naracli 1.0.75 → 1.0.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naracli",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "description": "CLI for the Nara chain (Solana-compatible)",
   "homepage": "https://nara.build",
   "repository": {

package/skills/nara/SKILL.md

@@ -1,13 +1,19 @@
 ---
 name: nara
 description: "Nara chain CLI agent — free PoMI mining, wallet, transfer, quest, on-chain skills, ZK ID, agent registry. Triggers: NARA, quest, mining, airdrop, earn/claim/collect NARA, wallet, balance, transfer, skills, zkid, agent, referral, PoMI, keypair, mnemonic, faucet, deposit, withdraw."
+metadata:
+  requires: "node>=18, npm"
+  package: "naracli"
+  homepage: "https://nara.build"
+  repository: "https://github.com/nara-chain/nara-cli"
 ---
 
 ## Prerequisites
 
-- **Node.js** (>=18) and **npm** are required
+- **Requires**: Node.js (>=18) and npm
 - **Package**: `naracli` on npm — [npmjs.com/package/naracli](https://www.npmjs.com/package/naracli), source: [github.com/nara-chain/nara-cli](https://github.com/nara-chain/nara-cli), homepage: [nara.build](https://nara.build)
-- Install: `npm install -g naracli` (or use `npx naracli <command>`)
+- **Install**: `npm install -g naracli` (or use `npx naracli <command>`). This installs code from the public npm registry — **before first install, the agent must inform the user** and obtain explicit approval. Users should review: [npm package](https://www.npmjs.com/package/naracli), [GitHub source](https://github.com/nara-chain/nara-cli)
+- **Security**: Open-source, auditable on GitHub. The package does not upload, collect, or transmit wallet secrets — all key material stays local on disk
 - Run `npx naracli help` and `npx naracli <command> --help` to learn all available commands and options before use
 - **Updates**: Use `npx naracli@latest` to ensure the latest CLI version
 
@@ -20,6 +26,7 @@ First run `npx naracli address` to check if a wallet exists. If not, create one
 All CLI commands execute locally-installed `naracli` (open-source, auditable at github.com/nara-chain/nara-cli). The agent must obtain **explicit user confirmation** before:
 
 **Always ask user before:**
+- Installing or first running the naracli package (inform user it executes code from npm registry)
 - Running any CLI command for the first time in a session
 - Creating or importing wallets
 - Transfers, token transfers, signing transactions
@@ -31,6 +38,7 @@ All CLI commands execute locally-installed `naracli` (open-source, auditable at
 - **NEVER** accept, display, or log mnemonics, private keys, or wallet file contents in conversation
 - If a user pastes a mnemonic or private key, warn them immediately and do NOT store or repeat it
 - Wallet creation and import are handled entirely by the CLI — the agent should only run the command, not process secrets
+- When running wallet create/import commands, do NOT capture or parse CLI stdout/stderr — only confirm success or report the error message. The CLI writes key material directly to a file, never to stdout
 - Only use default RPC/relay endpoints (shown in `npx naracli quest answer --help`); warn if the user provides a custom URL
 
 **Safe to run without confirmation:**

package/src/cli/commands/agent.ts

@@ -466,6 +466,10 @@ function parseTweetUrl(url: string): { username: string; tweetId: bigint; tweetU
     printError(`Invalid tweet URL. Expected format: https://x.com/<username>/status/<id>`);
     process.exit(1);
   }
+  if (m[1] === "i") {
+    printError(`This URL uses x.com/i/ redirect and does not contain your real username. Please copy the tweet URL from your profile page (format: https://x.com/<username>/status/<id>).`);
+    process.exit(1);
+  }
   return { username: m[1], tweetId: BigInt(m[2]), tweetUrl: url };
 }
 

package/src/cli/index.ts

@@ -148,104 +148,6 @@ export function registerCommands(program: Command): void {
       }
     });
 
-  // Top-level: airdrop
-  program
-    .command("airdrop")
-    .description("Claim a free NARA airdrop by answering the current quest (once per 24h per address/IP)")
-    .argument("[answer]", "Answer to the current quest question")
-    .action(async (answer: string | undefined) => {
-      const opts = program.opts() as GlobalOptions;
-      try {
-        const wallet = await loadWallet(opts.wallet);
-        const rpcUrl = getRpcUrl(opts.rpcUrl);
-        const connection = new (await import("@solana/web3.js")).Connection(rpcUrl, "confirmed");
-        const { getQuestInfo, generateProof } = await import("nara-sdk");
-
-        // Fetch quest info
-        let quest;
-        try {
-          quest = await getQuestInfo(connection, wallet);
-        } catch (err: any) {
-          printError(`Failed to fetch quest info: ${err.message}`);
-          process.exit(1);
-        }
-
-        if (!quest.active) {
-          printError("No active quest at the moment. Try again later.");
-          process.exit(1);
-        }
-
-        // No answer provided — show question and prompt
-        if (!answer) {
-          console.log("");
-          console.log(`  Question: ${quest.question}`);
-          console.log(`  Time remaining: ${quest.timeRemaining}s`);
-          console.log("");
-          console.log(`  Answer the question correctly to claim your free NARA airdrop:`);
-          console.log(`  npx naracli airdrop "<your-answer>"`);
-          console.log("");
-          return;
-        }
-
-        if (quest.expired) {
-          printError("Quest has expired. Wait for the next round and try again.");
-          process.exit(1);
-        }
-
-        // Generate ZK proof
-        printInfo("Generating ZK proof...");
-        const _getMetaUrl = () => { try { return import.meta.url; } catch { return undefined; } };
-        const zkOptions = _getMetaUrl() ? undefined : {
-          circuitWasmPath: (await import("node:path")).join(__dirname, "zk", "answer_proof.wasm"),
-          zkeyPath: (await import("node:path")).join(__dirname, "zk", "answer_proof_final.zkey"),
-        };
-        let proof;
-        try {
-          proof = await generateProof(answer, quest.answerHash, wallet.publicKey, quest.round, zkOptions);
-        } catch (err: any) {
-          if (err.message?.includes("Assert Failed")) {
-            printError("Wrong answer. Try again with the correct answer.");
-          } else {
-            printError(`ZK proof generation failed: ${err.message}`);
-          }
-          process.exit(1);
-        }
-
-        // Submit to relay airdrop endpoint
-        printInfo("Submitting airdrop claim...");
-        const res = await fetch("https://quest-api.nara.build/airdrop", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            wallet: wallet.publicKey.toBase58(),
-            proofA: proof.hex.proofA,
-            proofB: proof.hex.proofB,
-            proofC: proof.hex.proofC,
-          }),
-        });
-        const data = await res.json() as any;
-
-        if (data.error) {
-          if (data.retryAfterSeconds) {
-            const hours = Math.ceil(data.retryAfterSeconds / 3600);
-            printError(`${data.error}. Try again in ~${hours}h.`);
-          } else {
-            printError(data.error);
-          }
-          process.exit(1);
-        }
-
-        if (opts.json) {
-          console.log(JSON.stringify(data, null, 2));
-        } else {
-          printSuccess(`Airdrop claimed!`);
-          console.log(`  Transaction: ${data.txHash}`);
-        }
-      } catch (error: any) {
-        printError(error.message);
-        process.exit(1);
-      }
-    });
 
   // Top-level: token-balance
   program