mnemospark 1.1.0 → 1.2.1

package/dist/index.js

@@ -202,6 +202,10 @@ var PROXY_PORT = (() => {
   return DEFAULT_PORT;
 })();
 var MNEMOSPARK_BACKEND_API_BASE_URL = (process.env.MNEMOSPARK_BACKEND_API_BASE_URL ?? "").trim();
+var MNEMOSPARK_PROXY_VERBOSE_404 = (() => {
+  const v = process.env.MNEMOSPARK_PROXY_VERBOSE_404?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+})();
 
 // src/mnemospark-request-sign.ts
 import { getAddress } from "viem";
@@ -1778,8 +1782,15 @@ async function readProxyJsonBody(req) {
   }
   return JSON.parse(bodyText);
 }
+function createJsonResponseHeaders() {
+  return {
+    "Content-Type": "application/json",
+    "X-Content-Type-Options": "nosniff",
+    "Cache-Control": "no-store"
+  };
+}
 function sendJson(res, status, body) {
-  res.writeHead(status, { "Content-Type": "application/json" });
+  res.writeHead(status, createJsonResponseHeaders());
   res.end(JSON.stringify(body));
 }
 function logProxyEvent(level, event, fields = {}) {
@@ -1839,7 +1850,9 @@ function isAlreadySettledConflict(status, bodyText) {
 }
 function createBackendForwardHeaders(response) {
   const responseHeaders = {
-    "Content-Type": response.contentType
+    "Content-Type": response.contentType,
+    "X-Content-Type-Options": "nosniff",
+    "Cache-Control": "no-store"
   };
   if (response.paymentRequired) {
     responseHeaders["PAYMENT-REQUIRED"] = response.paymentRequired;
@@ -1877,6 +1890,10 @@ function createWalletRequiredBody() {
     message: "wallet required for storage endpoints"
   });
 }
+function sendWalletRequired(res) {
+  res.writeHead(400, createJsonResponseHeaders());
+  res.end(createWalletRequiredBody());
+}
 function getProxyPort() {
   return PROXY_PORT;
 }
@@ -1976,6 +1993,18 @@ async function startProxy(options) {
         }
         correlation.wallet_address = requestPayload.wallet_address;
         correlation.object_id = requestPayload.object_id;
+        if (requestPayload.wallet_address.toLowerCase() !== proxyWalletAddressLower) {
+          logProxyEvent("warn", "proxy_price_storage_wallet_mismatch", {
+            request_wallet: requestPayload.wallet_address,
+            proxy_wallet: account.address
+          });
+          emitProxyTerminalFromStatus(correlation, 403, { reason: "wallet_mismatch" });
+          sendJson(res, 403, {
+            error: "wallet_proof_invalid",
+            message: "wallet proof invalid"
+          });
+          return;
+        }
         emitProxyEvent("storage.call", "start", correlation, { target: "price-storage" });
         const walletSignature = await createBackendWalletSignature(
           "POST",
@@ -1984,8 +2013,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_price_storage_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2134,8 +2162,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_payment_settle_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2243,8 +2270,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_upload_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2291,8 +2317,7 @@ async function startProxy(options) {
         );
         if (!settleWalletSignature) {
           logProxyEvent("warn", "proxy_upload_settle_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "settle_signature_missing" });
           return;
         }
@@ -2432,8 +2457,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_upload_confirm_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2527,8 +2551,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_ls_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2622,8 +2645,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_download_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2739,8 +2761,7 @@ async function startProxy(options) {
         );
         if (!walletSignature) {
           logProxyEvent("warn", "proxy_delete_wallet_signature_missing");
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(createWalletRequiredBody());
+          sendWalletRequired(res);
           emitProxyTerminalFromStatus(correlation, 400, { reason: "wallet_signature_missing" });
           return;
         }
@@ -2810,10 +2831,14 @@ async function startProxy(options) {
       sendJson(res, 200, response);
       return;
     }
-    sendJson(res, 404, {
-      error: "Not found",
-      message: "Supported paths: /health and /mnemospark/* storage endpoints"
-    });
+    if (MNEMOSPARK_PROXY_VERBOSE_404) {
+      sendJson(res, 404, {
+        error: "Not found",
+        message: "Supported paths: /health and /mnemospark/* storage endpoints"
+      });
+    } else {
+      sendJson(res, 404, { error: "Not found" });
+    }
   });
   const tryListen = (attempt) => {
     return new Promise((resolveAttempt, rejectAttempt) => {
@@ -3014,6 +3039,15 @@ var USER_AGENT = `mnemospark/${VERSION}`;
 import { existsSync, readFileSync } from "fs";
 import { privateKeyToAccount as privateKeyToAccount6 } from "viem/accounts";
 
