npmguard-cli 0.4.0 → 0.5.0

package/dist/commands/install.js

@@ -1,7 +1,189 @@
 import chalk from "chalk";
 import ora from "ora";
+import qrcode from "qrcode-terminal";
+import { createInterface } from "node:readline";
 import { execSync } from "node:child_process";
+import { createPublicClient, createWalletClient, http, formatEther, encodeFunctionData, } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { defineChain } from "viem";
+import { SignClient } from "@walletconnect/sign-client";
+import { AUDIT_REQUEST_ADDRESS_0G, AUDIT_REQUEST_ABI, } from "../contract.js";
+const ogGalileo = defineChain({
+    id: 16602,
+    name: "0G-Galileo-Testnet",
+    nativeCurrency: { name: "0G", symbol: "0G", decimals: 18 },
+    rpcUrls: { default: { http: ["https://evmrpc-testnet.0g.ai"] } },
+    blockExplorers: { default: { name: "0G Explorer", url: "https://chainscan-galileo.0g.ai" } },
+    testnet: true,
+});
 const IPFS_GATEWAY = "https://gateway.pinata.cloud/ipfs";
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+const DEFAULT_AUDIT_API_URL = "http://209.38.42.28:8000/audit";
+const WALLETCONNECT_PROJECT_ID = process.env.WALLETCONNECT_PROJECT_ID ?? "d5eb170c427570e15ac00ae53acc93ba";
+const OG_RPC = "https://evmrpc-testnet.0g.ai";
+const BLOCK_EXPLORER = "https://chainscan-galileo.0g.ai";
+function prompt(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase());
+        });
+    });
+}
+function generateQrCode(text) {
+    return new Promise((resolve) => {
+        qrcode.generate(text, { small: true }, (code) => {
+            console.log(code);
+            resolve();
+        });
+    });
+}
+async function askInstallWithoutAudit(packageSpec) {
+    const answer = await prompt(chalk.white(`  Install from npm without audit? (y/n) `));
+    if (answer === "y" || answer === "yes") {
+        console.log();
+        execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
+    }
+}
+async function requestAuditOnChain(packageName, version, privateKey) {
+    const account = privateKeyToAccount(privateKey);
+    const rpcUrl = OG_RPC;
+    const publicClient = createPublicClient({
+        chain: ogGalileo,
+        transport: http(rpcUrl),
+    });
+    const walletClient = createWalletClient({
+        account,
+        chain: ogGalileo,
+        transport: http(rpcUrl),
+    });
+    const auditFee = await publicClient.readContract({
+        address: AUDIT_REQUEST_ADDRESS_0G,
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "auditFee",
+    });
+    const hash = await walletClient.writeContract({
+        address: AUDIT_REQUEST_ADDRESS_0G,
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "requestAudit",
+        args: [packageName, version],
+        value: auditFee,
+    });
+    await publicClient.waitForTransactionReceipt({ hash });
+    return hash;
+}
+async function payViaWalletConnect(packageName, version, feeWei, feeDisplay) {
+    const calldata = encodeFunctionData({
+        abi: AUDIT_REQUEST_ABI,
+        functionName: "requestAudit",
+        args: [packageName, version],
+    });
+    let signClient = null;
+    // WalletConnect throws unhandled errors when MetaMask sends
+    // session events after the session is cleaned up — suppress them
+    const wcErrorHandler = (err) => {
+        if (err?.message?.includes("No matching key"))
+            return;
+        console.error(err);
+        process.exit(1);
+    };
+    process.on("uncaughtException", wcErrorHandler);
+    try {
+        const initSpinner = ora("  Connecting to WalletConnect...").start();
+        signClient = await SignClient.init({
+            projectId: WALLETCONNECT_PROJECT_ID,
+            metadata: {
+                name: "NpmGuard",
+                description: "NPM package security audit",
+                url: "https://npmguard.dev",
+                icons: [],
+            },
+        });
+        initSpinner.stop();
+        const { uri, approval } = await signClient.connect({
+            requiredNamespaces: {
+                eip155: {
+                    methods: ["eth_sendTransaction"],
+                    chains: ["eip155:16602"],
+                    events: ["chainChanged", "accountsChanged"],
+                },
+            },
+        });
+        if (!uri) {
+            console.log(chalk.red("  Failed to generate WalletConnect URI"));
+            return false;
+        }
+        console.log();
+        console.log(chalk.cyan(`  Scan with your wallet to connect:`));
+        console.log();
+        await generateQrCode(uri);
+        console.log();
+        const pairSpinner = ora("  Waiting for wallet connection...").start();
+        const session = await approval();
+        // Find the 0G Galileo account in approved namespaces
+        const accounts = session.namespaces.eip155?.accounts ?? [];
+        const ogAccount = accounts.find((a) => a.startsWith("eip155:16602:"));
