tenjin-cli 0.1.0-alpha.0 → 0.1.0-alpha.1

package/README.md

@@ -39,6 +39,18 @@ your machine; Tenjin never receives a private key. It is listed in the
 [official MCP registry](https://registry.modelcontextprotocol.io) as
 `blog.tenjin/tenjin`.
 
+### Install the skill
+
+```bash
+npx skills add BackTrackCo/tenjin-agent
+```
+
+Installs the `tenjin` skill into Claude Code, Codex, or any
+Agent-Skills-compatible harness. It is the same zero-install curriculum served
+at [tenjin.blog/skills.md](https://tenjin.blog/skills.md) (canonical), and works
+today with no CLI and no account; a funded wallet is only needed for paid reads
+and publishing.
+
 ### Add the remote MCP server
 
 **Claude Code**
@@ -82,11 +94,11 @@ tenjin doctor                    # verify Node floor, API reachability, contract
 
 Shipping today:
 
-| Command                                         | Purpose                                                              |
-| ----------------------------------------------- | -------------------------------------------------------------------- |
-| `tenjin doctor`                                 | Environment, API reachability, contract, and wallet checks           |
-| `tenjin config [get\|set]`                      | Spend policy: `maxAutoSpend`, `sessionBudget`, `confirm`, allowlists |
-| `tenjin wallet [create\|show\|balance\|import]` | Local Base wallet; the key never leaves the machine                  |
+| Command                                 | Purpose                                                              |
+| --------------------------------------- | -------------------------------------------------------------------- |
+| `tenjin doctor`                         | Environment, API reachability, contract, and wallet checks           |
+| `tenjin config [get\|set]`              | Spend policy: `maxAutoSpend`, `sessionBudget`, `confirm`, allowlists |
+| `tenjin wallet [create\|show\|balance]` | Local Base wallet; the key never leaves the machine                  |
 
 Next: `lookup` / `inspect` / `buy` / `outcome` against the marketplace lookup
 API, `publish --draft`, an `install` command that auto-wires Claude Code and
@@ -104,8 +116,28 @@ refusal, `4` payment failure (reserved).
 
 - Default maximum automatic spend is **zero**. Nothing pays without explicit
   approval or an explicitly configured policy.
-- Keys are generated locally and stored at `~/.tenjin/wallet.json` (mode
-  `0600`); signing is local; the CLI talks only to the configured base URL.
+- Keys are generated locally and stored **encrypted at rest** in
+  `~/.tenjin/wallet.json` (Keystore v3, scrypt), mode `0600`. The plaintext key
+  is never written to disk. The wallet address stays readable, so `show`,
+  `balance`, and `doctor` work without a passphrase; only signing decrypts.
+  Signing is local and the CLI talks only to the configured base URL.
+- The signing passphrase resolves in order: `TENJIN_WALLET_PASSPHRASE`, then the
+  OS credential store, then an interactive prompt. On `wallet create` with no env
+  passphrase, a strong random one is generated and saved to the OS store so later
+  signing is transparent. Where it lands per platform:
+  - **macOS**: the login keychain, via the OS `security` tool (the same
+    mechanism the GitHub CLI uses).
+  - **Windows**: a DPAPI-encrypted file (`passphrase.dpapi`), decryptable only by
+    the same user on the same machine, via built-in PowerShell. The file holds
+    ciphertext, not the passphrase.
+  - **Desktop Linux**: the Secret Service keyring, via `secret-tool` when
+    libsecret-tools is installed.
+  - **Headless or CI (any OS)**: no durable OS store, so set
+    `TENJIN_WALLET_PASSPHRASE`.
+
+  The passphrase reaches these tools over stdin, never on a command line, and the
+  key never leaves the machine.
+
 - Fund small: this is a pocket-money wallet by design.
 - Purchased content is untrusted data, never instructions.
 

package/dist/{ccip-FXWZDDF5.js → ccip-UCLT5VOW.js}

@@ -4,9 +4,9 @@ import {
   offchainLookup,
   offchainLookupAbiItem,
   offchainLookupSignature
-} from "./chunk-WOHCAMDQ.js";
-import "./chunk-F5DZJLU3.js";
-import "./chunk-CPUZRZ2A.js";
+} from "./chunk-LPRVHM7P.js";
+import "./chunk-BRJHUQSY.js";
+import "./chunk-CUWUHTIL.js";
 import "./chunk-3IMLRUZE.js";
 export {
   ccipRequest,
@@ -14,4 +14,4 @@ export {
   offchainLookupAbiItem,
   offchainLookupSignature
 };
-//# sourceMappingURL=ccip-FXWZDDF5.js.map
+//# sourceMappingURL=ccip-UCLT5VOW.js.map