+// src/cloud-help-onboarding.ts
+var CLOUD_ONBOARDING_BLOCK_LINES = [
+  "",
+  "Start here to securely upload a file and we'll guide you along the way. Copy the line below and replace <file|directory> with the file or directory you'd like to save to the cloud and replace <friendly-name> with an easy to remember name.",
+  "",
+  "`/mnemospark cloud backup <file|directory> name:<friendly-name> async:true`",
+  ""
+];
+
 // src/cloud-command.ts
 import { spawn } from "child_process";
 import {
@@ -4261,7 +4295,7 @@ function expandTilde(path) {
 }
 var CLOUD_HELP_TEXT = [
   "\u2601\uFE0F **mnemospark - Wallet and go.** \u{1F499}",
-  "",
+  ...CLOUD_ONBOARDING_BLOCK_LINES,
   "**Syntax:** use `/mnemospark cloud \u2026`. Prefer `key:value` for arguments; `key=value` and `--key value` are also accepted. Optional verbose markers: `cloud:true`, `price-storage:true`, etc. Aliases: `wallet:` \u2192 wallet-address, `object:` \u2192 object-id, `quote:` \u2192 quote-id, `hash:` \u2192 object-id-hash.",
   "",
   "**Cloud Commands**",
@@ -7359,17 +7393,21 @@ operation-id: ${operationId}`,
 // src/mnemospark-handler.ts
 var MNEMOSPARK_ROOT_HELP_TEXT = [
   "\u2601\uFE0F **mnemospark - Wallet and go.** \u{1F499}",
+  ...CLOUD_ONBOARDING_BLOCK_LINES,
+  "To view the full help menu use these commands:",
   "",
-  "**Syntax:** `/mnemospark cloud \u2026` or `/mnemospark wallet \u2026`",
-  "Arguments may use `key:value`, `key=value`, or `--key value`. Optional verbose markers: `cloud:true`, `price-storage:true`, etc. (same as bare words).",
-  "Aliases include `wallet:` \u2192 wallet-address, `object:` \u2192 object-id, `quote:` \u2192 quote-id (see `/mnemospark cloud help`).",
-  "",
-  "**Cloud storage** \u2014 full reference:",
+  "**Cloud storage**",
   "\u2022 `/mnemospark cloud help`",
   "",
-  "**Wallet** \u2014 status:",
+  "**Wallet status and funding link:**",
   "\u2022 `/mnemospark wallet`",
-  "\u2022 `/mnemospark wallet help` \u2014 commands and funding link"
+  "\u2022 `/mnemospark wallet help`",
+  "",
+  "**Let your agent run mnemospark for you:**",
+  "",
+  "mnemospark installs as an OpenClaw extension under `~/.openclaw/extensions/mnemospark/`. Point your agent at the bundled skill:",
+  "",
+  "Install the mnemospark skill available at `~/.openclaw/extensions/mnemospark/skills/mnemospark/SKILL.md`"
 ].join("\n");
 var MNEMOSPARK_WALLET_HELP_TEXT = (address) => [
   "\u2601\uFE0F **mnemospark Wallet**",