+        const account = ogAccount
+            ? ogAccount.split(":")[2]
+            : accounts[0]?.split(":")[2];
+        if (!account) {
+            pairSpinner.fail("Wallet did not approve any accounts");
+            return false;
+        }
+        pairSpinner.succeed(`Connected: ${account.slice(0, 6)}...${account.slice(-4)}`);
+        console.log(chalk.cyan(`  Confirm the ${feeDisplay} transaction in your wallet...`));
+        const txHash = await signClient.request({
+            topic: session.topic,
+            chainId: "eip155:16602",
+            request: {
+                method: "eth_sendTransaction",
+                params: [
+                    {
+                        from: account,
+                        to: AUDIT_REQUEST_ADDRESS_0G,
+                        data: calldata,
+                        value: "0x" + feeWei.toString(16),
+                    },
+                ],
+            },
+        });
+        const confirmSpinner = ora("  Waiting for on-chain confirmation...").start();
+        const ogClient = createPublicClient({
+            chain: ogGalileo,
+            transport: http(OG_RPC),
+        });
+        const receipt = await ogClient.waitForTransactionReceipt({
+            hash: txHash,
+        });
+        if (receipt.status === "success") {
+            confirmSpinner.succeed("Payment confirmed on-chain!");
+            console.log(chalk.gray(`  Tx: ${BLOCK_EXPLORER}/tx/${txHash}`));
+            console.log();
+            return true;
+        }
+        else {
+            confirmSpinner.fail("Transaction reverted");
+            return false;
+        }
+    }
+    catch (err) {
+        const msg = err.message ?? String(err);
+        if (msg.includes("rejected") || msg.includes("denied")) {
+            console.log(chalk.yellow("  Transaction rejected by user."));
+        }
+        else {
+            console.log(chalk.red(`  WalletConnect error: ${msg}`));
+        }
+        console.log();
+        return false;
+    }
+    finally {
+        signClient = null;
+        // Remove handler after a delay to catch late WC events
+        setTimeout(() => process.off("uncaughtException", wcErrorHandler), 5000);
+    }
+}
 export async function installCommand(packageSpec, auditSource, force = false) {
     const atIndex = packageSpec.lastIndexOf("@");
     let packageName;
@@ -35,16 +217,144 @@ export async function installCommand(packageSpec, auditSource, force = false) {
     console.log();
     console.log(chalk.bold(`  ${packageName}@${requestedVersion}`));
     console.log();
-    // No audit found — fallback to npm
+    // ─── No audit found ───────────────────────────────────────────────
     if (!audit) {
         console.log(chalk.gray(`  NOT AUDITED — no NpmGuard record found for this version.`));
         console.log();
-        console.log(chalk.gray("  Falling back to npm install..."));
-        console.log();
-        execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
-        return;
+        const privateKey = process.env.NPMGUARD_PRIVATE_KEY;
+        const contractDeployed = AUDIT_REQUEST_ADDRESS_0G !== ZERO_ADDRESS;
+        if (contractDeployed) {
+            const publicClient = createPublicClient({
+                chain: ogGalileo,
+                transport: http(OG_RPC),
+            });
+            // Check if user already paid (previous attempt where audit engine failed)
+            let alreadyPaid = false;
+            try {
+                alreadyPaid = (await publicClient.readContract({
+                    address: AUDIT_REQUEST_ADDRESS_0G,
+                    abi: AUDIT_REQUEST_ABI,
+                    functionName: "isRequested",
+                    args: [packageName, requestedVersion],
+                }));
+            }
+            catch {
+                // can't read — assume not paid
+            }
+            if (alreadyPaid) {
+                console.log(chalk.cyan(`  Already paid on-chain — re-triggering audit...`));
+                console.log();
+            }
+            else {
+                // Read fee for display
+                let feeDisplay = "0.01 0G";
+                let feeWei = 10000000000000000n;
+                try {
+                    feeWei = (await publicClient.readContract({
+                        address: AUDIT_REQUEST_ADDRESS_0G,
+                        abi: AUDIT_REQUEST_ABI,
+                        functionName: "auditFee",
+                    }));
+                    feeDisplay = `${formatEther(feeWei)} 0G`;
+                }
+                catch { }
+                const wantAudit = await prompt(chalk.yellow(`  Request on-chain audit for ${feeDisplay}? (y/n) `));
+                if (wantAudit !== "y" && wantAudit !== "yes") {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+                // Ask how to pay
