arc402-cli 0.9.19 → 0.10.0

package/src/daemon/userops.ts

@@ -1,119 +0,0 @@
-/**
- * UserOperation builder and submitter for the ARC-402 daemon.
- * Wraps protocol calls (accept, fulfill) into ERC-4337 UserOperations.
- */
-import { ethers } from "ethers";
-import { BundlerClient } from "../bundler.js";
-import type { UserOperation } from "../bundler.js";
-import type { DaemonConfig } from "./config.js";
-import { ARC402_WALLET_EXECUTE_ABI } from "../abis.js";
-
-// ServiceAgreement calldata encoders
-const SA_IFACE = new ethers.Interface([
-  "function accept(uint256 agreementId) external",
-  "function fulfill(uint256 agreementId, bytes32 actualDeliverablesHash) external",
-]);
-
-// ARC402Wallet.executeContractCall param type
-const WALLET_EXEC_IFACE = new ethers.Interface(ARC402_WALLET_EXECUTE_ABI as unknown as string[]);
-
-export function encodeWalletCall(
-  target: string,
-  innerCalldata: string,
-  value = BigInt(0)
-): string {
-  return WALLET_EXEC_IFACE.encodeFunctionData("executeContractCall", [{
-    target,
-    data: innerCalldata,
-    value,
-    minReturnValue: BigInt(0),
-    maxApprovalAmount: BigInt(0),
-    approvalToken: ethers.ZeroAddress,
-  }]);
-}
-
-export function buildAcceptCalldata(
-  serviceAgreementAddress: string,
-  agreementId: string,
-  walletAddress: string
-): string {
-  const inner = SA_IFACE.encodeFunctionData("accept", [BigInt(agreementId)]);
-  return encodeWalletCall(serviceAgreementAddress, inner);
-}
-
-export function buildFulfillCalldata(
-  serviceAgreementAddress: string,
-  agreementId: string,
-  deliveryHash: string,
-  walletAddress: string
-): string {
-  const inner = SA_IFACE.encodeFunctionData("fulfill", [BigInt(agreementId), deliveryHash]);
-  return encodeWalletCall(serviceAgreementAddress, inner);
-}
-
-export class UserOpsManager {
-  private bundlerClient: BundlerClient;
-  private provider: ethers.Provider;
-  private config: DaemonConfig;
-
-  constructor(config: DaemonConfig, provider: ethers.Provider) {
-    this.config = config;
-    this.provider = provider;
-
-    const bundlerUrl =
-      config.bundler.endpoint || "https://api.pimlico.io/v2/base/rpc";
-    this.bundlerClient = new BundlerClient(
-      bundlerUrl,
-      config.network.entry_point,
-      config.network.chain_id
-    );
-  }
-
-  async buildUserOp(callData: string, senderWallet: string): Promise<UserOperation> {
-    const entryPointContract = new ethers.Contract(
-      this.config.network.entry_point,
-      ["function getNonce(address sender, uint192 key) external view returns (uint256)"],
-      this.provider
-    );
-    const nonce: bigint = await entryPointContract.getNonce(senderWallet, 0);
-    const feeData = await this.provider.getFeeData();
-    const maxFeePerGas = feeData.maxFeePerGas ?? BigInt(1_000_000_000);
-    const maxPriorityFeePerGas = feeData.maxPriorityFeePerGas ?? BigInt(100_000_000);
-
-    return {
-      sender: senderWallet,
-      nonce: ethers.toBeHex(nonce),
-      callData,
-      callGasLimit: ethers.toBeHex(300_000),
-      verificationGasLimit: ethers.toBeHex(150_000),
-      preVerificationGas: ethers.toBeHex(50_000),
-      maxFeePerGas: ethers.toBeHex(maxFeePerGas),
-      maxPriorityFeePerGas: ethers.toBeHex(maxPriorityFeePerGas),
-      signature: "0x",
-    };
-  }
-
-  async submit(callData: string, senderWallet: string): Promise<string> {
-    const userOp = await this.buildUserOp(callData, senderWallet);
-    return this.bundlerClient.sendUserOperation(userOp);
-  }
-
-  async waitForInclusion(userOpHash: string): Promise<void> {
-    await this.bundlerClient.getUserOperationReceipt(userOpHash);
-  }
-
-  async pingBundler(): Promise<boolean> {
-    try {
-      const bundlerUrl = this.config.bundler.endpoint || "https://api.pimlico.io/v2/base/rpc";
-      const response = await fetch(bundlerUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "eth_chainId", params: [] }),
-        signal: AbortSignal.timeout(5000),
-      });
-      return response.ok;
-    } catch {
-      return false;
-    }
-  }
-}

