arc402-cli 0.6.0 → 0.7.0

package/dist/ui/format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/ui/format.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,EAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAMR;AAID;;GAEG;AACH,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAe9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAEhE"}
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/ui/format.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,EAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAMR;AAID;;GAEG;AACH,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAgB9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/ui/format.js

@@ -40,6 +40,8 @@ function formatBalance(ethAmount, tokenAmount, tokenSymbol) {
 function formatTimeAgo(timestampSeconds) {
     const now = Math.floor(Date.now() / 1000);
     const delta = now - timestampSeconds;
+    if (delta < 0)
+        return "in " + formatDuration(Math.abs(delta));
     if (delta < 60)
         return "just now";
     if (delta < 3600) {

package/dist/ui/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/ui/format.ts"],"names":[],"mappings":";AAAA,iFAAiF;;AAMjF,sCAGC;AAOD,kCAEC;AAKD,sCAUC;AAOD,sCAeC;AAKD,wCASC;AAKD,0CAEC;AA1ED;;;GAGG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,WAAW,CAAC,MAAuB,EAAE,KAAa;IAChE,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,SAA0B,EAC1B,WAA6B,EAC7B,WAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,SAAS,MAAM,CAAC;IAC/B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,GAAG,GAAG,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,aAAa,CAAC,gBAAwB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,GAAG,gBAAgB,CAAC;IAErC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,gBAAwB;IACtD,OAAO,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/ui/format.ts"],"names":[],"mappings":";AAAA,iFAAiF;;AAMjF,sCAGC;AAOD,kCAEC;AAKD,sCAUC;AAOD,sCAgBC;AAKD,wCASC;AAKD,0CAEC;AA3ED;;;GAGG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,WAAW,CAAC,MAAuB,EAAE,KAAa;IAChE,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,SAA0B,EAC1B,WAA6B,EAC7B,WAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,SAAS,MAAM,CAAC;IAC/B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,GAAG,GAAG,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,aAAa,CAAC,gBAAwB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,GAAG,gBAAgB,CAAC;IAErC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,gBAAwB;IACtD,OAAO,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arc402-cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "ARC-402 CLI for discovery, negotiation payloads, hire/remediation/dispute workflows, and network reads",
   "bin": {
     "arc402": "./dist/index.js"

package/src/commands/config.ts

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 import prompts from "prompts";
 import chalk from "chalk";
-import { Arc402Config, NETWORK_DEFAULTS, configExists, loadConfig, saveConfig, getSubdomainApi } from "../config";
+import { Arc402Config, NETWORK_DEFAULTS, configExists, loadConfig, saveConfig, getSubdomainApi, getWcProjectId } from "../config";
 import { c } from '../ui/colors';
 
 export function registerConfigCommands(program: Command): void {
@@ -17,7 +17,7 @@ export function registerConfigCommands(program: Command): void {
     const defaults = NETWORK_DEFAULTS[answers.network] ?? {};
     const cfg: Arc402Config = {
       network: answers.network,
-      walletConnectProjectId: "455e9425343b9156fce1428250c9a54a",
+      walletConnectProjectId: getWcProjectId(),
       rpcUrl: defaults.rpcUrl ?? "https://mainnet.base.org",
       trustRegistryAddress: defaults.trustRegistryAddress ?? "",
       agentRegistryAddress: defaults.agentRegistryV2Address ?? defaults.agentRegistryAddress,
@@ -50,6 +50,16 @@ export function registerConfigCommands(program: Command): void {
     console.log(JSON.stringify({ ...cfg, privateKey: cfg.privateKey ? "***" : undefined, subdomainApi: getSubdomainApi(cfg) }, null, 2));
   });
   config.command("set <key> <value>").description("Set a config value: arc402 config set <key> <value>").action((key: string, value: string) => {
+    const BLOCKED_KEYS = ["privateKey", "guardianPrivateKey", "cdpPrivateKey", "machineKey"];
+    const ALLOWED_KEYS = ["network", "rpcUrl", "walletContractAddress", "ownerAddress", "walletConnectProjectId", "subdomainApi", "telegramBotToken", "telegramChatId", "telegramThreadId"];
+    if (BLOCKED_KEYS.includes(key)) {
+      console.error(chalk.red("Cannot set sensitive keys via config set. Edit ~/.arc402/config.json directly."));
+      process.exit(1);
+    }
+    if (!ALLOWED_KEYS.includes(key)) {
+      console.error(chalk.red(`Unknown config key: ${key}. Allowed keys: ${ALLOWED_KEYS.join(", ")}`));
+      process.exit(1);
+    }
     const cfg = loadConfig();
     (cfg as unknown as Record<string, unknown>)[key] = value;
     saveConfig(cfg);