+                console.log();
+                console.log(chalk.bold(`  How to pay?`));
+                if (privateKey) {
+                    console.log(`    1) Wallet (NPMGUARD_PRIVATE_KEY)`);
+                    console.log(`    2) WalletConnect (mobile wallet)`);
+                    console.log(`    3) Back`);
+                }
+                else {
+                    console.log(`    1) WalletConnect (mobile wallet)`);
+                    console.log(`    2) Back`);
+                }
+                console.log();
+                const choice = await prompt(`  Choice: `);
+                const backChoice = privateKey ? "3" : "2";
+                if (choice === backChoice) {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+                if (privateKey && choice === "1") {
+                    const txSpinner = ora("  Sending payment transaction...").start();
+                    try {
+                        const txHash = await requestAuditOnChain(packageName, requestedVersion, privateKey);
+                        txSpinner.succeed("Payment confirmed on-chain!");
+                        console.log(chalk.gray(`  Tx: ${BLOCK_EXPLORER}/tx/${txHash}`));
+                        console.log();
+                    }
+                    catch (err) {
+                        txSpinner.fail("Transaction failed");
+                        console.log(chalk.red(`  ${err.shortMessage ?? err.message}`));
+                        console.log();
+                        return askInstallWithoutAudit(packageSpec);
+                    }
+                }
+                else if ((privateKey && choice === "2") || (!privateKey && choice === "1")) {
+                    const paid = await payViaWalletConnect(packageName, requestedVersion, feeWei, feeDisplay);
+                    if (!paid)
+                        return askInstallWithoutAudit(packageSpec);
+                }
+                else {
+                    return askInstallWithoutAudit(packageSpec);
+                }
+            }
+            // Trigger audit engine
+            const auditApiUrl = process.env.NPMGUARD_AUDIT_API_URL ?? DEFAULT_AUDIT_API_URL;
+            const auditSpinner = ora("  Running security audit...").start();
+            try {
+                const resp = await fetch(auditApiUrl, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ packageName, version: requestedVersion }),
+                });
+                if (!resp.ok)
+                    throw new Error(`Audit engine returned ${resp.status}`);
+                const result = await resp.json();
+                auditSpinner.stop();
+                console.log();
+                const verdict = (result.verdict ?? "UNKNOWN").toUpperCase();
+                const capabilities = result.capabilities ?? [];
+                if (verdict === "SAFE") {
+                    console.log(chalk.green(`  Verdict: SAFE`));
+                }
+                else if (verdict === "DANGEROUS") {
+                    console.log(chalk.red(`  Verdict: DANGEROUS`));
+                }
+                else {
+                    console.log(chalk.yellow(`  Verdict: ${verdict}`));
+                }
+                if (capabilities.length > 0) {
+                    console.log(chalk.gray(`  Capabilities: ${capabilities.join(", ")}`));
+                }
+                console.log();
+                if (verdict === "DANGEROUS" && !force) {
+                    console.log(chalk.red.bold("  Installation blocked. This package is dangerous."));
+                    console.log(chalk.gray("  Use --force to install anyway."));
+                    console.log();
+                    return;
+                }
+                console.log(chalk.gray("  Installing from npm..."));
+                console.log();
+                execSync(`npm install ${packageSpec}`, { stdio: "inherit" });
+            }
+            catch (err) {
+                auditSpinner.fail("Audit engine unreachable");
+                console.log(chalk.gray(`  ${err.message ?? err}`));
+                console.log();
+                return askInstallWithoutAudit(packageSpec);
+            }
+            return;
+        }
+        // Contract not deployed
+        return askInstallWithoutAudit(packageSpec);
     }
-    // Show verdict
+    // ─── Audit found — show verdict ───────────────────────────────────
     if (audit.verdict === "SAFE") {
         console.log(chalk.green(`  SAFE (score: ${audit.score})`));
     }
@@ -82,7 +392,6 @@ export async function installCommand(packageSpec, auditSource, force = false) {
         }
     }
     else {
-        // No sourceCid — install from npm
         console.log(chalk.gray("  No IPFS source available, installing from npm..."));
         console.log();
         execSync(`npm install ${packageSpec}`, { stdio: "inherit" });

