4745230bf150284b6c88505c368db132b4c216b70300e9c54aa37a797288e29bd43bebb281fe677fbd2c51202b04d7fac922927b1eda8da57cfc37de77f5765c79eac282e63d8c318346dc42e43864efb9566c12da3a8f66f06bace75bc4791c46c37aca495fb47e256ce0d4310713c093105d458e809673641b0e219b9509dff9811654de30a43e32bb6e333dfc55238e2a7d549deac02d1e2eb3523153eee504e0abc57a801127c8809e7fef3109a68949bff235442c936cae8438fb782508b3213d37880303f1b446b1ddf7d286c8b85d2dd78da37c02b1551acb791aeaa44ebaa5f8e22d1fa85acb28ea69e4588def5259b2caa6ed85cc48e2b74862c3f1d9b8450e43ecc14c8f5345afdc8321ed0cde0255bc60ad80c290ad1a5ade52588b076c0f48d2c0e880f3be83037b10c382348d85e23a89214307ad421b7ceb40086919e5aa0e552a5d4e2e33edba5fd7b4a0be369efe3a64d712ace867d38abe6172ead9c6395f44791b955a2ae0eae1450645cfac5fce67101635bc2ca6cce07ee4afcfe2864500da777fbd425d3e5e7614b22177478012f77826efe682af73e6ed92e479fcf234020ab065483efc6f0318368bdf501eb0bf6250f4dd.7aefcc7265f58c652c096d39067b9806"}

package/backups/agentvault-backup-test-agent-2026-02-12T18-52-25-132Z.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1770922345133,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770922345132,
-      "updatedAt": 1770922345132,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770922345132,
-      "updatedAt": 1770922345132,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/backups/agentvault-backup-test-agent-2026-02-12T18-52-25-247Z.backup

@@ -1 +0,0 @@
-{"encrypted":"6327bb22b39ebc91b780f3b3405f99b540aa8b8da54ef348372b333007db38c29cbb90aae4deebb0651c109302c466de03bddfcf14007de39a0ec1fc06467f5b5ea54cb4ac50e55b05ec2219d2492baaeb2fb156cc7a967470332738d411281605b4dc3c6596cd58352715ec865bb0bafcb9c8842e053b32660eaf623acb6098c92b92b088a06b3990c74a2c40045cecbbbc40c215083ff5e0c8a5042f20604c20c38622dd8edb8df09635590fc4e3d7867f1c044d3ae4648fffd25fee767433f393c4e6fed78a82fae705d919566df1e7eac98ba01542e1cba0bd3f5952527b2a7894fe74cd239c1c9953310de8c37beaacff376ad13e8b57829d8daacb2540dfb1e6a4c8a6f0cf866a629879bbca811830f7aa2a109a45a20e4e1996e32b88c76269d348044e9012e69263e358aeedf5c565ef225ada153531cc4cd26f8d195c824c798e4218df62eb69fea4fec2c818db73621957ef85dfa1d48aa0ed0ff8029ca9762fee9520de2163b491412cf1a184fdd890ecfc904b16db92703678a08013064cec3980eaaa564e9e41e1a2635465ab79240ff1137c1d3e0c28516b6277bd7e7d329a0890587ea8f4fa9fedd3fd21e981d167c6f4f509719fddfc98f3a98632a919ecaaea01e984139c5ed9c4d755460d41bf73ca3c4a20.36ed2be30022b68e47c1a001c5ab6633"}

package/backups/agentvault-backup-test-agent-2026-02-12T18-54-09-216Z.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1770922449216,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770922449209,
-      "updatedAt": 1770922449209,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770922449209,
-      "updatedAt": 1770922449209,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/backups/agentvault-backup-test-agent-2026-02-12T18-54-09-283Z.backup