package/src/commands/doctor.ts

@@ -0,0 +1,172 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { spawnSync } from "child_process";
+import { configExists, loadConfig } from "../config";
+import { c } from "../ui/colors";
+
+const ARC402_DIR = path.join(os.homedir(), ".arc402");
+const CONFIG_PATH = path.join(ARC402_DIR, "config.json");
+const DAEMON_PID_PATH = path.join(ARC402_DIR, "daemon.pid");
+
+function ok(label: string, detail?: string): void {
+  process.stdout.write(
+    "  " + chalk.green("✓") + " " + chalk.white(label) + (detail ? chalk.dim("  " + detail) : "") + "\n"
+  );
+}
+
+function fail(label: string, detail?: string): void {
+  process.stdout.write(
+    "  " + chalk.red("✗") + " " + chalk.white(label) + (detail ? chalk.dim("  " + detail) : "") + "\n"
+  );
+}
+
+function warn(label: string, detail?: string): void {
+  process.stdout.write(
+    "  " + chalk.yellow("⚠") + " " + chalk.white(label) + (detail ? chalk.dim("  " + detail) : "") + "\n"
+  );
+}
+
+async function fetchJson(url: string, timeoutMs = 4000): Promise<unknown> {
+  const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+  return res.json();
+}
+
+export function registerDoctorCommand(program: Command): void {
+  program
+    .command("doctor")
+    .description("Check ARC-402 environment health")
+    .action(async () => {
+      process.stdout.write("\n" + c.cyan("◈ ") + chalk.white("arc402 doctor") + "\n\n");
+
+      // ── 1. Config exists ───────────────────────────────────────────────────
+      if (configExists()) {
+        ok("Config found", CONFIG_PATH);
+      } else {
+        fail("Config not found", "Run: arc402 config init");
+        process.stdout.write("\n");
+        return;
+      }
+
+      const config = loadConfig();
+
+      // ── 2. RPC reachable ───────────────────────────────────────────────────
+      try {
+        const body = JSON.stringify({ jsonrpc: "2.0", method: "eth_blockNumber", params: [], id: 1 });
+        const res = await fetch(config.rpcUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body,
+          signal: AbortSignal.timeout(5000),
+        });
+        const json = await res.json() as { result?: string };
+        if (json.result) {
+          const block = parseInt(json.result, 16);
+          ok("RPC reachable", `block #${block.toLocaleString()}`);
+        } else {
+          fail("RPC returned no block", config.rpcUrl);
+        }
+      } catch (err) {
+        fail("RPC unreachable", config.rpcUrl + " — " + (err instanceof Error ? err.message : String(err)));
+      }
+
+      // ── 3. Wallet deployed ─────────────────────────────────────────────────
+      if (config.walletContractAddress) {
+        try {
+          const body = JSON.stringify({
+            jsonrpc: "2.0",
+            method: "eth_getCode",
+            params: [config.walletContractAddress, "latest"],
+            id: 1,
+          });
+          const res = await fetch(config.rpcUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body,
+            signal: AbortSignal.timeout(5000),
+          });
+          const json = await res.json() as { result?: string };
+          if (json.result && json.result !== "0x" && json.result.length > 2) {
+            ok("Wallet deployed", config.walletContractAddress);
+          } else {
+            fail("Wallet not deployed", config.walletContractAddress + " — no code at address");
+          }
+        } catch (err) {
+          warn("Wallet check failed", err instanceof Error ? err.message : String(err));
+        }
+      } else {
+        warn("Wallet not configured", "Run: arc402 wallet deploy");
+      }
+
+      // ── 4. Machine key authorized ──────────────────────────────────────────
+      if (config.privateKey && config.walletContractAddress) {
+        try {
+          const { ethers } = await import("ethers");
+          const machineKey = new ethers.Wallet(config.privateKey);
+          const provider = new ethers.JsonRpcProvider(config.rpcUrl);
+          const iface = new ethers.Interface(["function authorizedMachineKeys(address) external view returns (bool)"]);
+          const data = iface.encodeFunctionData("authorizedMachineKeys", [machineKey.address]);
+          const result = await Promise.race([
+            provider.call({ to: config.walletContractAddress, data }),
+            new Promise<never>((_, r) => setTimeout(() => r(new Error("timeout")), 4000)),
+          ]);
+          const authorized = iface.decodeFunctionResult("authorizedMachineKeys", result)[0] as boolean;
+          if (authorized) {
+            ok("Machine key authorized", machineKey.address);
+          } else {
+            fail("Machine key not authorized", machineKey.address + " — run: arc402 wallet onboard");
+          }
+        } catch (err) {
+          warn("Machine key check failed", err instanceof Error ? err.message : String(err));
+        }
+      } else if (!config.privateKey) {
+        warn("Machine key not configured", "No privateKey in config");
+      }
+
+      // ── 5. Daemon running ──────────────────────────────────────────────────
+      let daemonRunning = false;
+      if (fs.existsSync(DAEMON_PID_PATH)) {
+        try {
+          const pid = parseInt(fs.readFileSync(DAEMON_PID_PATH, "utf-8").trim(), 10);
+          // Check if process is alive
+          process.kill(pid, 0);
+          daemonRunning = true;
+          ok("Daemon running", `PID ${pid}`);
+        } catch {
+          fail("Daemon PID file stale", "Run: arc402 daemon start");
+        }
+      } else {
+        fail("Daemon not running", "Run: arc402 daemon start");
+      }
+
+      // ── 6. Docker available ────────────────────────────────────────────────
+      try {
+        const docker = spawnSync("docker", ["--version"], { encoding: "utf-8", timeout: 3000 });
+        if (docker.status === 0) {
+          ok("Docker available", docker.stdout.trim().split("\n")[0]);
+        } else {
+          warn("Docker not found", "Install from https://docs.docker.com/get-docker/");
+        }
+      } catch {
+        warn("Docker not found", "Install from https://docs.docker.com/get-docker/");
+      }
+
+      // ── 7. HTTP relay reachable (if daemon is running) ─────────────────────
+      if (daemonRunning) {
+        try {
+          const health = await fetchJson("http://localhost:4402/health") as { status?: string };
+          if (health.status === "online") {
+            ok("HTTP relay reachable", "http://localhost:4402");
+          } else {
+            warn("HTTP relay responded", JSON.stringify(health));
+          }
+        } catch {
+          fail("HTTP relay not reachable", "http://localhost:4402 — daemon may still be starting");
+        }
+      }
+
+      process.stdout.write("\n");
+    });
+}