package/dist/contract.d.ts

@@ -0,0 +1,121 @@
+export declare const AUDIT_REQUEST_ADDRESS: `0x${string}`;
+export declare const AUDIT_REQUEST_ADDRESS_0G: `0x${string}`;
+export declare const AUDIT_REQUEST_ABI: readonly [{
+    readonly inputs: readonly [{
+        readonly name: "_auditFee";
+        readonly type: "uint256";
+    }];
+    readonly stateMutability: "nonpayable";
+    readonly type: "constructor";
+}, {
+    readonly anonymous: false;
+    readonly inputs: readonly [{
+        readonly indexed: false;
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly indexed: false;
+        readonly name: "version";
+        readonly type: "string";
+    }, {
+        readonly indexed: true;
+        readonly name: "requester";
+        readonly type: "address";
+    }];
+    readonly name: "AuditRequested";
+    readonly type: "event";
+}, {
+    readonly anonymous: false;
+    readonly inputs: readonly [{
+        readonly indexed: true;
+        readonly name: "key";
+        readonly type: "bytes32";
+    }, {
+        readonly indexed: true;
+        readonly name: "requester";
+        readonly type: "address";
+    }];
+    readonly name: "AuditRequestedByKey";
+    readonly type: "event";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly name: "version";
+        readonly type: "string";
+    }];
+    readonly name: "requestAudit";
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "key";
+        readonly type: "bytes32";
+    }];
+    readonly name: "requestAuditByKey";
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "auditFee";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "owner";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "address";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "packageName";
+        readonly type: "string";
+    }, {
+        readonly name: "version";
+        readonly type: "string";
+    }];
+    readonly name: "isRequested";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bool";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+    }];
+    readonly name: "requested";
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bool";
+    }];
+    readonly stateMutability: "view";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [{
+        readonly name: "_fee";
+        readonly type: "uint256";
+    }];
+    readonly name: "setFee";
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+    readonly type: "function";
+}, {
+    readonly inputs: readonly [];
+    readonly name: "withdraw";
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+    readonly type: "function";
+}];