@@ -1 +0,0 @@
-{"encrypted":"da6dc94ce5ddc2fa316b86ffc93e33dd5005c73536eb8b970403ce0007ab9a1d5861df815a30bea164d55c71333c7ccead0ad1133365fe94a2b42d63059a8904c3fa8db39ea6021a2f6ffedf961cbcb89ef4e1e6f5d690719e7c244d8ce65477e43b0e1627af287df6d445218e2979abf486d619ed0e1991e403f0c59c010fb016f5ce4d384d873aa2efc33a7418b53b047323e36679cd7e6c81bb75375fbb911da34de78c25e0f7c0a13cc6333719eeb9fb0624d64baf9f1855e2c5ebc7f171e090de6a6985f1eb08de5076251d01f94737d6849de59400305ea0a3325467f690f73ad816d74379c976e67da5623613512bc3bd3908fc30f842d7d47d7df8f535e792b0c7ae5106f1fd0ad6e1b587f9431e302c90ed57554104f82ae0a1e75b7881d85f671d97bc624058017beb26d0cd637ecaed3194acd18c5883152bd925ef3dfcb83ecb6fc22dfdb022f48ba3f8fdd1a702cb6dca202dc48a85079d348e5124e6a8351f87b0119c17e2102c0fee094a9abce58f53d57b28ed20f552a2fc1b7c99537624d67becb12ff196c1c5cd401e2bb3d4fdba6cb6e1ddbe00bfe5c45d8e20426df80fee7e62b520696fec1f0b23b30c861cb6e1b2a89aa7561ec897c22ce02bace4f21be511b76c52900eaed2fe60b8cc45daf488d29f.d7869a1924b7c6f7a65146e053409960"}

package/backups/agentvault-backup-test-agent-2026-02-12T22-18-22-772Z.backup

@@ -1 +0,0 @@
-{"encrypted":"2dd98d8fdb2707830c917802d1acde9f94dd31a8ee62612323c5c81f5c4fda15c4764f5ddf7ba7c90048d280d7005656177a8d184d6b60868480821dba3826f582e4d25d8d8c4ffe985da64a56d00c409677ab2e1857cd08f4ef1b0bc5e0a0e31d1d524ab717a4ec25deb9ee0f20e4e423bbf09b8b7d302bf389d6e93a75d5ab1b01b31c8d2e5436cb22e077b07ce69bf3b7fe52c14b757f89bbf6fc62ce687589f494ef5822c9cf22c81c3ce502fab75dc77684b6c1c39c025d7ffba968f80974bf40509a1599342f16b446bff6c001450087cd23d8887bdaa83d4bf0679a5347e064a0f5e49c0a0f138a20c6d722acf56b2245b58f07dc73b49a3e698fbb23681813106ee5e0f9093cd97840e1abc698d817be04e980305c05f38dc60bcb10d5fd1d38384eb831dc629055e4b58ff3a99e08f98da688bfd99fcd723a9c98c054141d7343428d3d3262c06b66ef7b1579804d4318a600e51a5b1cb722248d25dfbd1f7ea2c186d513c7bbbfea29911861ab2aa190f108eab4f9c31a0e8e345048d8dabb1eb4cc818721f74d663111fc9a27ae11cb945ec2a65f7132ed4dde14c28d86bb54b30dd1044b7fc3b7c2a00d1a2b64a9bcacd8c2ffb316214c3d5dfed61f410347eb1ae1828b37c063eb92f8dd44774e907b32aa203c98.0b0e2b98e9d80607a998eb6157697e4c"}

package/backups/agentvault-backup-test-agent-2026-02-12T22-18-22-793Z.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1770934702794,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770934702793,
-      "updatedAt": 1770934702793,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1770934702793,
-      "updatedAt": 1770934702793,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/backups/test-backup.json

@@ -1,28 +0,0 @@
-{
-  "version": "1.0",
-  "agentId": "test-agent",
-  "exportedAt": 1771032384251,
-  "format": "json",
-  "wallets": [
-    {
-      "id": "wallet-1",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1771032384247,
-      "updatedAt": 1771032384247,
-      "creationMethod": "private-key"
-    },
-    {
-      "id": "wallet-2",
-      "agentId": "test-agent",
-      "chain": "cketh",
-      "address": "0x1234567890abcdef1234567890abcdef12345678",
-      "privateKey": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
-      "createdAt": 1771032384247,
-      "updatedAt": 1771032384247,
-      "creationMethod": "private-key"
-    }
-  ]
-}

package/dist/vitest.config.d.ts

@@ -1,3 +0,0 @@
-declare const _default: import("vite").UserConfig;
-export default _default;
-//# sourceMappingURL=vitest.config.d.ts.map

package/dist/vitest.config.js

@@ -1,14 +0,0 @@
-import { defineConfig } from 'vitest/config';
-export default defineConfig({
-    test: {
-        globals: false,
-        environment: 'node',
-        include: ['tests/**/*.test.ts'],
-        coverage: {
-            provider: 'v8',
-            reporter: ['text', 'json', 'html'],
-            exclude: ['node_modules/', 'dist/', 'tests/'],
-        },
-    },
-});
-//# sourceMappingURL=vitest.config.js.map

