nansen-cli 1.11.2 → 1.12.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.12.0
+
+### Minor Changes
+
+- [#207](https://github.com/nansen-ai/nansen-cli/pull/207) [`73ca500`](https://github.com/nansen-ai/nansen-cli/commit/73ca5009c03ad541673165ca6b50f33ff4cc1673) Thanks [@TimNooren](https://github.com/TimNooren)! - Add --unsafe-no-password flag to wallet create for agent-friendly passwordless wallets.
+
+### Patch Changes
+
+- [#212](https://github.com/nansen-ai/nansen-cli/pull/212) [`726c29d`](https://github.com/nansen-ai/nansen-cli/commit/726c29d2676c8a37772299c6237b44890493dfa5) Thanks [@0xlaveen](https://github.com/0xlaveen)! - Clarify empty input handling in parseAddressList with explicit early return
+
+- [#218](https://github.com/nansen-ai/nansen-cli/pull/218) [`8c4dd71`](https://github.com/nansen-ai/nansen-cli/commit/8c4dd71ce215026e149a6b097540c46622f13d3a) Thanks [@TimNooren](https://github.com/TimNooren)! - fix: `nansen changelog --since <version>` now correctly filters changeset-format entries (## x.y.z) in addition to Keep a Changelog entries (## [x.y.z])
+
+- [#209](https://github.com/nansen-ai/nansen-cli/pull/209) [`a6dc1ed`](https://github.com/nansen-ai/nansen-cli/commit/a6dc1ed9dc40ad3506e7debe09746d463a70c14d) Thanks [@0xlaveen](https://github.com/0xlaveen)! - fix: prevent --help from executing destructive commands (logout, schema, cache)
+
 ## 1.11.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nansen-cli",
-  "version": "1.11.2",
+  "version": "1.12.0",
   "description": "Command-line interface for Nansen API - designed for AI agents",
   "main": "src/index.js",
   "type": "module",

package/src/api.js

@@ -582,7 +582,9 @@ export class NansenAPI {
                     // No API key and no payment wallet — guide the user to login rather than
                     // showing a confusing x402 payment dump they can't act on.
                     // TODO: full fix would skip x402 entirely when no apiKey is set — see PR #<this PR number>
-                    message = 'No API key configured. Run: nansen login --api-key <key>. Get your key at https://app.nansen.ai/api';
+                    message = 'No API key configured. Two ways to authenticate:\n' +
+                      '  1. API key: nansen login --api-key <key> (get key at https://app.nansen.ai/api)\n' +
+                      '  2. x402 micropayment: nansen wallet create + fund with USDC (no API key needed)';
                   } else {
                     message = `x402 auto-payment failed: ${x402Err.message}`;
                   }

package/src/cli.js

@@ -439,6 +439,37 @@ async function enrichTransfers(result, apiInstance, chain) {
   return result;
 }
 
+// ============= Address Parsing =============
+
+/**
+ * Parse an --addresses option that may arrive as:
+ *  - a pre-parsed array (arg parser split it)
+ *  - a JSON array string: '["0x…","0x…"]'
+ *  - a comma-separated string: "0x…,0x…"
+ * Non-array JSON values (objects, numbers, booleans) are rejected.
+ */
+export function parseAddressList(raw) {
+  if (Array.isArray(raw)) {
+    return raw.map(a => String(a).trim()).filter(Boolean);
+  }
+  if (!raw) return [];
+
+  const s = String(raw);
+  try {
+    const parsed = JSON.parse(s);
+    if (Array.isArray(parsed)) {
+      return parsed.map(a => String(a).trim()).filter(Boolean);
+    }
+    throw new NansenError(
+      '--addresses must be a comma-separated list or JSON array, got: ' + typeof parsed,
+      ErrorCode.INVALID_PARAMS
+    );
+  } catch (e) {
+    if (e instanceof NansenError) throw e;
+    return s.split(',').map(a => a.trim()).filter(Boolean);
+  }
+}
+
 // ============= Composite Functions =============
 
 export async function batchProfile(api, params = {}) {
@@ -644,7 +675,7 @@ EXAMPLES:
   nansen research profiler balance --address 0x... --chain ethereum
   nansen trade quote --chain base --from ETH --to USDC --amount 1
 
