kira-wallet 0.2.3 → 1.0.0

package/README.md

@@ -15,7 +15,7 @@ web app to manage wallets, inspect token markets and follow research. Your
 existing AI agent can use the same records and actions through the Kira CLI or
 optional MCP connection, then open the web app beside your conversation.
 
-**Kira 0.2.2 is published on npm; this branch prepares 0.2.3.** Kira supplies wallet tools and a full-window
+Kira supplies wallet tools and a full-window
 management app. Your agent host manages its own conversations, models, files and
 approvals. Kira does not launch a model CLI or require a model login.
 
@@ -29,9 +29,6 @@ npm install -g kira-wallet
 kira setup
 ```
 
-When installing a prepared release before publication, use its verified archive
-instead of assuming the npm default already contains this branch.
-
 1. **Connect Alchemy.** Follow the [setup guide](docs/ALCHEMY_SETUP.md). Run
    `kira connect alchemy` in your terminal and enter the app key at the hidden
    prompt. The key stays in a private local file. Existing environment or file

package/docs/AGENT_TOOLS.md

@@ -1,6 +1,6 @@
 # Kira tools for your agent
 
-Kira 0.2.0 provides one local application contract to the CLI, optional stdio
+Kira provides one local application contract to the CLI, optional stdio
 MCP adapter and human web controls. It supplies wallet logic and saved facts.
 The host agent owns its model, conversation, general tools and approval flow.
 No model process is launched by Kira.

package/docs/CLI.md

@@ -3,7 +3,6 @@
 Kira is a local wallet engine, CLI and web interface. Any capable agent
 can use the CLI; MCP is optional. Your agent host supplies its own model,
 conversation, general tools and approvals. Kira does not start a model process.
-Version 0.2.2 is published on npm. This source prepares 0.2.3.
 
 ## Install and choose a workspace
 
@@ -14,15 +13,13 @@ kira info --json
 kira skill
 ```
 
-Before this version is published, install the prepared package archive to try these
-commands. The default registry install may still provide an earlier version.
 Node.js 22+, Python 3.11+ and a POSIX host are required; macOS is verified.
 The package includes the engine, browser assets and declared dependencies.
 It excludes wallet records, credentials, conversations and logs.
 
 The supported CLI uses `~/.local/share/kira-wallet`, independently of the
 current directory or agent session. `KIRA_DATA_DIR` selects another workspace;
-the equivalent global `--data-dir` must precede the command:
+the equivalent `--data-dir` option also works before or after the command:
 
 ```sh
 kira --data-dir /absolute/private/workspace info --json
@@ -245,6 +242,9 @@ Its optional SDK is `@open-wallet-standard/core` 1.4.3; the vault defaults to
 passphrase in the local interface. Kira does not return private keys or seed
 phrases. Recovery keeps the original passphrase and interrupted requests retain
 their identity to prevent duplicate creation. Use OWS owner tools for backup
-and recovery. Agents must leave passphrase entry to the human. OWS absence
+and recovery. A newly created wallet is registered and linked without starting
+asset research. Use **Refresh holdings** when you want to check its assets.
+Linking an existing, unregistered OWS wallet still starts its initial research.
+Agents must leave passphrase entry to the human. OWS absence
 does not block ordinary public-address onboarding. Kira exposes no signing,
 trading, key export or account deletion.

package/docs/RELEASE.md

@@ -1,6 +1,56 @@
 # Release preparation
 
-## Candidate 0.2.3
+## Release candidate: 1.0.0
+
+The operator selected 1.0.0 on 2026-10-25. Version 0.2.3 remains the published
+package while live acceptance and the final 1.0.0 archive are prepared. This
+candidate keeps the research engine and saved-data formats from 0.2.3.
+
+New OWS wallets are registered and linked without starting asset research.
+Their holdings remain unchecked until an explicit holdings refresh. Linking an
+existing unregistered wallet still starts initial research, and retries recover
+older registration jobs without duplicating or restarting cancelled work.
+The empty wallet screen explains the manual lookup instead of suggesting
+that automatic research is pending. Post-creation navigation waits for saved
+wallet state, and a failed descriptor reload keeps the same recovery request.
+
+The 1.x compatibility commitment covers documented CLI commands and
+options, the shared CLI/MCP tool names and documented request/response fields,
+and access to existing wallets, jobs and saved observations. Incompatible
+changes to these interfaces require a new major version. Compatible additions
+use a minor version; compatible fixes use a patch version. Clients must tolerate
+additional response fields. Observation values, provider availability, coverage,
+prices and UI layout are not fixed by this commitment. Internal Python modules,
+cache files and browser-only endpoints are not a supported integration API.