package/dist/contract.js

@@ -0,0 +1,92 @@
+// NpmGuardAuditRequest contract — deployed on Sepolia + 0G Galileo Testnet
+// Update these addresses after running: cd contracts && npm run deploy
+export const AUDIT_REQUEST_ADDRESS = "0x4bbaf196bde9e02594631e03c28ebe16719214f3"; // Sepolia
+export const AUDIT_REQUEST_ADDRESS_0G = "0x1201448ae5f00e1783036439569e71ab3757d0de"; // 0G Galileo Testnet
+export const AUDIT_REQUEST_ABI = [
+    {
+        inputs: [{ name: "_auditFee", type: "uint256" }],
+        stateMutability: "nonpayable",
+        type: "constructor",
+    },
+    {
+        anonymous: false,
+        inputs: [
+            { indexed: false, name: "packageName", type: "string" },
+            { indexed: false, name: "version", type: "string" },
+            { indexed: true, name: "requester", type: "address" },
+        ],
+        name: "AuditRequested",
+        type: "event",
+    },
+    {
+        anonymous: false,
+        inputs: [
+            { indexed: true, name: "key", type: "bytes32" },
+            { indexed: true, name: "requester", type: "address" },
+        ],
+        name: "AuditRequestedByKey",
+        type: "event",
+    },
+    {
+        inputs: [
+            { name: "packageName", type: "string" },
+            { name: "version", type: "string" },
+        ],
+        name: "requestAudit",
+        outputs: [],
+        stateMutability: "payable",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "key", type: "bytes32" }],
+        name: "requestAuditByKey",
+        outputs: [],
+        stateMutability: "payable",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "auditFee",
+        outputs: [{ name: "", type: "uint256" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "owner",
+        outputs: [{ name: "", type: "address" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [
+            { name: "packageName", type: "string" },
+            { name: "version", type: "string" },
+        ],
+        name: "isRequested",
+        outputs: [{ name: "", type: "bool" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "", type: "bytes32" }],
+        name: "requested",
+        outputs: [{ name: "", type: "bool" }],
+        stateMutability: "view",
+        type: "function",
+    },
+    {
+        inputs: [{ name: "_fee", type: "uint256" }],
+        name: "setFee",
+        outputs: [],
+        stateMutability: "nonpayable",
+        type: "function",
+    },
+    {
+        inputs: [],
+        name: "withdraw",
+        outputs: [],
+        stateMutability: "nonpayable",
+        type: "function",
+    },
+];

package/dist/ens-source.js

@@ -1,16 +1,25 @@
 import { createPublicClient, http } from "viem";
 import { sepolia } from "viem/chains";
-const client = createPublicClient({
-    chain: sepolia,
-    transport: http("https://ethereum-sepolia-rpc.publicnode.com"),
-});
+const RPC_URLS = process.env.SEPOLIA_RPC_URL
+    ? [process.env.SEPOLIA_RPC_URL]
+    : [
+        "https://ethereum-sepolia-rpc.publicnode.com",
+        "https://rpc.sepolia.org",
+        "https://sepolia.drpc.org",
+    ];
+function makeClient(url) {
+    return createPublicClient({ chain: sepolia, transport: http(url) });
+}
 async function getText(ensName, key) {
-    try {
-        return await client.getEnsText({ name: ensName, key });
-    }
-    catch {
-        return null;
+    for (const url of RPC_URLS) {
+        try {
+            return await makeClient(url).getEnsText({ name: ensName, key });
+        }
+        catch {
+            continue;
+        }
     }
+    return null;
 }
 export class ENSAuditSource {
     async getAudit(packageName, version) {

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export {};
+import "dotenv/config";

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import "dotenv/config";
 import { Command } from "commander";
 import { resolve } from "node:path";
 import { ENSAuditSource } from "./ens-source.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npmguard-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "Check npm packages against NpmGuard security audits on ENS before installing",
   "bin": "./dist/index.js",
@@ -22,10 +22,13 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@walletconnect/sign-client": "^2.23.9",
     "chalk": "^5.4.0",
     "cli-table3": "^0.6.5",
     "commander": "^13.1.0",
+    "dotenv": "^17.4.0",
     "ora": "^8.2.0",
+    "qrcode-terminal": "^0.12.0",
     "viem": "^2.34.0"
   },
   "devDependencies": {