package/src/daemon/wallet-monitor.ts

@@ -1,90 +0,0 @@
-/**
- * Wallet monitor — verifies wallet contract exists and is operational.
- * Steps 4 and 5 of the daemon startup sequence (Spec 32 §3).
- */
-import { ethers } from "ethers";
-import type { DaemonConfig } from "./config.js";
-import {
-  ARC402_WALLET_GUARDIAN_ABI,
-  ARC402_WALLET_MACHINE_KEY_ABI,
-} from "../abis.js";
-
-export interface WalletStatus {
-  contractAddress: string;
-  ownerAddress: string;
-  isFrozen: boolean;
-  machineKeyAuthorized: boolean;
-  ethBalance: string;
-}
-
-export async function verifyWallet(
-  config: DaemonConfig,
-  provider: ethers.Provider,
-  machineKeyAddress: string
-): Promise<WalletStatus> {
-  const { contract_address, owner_address } = config.wallet;
-
-  // Step 4: Verify wallet contract exists
-  const code = await provider.getCode(contract_address);
-  if (code === "0x") {
-    throw new Error(`No contract at wallet address ${contract_address}`);
-  }
-
-  const guardianContract = new ethers.Contract(
-    contract_address,
-    ARC402_WALLET_GUARDIAN_ABI,
-    provider
-  );
-
-  // Verify owner matches config (if owner_address is set)
-  if (owner_address) {
-    const onChainOwner: string = await guardianContract.owner();
-    if (onChainOwner.toLowerCase() !== owner_address.toLowerCase()) {
-      throw new Error(
-        `Wallet owner mismatch. Config: ${owner_address}, On-chain: ${onChainOwner}`
-      );
-    }
-  }
-
-  const onChainOwner: string = await guardianContract.owner();
-
-  // Step 5: Check wallet is not frozen
-  const frozen: boolean = await guardianContract.frozen();
-  if (frozen) {
-    throw new Error("Wallet is frozen. Daemon cannot operate.");
-  }
-
-  // Check machine key authorization (best effort — v1 wallets may not have registry)
-  let machineKeyAuthorized = false;
-  try {
-    const machineKeyContract = new ethers.Contract(
-      contract_address,
-      ARC402_WALLET_MACHINE_KEY_ABI,
-      provider
-    );
-    machineKeyAuthorized = await machineKeyContract.authorizedMachineKeys(machineKeyAddress);
-  } catch {
-    // v1 wallet may not have machine key registry — policy-based auth, continue
-    machineKeyAuthorized = true;
-  }
-
-  // Get ETH balance
-  const balanceBig = await provider.getBalance(contract_address);
-  const ethBalance = ethers.formatEther(balanceBig);
-
-  return {
-    contractAddress: contract_address,
-    ownerAddress: onChainOwner,
-    isFrozen: false,
-    machineKeyAuthorized,
-    ethBalance,
-  };
-}
-
-export async function getWalletBalance(
-  contractAddress: string,
-  provider: ethers.Provider
-): Promise<string> {
-  const balanceBig = await provider.getBalance(contractAddress);
-  return ethers.formatEther(balanceBig);
-}

