zk-agent-cli 0.1.0-beta.1 → 0.1.0-beta.3

package/dist/builtin-account-profiles/contracts/sed-lite/NativePerTxLimitHook.sol

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/utils/introspection/ERC165.sol';
+import './IValidationHook.sol';
+
+contract NativePerTxLimitHook is ERC165, IValidationHook {
+  struct LimitState {
+    uint256 maxPerTx;
+    bool enabled;
+  }
+
+  mapping(address => LimitState) public limits;
+
+  event MaxPerTxSet(address indexed account, uint256 maxPerTx);
+  event MaxPerTxRemoved(address indexed account);
+
+  function init(bytes calldata initData) external override {
+    uint256 maxPerTx = abi.decode(initData, (uint256));
+    _setLimit(msg.sender, maxPerTx);
+    emit Inited(msg.sender);
+  }
+
+  function disable() external override {
+    delete limits[msg.sender];
+    emit Disabled(msg.sender);
+  }
+
+  function isInited(address account) external view override returns (bool) {
+    return limits[account].enabled;
+  }
+
+  function setMaxPerTx(uint256 maxPerTx) external {
+    _setLimit(msg.sender, maxPerTx);
+  }
+
+  function removeMaxPerTx() external {
+    require(limits[msg.sender].enabled, 'Limit hook is not enabled');
+    delete limits[msg.sender];
+    emit MaxPerTxRemoved(msg.sender);
+  }
+
+  function validationHook(bytes32, Transaction calldata transaction) external view override {
+    LimitState memory state = limits[msg.sender];
+    if (!state.enabled) {
+      return;
+    }
+
+    uint256 value = transaction.reserved[1];
+    if (value == 0) {
+      value = transaction.value;
+    }
+
+    require(value <= state.maxPerTx, 'Native transfer exceeds hook per-tx cap');
+  }
+
+  function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
+    return interfaceId == type(IValidationHook).interfaceId || super.supportsInterface(interfaceId);
+  }
+
+  function _setLimit(address account, uint256 maxPerTx) internal {
+    require(maxPerTx > 0, 'Spend cap must be greater than zero');
+    limits[account] = LimitState({ maxPerTx: maxPerTx, enabled: true });
+    emit MaxPerTxSet(account, maxPerTx);
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/OwnerManager.sol

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import './Auth.sol';
+
+abstract contract OwnerManager is Auth {
+  address public owner;
+
+  event OwnerChanged(address indexed previousOwner, address indexed newOwner);
+
+  function changeOwner(address newOwner) external onlySelf {
+    _changeOwner(newOwner);
+  }
+
+  function _initializeOwner(address initialOwner) internal {
+    require(initialOwner != address(0), 'Owner must not be zero');
+    owner = initialOwner;
+  }
+
+  function _changeOwner(address newOwner) internal {
+    require(newOwner != address(0), 'Owner must not be zero');
+    emit OwnerChanged(owner, newOwner);
+    owner = newOwner;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/SelfAuth.sol

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+abstract contract SelfAuth {
+  modifier onlySelf() {
+    require(msg.sender == address(this), 'Only the account contract can call this method');
+    _;
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/TargetAllowlistHook.sol

