release/0.5.2 - #66
Merged
Merged
Conversation
…critical errors - SECURITY.md: new "Why trust VaultPilot?" section before Trust boundaries — states the threat model in plain language and how layered crypto binding produces a visible mismatch on-device. - README.md: mirrored short version at top of Security model; updates the layered-defenses paragraph to cover clear-sign (decoded fields) vs blind-sign (hash) on-device checks and lists the WalletConnect session-topic cross-check; `get_ledger_status` description now mentions the `topic` return + Ledger Live → Settings → Connected Apps verification. - Security-critical error paths (EVM + TRON payload-hash mismatch, previewToken mismatch, TRON device-address mismatch, unexpected signature shape) now carry a `SECURITY:` prefix and explicit "do NOT retry this handle" guidance so users know to re-prepare from scratch and what to check rather than blindly retry. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Rolls up post-0.5.1 security/UX changes: - Auto-run preview-time checks: agent-side ABI decode + pair-consistency pre-sign hash recomputation now run unprompted at preview_send and report in a CHECKS PERFORMED block (PR #57, #59). - Swiss-knife decoder URL surfaces as a Markdown hyperlink fallback when the agent's ABI decode is low-confidence (PR #59, #62). - WalletConnect session-topic cross-check: get_ledger_status now returns the WC `topic`; the agent is instructed to surface its last 8 chars and ask the user to verify a matching session in Ledger Live → Settings → Connected Apps, catching peer impersonation that the self-reported name/URL pair can't (PR #61). - Clear-sign vs blind-sign branching in on-device check reminders — Aave / Lido / 1inch / LiFi / approve flows check decoded fields, not a hash (PR #59 prose refinements). - Agent-prompt notation fix: `{✓|✗|⚠}` placeholders instead of `[…]` so literal Markdown brackets + inline-code backticks survive the agent's paraphrase (PR #63). - Integrator string reverted to "vaultpilot-mcp" on LiFi (PR #60). - Plain-English "Why trust VaultPilot?" framing at top of SECURITY.md and mirrored in README Security model; security-critical error paths (payload-hash mismatch, previewToken mismatch, TRON device-address mismatch, unexpected signature shape) now carry a `SECURITY:` prefix and explicit "do NOT retry this handle — re-prepare from scratch" guidance so users know what to check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rolls up post-0.5.1 security and verification-UX changes into a patch release.
preview_sendand report in aCHECKS PERFORMEDblock (no more user-consent menu per check). See PRs refactor(verify): auto-run ABI decode + pair-consistency checks at preview #57 / fix(verify): cover both Ledger display modes in on-device reminders #59.get_ledger_statusreturns the WCtopic; agent surfaces last 8 chars and asks the user to verify a matching session in Ledger Live → Settings → Connected Apps. Catches peer impersonation that the self-reported name/URL alone can't (PR feat(security): surface WC session topic for Connected Apps cross-check #61).{✓|✗|⚠}placeholders instead of[…]so literal Markdown brackets and inline-code backticks survive the agent's paraphrase (PR fix(verify): distinguish placeholder brackets from literal Markdown syntax #63).SECURITY.md, mirrored briefly in README's Security model.SECURITY:prefix + explicit "do NOT retry this handle — re-prepare from scratch" guidance on payload-hash mismatch (EVM + TRON), previewToken mismatch, TRON device-address mismatch, and unexpected-signature-shape errors."vaultpilot-mcp"(PR chore(lifi): set integrator to "vaultpilot-mcp" #60).Test plan
npm run build— cleannpm test— 482/482 passpreview_send, verify agent auto-emits CHECKS PERFORMED with ABI-decode ✓ and pair-consistency-hash ✓ linesget_ledger_statussurfaces WC session topic (last 8 chars) and directs user to Ledger Live → Connected Appsserver.json🤖 Generated with Claude Code