package/src/drain-v4.ts

@@ -1,159 +0,0 @@
-/**
- * drain-v4.ts
- * Drains ETH from v4 wallet (0xb4aF8760) to owner (0x7745772d) via WalletConnect.
- * Steps: openContext → attest → executeSpend → closeContext
- */
-import { ethers } from "ethers";
-import { SignClient } from "@walletconnect/sign-client";
-import { KeyValueStorage } from "@walletconnect/keyvaluestorage";
-import { printQR } from "./ui/qr-render.js";
-import path from "path";
-import os from "os";
-import * as fs from "fs";
-
-const V4_WALLET    = "0xb4aF8760d349a6A4C8495Ae4da9089bC84994eE6";
-const OWNER        = "0x7745772d67Cd52c1F38706bF5550AdcD925c7c00";
-const INTENT_ATTEST = "0x7ad8db6C5f394542E8e9658F86C85cC99Cf6D460";
-const CHAIN_ID     = 8453;
-const RPC          = "https://base-mainnet.g.alchemy.com/v2/YIA2uRCsFI-j5pqH-aRzflrACSlV1Qrs";
-
-// Leave 0.00005 ETH for gas
-const DRAIN_AMOUNT = ethers.parseEther("0.00045");
-
-const WALLET_ABI = [
-  "function openContext(bytes32 contextId, string calldata taskType) external",
-  "function attest(bytes32 attestationId, string calldata action, string calldata reason, address recipient, uint256 amount, address token, uint256 expiresAt) external",
-  "function executeSpend(address payable recipient, uint256 amount, string calldata category, bytes32 attestationId) external",
-  "function closeContext() external",
-  "function contextOpen() external view returns (bool)",
-];
-
-const ATTEST_ABI = [
-  "function attest(bytes32 attestationId, string calldata action, string calldata reason, address recipient, uint256 amount, address token, uint256 expiresAt) external",
-];
-
-async function main() {
-  const provider = new ethers.JsonRpcProvider(RPC);
-  const balance = await provider.getBalance(V4_WALLET);
-  console.log(`v4 balance: ${ethers.formatEther(balance)} ETH`);
-
-  if (balance < DRAIN_AMOUNT) {
-    console.error("Insufficient balance");
-    process.exit(1);
-  }
-
-  // Load config for machine key
-  const config = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".arc402/config.json"), "utf8"));
-  const machineKey = new ethers.Wallet(config.privateKey, provider);
-  console.log(`Machine key: ${machineKey.address}`);
-
-  // WalletConnect setup
-  const projectId = config.walletConnectProjectId;
-  const storagePath = path.join(os.homedir(), ".arc402/wc-storage.json");
-  const client = await SignClient.init({
-    projectId,
-    metadata: { name: "ARC-402 Drain v4", description: "Drain v4 wallet ETH to owner", url: "https://app.arc402.xyz", icons: [] },
-    storage: new KeyValueStorage({ database: storagePath }),
-  });
-
-  const { uri, approval } = await client.connect({
-    requiredNamespaces: {
-      eip155: {
-        methods: ["eth_sendTransaction"],
-        chains: [`eip155:${CHAIN_ID}`],
-        events: ["chainChanged", "accountsChanged"],
-      },
-    },
-  });
-
-  console.log("\nScan this QR in MetaMask (make sure you're on Base):\n");
-  printQR(uri!);
-  console.log(`\nMetaMask deep link:\nmetamask://wc?uri=${encodeURIComponent(uri!)}\n`);
-  console.log("Waiting for MetaMask approval...");
-
-  const session = await approval();
-  console.log("✓ MetaMask connected");
-
-  // Build transactions
-  const walletIface = new ethers.Interface(WALLET_ABI);
-  const attestIface = new ethers.Interface(ATTEST_ABI);
-
-  const contextId = ethers.keccak256(ethers.toUtf8Bytes(`drain-${Date.now()}`));
-  const attestationId = ethers.keccak256(ethers.toUtf8Bytes(`attest-${Date.now()}`));
-  const expiry = Math.floor(Date.now() / 1000) + 600; // 10 min
-
-  const account = session.namespaces.eip155.accounts[0].split(":")[2];
-  console.log(`Owner address: ${account}`);
-
-  async function sendTx(to: string, data: string, description: string) {
-    console.log(`\nSending tx: ${description}`);
-    const result = await client.request({
-      topic: session.topic,
-      chainId: `eip155:${CHAIN_ID}`,
-      request: {
-        method: "eth_sendTransaction",
-        params: [{ from: account, to, data, gas: "0x30D40" }],
-      },
-    });
-    console.log(`✓ ${description}: ${result}`);
-    // Wait for confirmation
-    const receipt = await provider.waitForTransaction(result as string, 1, 60000);
-    console.log(`  Confirmed in block ${receipt?.blockNumber}`);
-    return result;
-  }
-
-  // Step 1: close stale context via machine key if needed
-  console.log("\nStep 1: Checking context state...");
-  const walletContract = new ethers.Contract(V4_WALLET, WALLET_ABI, machineKey);
-  const isOpen = await walletContract.contextOpen();
-  if (isOpen) {
-    console.log("  Stale context found — closing it...");
-    const closeTx = await walletContract.closeContext();
-    await closeTx.wait(2);
-    await new Promise(r => setTimeout(r, 3000));
-    console.log(`  ✓ Closed: ${closeTx.hash}`);
-  }
-
-  // Step 2: owner opens context (MetaMask signs — so simulation sees it)
-  console.log("\nStep 2: Owner opens context via MetaMask...");
-  await sendTx(
-    V4_WALLET,
-    new ethers.Interface(WALLET_ABI).encodeFunctionData("openContext", [contextId, "drain"]),
-    "Open context"
-  );
-
-  // Step 3: call attest() directly on wallet (onlyOwnerOrMachineKey — no executeContractCall needed)
-  const walletIface2 = new ethers.Interface(WALLET_ABI);
-  await sendTx(
-    V4_WALLET,
-    walletIface2.encodeFunctionData("attest", [
-      attestationId,
-      "spend",
-      "drain v4 to owner",
-      OWNER,
-      DRAIN_AMOUNT,
-      ethers.ZeroAddress,
-      expiry,
-    ]),
-    "Create spend attestation"
-  );
-
-  // Step 4: machine key executes spend
-  console.log("\nStep 4: Executing spend (machine key)...");
-  const spendTx = await walletContract.executeSpend(OWNER, DRAIN_AMOUNT, "general", attestationId);
-  await spendTx.wait();
-  console.log(`✓ ETH sent to owner: ${spendTx.hash}`);
-
-  // Step 4: close context
-  const closeTx = await walletContract.closeContext();
-  await closeTx.wait();
-  console.log(`✓ Context closed: ${closeTx.hash}`);
-
-  const newBalance = await provider.getBalance(V4_WALLET);
-  console.log(`\nv4 remaining balance: ${ethers.formatEther(newBalance)} ETH`);
-  console.log(`Done. ${ethers.formatEther(DRAIN_AMOUNT)} ETH sent to ${OWNER}`);
-
-  process.exit(0);
-}
-
-main().catch(e => { console.error(e); process.exit(1); });

