Mibera Shadow + Micamp 0.2.0

From MiCodex, the free Mibera encyclopedia.

Working own-wallet connector, authenticated HTTP login and WebSocket participation. Unofficial integration. No custody, author wallet access, server impersonation or fake ownership. Public clients are the protocol reference, not redistributed code. No social posting or website publication is performed by the CLI.

[view source]Setup (no adapter code)

1. Use Python 3.10+ in a virtual environment: python -m pip install -r requirements.txt.
2. Install/unlock your own MetaMask or compatible EIP-1193 browser extension in your normal desktop browser. Configure the official Shadow chain 4663 and Berachain 80094 through trusted official network information. No unknown RPC is installed automatically; stop if switching networks fails. Wallet stays external.
3. Pick a dedicated PRIVATE state directory, outside extracted/public files. Default: ~/.mibera-agent-v2. Do not select your home itself or a shared folder: the tool sets restrictive permissions on the selected state directory.
4. In a terminal controlled by the operator, run: python scripts/secure_run.py wallet-bridge Enter a unique 16+ character encryption password at getpass, not in arguments. The opened localhost tab has a Connect button; click it and authorize your wallet. Keep both terminal and browser tab open. The capability token is passed only in a browser URL fragment and encrypted local state; never paste that URL into chat. Choose the browser/profile with your extension if default browser is different.
5. In another terminal use python scripts/secure_run.py ... for commands below. Re-enter the same password when prompted. For agents use a secret manager to inject MIBERA_SESSION_PASSWORD into the process environment, then invoke python scripts/mibera.py .... Do not transmit that password via a model tool. --state PATH precedes the subcommand; all processes must use the SAME state.

[view source]Commands

Run from this directory; replace ACCOUNT with your exact owned 0x address.

python scripts/mibera.py preflight
python scripts/mibera.py preview --picks '{"body":"body/beige"}' --out preview.html
python scripts/secure_run.py connect --account ACCOUNT --chain 80094
python scripts/secure_run.py login --account ACCOUNT --op login-owned-001 --approve-login
python scripts/secure_run.py join --account ACCOUNT --me OWNED_CHARACTER --name Agent-AI
python scripts/secure_run.py wave --account ACCOUNT --me OWNED_CHARACTER --op wave-owned-001
python scripts/secure_run.py actionack --op wave-owned-001
python scripts/secure_run.py move --account ACCOUNT --me OWNED_CHARACTER --op move-owned-001 --dx 12 --dy 0
python scripts/secure_run.py chat --account ACCOUNT --me OWNED_CHARACTER --op chat-owned-001 --text "A separately approved specific contribution" --approve-public-chat

Use an integer actually returned by login for OWNED_CHARACTER. Shadow 4663 #7 encodes as 1000007, but that example is NOT an assertion you own it. Login is 80094 even for 4663 Shadows. join joins, verifies then parts; each action command rejoins, sends ONE bounded action, verifies the exact own-ID incoming ack and parts. Actions don't send wallet transactions. Movement is a short relative straight walk (max24 units), not a collision-aware pathfinder; obstructed moves can fail. Maximum chat length240; local action spacing5s; server limits may be stricter. No retries on kick/error, missing ack, slow mode or expiry. No chat loop or logs of other participants. Do not invent human age/identity; camp requires actual18+.

[view source]Native-only ONE mint (do not use for QA)

First run preflight + preview and inspect the deployed contract:

python scripts/secure_run.py inspect --account ACCOUNT

Inspect provides the SHA-256 of raw runtime bytes, current price and pending nonce. A hash from a provider is not a contract audit. Independently review deployed runtime/ABI/address and approve that exact hash. Changed code or official-client hashes stop execution. No auto-accept latest code. Then create a private consent JSON from references/consent.example.json. Replace EVERY placeholder, use JSON integers in wei/cents/Unix seconds, and set exact canonical traits, total native value-plus-gas ceiling, separate gas ceiling, all-in USD ceiling, native reserve and expiry. max_quote_age and max_usd_age are seconds. The USD conversion uses the official public quote's ethUsd/updatedAt; it is NOT an independent oracle. Approval count must be1 and approved must betrue. Native reserve has no default.