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/utils/introspection/ERC165.sol';
+import './IValidationHook.sol';
+
+contract TargetAllowlistHook is ERC165, IValidationHook {
+  mapping(address => bool) public enabled;
+  mapping(address => mapping(address => bool)) public allowedTargets;
+  mapping(address => address[]) private targetLists;
+
+  event AllowedTargetAdded(address indexed account, address indexed target);
+  event AllowedTargetRemoved(address indexed account, address indexed target);
+
+  function init(bytes calldata initData) external override {
+    address[] memory targets = abi.decode(initData, (address[]));
+    enabled[msg.sender] = true;
+
+    uint256 length = targets.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      _addAllowedTarget(msg.sender, targets[i]);
+    }
+
+    emit Inited(msg.sender);
+  }
+
+  function disable() external override {
+    require(enabled[msg.sender], 'Allowlist hook is not enabled');
+    _clearAllowedTargets(msg.sender);
+    enabled[msg.sender] = false;
+    emit Disabled(msg.sender);
+  }
+
+  function isInited(address account) external view override returns (bool) {
+    return enabled[account];
+  }
+
+  function state(address account) external view returns (bool accountEnabled, address[] memory targets) {
+    return (enabled[account], targetLists[account]);
+  }
+
+  function isTargetAllowed(address account, address target) external view returns (bool) {
+    return allowedTargets[account][target];
+  }
+
+  function addAllowedTarget(address target) external {
+    require(enabled[msg.sender], 'Allowlist hook is not enabled');
+    _addAllowedTarget(msg.sender, target);
+  }
+
+  function removeAllowedTarget(address target) external {
+    require(enabled[msg.sender], 'Allowlist hook is not enabled');
+    require(allowedTargets[msg.sender][target], 'Target is not allowlisted');
+
+    delete allowedTargets[msg.sender][target];
+
+    address[] storage targets = targetLists[msg.sender];
+    uint256 length = targets.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      if (targets[i] == target) {
+        uint256 lastIndex = length - 1;
+        if (i != lastIndex) {
+          targets[i] = targets[lastIndex];
+        }
+        targets.pop();
+        break;
+      }
+    }
+
+    emit AllowedTargetRemoved(msg.sender, target);
+  }
+
+  function validationHook(bytes32, Transaction calldata transaction) external view override {
+    if (!enabled[msg.sender]) {
+      return;
+    }
+
+    address target = address(uint160(transaction.to));
+    if (target == msg.sender) {
+      return;
+    }
+
+    require(allowedTargets[msg.sender][target], 'Target is not allowlisted');
+  }
+
+  function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
+    return interfaceId == type(IValidationHook).interfaceId || super.supportsInterface(interfaceId);
+  }
+
+  function _addAllowedTarget(address account, address target) internal {
+    require(target != address(0), 'Target must not be zero');
+    require(target != account, 'Account self-target is implicit');
+    require(!allowedTargets[account][target], 'Target already allowlisted');
+
+    allowedTargets[account][target] = true;
+    targetLists[account].push(target);
+
+    emit AllowedTargetAdded(account, target);
+  }
+
+  function _clearAllowedTargets(address account) internal {
+    address[] storage targets = targetLists[account];
+    uint256 length = targets.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      delete allowedTargets[account][targets[i]];
+    }
+    delete targetLists[account];
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/TargetSelectorAllowlistHook.sol