package/src/commands/wallet.ts

@@ -267,12 +267,15 @@ async function runCompleteOnboardingCeremony(
     const guardianInput = (guardianAns.guardian as string | undefined)?.trim() ?? "";
     if (guardianInput.toLowerCase() === "g") {
       const generatedGuardian = ethers.Wallet.createRandom();
-      config.guardianPrivateKey = generatedGuardian.privateKey;
+      // Save guardian private key to a separate restricted file, NOT config.json
+      const guardianKeyPath = path.join(os.homedir(), ".arc402", "guardian.key");
+      fs.mkdirSync(path.dirname(guardianKeyPath), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(guardianKeyPath, generatedGuardian.privateKey + "\n", { mode: 0o400 });
+      // Only save address (not private key) to config
       config.guardianAddress = generatedGuardian.address;
       saveConfig(config);
       guardianAddress = generatedGuardian.address;
-      console.log("\n " + c.warning + " IMPORTANT: Save this guardian private key (emergency freeze key):");
-      console.log("   " + c.dim(generatedGuardian.privateKey));
+      console.log("\n " + c.warning + " Guardian key saved to ~/.arc402/guardian.key — move offline for security");
       console.log("   " + c.dim("Address: ") + c.white(generatedGuardian.address) + "\n");
       const guardianIface = new ethers.Interface(["function setGuardian(address _guardian) external"]);
       await sendTx(
@@ -686,16 +689,40 @@ export function registerWalletCommands(program: Command): void {
 