+
+Live acceptance completed on the published 0.2.3 research engine, which is
+byte-identical to this candidate. It verified preserved upgrade data, price-only
+refresh and immutable history, browser-wallet connection, human-submitted OWS
+creation, disconnect/reconnect and restart persistence. Optional sell analysis
+reached its natural terminal state with all review targets checked and no
+pending market work. Holdings and prior price evidence stayed unchanged.
+Provider coverage gaps and unavailable quotes remain explicit unknowns.
+
+The changed OWS registration flow passed isolated regressions for no automatic
+research, explicit manual refresh, retries, interrupted writes, earlier-version
+job recovery and preserved cancelled jobs. Browser checks with a synthetic
+public descriptor verified the empty account, zero activity jobs and desktop
+and mobile layouts. The OWS key-creation bridge is unchanged from the human
+acceptance. Human grants and passphrases stayed outside the agent; acceptance
+included no signing, trades, funding or key export.
+
+The final source passed 265 engine tests, 70 viewer tests, all JavaScript
+suites, clean package installation and lifecycle checks. The locked dependency
+audit reported zero known vulnerabilities. Tracked-source privacy checks found
+no private content; strict history findings are the previously recorded public
+identity metadata and verified normal CLI merge metadata under the policy below.
+The operator publishes the exact archive frozen from the landed source.
+
+Installation guidance is version-independent so it does not claim that a
+published package is still a candidate. Review not selected for this release
+preparation; existing audit evidence is retained.
+
+## Published 0.2.3
 
 Research and price refresh share the Alchemy index fallback and DEX liquidity
 checks. Insufficient or extremely one-sided DEX liquidity stays unpriced;
@@ -18,7 +68,7 @@ OWS registration retries recover the same admitted job after interrupted
 worker launch or receipt storage, including requests saved by 0.2.2. Previously
 registered wallets keep their names, and cancelled jobs remain cancelled.
 Unused embedded-agent completion parsing is removed. The website setup link
-points to the currently published 0.2.2 guide until the next site update.
+remains pinned to the 0.2.2 guide until the next site update.
 
 One independent review of the four audit PRs found a legacy OWS receipt recovery
 gap, corrected with an upgrade regression. Final verification covers the full
@@ -26,9 +76,18 @@ suite, isolated installation, exact archive members, CLI/MCP price history and
 source/history privacy checks. Synthetic checks do not claim live provider or
 Gemini/Grok account acceptance.
 
-Freeze the final archive from the validated, landed source and dry-run that
-exact archive. Release publication and website deployment remain operator
-actions. Preparation does not establish registry publication.
+The operator published 0.2.3 on 2026-10-25, and the npm `latest` tag resolves
+to this version. Its archive was frozen from the landed merge commit
+`7fcdb5eb13f4b4009e86b9880a4130a50721d233`. The registry archive is byte-identical
+to the frozen one, SHA-256
+`fa9b935e6ec410cb098c5caac11693d70da2da763b710093ced71872b2e15a73`.
+The registry SHA-1 and SHA-512 integrity values also match. A fresh isolated
+registry installation matched all 93 members with no extra package files.
+Installed CLI and MCP price-history checks and local app startup and shutdown
+passed with synthetic data, unchanged saved evidence and no research jobs.
+The personal installation and workspace were not changed. Website deployment
+remains a separate operator action. Review not selected for this
+publication-record update.
 
 ## Published 0.2.2
 
@@ -191,7 +250,7 @@ The earlier unpublished 0.1.2 candidate is preserved in the ignored
 `dist/preserved-0.1.2-bad8f02/` directory. Use the current `dist/release.json`
 and its matching archive for publication; do not mix manifests from candidates.
 
-Keep published GitHub tags, release assets and npm versions through 0.2.2
+Keep published GitHub tags, release assets and npm versions through 0.2.3
 immutable. Do not rebuild them from later documentation commits. Future package
 changes need a new version. Release preparation does not publish a GitHub
 release, promote the website or publish to npm.