@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/utils/introspection/ERC165.sol';
+import './IValidationHook.sol';
+
+contract TargetSelectorAllowlistHook is ERC165, IValidationHook {
+  struct SelectorRule {
+    address target;
+    bytes4 selector;
+  }
+
+  mapping(address => bool) public enabled;
+  mapping(address => mapping(address => bool)) public allowedTargets;
+  mapping(address => mapping(address => mapping(bytes4 => bool))) public allowedSelectors;
+  mapping(address => address[]) private targetLists;
+  mapping(address => SelectorRule[]) private selectorRuleLists;
+
+  event AllowedTargetAdded(address indexed account, address indexed target);
+  event AllowedTargetRemoved(address indexed account, address indexed target);
+  event AllowedSelectorAdded(address indexed account, address indexed target, bytes4 indexed selector);
+  event AllowedSelectorRemoved(
+    address indexed account,
+    address indexed target,
+    bytes4 indexed selector
+  );
+
+  function init(bytes calldata initData) external override {
+    (address[] memory targets, SelectorRule[] memory selectorRules) = abi.decode(
+      initData,
+      (address[], SelectorRule[])
+    );
+
+    enabled[msg.sender] = true;
+
+    uint256 targetLength = targets.length;
+    for (uint256 i = 0; i < targetLength; i += 1) {
+      _addAllowedTarget(msg.sender, targets[i]);
+    }
+
+    uint256 selectorRuleLength = selectorRules.length;
+    for (uint256 i = 0; i < selectorRuleLength; i += 1) {
+      SelectorRule memory rule = selectorRules[i];
+      _addAllowedSelector(msg.sender, rule.target, rule.selector);
+    }
+
+    emit Inited(msg.sender);
+  }
+
+  function disable() external override {
+    require(enabled[msg.sender], 'Selector allowlist hook is not enabled');
+    _clearAllowedTargets(msg.sender);
+    _clearAllowedSelectors(msg.sender);
+    enabled[msg.sender] = false;
+    emit Disabled(msg.sender);
+  }
+
+  function isInited(address account) external view override returns (bool) {
+    return enabled[account];
+  }
+
+  function state(address account)
+    external
+    view
+    returns (
+      bool accountEnabled,
+      address[] memory targets,
+      SelectorRule[] memory selectorRules
+    )
+  {
+    return (enabled[account], targetLists[account], selectorRuleLists[account]);
+  }
+
+  function isTargetAllowed(address account, address target) external view returns (bool) {
+    return allowedTargets[account][target];
+  }
+
+  function isSelectorAllowed(address account, address target, bytes4 selector)
+    external
+    view
+    returns (bool)
+  {
+    return allowedSelectors[account][target][selector];
+  }
+
+  function addAllowedTarget(address target) external {
+    require(enabled[msg.sender], 'Selector allowlist hook is not enabled');
+    _addAllowedTarget(msg.sender, target);
+  }
+
+  function removeAllowedTarget(address target) external {
+    require(enabled[msg.sender], 'Selector allowlist hook is not enabled');
+    require(allowedTargets[msg.sender][target], 'Target is not allowlisted');
+
+    delete allowedTargets[msg.sender][target];
+
+    address[] storage targets = targetLists[msg.sender];
+    uint256 length = targets.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      if (targets[i] == target) {
+        uint256 lastIndex = length - 1;
+        if (i != lastIndex) {
+          targets[i] = targets[lastIndex];
+        }
+        targets.pop();
+        break;
+      }
+    }
+
+    emit AllowedTargetRemoved(msg.sender, target);
+  }
+
+  function addAllowedSelector(address target, bytes4 selector) external {
+    require(enabled[msg.sender], 'Selector allowlist hook is not enabled');
+    _addAllowedSelector(msg.sender, target, selector);
+  }
+
+  function removeAllowedSelector(address target, bytes4 selector) external {
+    require(enabled[msg.sender], 'Selector allowlist hook is not enabled');
+    require(
+      allowedSelectors[msg.sender][target][selector],
+      'Target selector is not allowlisted'
+    );
+
+    delete allowedSelectors[msg.sender][target][selector];
+
+    SelectorRule[] storage selectorRules = selectorRuleLists[msg.sender];
+    uint256 length = selectorRules.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      SelectorRule storage rule = selectorRules[i];
+      if (rule.target == target && rule.selector == selector) {
+        uint256 lastIndex = length - 1;
+        if (i != lastIndex) {
+          selectorRules[i] = selectorRules[lastIndex];
+        }
+        selectorRules.pop();
+        break;
+      }
+    }
+
+    emit AllowedSelectorRemoved(msg.sender, target, selector);
+  }
+
+  function validationHook(bytes32, Transaction calldata transaction) external view override {
+    if (!enabled[msg.sender]) {
+      return;
+    }
+
+    address target = address(uint160(transaction.to));
+    if (target == msg.sender) {
+      return;
+    }
+
+    if (transaction.data.length < 4) {
+      require(allowedTargets[msg.sender][target], 'Target is not allowlisted');
+      return;
+    }
+
+    bytes4 selector = _selector(transaction.data);
+    require(
+      allowedSelectors[msg.sender][target][selector],
+      'Target selector is not allowlisted'
+    );
+  }
+
+  function debugValidation(address account, Transaction calldata transaction)
+    external
+    view
+    returns (
+      bool accountEnabled,
+      address target,
+      uint256 dataLength,
+      bytes4 selector,
+      bool targetAllowed,
+      bool selectorAllowed,
+      bool wouldAllow
+    )
+  {
+    accountEnabled = enabled[account];
+    target = address(uint160(transaction.to));
+    dataLength = transaction.data.length;
+    targetAllowed = allowedTargets[account][target];
+    wouldAllow = !accountEnabled;
+
+    if (target == account) {
+      return (accountEnabled, target, dataLength, bytes4(0), targetAllowed, false, true);
+    }
+
+    if (dataLength < 4) {
+      return (
+        accountEnabled,
+        target,
+        dataLength,
+        bytes4(0),
+        targetAllowed,
+        false,
+        targetAllowed
+      );
+    }
+
+    selector = _selector(transaction.data);
+    selectorAllowed = allowedSelectors[account][target][selector];
+    wouldAllow = !accountEnabled || selectorAllowed;
+  }
+
+  function supportsInterface(bytes4 interfaceId) public view override(ERC165, IERC165) returns (bool) {
+    return interfaceId == type(IValidationHook).interfaceId || super.supportsInterface(interfaceId);
+  }
+
+  function _selector(bytes calldata data) internal pure returns (bytes4 selector) {
+    selector = bytes4(
+      (uint32(uint8(data[0])) << 24)
+        | (uint32(uint8(data[1])) << 16)
+        | (uint32(uint8(data[2])) << 8)
+        | uint32(uint8(data[3]))
+    );
+  }
+
+  function _addAllowedTarget(address account, address target) internal {
+    require(target != address(0), 'Target must not be zero');
+    require(target != account, 'Account self-target is implicit');
+    require(!allowedTargets[account][target], 'Target already allowlisted');
+
+    allowedTargets[account][target] = true;
+    targetLists[account].push(target);
+
+    emit AllowedTargetAdded(account, target);
+  }
+
+  function _addAllowedSelector(address account, address target, bytes4 selector) internal {
+    require(target != address(0), 'Target must not be zero');
+    require(target != account, 'Account self-target is implicit');
+    require(
+      !allowedSelectors[account][target][selector],
+      'Target selector already allowlisted'
+    );
+
+    allowedSelectors[account][target][selector] = true;
+    selectorRuleLists[account].push(SelectorRule({ target: target, selector: selector }));
+
+    emit AllowedSelectorAdded(account, target, selector);
+  }
+
+  function _clearAllowedTargets(address account) internal {
+    address[] storage targets = targetLists[account];
+    uint256 length = targets.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      delete allowedTargets[account][targets[i]];
+    }
+    delete targetLists[account];
+  }
+
+  function _clearAllowedSelectors(address account) internal {
+    SelectorRule[] storage selectorRules = selectorRuleLists[account];
+    uint256 length = selectorRules.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      SelectorRule storage rule = selectorRules[i];
+      delete allowedSelectors[account][rule.target][rule.selector];
+    }
+    delete selectorRuleLists[account];
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/ValidationHookManager.sol