package/src/endpoint-config.ts

@@ -1,83 +0,0 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-
-export const ARC402_DIR = path.join(os.homedir(), ".arc402");
-export const ENDPOINT_CONFIG_PATH = path.join(ARC402_DIR, "endpoint.json");
-export const DEFAULT_LOCAL_INGRESS_TARGET = "http://127.0.0.1:4402";
-export const DEFAULT_TUNNEL_MODE = "host-cloudflared" as const;
-
-export interface EndpointConfig {
-  version: 1;
-  agentName: string;
-  hostname: string;
-  publicUrl: string;
-  localIngressTarget: string;
-  tunnelMode: "host-cloudflared";
-  tunnelTarget?: string;
-  walletAddress?: string;
-  subdomainApi?: string;
-  notes?: string;
-  claimedAt?: string;
-  updatedAt: string;
-}
-
-export function endpointConfigExists(): boolean {
-  return fs.existsSync(ENDPOINT_CONFIG_PATH);
-}
-
-export function loadEndpointConfig(): EndpointConfig | null {
-  if (!endpointConfigExists()) return null;
-  try {
-    return JSON.parse(fs.readFileSync(ENDPOINT_CONFIG_PATH, "utf-8")) as EndpointConfig;
-  } catch {
-    return null;
-  }
-}
-
-export function saveEndpointConfig(config: EndpointConfig): void {
-  fs.mkdirSync(ARC402_DIR, { recursive: true, mode: 0o700 });
-  fs.writeFileSync(ENDPOINT_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
-}
-
-export function normalizeAgentName(value: string): string {
-  return value.trim().toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-}
-
-export function buildHostname(agentName: string): string {
-  return `${normalizeAgentName(agentName)}.arc402.xyz`;
-}
-
-export function buildPublicUrl(hostname: string): string {
-  return `https://${hostname}`;
-}
-
-export function buildEndpointConfig(input: {
-  agentName: string;
-  localIngressTarget?: string;
-  tunnelMode?: "host-cloudflared";
-  tunnelTarget?: string;
-  walletAddress?: string;
-  subdomainApi?: string;
-  notes?: string;
-  claimedAt?: string;
-  existing?: EndpointConfig | null;
-}): EndpointConfig {
-  const normalizedName = normalizeAgentName(input.agentName);
-  const hostname = buildHostname(normalizedName);
-  const now = new Date().toISOString();
-  return {
-    version: 1,
-    agentName: normalizedName,
-    hostname,
-    publicUrl: buildPublicUrl(hostname),
-    localIngressTarget: input.localIngressTarget ?? input.existing?.localIngressTarget ?? DEFAULT_LOCAL_INGRESS_TARGET,
-    tunnelMode: input.tunnelMode ?? input.existing?.tunnelMode ?? DEFAULT_TUNNEL_MODE,
-    tunnelTarget: input.tunnelTarget ?? input.existing?.tunnelTarget,
-    walletAddress: input.walletAddress ?? input.existing?.walletAddress,
-    subdomainApi: input.subdomainApi ?? input.existing?.subdomainApi,
-    notes: input.notes ?? input.existing?.notes,
-    claimedAt: input.claimedAt ?? input.existing?.claimedAt,
-    updatedAt: now,
-  };
-}