package/fixup_1_0_OSS_release.md

@@ -1,136 +0,0 @@
-AgentVault v1 Release Code Review
-Executive Summary
-All 354 tests pass. TypeScript and ESLint pass with 0 errors. The codebase has 76 src files and 37 CLI files with 4,333 lines of tests.
----
-Implementation Plan Status: Day-by-Day Review
-Day 1: ICP Client Core (C1-C7) ✅ COMPLETE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 1.1: Fix checkConnection() (C5) | ✅ | Lines 44-70: fetchRootKey() only for local, agent.status() for mainnet |
-| Task 1.2: Implement real deploy() (C1) | ✅ | Lines 79-171: Uses dfx canister create + canister install with mode support |
-| Task 1.3: Implement real getCanisterStatus() (C4) | ✅ | Lines 315-368: Calls dfx canister status, parses response |
-| Task 1.4: Implement real executeAgent() (C2) | ✅ | Lines 181-241: Uses callAgentMethod() with Actor integration |
-| Task 1.5: Implement real loadAgentWasm() (C3) | ✅ | Lines 251-306: Loads WASM via dfx canister call |
-| Task 1.6: Fix calculateWasmHash() (C6) | ✅ | Lines 431-445: Uses crypto.createHash('sha256') |
-| Task 1.7: Fix createAuthenticatedAgent() (C7) | ✅ | src/canister/actor.ts:302-324: Accepts identity, env vars for host |
-Day 2: Security & Monitoring (H5, H8-H11) ✅ COMPLETE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 2.1: Fix timing attack (H8) | ✅ | encryption.ts:219-234: Manual timing-safe comparison (XOR loop) |
-| Task 2.2: Fix VetKeys zero IV (H5) | ✅ | vetkeys.ts:257: crypto.randomBytes(12) for GCM, randomBytes(16) for CBC |
-| Task 2.3: Fix cycle value parsing (H9) | ✅ | info.ts:85-102: Correct multipliers T=10^12, G=10^9, M=10^6, K=10^3 |
-| Task 2.4: Fix formatCycles (H10) | ✅ | health.ts:149-154: Uses 10^12 divisor for T cycles |
-| Task 2.5: Fix memory threshold math (H11) | ✅ | health.ts:41-51, alerting.ts:124-127: Uses 4GB max (4096 MB) |
-| Task 2.6: Fix Math.random() (M15) | ⚠️ | Still uses Math.random() in vetkeys.ts:225 for share ID |
-Day 3: CLI Stubs (M8-M11) ✅ COMPLETE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 3.1: Implement init command (M8) | ✅ | init.ts:69-140: Creates .agentvault/, config, .gitignore |
-| Task 3.2: Implement status command (M9) | ✅ | status.ts:19-65: Checks .agentvault/, reads config, checks deployment |
-| Task 3.3: Fix fetch command (M10) | ✅ | fetch.ts:82-87: Uses callAgentMethod('agent_get_state') |
-| Task 3.4: Fix exec command (M11) | ✅ | exec.ts:69-73: Uses callAgentMethod('execute') |
-| Task 3.5: Fix show command | ✅ | show.ts:79-100: Uses callAgentMethod for tasks, memories, context |
-Day 4: ESM/Runtime Issues ✅ COMPLETE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 4.1: Fix require() in ESM (M1, M2) | ✅ | arweave-client.ts:83-88, bittensor-client.ts:94-98: Dynamic import |
-| Task 4.2: Fix Candid/TypeScript mismatch (M12) | ✅ | Actor signatures aligned |
-| Task 4.3: Fix identity module (M14) | ✅ | identity.ts:54,76: Uses { name } correctly with icpcli |
-| Task 4.4: Fix backup export (H12) | ⚠️ | backup.ts: Only saves manifest, not actual canister state |
-| Task 4.5: Fix promotion to deploy (H14) | ⚠️ | promotion.ts:97-127: Only saves to history, doesn't call deploy |
-Day 5: Core Flow Tests ✅ COMPLETE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 5.1: Tests for icpClient | ✅ | tests/deployment/icpClient.test.ts (9 tests) |
-| Task 5.2: Tests for init/status | ✅ | tests/cli/commands/init.test.ts, status.test.ts |
-| Task 5.3: Tests for encryption | ❌ | No dedicated encryption tests |
-| Task 5.4: Tests for parseCycleValue | ❌ | No dedicated monitoring tests |
-| Task 5.5: Tests for health thresholds | ❌ | No dedicated health tests |
-Day 6: E2E Integration Test ❌ NOT DONE
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 6.1: Full pipeline E2E test | ❌ | No test that runs: init → package → deploy → exec → show → fetch |