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@matterlabs/zksync-contracts/contracts/system-contracts/libraries/TransactionHelper.sol';
+import '@openzeppelin/contracts/utils/introspection/ERC165Checker.sol';
+import './Auth.sol';
+import './IValidationHook.sol';
+
+abstract contract ValidationHookManager is Auth {
+  using ERC165Checker for address;
+
+  mapping(address => bool) public validationHooks;
+  address[] internal validationHookList;
+
+  event ValidationHookAdded(address indexed hook);
+  event ValidationHookRemoved(address indexed hook);
+
+  function addValidationHook(address hook, bytes calldata initData) external onlySelf {
+    _addValidationHook(hook, initData);
+  }
+
+  function removeValidationHook(address hook) external onlySelf {
+    _removeValidationHook(hook);
+  }
+
+  function listValidationHooks() external view returns (address[] memory hooks) {
+    hooks = validationHookList;
+  }
+
+  function _addValidationHook(address hook, bytes calldata initData) internal {
+    require(hook != address(0), 'Hook must not be zero');
+    require(hook != address(this), 'Account can not be a hook');
+    require(hook.code.length > 0, 'Hook must be a deployed contract');
+    require(!validationHooks[hook], 'Hook already enabled');
+    require(
+      hook.supportsInterface(type(IValidationHook).interfaceId),
+      'Hook does not support validation interface'
+    );
+
+    validationHooks[hook] = true;
+    validationHookList.push(hook);
+    IValidationHook(hook).init(initData);
+    emit ValidationHookAdded(hook);
+  }
+
+  function _removeValidationHook(address hook) internal {
+    require(validationHooks[hook], 'Hook is not enabled');
+    delete validationHooks[hook];
+
+    uint256 length = validationHookList.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      if (validationHookList[i] == hook) {
+        uint256 lastIndex = length - 1;
+        if (i != lastIndex) {
+          validationHookList[i] = validationHookList[lastIndex];
+        }
+        validationHookList.pop();
+        break;
+      }
+    }
+
+    try IValidationHook(hook).disable() {} catch {}
+
+    emit ValidationHookRemoved(hook);
+  }
+
+  function _runValidationHooks(
+    bytes32 signedHash,
+    Transaction calldata transaction
+  ) internal {
+    uint256 length = validationHookList.length;
+    for (uint256 i = 0; i < length; i += 1) {
+      IValidationHook(validationHookList[i]).validationHook(signedHash, transaction);
+    }
+  }
+}

package/dist/builtin-account-profiles/contracts/sed-lite/ValidatorManager.sol

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.17;
+
+import '@openzeppelin/contracts/utils/introspection/ERC165Checker.sol';
+import './Auth.sol';
+import './IValidator.sol';
+
+abstract contract ValidatorManager is Auth {
+  using ERC165Checker for address;
+
+  address public validator;
+
+  event ValidatorChanged(address indexed previousValidator, address indexed newValidator);
+
+  function setValidator(address newValidator) external onlySelf {
+    _setValidator(newValidator);
+  }
+
+  function _setValidator(address newValidator) internal {
+    require(newValidator != address(0), 'Validator must not be zero');
+    require(newValidator != address(this), 'Account can not be a validator');
+    require(newValidator.code.length > 0, 'Validator must be a deployed contract');
+    require(
+      newValidator.supportsInterface(type(IK1Validator).interfaceId),
+      'Validator does not support K1 interface'
+    );
+
+    emit ValidatorChanged(validator, newValidator);
+    validator = newValidator;
+  }
+}