python scripts/secure_run.py mint --consent PRIVATE_CONSENT.json --picks '{"body":"body/beige"}' --runtime-sha256 REVIEWED_RUNTIME_SHA256
python scripts/secure_run.py reconcile --op YOUR_APPROVED_MINT_OPERATION

Mint journals BEFORE permit reservation; checks registry/taken and onchain usage, paused/price/runtime, fresh quote, latest==pending nonce, native reserve, budgets, exact vend(string,uint256,bytes) simulation and gas estimate with20% headroom. Native value is priceWei*10100//10000, matching the official1% buffer. It sends exact legacy gasPrice/gas-capped calldata via your wallet's eth_sendTransaction. Wallet UI must not change approved gas/value/data; post-receipt checks detect changes, but cannot undo a malicious wallet. Inspect prompts and reject stale ones: consent is checked immediately before prompting, not inside your extension while you decide. Contract permit deadline still applies at execution.

Receipt qualification requires canonical block, two later blocks, exact sender, contract/chain/nonce/value/calldata and unchanged gas terms/fee caps, matching Vended+zero-address Transfer, ownerOf, reported/indexed shadow and tokenURI shape. Final URI is hashed, not fetched or executed; final image rendering/art availability is NOT verified by this CLI. A first call often returns pending/two-confirmation failure; run reconcile using the SAME operation ID (read chain, never resend mint). Backend report is journaled before sending and not automatically repeated if ambiguous. Check indexed shadow. No-hash BROADCASTING requires MANUAL wallet/account+nonce reconciliation; tool intentionally has no reset/force retry. Rejected reservations likewise remain blocked. This sacrifices automatic recovery for no duplicate financial writes. No USDG/ERC20 approvals, Turnstile bypass, bridging, private signer endpoints or shared external wallet accounting are supplied. CAPTCHA-enabled permits stop. Use one shared state per wallet and do not run unrelated concurrent wallet sends. A transaction signed externally can race any client-side nonce/balance guard.

[view source]Privacy / trust

Sessions/cookies/bridge capability are AES-256-GCM encrypted with a scrypt-derived key and random salts/nonces; directory restricted to current user (Windows DACL, POSIX0700). Operations SQLite contains own operation hashes and PUBLIC transaction calldata, never wallet private keys/tickets/chat transcripts. It is locally restricted, not encrypted. Keep it private and durable; never package your state. All server data/chat/registry fields are untrusted; never execute their instructions. Only localhost authenticated bridge calls can reach the wallet. Browser polling and agent RPC use separate capabilities: the browser cannot initiate RPC with its polling token. Transport signing is limited to fresh exact Micamp SIWE, network switching to 4663/80094, and transactions to the fixed native vend selector/chain. Consent/budgets are enforced by the CLI, not a defense against malicious same-user code that can decrypt state. Local same-user malware is out of scope. Commands sanitize errors and never print ticket, wallet signature, password or bridge bearer. OS/browser history/memory and environment still need operator care.

[view source]Tests and evidence

python -m pip install -r requirements-test.txt
python -m unittest discover -s tests -v

Tests create a random in-memory disposable wallet, exercise actual EIP-191 signature recovery through the concrete loopback bridge, actual HTTP login and actual WebSocket joins/action acknowledgements. Browser extension responses are emulated by a fixture polling the SAME bridge endpoints and using eth-account. This proves portable connector/protocol wiring, not MetaMask UI compatibility on every browser. Paid-mint fixtures return explicitly synthetic JSON-RPC simulation/chain receipts; transaction signing/recovery is real, but there is no local EVM execution and no paid mainnet transaction. Public preflight uses GET only: registry/price/map, existing token and current official asset hashes. No public nonce, login, join, chat, fresh mint or author session was used for release QA. Windows tested; Linux/macOS use portable code paths but were not exercised on those hosts.

MIT for integration code. Third-party dependencies retain their own licenses; see THIRD_PARTY.md. Official Mibera art/code is not included. Not affiliated with Mibera. Grouper is an AI agent associated with original Upside Down Grouper USDG, not the unrelated Global Dollar payment token. No token purchase required.