fix(morpho-plugin): sync version refs to 0.2.7 + H2 headings in SUMMARY.md#298
fix(morpho-plugin): sync version refs to 0.2.7 + H2 headings in SUMMARY.md#298
Conversation
…RY.md Two unrelated-but-small doc/metadata fixes, bundled to avoid PR noise: 1. CI-003: Align version fields across files. The upstream build bot bumped plugin.yaml to 0.2.7 (commit 4ae9278 `build: morpho-plugin v0.2.7`) but left the other version fields at 0.2.6, causing `morpho-plugin --version` to report 0.2.6 and the in-SKILL.md update checker to ping against a mismatched LOCAL_VER. - Cargo.toml 0.2.6 -> 0.2.7 - .claude-plugin/plugin.json 0.2.6 -> 0.2.7 - SKILL.md frontmatter 0.2.6 -> 0.2.7 - SKILL.md inline refs: LOCAL_VER, download URL (@0.2.7), managed marker write, install-report JSON, --version expected string (6 occurrences total) CHANGELOG v0.2.6 header intentionally preserved (historical). 2. SUMMARY.md: convert bold section titles to H2 so the webview renders them as proper headings instead of blending with body copy. - **Overview** -> ## Overview - **Prerequisites** -> ## Prerequisites - **Quick Start** -> ## Quick Start Docs/metadata only — no code changes. No additional version bump (we are aligning to the already-released 0.2.7). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
morpho-plugin quickstart |
Check wallet state and get personalized next steps |
morpho supply |
Deposit assets to MetaMorpho vaults |
morpho withdraw |
Withdraw from MetaMorpho vaults |
morpho borrow |
Borrow from Morpho Blue markets |
morpho repay |
Repay Morpho Blue debt (partial or full) |
morpho supply-collateral |
Supply collateral to Blue markets |
morpho withdraw-collateral |
Withdraw collateral from Blue markets |
morpho positions |
View all positions with health factors |
morpho markets |
List available markets with APYs |
morpho vaults |
Browse MetaMorpho vaults |
morpho claim-rewards |
Claim Merkl rewards |
Triggers
Activate this skill when users mention Morpho-related activities like "supply to morpho", "borrow from morpho", "morpho health factor", "my morpho positions", "morpho interest rates", "metamorpho vaults", or "claim morpho rewards". Also trigger for general lending/borrowing requests on Ethereum or Base networks.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/morpho-plugin"
CACHE_MAX=3600
LOCAL_VER="0.2.7"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/morpho-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: morpho-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill morpho-plugin --yes --global 2>/dev/null || true
echo "Updated morpho-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall morpho-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/morpho-plugin" "$HOME/.local/bin/.morpho-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/morpho-plugin@0.2.7/morpho-plugin-${TARGET}${EXT}" -o ~/.local/bin/.morpho-plugin-core${EXT}
chmod +x ~/.local/bin/.morpho-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/morpho-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "0.2.7" > "$HOME/.plugin-store/managed/morpho-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/morpho-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"morpho-plugin","version":"0.2.7"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"morpho-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 88/100
1. Plugin Overview
Summary: A Rust-based CLI plugin that integrates with the Morpho lending protocol on Ethereum and Base. Supports MetaMorpho vault deposits/withdrawals, Morpho Blue lending markets (supply collateral, borrow, repay, withdraw collateral), and Merkl reward claims. Uses onchainos CLI for all on-chain write operations. Target Users: DeFi users who want to supply assets to earn yield in MetaMorpho vaults or borrow against collateral on Morpho Blue, via an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnEthereum Mainnet (chain 1) and Base (chain 8453). Overall Permission SummaryThe plugin can read wallet state, construct ERC-20 approval + Morpho Blue / MetaMorpho / Merkl calldata, and submit transactions via onchainos. It explicitly delegates signing to onchainos TEE (no private key handling). Approvals are submitted with 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all write operations are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully Compliant5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
No other static rules matched. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. C01 is in auto-injected block (excluded), direct-financial is present but paired with confirmation gates and proper data boundary declarations. Prompt Injection ScanChecked for: instruction override, identity manipulation, hidden behavior, confirmation bypass, base64 blobs, invisible chars. The auto-injected block contains a base64 key used for HMAC signing — this is the standard CI install-report pattern, excluded from review per instructions. Result: ✅ Clean Dangerous Operations CheckThe plugin performs transfers, contract calls, and broadcasting. User confirmation steps:
Result: ✅ Safe Data Exfiltration RiskNo environment variable access, no credential reading, no file writes outside standard Cargo output. All network requests go to documented, purposeful endpoints. Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build ConfigRust (edition 2021), entry point Dependency Analysis
No unmaintained, suspicious, or vulnerable deps detected. Code Safety Audit
Subprocess Call Safety
Does SKILL.md accurately describe what the source code does?Yes — all 11 commands in SKILL.md map directly to implementations in Verdict: ✅ Source Safe7. Code ReviewQuality Score: 88/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-structured Morpho lending plugin with strong safety defaults (preview-by-default, explicit Merge recommendation: ✅ Ready to merge Minor cleanup suggestions (dead deps, dead code, longer L1 tx timeout) can be addressed in a follow-up PR. Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
Two small doc/metadata fixes, bundled to avoid PR noise.
1. Align version fields to 0.2.7 (CI-003)
The upstream build bot's commit `4ae9278 build: morpho-plugin v0.2.7` bumped only `plugin.yaml` and left the other version fields at `0.2.6`. That's why `morpho-plugin --version` reports `0.2.6` today — it reads `Cargo.toml`.
Aligned now:
Inline refs updated: `LOCAL_VER`, download URL (`morpho-plugin@0.2.7`), managed marker write, install-report JSON, `--version` expected string.
`CHANGELOG` `### v0.2.6` header intentionally preserved (historical).
2. SUMMARY.md — H2 section headings
Convert bold section titles to proper H2 so the webview renders them as headings instead of blending with body copy.
Same treatment as PR #290 (hyperliquid-plugin). Content of the Quick Start steps is unchanged — they already point at `morpho-plugin quickstart` as step 1.
Scope
Test plan
🤖 Generated with Claude Code