Skip to content

@blockrun/core 0.1.0 + @blockrun/cli 0.2.0 — payment-signing takeover fix

Choose a tag to compare

View all tags
@VickyXAI VickyXAI released this 07 Aug 22:29
· 9 commits to master since this release
v0.2.0
98afd10

Security: a provider wallet could take over x402 payment signing

@blockrun/core's resolveFromFiles() consulted ~/.<app>/wallet.json files before the canonical ~/.blockrun/.session, returning whichever was modified most recently. Installing another product — or writing one file into the home directory — therefore changed which key resolvePrivateKey() handed to payment signing, across blockrun api, pay, chat, run, image, video, music, speech, and the data commands. scanWallets() also reported each file's self-declared address, so blockrun wallet recover could display an address the file held no key for.

  • resolveFromFiles() now reads .session → legacy wallet.key only. Discovered provider wallets never participate in automatic resolution.
  • scanWallets() derives each address from the discovered private key and drops unusable entries. The file's address field is no longer trusted anywhere.
  • WalletSource no longer includes "provider". Breaking for anything narrowing on that member.
  • Added listDiscoveredWallets() and adoptWallet(address) — the deliberate migration path. Adoption matches on the derived address and backs up the outgoing .session first, so funds are never stranded.

Why the CLI ships as 0.2.0

Two releases never reached npm before this one. @blockrun/cli 0.1.1 was tagged and changelogged on 2026-07-17 but never published — npm's latest was still 0.1.0 — and core 0.1.0 sat built-but-unpublished while @blockrun/cli@0.1.0 kept resolving @blockrun/core@^0.0.3, which carries the defect above.

A ^0.0.3 range cannot reach 0.1.0, so publishing core alone would have fixed nobody. The CLI ships too, with the range moved to ^0.1.0. 0.2.0 is the first build users can install that contains either the 0.1.1 work or this security fix.

Also in this release

  • Removed a vulnerable undici dependency chain, with a dependencies.test.ts guard. @blockrun/llm moves ^3.5.0 → ^3.9.0.
  • Hardened the CLI security boundaries (cli.ts, chat.ts, x402.ts, dispatch.ts, new http.ts, core/output.ts).
  • HTTP timeout made portable across Node versions.
  • blockrun wallet list and blockrun wallet adopt <address> added; wallet recover now reports entries in true resolution order and marks exactly one active.

Release automation

The repo had no publish workflow — releasing meant remembering to run npm publish twice, in the right order, by hand, which is how both prior releases were lost. .github/workflows/publish.yml now publishes on release: core first (the CLI's range must be resolvable before the CLI exists), then the CLI, each guarded against double-publishing, both with --provenance. It uses pnpm publish, not npm publish — only pnpm rewrites the workspace:^ protocol into a real semver range.

Verified: pnpm install --frozen-lockfile clean, build + typecheck clean, 57/57 tests pass, CI green on Node 20/22/24 including the packed-artifact smoke test that plants a newer provider wallet.json and asserts .session still wins.

Assets 2
Loading