-Research chains: ethereum, solana, base, bnb, arbitrum, polygon, optimism, avalanche, linea, scroll, mantle, ronin, sei, plasma, sonic, monad, hyperevm, iotaevm
+Research chains: ethereum, solana, base, bnb, arbitrum, polygon, optimism, avalanche, linea, scroll, zksync, mantle, ronin, sei, plasma, sonic, unichain, monad, hyperevm, iotaevm
 Trade chains: solana, base
 Labels: Fund, Smart Trader, 30D/90D/180D Smart Trader, Smart HL Perps Trader
 
@@ -780,6 +811,10 @@ export function buildCommands(deps = {}) {
     },
 
     'changelog': async (_args, _apiInstance, _flags, _options) => {
+      if (_flags.help || _flags.h) {
+        log('changelog — Show release history\n\nUsage:\n  nansen changelog [--since <version>]\n\nOptions:\n  --since <version>   Show only entries for versions >= this version\n\nExamples:\n  nansen changelog\n  nansen changelog --since 1.10.0');
+        return;
+      }
       const changelogPath = new URL('../CHANGELOG.md', import.meta.url).pathname;
       let content;
       try {
@@ -795,10 +830,10 @@ export function buildCommands(deps = {}) {
         const filtered = [];
         let include = false;
         for (const line of lines) {
-          // Match ## [x.y.z] headers
-          const match = line.match(/^## \[(\d+\.\d+\.\d+)\]/);
+          // Match ## [x.y.z] (Keep a Changelog format) or ## x.y.z (changeset format)
+          const match = line.match(/^## \[(\d+\.\d+\.\d+)\]|^## (\d+\.\d+\.\d+)\b/);
           if (match) {
-            const ver = match[1];
+            const ver = match[1] || match[2];
             // Compare: include versions >= since, stop at versions < since
             if (compareSemver(ver, since) >= 0) {
               include = true;
@@ -945,7 +980,7 @@ export function buildCommands(deps = {}) {
         'batch': () => {
           let addresses = [];
           if (options.addresses) {
-            addresses = options.addresses.split(',').map(a => a.trim()).filter(Boolean);
+            addresses = parseAddressList(options.addresses);
           } else if (options.file) {
             const content = fs.readFileSync(options.file, 'utf8');
             try {
@@ -976,13 +1011,13 @@ export function buildCommands(deps = {}) {
           return traceCounterparties(apiInstance, { address, chain, depth, width, days, delayMs });
         },
         'compare': () => {
-          const addrs = (options.addresses || '').split(',').map(a => a.trim()).filter(Boolean);
+          const addrs = parseAddressList(options.addresses);
           return compareWallets(apiInstance, { addresses: addrs, chain, days });
         },
         'help': () => ({
           commands: ['balance', 'labels', 'transactions', 'pnl', 'search', 'historical-balances', 'related-wallets', 'counterparties', 'pnl-summary', 'perp-positions', 'perp-trades', 'batch', 'trace', 'compare'],
           description: 'Wallet profiling endpoints',
-          example: 'nansen profiler balance --address 0x123... --chain ethereum'
+          example: 'nansen research profiler compare --addresses "0xABC...,0xDEF..." --chain ethereum'
         })
       };
 
@@ -1294,7 +1329,8 @@ export function generateSubcommandHelp(command, subcommand) {
 
   const exampleValues = { address: '0x...', token: '0x...', query: '"term"', symbol: 'BTC', date: '2024-01-01' };
   const chain = subSchema.options?.chain?.default || 'solana';
-  let example = `nansen ${command} ${subcommand}`;
+  const prefix = DEPRECATED_TO_RESEARCH.has(command) ? `research ${command}` : command;
+  let example = `nansen ${prefix} ${subcommand}`;
   if (subSchema.options) {
     for (const [name, opt] of Object.entries(subSchema.options)) {
       if (opt.required) example += ` --${name} ${exampleValues[name] || '<val>'}`;
@@ -1408,6 +1444,20 @@ export async function runCLI(rawArgs, deps = {}) {
         return { type: 'command-help', command };
       }
     }
+    // Simple commands (logout, schema, cache) — show help instead of executing
+    // Prevents destructive commands like logout from running when user just wants help
+    if (commands[command]) {
+      const simpleHelp = {
+        'logout': 'nansen logout — Remove saved API key from ~/.nansen/config.json',
+        'schema': 'nansen schema [command] [--pretty] — Show JSON schema for all commands (or a specific command)',
+        'cache':  'nansen cache clear — Clear the API response cache',
+      };
+      if (simpleHelp[command]) {
+        output(simpleHelp[command]);
+        notify();
+        return { type: 'command-help', command };
+      }
+    }
     // Commands with handlers (e.g. quote, execute) show their own usage
     if (command === 'help' || !commands[command]) {
       output(BANNER + HELP);