package/dist/builtin-account-profiles/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "@zk-agent/account-profiles",
+  "private": true,
+  "type": "module"
+}

package/dist/connector-ui/assets/index-BnFLonFL.css

@@ -0,0 +1 @@
+:root{color:#e7eefb;background:radial-gradient(circle at top,rgba(236,186,66,.18),transparent 38%),radial-gradient(circle at 20% 20%,rgba(61,135,255,.18),transparent 30%),linear-gradient(180deg,#091120,#050a14);font-family:IBM Plex Sans,Segoe UI,sans-serif}*{box-sizing:border-box}body{margin:0;min-height:100vh}.page{min-height:100vh;display:grid;place-items:center;padding:24px}.card{width:min(860px,100%);padding:32px;border-radius:24px;background:#080f1feb;border:1px solid rgba(122,145,201,.22);box-shadow:0 30px 80px #00000059}.eyebrow{margin:0 0 8px;text-transform:uppercase;letter-spacing:.16em;color:#9fc0ff;font-size:12px}h1{margin:0 0 12px;font-size:36px}.lede{margin:0 0 24px;color:#b7c6e7;line-height:1.6}.meta{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin:0 0 24px}.meta div{padding:14px 16px;border-radius:16px;background:#131c35f2;border:1px solid rgba(145,162,204,.18)}.meta dt{color:#8fa3d7;font-size:12px;text-transform:uppercase;margin-bottom:6px}.meta dd{margin:0;font-family:Cascadia Code,Consolas,monospace;word-break:break-word}.callout{padding:16px 18px;border-radius:18px;background:#2c4c9133;color:#d7e1fb}.panel{margin-top:22px;padding:18px;border-radius:18px;background:#0d172de6;border:1px solid rgba(122,145,201,.14)}.panel-header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:14px}.panel h2{margin:0;font-size:18px}.state-pill{padding:8px 12px;border-radius:999px;font-family:Cascadia Code,Consolas,monospace;font-size:12px;text-transform:uppercase;letter-spacing:.08em}.state-pill--good{background:#47c48a29;border:1px solid rgba(71,196,138,.28);color:#9cf0c3}.state-pill--warn{background:#efbe5424;border:1px solid rgba(239,190,84,.22);color:#f7df9f}.state-pill--bad{background:#ff727224;border:1px solid rgba(255,114,114,.24);color:#ffb1b1}.state-pill--muted{background:#7a91c91f;border:1px solid rgba(122,145,201,.2);color:#c2d1f3}.chip-row{display:flex;flex-wrap:wrap;gap:10px}.chip{padding:8px 12px;border-radius:999px;background:#efbe541f;border:1px solid rgba(239,190,84,.18);color:#f7df9f;font-family:Cascadia Code,Consolas,monospace;font-size:12px}.form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:14px}.form-grid label{display:grid;gap:8px}.form-grid span,.helper,.status{color:#9eb2de;font-size:14px}.helper-stack{display:grid;gap:8px;margin-bottom:14px}.helper-stack code,.status code{font-family:Cascadia Code,Consolas,monospace;color:#e7eefb}.field-stack{display:grid;gap:8px}.field-stack span{color:#9eb2de;font-size:14px}.form-grid input,.payload{width:100%;border:1px solid rgba(122,145,201,.24);border-radius:14px;background:#040a16f5;color:#e7eefb;padding:12px 14px;font:inherit}.payload{min-height:220px;margin-top:12px;resize:vertical;font-family:Cascadia Code,Consolas,monospace;font-size:13px;line-height:1.5}.command-block{width:100%;min-height:88px;border:1px solid rgba(122,145,201,.24);border-radius:14px;background:#040a16f5;color:#e7eefb;padding:12px 14px;resize:vertical;font:13px/1.5 Cascadia Code,Consolas,monospace}.actions{display:flex;align-items:center;flex-wrap:wrap;gap:14px;margin-top:14px}.compact-meta{margin-bottom:0}button{border:0;border-radius:999px;padding:12px 18px;background:linear-gradient(135deg,#f2cc63,#db9a2f);color:#1e1606;font-weight:700;cursor:pointer}button:disabled{cursor:not-allowed;opacity:.45}.button-secondary{background:#7a91c91f;color:#d7e1fb;border:1px solid rgba(122,145,201,.24);font-weight:600}.status-error{color:#ffb1b1}@media (max-width: 720px){.card{padding:22px;border-radius:20px}h1{font-size:30px}.panel-header{align-items:flex-start;flex-direction:column}}