package/src/endpoint-notify.ts

@@ -1,134 +0,0 @@
-/**
- * Shared endpoint-notify helper for CLI commands.
- * Resolves an agent's registered HTTP endpoint from AgentRegistry
- * and POSTs lifecycle events after onchain transactions.
- */
-import { ethers } from "ethers";
-import { AGENT_REGISTRY_ABI } from "./abis.js";
-import * as dns from "dns/promises";
-
-export const DEFAULT_REGISTRY_ADDRESS = "0xD5c2851B00090c92Ba7F4723FB548bb30C9B6865";
-
-// ─── SSRF protection ──────────────────────────────────────────────────────────
-
-const RFC1918_RANGES = [
-  // 10.0.0.0/8
-  (n: number) => (n >>> 24) === 10,
-  // 172.16.0.0/12
-  (n: number) => (n >>> 24) === 172 && ((n >>> 16) & 0xff) >= 16 && ((n >>> 16) & 0xff) <= 31,
-  // 192.168.0.0/16
-  (n: number) => (n >>> 24) === 192 && ((n >>> 16) & 0xff) === 168,
-];
-
-function ipToInt(ip: string): number {
-  return ip.split(".").reduce((acc, octet) => (acc << 8) | parseInt(octet, 10), 0) >>> 0;
-}
-
-function isPrivateIp(ip: string): boolean {
-  // IPv6 non-loopback — block (only allow ::1)
-  if (ip.includes(":")) {
-    return ip !== "::1";
-  }
-  const n = ipToInt(ip);
-  // Loopback 127.0.0.0/8
-  if ((n >>> 24) === 127) return true;
-  // Link-local 169.254.0.0/16 (includes AWS metadata 169.254.169.254)
-  if ((n >>> 24) === 169 && ((n >>> 16) & 0xff) === 254) return true;
-  return RFC1918_RANGES.some((fn) => fn(n));
-}
-
-/**
- * Validates that an endpoint URL is safe to connect to (SSRF protection).
- * Allows HTTPS (any host) and HTTP only for localhost/127.0.0.1.
- * Blocks RFC 1918, link-local, loopback non-localhost, and AWS metadata IPs.
- */
-export async function validateEndpointUrl(endpoint: string): Promise<void> {
-  let parsed: URL;
-  try {
-    parsed = new URL(endpoint);
-  } catch {
-    throw new Error(`Invalid endpoint URL: ${endpoint}`);
-  }
-
-  const { protocol, hostname } = parsed;
-  const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-
-  if (protocol !== "https:" && !(protocol === "http:" && isLocalhost)) {
-    throw new Error(`Endpoint must use HTTPS (or HTTP for localhost). Got: ${endpoint}`);
-  }
-
-  // Resolve hostname and check resolved IPs
-  if (!isLocalhost) {
-    let addresses: string[];
-    try {
-      addresses = await dns.resolve(hostname);
-    } catch {
-      // If DNS fails, let the fetch fail naturally; don't block
-      return;
-    }
-    for (const addr of addresses) {
-      if (isPrivateIp(addr)) {
-        throw new Error(`Endpoint resolves to a private/reserved IP (${addr}) — blocked for security`);
-      }
-    }
-  }
-}
-
-/**
- * Reads an agent's public HTTP endpoint from AgentRegistry.
- * Returns empty string if not registered or no endpoint.
- */
-export async function resolveAgentEndpoint(
-  address: string,
-  provider: ethers.Provider,
-  registryAddress = DEFAULT_REGISTRY_ADDRESS
-): Promise<string> {
-  const registry = new ethers.Contract(registryAddress, AGENT_REGISTRY_ABI, provider);
-  const agentData = await registry.getAgent(address);
-  let endpoint = (agentData.endpoint as string) ?? "";
-  // Normalize: prepend https:// if no protocol specified
-  if (endpoint && !endpoint.startsWith("http://") && !endpoint.startsWith("https://")) {
-    endpoint = "https://" + endpoint;
-  }
-  return endpoint;
-}
-
-/**
- * POSTs JSON payload to {endpoint}{path}. Returns true on success.
- * Never throws — logs a warning on failure.
- * Validates endpoint URL for SSRF before connecting.
- * If signingKey is provided, signs the payload and adds X-ARC402-Signature / X-ARC402-Signer headers.
- */
-export async function notifyAgent(
-  endpoint: string,
-  path: string,
-  payload: Record<string, unknown>,
-  signingKey?: string
-): Promise<boolean> {
-  if (!endpoint) return false;
-  try {
-    await validateEndpointUrl(endpoint);
-  } catch (err) {
-    console.warn(`Warning: endpoint notify blocked (${endpoint}${path}): ${err instanceof Error ? err.message : String(err)}`);
-    return false;
-  }
-  try {
-    const body = JSON.stringify(payload);
-    const headers: Record<string, string> = { "Content-Type": "application/json" };
-    if (signingKey) {
-      const wallet = new ethers.Wallet(signingKey);
-      const signature = await wallet.signMessage(body);
-      headers["X-ARC402-Signature"] = signature;
-      headers["X-ARC402-Signer"] = wallet.address;
-    }
-    const res = await fetch(`${endpoint}${path}`, {
-      method: "POST",
-      headers,
-      body,
-    });
-    return res.ok;
-  } catch (err) {
-    console.warn(`Warning: endpoint notify failed (${endpoint}${path}): ${err instanceof Error ? err.message : String(err)}`);
-    return false;
-  }
-}