package/src/schema.json

@@ -1622,7 +1622,7 @@
             },
             "wallet": {
               "type": "string",
-              "description": "Wallet name (or \"walletconnect\"/\"wc\" for WalletConnect, EVM only). A configured wallet is required — run `nansen wallet create` if you haven't set one up yet."
+              "description": "Wallet name (or \"walletconnect\"/\"wc\" for WalletConnect, EVM only). A configured wallet is required \u2014 run `nansen wallet create` if you haven't set one up yet."
             }
           },
           "prerequisites": [
@@ -1692,11 +1692,13 @@
     "avalanche",
     "linea",
     "scroll",
+    "zksync",
     "mantle",
     "ronin",
     "sei",
     "plasma",
     "sonic",
+    "unichain",
     "monad",
     "hyperevm",
     "iotaevm"

package/src/trading.js

@@ -8,7 +8,7 @@
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
-import { exportWallet, getDefaultAddress, showWallet, listWallets } from './wallet.js';
+import { exportWallet, getDefaultAddress, showWallet, listWallets, getWalletConfig } from './wallet.js';
 import { base58Decode } from './transfer.js';
 import { keccak256, signSecp256k1, rlpEncode } from './crypto.js';
 import { getWalletConnectAddress, sendTransactionViaWalletConnect, sendApprovalViaWalletConnect } from './walletconnect-trading.js';
@@ -957,7 +957,10 @@ EXAMPLES:
         let exported = null;
         if (!isWalletConnect) {
           // Get wallet credentials once (before the loop)
-          const password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
+          const walletConfig = getWalletConfig();
+          const password = walletConfig.passwordHash
+            ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
+            : null;
 
           let effectiveWalletName = walletName;
           if (!effectiveWalletName) {

package/src/transfer.js

@@ -590,7 +590,7 @@ export async function sendTokens({ to, amount, chain, token = null, wallet = nul
   }
 
   const config = getWalletConfig();
-  if (!verifyPassword(password, config)) throw new Error('Incorrect password');
+  if (config.passwordHash && !verifyPassword(password, config)) throw new Error('Incorrect password');
 
   const walletName = wallet || config.defaultWallet;
   if (!walletName) throw new Error('No wallet specified and no default wallet set');

package/src/wallet.js

@@ -58,6 +58,10 @@ function deriveKey(password, salt) {
  * Returns a JSON-serializable object with all params needed for decryption.
  */
 export function encryptKey(privateKeyHex, password) {
+  if (password === null) {
+    return { data: privateKeyHex, encrypted: false };
+  }
+
   const salt = crypto.randomBytes(SALT_LEN);
   const iv = crypto.randomBytes(IV_LEN);
   const key = deriveKey(password, salt);
@@ -79,10 +83,31 @@ export function encryptKey(privateKeyHex, password) {
 
 /**
  * Decrypt a private key with a password.
- * @returns {string} Private key hex string
- * @throws {Error} If password is wrong
+ * For unencrypted wallets (encrypted: false), password is ignored and
+ * plaintext data is returned directly.
  */
 export function decryptKey(encryptedData, password) {
+  const ENCRYPTED_FIELDS = ['salt', 'iv', 'authTag', 'ciphertext'];
+  const hasEncryptionFields = ENCRYPTED_FIELDS.some(f => f in encryptedData);
+
+  // Unencrypted blob
+  if (encryptedData.encrypted === false) {
+    if (hasEncryptionFields) {
+      throw new Error('Wallet data corrupted or tampered');
+    }
+    return encryptedData.data;
+  }
+
+  // Encrypted blob with missing fields
+  if (!ENCRYPTED_FIELDS.every(f => f in encryptedData)) {
+    throw new Error('Wallet data corrupted or tampered');
+  }
+
+  // Encrypted blob but no password provided
+  if (password === null || password === undefined) {
+    throw new Error('Wallet is encrypted. Set NANSEN_WALLET_PASSWORD.');
+  }
+
   const salt = Buffer.from(encryptedData.salt, 'hex');
   const iv = Buffer.from(encryptedData.iv, 'hex');
   const authTag = Buffer.from(encryptedData.authTag, 'hex');
@@ -214,6 +239,7 @@ function getWalletFile(name) {
  */
 export function verifyPassword(password, config) {
   if (!config.passwordHash) return true; // No password set yet
+  if (password === null || password === undefined) return false;
   const { salt, hash } = config.passwordHash;
   const derived = crypto.scryptSync(password, Buffer.from(salt, 'hex'), 32, {
     N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 256 * 1024 * 1024,
@@ -308,11 +334,22 @@ export function createWallet(name, password) {
     throw new Error(`Wallet "${name}" already exists`);
   }
 