package/kira_ows.py

@@ -106,7 +106,17 @@ class OwsStore:
             job=None
             registration_key=str(uuid.uuid5(uuid.UUID(key),'ows-register'))
             # Pre-intent receipts from older versions may already own a queued job.
-            if not registered or receipt.get('registration_requested') or any(j['key_hash']==digest(registration_key) for j in store.list()):
+            pending_registration=receipt.get('registration_requested') or any(j['key_hash']==digest(registration_key) for j in store.list())
+            if create and not pending_registration:
+                address=store.normalize('wallet.add',{'address':address,'tag':tag})['address']
+                from wallet import register, registry_locked
+                with registry_locked(self.root):
+                    registry=json.loads((self.root/'wallets.json').read_text())
+                    registered=next((w for w in registry['wallets'] if w['address_key']==address.lower()),None)
+                    if registered is None:
+                        registered=register(registry,address,tag)
+                        atomic(self.root/'wallets.json',registry)
+            elif not registered or pending_registration:
                 # Record intent before admission: submit can register the wallet
                 # before this process has saved its job ID or started a worker.
                 if not receipt.get('registration_requested'):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kira-wallet",
-  "version": "0.2.3",
+  "version": "1.0.0",
   "description": "Local wallet research for your agent session and a human-controlled web workspace.",
   "license": "MIT",
   "private": false,

package/viewer/static/app.js

@@ -156,7 +156,7 @@ function renderHome(){
   $('wallet-cards').innerHTML=state.wallets.map(w=>{
     const count=w.mainnet_asset_count??w.assets.filter(a=>a.environment==='mainnet').length,unpriced=w.mainnet_unpriced_count??w.unpriced_count;
     const value=w.analysed_at?w.known_value_usd:null;
-    return `<button class="wallet-card" data-wallet="${escapeHTML(w.key)}" aria-label="Open ${escapeHTML(w.name)} holdings"><span class="wallet-card-heading"><span class="card-wallet-icon">${walletGlyph}</span><span class="wallet-card-identity"><strong>${escapeHTML(w.name)}</strong><span>${escapeHTML(shortAddress(w.address))}</span></span><span class="card-arrow" aria-hidden="true">${arrowGlyph}</span></span><span class="wallet-card-value">${money(value)}</span><span class="wallet-card-meta"><span>${w.analysed_at?count+(count===1?' position · ':' positions · ')+unpriced+' unpriced':'Awaiting analysis'}</span><span>${value!=null?share(value,s.known_value_usd)+' of priced value':''}</span></span>${progress(value,s.known_value_usd,w.name+' share of priced value')}</button>`;
+    return `<button class="wallet-card" data-wallet="${escapeHTML(w.key)}" aria-label="Open ${escapeHTML(w.name)} holdings"><span class="wallet-card-heading"><span class="card-wallet-icon">${walletGlyph}</span><span class="wallet-card-identity"><strong>${escapeHTML(w.name)}</strong><span>${escapeHTML(shortAddress(w.address))}</span></span><span class="card-arrow" aria-hidden="true">${arrowGlyph}</span></span><span class="wallet-card-value">${money(value)}</span><span class="wallet-card-meta"><span>${w.analysed_at?count+(count===1?' position · ':' positions · ')+unpriced+' unpriced':'Not checked'}</span><span>${value!=null?share(value,s.known_value_usd)+' of priced value':''}</span></span>${progress(value,s.known_value_usd,w.name+' share of priced value')}</button>`;
   }).join('');
   $('network-allocation').innerHTML=s.networks.map(c=>`<a class="network-row" href="${networkHref(c.id)}" aria-label="Open ${escapeHTML(c.name)} network overview"><div class="network-row-heading"><span class="network-label">${chainIcon(c.name)}${escapeHTML(c.name)}<span class="detail-arrow" aria-hidden="true">${arrowGlyph}</span></span><span class="network-value">${money(c.value_usd)}</span></div><div class="network-row-meta"><span>${c.position_count} ${c.position_count===1?'position':'positions'}${c.value_usd==null?' · Unpriced':''}</span><span>${share(c.value_usd,s.known_value_usd)}</span></div>${progress(c.value_usd,s.known_value_usd,c.name+' share of priced value')}</a>`).join('')||'<p class="panel-empty">Networks appear after analysis.</p>';
   if(typeof renderHomeTokens==='function')renderHomeTokens();
@@ -170,14 +170,14 @@ function renderWallet(){