   // ─── import ────────────────────────────────────────────────────────────────
 
-  wallet.command("import <privateKey>")
-    .description("Import an existing private key")
+  wallet.command("import")
+    .description("Import an existing private key (use --key-file or stdin prompt)")
     .option("--network <network>", "Network (base-mainnet or base-sepolia)", "base-sepolia")
-    .action(async (privateKey, opts) => {
+    .option("--key-file <path>", "Read private key from file instead of prompting")
+    .action(async (opts) => {
       const network = opts.network as "base-mainnet" | "base-sepolia";
       const defaults = NETWORK_DEFAULTS[network];
       if (!defaults) {
         console.error(`Unknown network: ${network}. Use base-mainnet or base-sepolia.`);
         process.exit(1);
       }
+
+      let privateKey: string;
+      if (opts.keyFile) {
+        try {
+          privateKey = fs.readFileSync(opts.keyFile, "utf-8").trim();
+        } catch (e) {
+          console.error(`Cannot read key file: ${e instanceof Error ? e.message : String(e)}`);
+          process.exit(1);
+        }
+      } else {
+        // Interactive prompt — hidden input avoids shell history
+        const answer = await prompts({
+          type: "password",
+          name: "key",
+          message: "Paste private key (hidden):",
+        });
+        privateKey = ((answer.key as string | undefined) ?? "").trim();
+        if (!privateKey) {
+          console.error("No private key entered.");
+          process.exit(1);
+        }
+      }
+
       let imported: ethers.Wallet;
       try {
         imported = new ethers.Wallet(privateKey);
@@ -850,8 +877,32 @@ export function registerWalletCommands(program: Command): void {
     .option("--smart-wallet", "Connect via Base Smart Wallet (Coinbase Wallet SDK) instead of WalletConnect")
     .option("--hardware", "Hardware wallet mode: show raw wc: URI only (for Ledger Live, Trezor Suite, etc.)")
     .option("--sponsored", "Use CDP paymaster for gas sponsorship (requires paymasterUrl + cdpKeyName + CDP_PRIVATE_KEY env)")
+    .option("--dry-run", "Simulate the deployment ceremony without sending transactions")
     .action(async (opts) => {
       const config = loadConfig();
+
+      if (opts.dryRun) {
+        const factoryAddr = config.walletFactoryAddress ?? NETWORK_DEFAULTS[config.network]?.walletFactoryAddress ?? "(not configured)";
+        const chainId = config.network === "base-mainnet" ? 8453 : 84532;
+        console.log();
+        console.log(" " + c.dim("── Dry run: wallet deploy ──────────────────────────────────────"));
+        console.log(" " + c.dim("Network:         ") + c.white(config.network));
+        console.log(" " + c.dim("Chain ID:        ") + c.white(String(chainId)));
+        console.log(" " + c.dim("RPC:             ") + c.white(config.rpcUrl));
+        console.log(" " + c.dim("WalletFactory:   ") + c.white(factoryAddr));
+        console.log(" " + c.dim("Signing method:  ") + c.white(opts.smartWallet ? "Base Smart Wallet" : opts.hardware ? "Hardware (WC URI)" : "WalletConnect"));
+        console.log(" " + c.dim("Sponsored:       ") + c.white(opts.sponsored ? "yes" : "no"));
+        console.log();
+        console.log(" " + c.dim("Steps that would run:"));
+        console.log("   1. Connect " + (opts.smartWallet ? "Coinbase Smart Wallet" : "WalletConnect") + " session");
+        console.log("   2. Call WalletFactory.createWallet() → deploy ARC402Wallet");
+        console.log("   3. Save walletContractAddress to config");
+        console.log("   4. Run onboarding ceremony (PolicyEngine, machine key, agent registration)");
+        console.log();
+        console.log(" " + c.dim("No transactions sent (--dry-run mode)."));
+        console.log();
+        return;
+      }
       const factoryAddress = config.walletFactoryAddress ?? NETWORK_DEFAULTS[config.network]?.walletFactoryAddress;
       if (!factoryAddress) {
         console.error("walletFactoryAddress not found in config or NETWORK_DEFAULTS. Add walletFactoryAddress to your config.");

package/src/config.ts

@@ -51,6 +51,10 @@ export interface Arc402Config {
 const CONFIG_DIR = path.join(os.homedir(), ".arc402");
 const CONFIG_PATH = process.env.ARC402_CONFIG || path.join(CONFIG_DIR, "config.json");
 
+// WalletConnect project ID — get your own at cloud.walletconnect.com
+const DEFAULT_WC_PROJECT_ID = "455e9425343b9156fce1428250c9a54a";
+export const getWcProjectId = () => process.env.WC_PROJECT_ID ?? DEFAULT_WC_PROJECT_ID;
+
 export const getConfigPath = () => CONFIG_PATH;
 
 export function loadConfig(): Arc402Config {
@@ -61,7 +65,7 @@ export function loadConfig(): Arc402Config {
     const autoConfig: Arc402Config = {
       network: "base-mainnet",
       rpcUrl: defaults.rpcUrl ?? "https://mainnet.base.org",
-      walletConnectProjectId: "455e9425343b9156fce1428250c9a54a",
+      walletConnectProjectId: getWcProjectId(),
       ownerAddress: undefined,
       policyEngineAddress: defaults.policyEngineAddress,
       trustRegistryAddress: defaults.trustRegistryAddress ?? "",
@@ -77,6 +81,7 @@ export function loadConfig(): Arc402Config {
     };
     saveConfig(autoConfig);
     console.log(`◈ Config auto-created at ${CONFIG_PATH} (Base Mainnet)`);
+    console.log("⚠ Base Mainnet — real funds at risk. Use arc402 config init for testnet.");
     return autoConfig;
   }
   return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8")) as Arc402Config;
@@ -86,6 +91,9 @@ export function saveConfig(config: Arc402Config): void {
   const configDir = path.dirname(CONFIG_PATH);
   fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
   fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });
+  if (config.privateKey) {
+    console.warn("⚠ Private key stored in plaintext at ~/.arc402/config.json");
+  }
 }
 
 export const configExists = () => fs.existsSync(CONFIG_PATH);