-  // If this is the first wallet, set the password hash
-  if (!config.passwordHash) {
-    config.passwordHash = hashPassword(password);
+  if (password === null) {
+    // Passwordless mode: reject if existing wallets are encrypted
+    if (config.passwordHash) {
+      throw new Error('Existing wallets are password-protected. Set NANSEN_WALLET_PASSWORD.');
+    }
   } else {
-    if (!verifyPassword(password, config)) {
+    // Encrypted mode
+    if (!config.passwordHash) {
+      // First encrypted wallet: reject if passwordless wallets exist
+      const existingWallets = fs.readdirSync(getWalletsDir())
+        .filter(f => f.endsWith('.json') && f !== 'config.json');
+      if (existingWallets.length > 0) {
+        throw new Error('Existing wallets are passwordless. Cannot mix encrypted and unencrypted wallets.');
+      }
+      config.passwordHash = hashPassword(password);
+    } else if (!verifyPassword(password, config)) {
       throw new Error('Incorrect password');
     }
   }
@@ -380,7 +417,7 @@ export function exportWallet(name, password) {
   }
 
   const config = getWalletConfig();
-  if (!verifyPassword(password, config)) {
+  if (config.passwordHash && !verifyPassword(password, config)) {
     throw new Error('Incorrect password');
   }
 
@@ -425,7 +462,7 @@ export function deleteWallet(name, password) {
   }
 
   const config = getWalletConfig();
-  if (!verifyPassword(password, config)) {
+  if (config.passwordHash && !verifyPassword(password, config)) {
     throw new Error('Incorrect password');
   }
 
@@ -470,22 +507,35 @@ export function buildWalletCommands(deps = {}) {
       const handlers = {
         'create': async () => {
           const name = options.name || args[1] || 'default';
-          const password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
-          if (!password || password.length < 12) {
-            log('❌ Password must be at least 12 characters');
+
+          let password;
+          if (flags['unsafe-no-password']) {
+            process.stderr.write('WARNING: --unsafe-no-password is set. Private keys will be stored UNENCRYPTED on disk.\nAnyone with access to this machine can steal your funds.\n');
+            password = null;
+          } else if (!process.env.NANSEN_WALLET_PASSWORD && !process.stdin.isTTY && !deps.promptFn) {
+            log('❌ No password provided. Either:');
+            log('   set NANSEN_WALLET_PASSWORD, or');
+            log('   use --unsafe-no-password (WARNING: Private keys will be stored UNENCRYPTED on disk. Anyone with access to this machine can steal your funds.)');
             exit(1);
             return;
-          }
-
-          // Confirm password for first wallet (skip if set via env var)
-          const config = getWalletConfig();
-          if (!config.passwordHash && !process.env.NANSEN_WALLET_PASSWORD) {
-            const confirm = await promptPassword('Confirm password: ', deps);
-            if (password !== confirm) {
-              log('❌ Passwords do not match');
+          } else {
+            password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
+            if (!password || password.length < 12) {
+              log('❌ Password must be at least 12 characters');
               exit(1);
               return;
             }
+
+            // Confirm password for first wallet (skip if set via env var)
+            const config = getWalletConfig();
+            if (!config.passwordHash && !process.env.NANSEN_WALLET_PASSWORD) {
+              const confirm = await promptPassword('Confirm password: ', deps);
+              if (password !== confirm) {
+                log('❌ Passwords do not match');
+                exit(1);
+                return;
+              }
+            }
           }
 