   $('report-link').hidden=!w.report_url;if(w.report_url)$('report-link').href=safeURL(w.report_url);
   $('total-value').textContent=w.analysed_at?money(w.known_value_usd):'—';
   const partial=w.chains.some(c=>c.environment==='mainnet'&&KiraView.coverageGap(c));
-  $('valuation-note').textContent=w.analysed_at?(partial?'Partial portfolio · ':'')+(w.known_value_usd==null?((w.asset_count??w.assets.length)?'Value is unknown because prices are unavailable.':'No positive holdings recorded · unchecked networks remain unknown.'):'Market and curve spot estimates · excludes unpriced assets'):'Analysis will appear here when it is ready.';
+  $('valuation-note').textContent=w.analysed_at?(partial?'Partial portfolio · ':'')+(w.known_value_usd==null?((w.asset_count??w.assets.length)?'Value is unknown because prices are unavailable.':'No positive holdings recorded · unchecked networks remain unknown.'):'Market and curve spot estimates · excludes unpriced assets'):'No holdings lookup saved yet.';
   $('asset-count').textContent=w.asset_count??w.assets.length;$('unpriced-count').textContent=w.unpriced_count+' unpriced';
   const mainnets=w.chains.filter(c=>c.environment==='mainnet'&&c.lifecycle?.status!=='retired');
   $('chain-count').textContent=mainnets.filter(c=>c.assets>0).length;
   const coverage=mainnets.filter(c=>c.complete).length;
   $('coverage-note').textContent='Token discovery: '+coverage+' of '+mainnets.length+' mainnets checked';
   $('coverage-note').title='Token discovery and on-chain balance checks are separate. See network coverage details for failures.';
-  $('sync-label').textContent=w.analysed_at?'Analysis '+stamp(w.analysed_at):'Awaiting analysis';
+  $('sync-label').textContent=w.analysed_at?'Analysis '+stamp(w.analysed_at):'Not checked';
   $('price-time').textContent=w.prices_at?'Prices '+stamp(w.prices_at):'';
   const chainOptions=w.chains.filter(c=>c.assets>0||KiraView.coverageGap(c));
   if(selectedChain!=='all'&&!chainOptions.some(c=>String(c.id)===selectedChain))selectedChain='all';
@@ -311,7 +311,7 @@ function renderHoldings(){
     const c=w.chains.find(c=>String(c.id)===selectedChain);
     $('empty').querySelector('h3').textContent=c&&!c.complete?'Research is incomplete on '+c.name:'No assets in this view';
     $('empty').querySelector('p').textContent=c&&!c.complete?'This chain has not been fully checked. Missing data does not mean a zero balance.':'Choose another chain or lower the minimum value.';
-  }else{$('empty').querySelector('h3').textContent=w.analysed_at&&!(w.asset_count??w.assets.length)?'No holdings recorded':'No assets in this view';$('empty').querySelector('p').textContent=w.analysed_at?(!(w.asset_count??w.assets.length)?'No positive balances were found in the checked networks. Refresh holdings to check again.':'Choose another chain or lower the minimum value.'):'Analysis will appear here when it is ready.';}
+  }else{$('empty').querySelector('h3').textContent=w.analysed_at&&!(w.asset_count??w.assets.length)?'No holdings recorded':'No assets in this view';$('empty').querySelector('p').textContent=w.analysed_at?(!(w.asset_count??w.assets.length)?'No positive balances were found in the checked networks. Refresh holdings to check again.':'Choose another chain or lower the minimum value.'):'Your wallet is saved. Use Refresh holdings to check its assets.';}
   bindImages();
 }
 function timeRange(range){return range?.from?stamp(range.from)+(range.to!==range.from?' – '+stamp(range.to):''):'Not recorded';}

package/viewer/static/ows.js

@@ -81,8 +81,10 @@ async function submitOws(create, event) {
   try {
     const result = await localAPI(create ? '/api/ows/create' : '/api/ows/connect', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(request), signal: AbortSignal.timeout(75000)});
     delete request.passphrase;
-    owsRequest = null; saveOwsRequest(); owsSelected = null; await loadOws();
-    $('ows-dialog').close(); navigate(result.job_id ? '#/activity' : '#/wallet/'+result.connection.address.toLowerCase());
+    await loadOws(); owsRequest = null; saveOwsRequest(); owsSelected = null;
+    if (!result.job_id) await poll();
+    const address = result.connection.address.toLowerCase();
+    $('ows-dialog').close(); navigate(result.job_id ? '#/activity' : state?.wallets?.some(wallet => wallet.key === address) ? '#/wallet/'+address : '#/home');
     toast(result.note);
   } catch (error) { delete request.passphrase; $('ows-error').textContent = error.message; }
   finally { owsBusy = false; renderOws(); }