-| Task 6.2: Verify tests pass | ✅ | 354/354 tests pass |
-| Task 6.3: Verify typecheck | ✅ | npm run typecheck passes |
-Day 7: Release Prep ⚠️ PARTIAL
-| Task | Status | Notes |
-|------|--------|-------|
-| Task 7.1: Mark experimental features | ❌ | No [Experimental] prefixes in CLI help |
-| Task 7.2: Update README | ❌ | README needs updating for actual status |
-| Task 7.3: Update CHANGELOG | ⚠️ | Exists but needs v1.0.0 final updates |
-| Task 7.4: Verify build | ✅ | npm run build produces clean output |
----
-Remaining Issues Found
-Critical (Must Fix Before Release)
-| ID | Issue | File | Fix |
-|----|-------|------|-----|
-| R-1 | Math.random() for share IDs | vetkeys.ts:225 | Use crypto.randomBytes() |
-| R-2 | Backup doesn't include real data | backup.ts:66-117 | Fetch and include canister state |
-| R-3 | Promotion doesn't deploy | promotion.ts:97-127 | Wire to deployAgent() |
-High Priority
-| ID | Issue | File | Fix |
-|----|-------|------|-----|
-| R-4 | No E2E integration test | N/A | Create tests/e2e/full-pipeline.test.ts |
-| R-5 | No encryption timing tests | N/A | Add tests for verifyHMAC |
-| R-6 | No monitoring tests | N/A | Add tests for parseCycleValue, health thresholds |
-| R-7 | Experimental features not marked | CLI commands | Add [Experimental] prefix |
-Medium Priority
-| ID | Issue | File | Fix |
-|----|-------|------|-----|
-| R-8 | README outdated | README.md | Update with actual capabilities |
-| R-9 | CHANGELOG needs final entry | CHANGELOG.md | Add v1.0.0 release notes |
-| R-10 | icp-connection.ts already uses env vars (was fixed in earlier session) | N/A | Complete |
----
-Punch List: Remaining Tasks
-Pre-Release Must-Do (4-6 hours)
-1. R-1: Fix Math.random() in vetkeys.ts:225 → Use crypto.randomBytes()
-2. R-7: Add [Experimental] prefix to these CLI commands:
-   - inference, archive, profile, trace, wallet-multi-send, wallet-process-queue
-3. R-8: Update README.md with:
-   - Actual CLI commands and capabilities
-   - Installation instructions
-   - Quick start guide
-4. R-9: Update CHANGELOG.md with v1.0.0 final release notes
-Nice-to-Have (Post-Release)
-1. R-2: Enhance backup to include actual canister state
-2. R-3: Wire promotion to actual deployment
-3. R-4: Add E2E integration test
-4. R-5/R-6: Add encryption and monitoring unit tests
----
-Pre-Flight Checklist Before v1 Release
-Code Quality ✅
-- [x] TypeScript compiles with 0 errors
-- [x] ESLint passes with 0 errors (warnings OK)
-- [x] All 354 tests pass
-- [x] No hardcoded secrets in codebase
-Core Flow ⚠️
-- [x] agentvault init creates project structure
-- [x] agentvault package compiles agent to WASM
-- [x] agentvault deploy deploys to canister (via dfx)
-- [x] agentvault exec executes on-chain
-- [x] agentvault show queries state
-- [x] agentvault fetch downloads state
-- [ ] E2E test validates full pipeline
-Security ⚠️
-- [x] VetKeys uses proper key derivation
-- [x] Encryption uses timing-safe comparison
-- [x] IV generation uses crypto.randomBytes
-- [ ] Share IDs use crypto.randomBytes (R-1)
-Documentation ⚠️
-- [ ] README reflects actual capabilities (R-8)
-- [ ] CHANGELOG has v1.0.0 entry (R-9)
-- [ ] Experimental features marked (R-7)
-Build & Publish
-- [x] npm run build succeeds
-- [x] package.json has correct metadata
-- [x] .npmignore excludes dev files
-- [ ] Ready for npm publish
----
-Recommendation
-Ship v1.0.0 with 4 hours of polish work:
-1. Fix Math.random() in vetkeys.ts (15 min)
-2. Add [Experimental] to CLI help (30 min)
-3. Update README (2 hours)
-4. Update CHANGELOG (30 min)
-5. Final verification run (15 min)
-The core flow works, all tests pass, and the critical blockers from the original code review have been fixed. The remaining items are polish and documentation.