           try {
@@ -499,8 +549,12 @@ export function buildWalletCommands(deps = {}) {
             log(`    Base (recommended, lower fees): send USDC to ${result.evm}`);
             log(`    Solana: send USDC to ${result.solana}`);
             log('');
-            log('  ⚠️  This is a hot wallet and is fundamentally insecure — do not deposit more than you can afford to lose.');
-            log('     Store and handle your password securely, e.g. using a secrets manager or system keychain.');
+            if (password === null) {
+              log('  ⚠️  This is an UNENCRYPTED hot wallet — private keys are stored in plaintext on disk.');
+            } else {
+              log('  ⚠️  This is a hot wallet and is fundamentally insecure — do not deposit more than you can afford to lose.');
+              log('     Store and handle your password securely, e.g. using a secrets manager or system keychain.');
+            }
             log('');
             return;
           } catch (err) {
@@ -553,7 +607,10 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
-          const password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
+          const config = getWalletConfig();
+          const password = config.passwordHash
+            ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
+            : null;
           try {
             const result = exportWallet(name, password);
             log(`\n⚠️  Private keys for "${result.name}" — do not share!\n`);
@@ -595,7 +652,10 @@ export function buildWalletCommands(deps = {}) {
             exit(1);
             return;
           }
-          const password = process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps);
+          const config = getWalletConfig();
+          const password = config.passwordHash
+            ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
+            : null;
           try {
             const result = deleteWallet(name, password);
             log(`✓ Wallet "${result.deleted}" deleted`);
@@ -638,7 +698,15 @@ export function buildWalletCommands(deps = {}) {
           }
 
           const isWalletConnect = options.wallet === 'walletconnect' || options.wallet === 'wc';
-          const password = isWalletConnect ? null : (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps));
+          let password;
+          if (isWalletConnect) {
+            password = null;
+          } else {
+            const sendConfig = getWalletConfig();
+            password = sendConfig.passwordHash
+              ? (process.env.NANSEN_WALLET_PASSWORD || await promptPassword('Enter wallet password: ', deps))
+              : null;
+          }
           const dryRun = flags['dry-run'] || flags.dryRun;
 
           try {
@@ -695,7 +763,8 @@ USAGE:
   nansen wallet <command> [options]
 
 COMMANDS:
-  create [--name <label>]    Create a new wallet pair (EVM + Solana)
+  create [--name <label>] [--unsafe-no-password]
+                             Create a new wallet pair (EVM + Solana)
   list                       List all wallets
   show <name>                Show wallet addresses
   export <name>              Export private keys (requires password)
@@ -712,6 +781,7 @@ OPTIONS:
   --token <address>          Token contract/mint address (optional, sends native if omitted)
   --wallet <name>            Wallet to use (optional, uses default if omitted; use "walletconnect" or "wc" for WalletConnect, EVM only)
   --max                      Send entire balance (deducts gas for native transfers)
+  --unsafe-no-password       Skip encryption — private keys stored UNENCRYPTED on disk (create only)
 
 ENVIRONMENT:
   NANSEN_WALLET_PASSWORD     Password for non-interactive use (e.g. CI/scripts)

package/src/x402.js

@@ -96,18 +96,23 @@ export async function* createPaymentSignatures(response, url, options = {}) {
   const ranked = rankRequirements(requirements);
   if (ranked.length === 0) return;
 
-  const password = options.password || process.env.NANSEN_WALLET_PASSWORD;
-  if (!password) return;
-
-  let exportWallet, listWallets;
+  let exportWallet, listWallets, getWalletConfig;
   try {
     const walletMod = await import('./wallet.js');
     exportWallet = walletMod.exportWallet;
     listWallets = walletMod.listWallets;
+    getWalletConfig = walletMod.getWalletConfig;
   } catch {
     return;
   }
 
+  const walletConfig = getWalletConfig();
+  const password = walletConfig.passwordHash
+    ? (options.password || process.env.NANSEN_WALLET_PASSWORD || null)
+    : null;
+  // Encrypted wallets need a password -- silently skip if unavailable
+  if (walletConfig.passwordHash && password === null) return;
+
   const wallets = listWallets();
   if (wallets.wallets.length === 0) return;