nodpay 0.2.8 → 0.2.10

package/SKILL.md

@@ -11,9 +11,11 @@ You propose payments, your human approves with one tap. 2-of-3 multisig — you
 
 ## Trust Model
 
-- **Your private key never leaves disk.** `keygen` writes to `.nodpay/.env` (chmod 600) — it never appears in stdout, context, or logs.
-- **You can only propose.** Execution requires human approval (passkey co-sign).
+- **Your private key never leaves disk.** `keygen` writes to `.nodpay/.env` (chmod 600) — never in stdout, context, or logs.
+- **You can only propose.** Execution requires human co-sign (passkey). No single party can move funds.
 - **Wallet info is public key material.** Safe address, passkey X/Y, recovery signer — all safe to store.
+- **NodPay server is stateless.** It relays signed operations — no private keys, no custody, no accounts. If the server goes offline, funds stay safe on-chain.
+- **The web app is a convenience layer.** It helps users create wallets and approve transactions. All crypto operations happen client-side; nothing sensitive is stored server-side.
 - **Verify the agent address matches yours** before storing wallet info. Mismatch = wrong key binding.
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodpay",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "NodPay CLI — propose on-chain payments from agent-human shared wallets",
   "type": "module",
   "bin": {

package/scripts/keygen.mjs

@@ -52,12 +52,17 @@ if (existing) {
   }
 } else {
   const wallet = Wallet.createRandom();
-  // Ensure .nodpay/ directory exists with restricted permissions
+
+  // SECURITY: Private key is written directly to file — it never appears in
+  // stdout or process output. This is intentional: the calling agent (LLM)
+  // only sees the public address, so the key never enters the model's context
+  // window and cannot be leaked via prompt injection or conversation history.
   const dir = dirname(envFile);
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  // Write key file with restricted permissions (owner read/write only)
+  mkdirSync(dir, { recursive: true, mode: 0o700 });   // directory: owner-only
   const content = existsSync(envFile) ? readFileSync(envFile, 'utf8') : '';
-  writeFileSync(envFile, content + `${ENV_VAR}=${wallet.privateKey}\n`, { mode: 0o600 });
+  writeFileSync(envFile, content + `${ENV_VAR}=${wallet.privateKey}\n`, { mode: 0o600 }); // file: owner read/write only
+
+  // Only the public address reaches stdout — safe for LLM context
   console.log(wallet.address);
   console.error(`Generated new agent key → ${envFile}`);
 }

package/scripts/propose.mjs

@@ -62,7 +62,9 @@ if (!RPC_URL || !CHAIN_ID) {
 }
 const ENTRYPOINT_ADDRESS = ENTRYPOINT;
 
-// Read agent key from .nodpay/.env
+// SECURITY: Read agent key from .nodpay/.env file (chmod 600), not from
+// process.env or CLI args. The key is loaded at runtime by the script itself,
+// so it never passes through the LLM agent's context or conversation history.
 function loadAgentKey() {
   try {
     const envPath = join(process.cwd(), '.nodpay', '.env');