package/src/index.ts

@@ -1,74 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from "node:module";
-import { createProgram } from "./program.js";
-import { startREPL } from "./repl.js";
-import { configExists, loadConfig, saveConfig } from "./config.js";
-
-// ── Upgrade safety check ────────────────────────────────────────────────────
-const _require = createRequire(import.meta.url);
-const currentVersion: string = (_require("../package.json") as { version: string }).version;
-
-function checkUpgrade(): void {
-  if (!configExists()) return;
-  if (process.env.ARC402_CHILD) return; // suppress when spawned as TUI child process
-  try {
-    const config = loadConfig();
-    const prev = config.lastCliVersion;
-    if (prev && prev !== currentVersion) {
-      // Compare semver loosely — just print if different
-      console.log(`◈ Upgraded from ${prev} → ${currentVersion}`);
-    }
-    if (config.lastCliVersion !== currentVersion) {
-      // Never overwrite existing fields — only update lastCliVersion
-      saveConfig({ ...config, lastCliVersion: currentVersion });
-    }
-  } catch {
-    // Never crash on upgrade check
-  }
-}
-
-const printMode = process.argv.includes("--print");
-
-// Detect if a subcommand was provided (any arg after the binary that doesn't start with -)
-const knownSubcommands = (() => {
-  try {
-    const prog = createProgram();
-    return new Set(prog.commands.map((cmd) => cmd.name()));
-  } catch {
-    return new Set<string>();
-  }
-})();
-const argv = process.argv.slice(2).filter((a) => a !== "--print");
-const hasSubcommand = argv.some((a) => !a.startsWith("-") && knownSubcommands.has(a));
-
-if (printMode) {
-  // --print mode: skip REPL entirely, suppress ANSI/spinners, run command, exit.
-  // Used by OpenClaw agents running arc402 commands via ACP.
-  process.argv = process.argv.filter((a) => a !== "--print");
-  process.env["NO_COLOR"] = "1";
-  process.env["FORCE_COLOR"] = "0";
-  process.env["ARC402_PRINT"] = "1";
-  checkUpgrade();
-  const program = createProgram();
-  void program.parseAsync(process.argv).then(() => process.exit(0)).catch((e: unknown) => {
-    console.error(e instanceof Error ? e.message : String(e));
-    process.exit(1);
-  });
-} else if (process.stdout.isTTY && !hasSubcommand && process.argv.length <= 2 && !process.env.ARC402_NO_TUI) {
-  // TTY with no subcommand — launch Ink TUI
-  checkUpgrade();
-  void import("./tui/index.js").then(({ launchTUI }) => launchTUI()).catch((e: unknown) => {
-    console.error("TUI failed to start:", e instanceof Error ? e.message : String(e));
-    // Fallback to REPL
-    void startREPL();
-  });
-} else if (process.argv.length <= 2) {
-  // No subcommand, not TTY — enter basic REPL fallback
-  checkUpgrade();
-  void startREPL();
-} else {
-  // One-shot mode — arc402 wallet deploy still works as usual
-  checkUpgrade();
-  const program = createProgram();
-  program.parse(process.argv);
-}