Merge develop into master

.github/workflows/changeset-check.yml

@@ -44,7 +44,7 @@ jobs:
           fi
 
       - name: Comment on PR (success)
-        if: steps.check.outputs.has_changeset == 'true'
+        if: steps.check.outputs.has_changeset == 'true' && !github.event.pull_request.head.repo.fork
         uses: actions/github-script@v7
         with:
           script: |
@@ -68,7 +68,7 @@ jobs:
             }
 
       - name: Comment on PR (failure)
-        if: failure()
+        if: failure() && !github.event.pull_request.head.repo.fork
         uses: actions/github-script@v7
         with:
           script: |

.gitignore

@@ -12,3 +12,6 @@ package-lock.json
 # Test coverage
 coverage/
 *.lcov
+
+# Sisyphus plans and sessions
+.sisyphus/

.sisyphus/plans/ckb-tx-dumper.md

@@ -0,0 +1,175 @@
+# Replace ckb-transaction-dumper with ccc-based implementation
+
+## TL;DR
+
+> **Quick Summary**: Replace `ckb-transaction-dumper` npm package with a pure ccc-based implementation.
+>
+> **Deliverables**:
+>
+> - New `src/tools/ckb-tx-dumper.ts` (replaces old implementation)
+> - Removed `ckb-transaction-dumper` from package.json
+>
+> **Estimated Effort**: Medium (2-3 hours)
+> **Parallel Execution**: NO - sequential
+
+---
+
+## Context
+
+### Request
+
+Replace `ckb-transaction-dumper` with ccc-based implementation (no external dependencies, use ccc throughout).
+
+### Current Implementation
+
+- `src/tools/ckb-tx-dumper.ts` spawns `ckb-transaction-dumper` binary
+- Depends on npm package `ckb-transaction-dumper@0.4.2`
+
+### What TransactionDumper Does
+
+1. Load transaction (from file or fetch by hash)
+2. Resolve cell deps (handle dep_group type)
+3. Resolve inputs
+4. Output mock transaction JSON for ckb-debugger
+
+### ccc Molecule Support
+
+ccc provides full molecule codec:
+
+- `ccc.molecule.struct()` - for OutPoint { tx_hash, index }
+- `ccc.molecule.vector()` - for OutPointVec
+- `ccc.Byte32`, `ccc.Uint32LE` - predefined codecs
+
+No manual bytes parsing needed!
+
+---
+
+## Work Objectives
+
+### Core Objective
+
+Replace `ckb-transaction-dumper` with pure ccc implementation.
+
+### Must Have
+
+- Keep `DumpOption` interface
+- Keep `dumpTransaction()` signature
+- Same JSON output format
+
+### Must NOT Have
+
+- Breaking API changes
+- New dependencies
+
+---
+
+## TODOs
+
+- [ ] 1. Implement ccc-based transaction dumper
+
+  **What to do**:
+
+  - Rewrite `src/tools/ckb-tx-dumper.ts`
+  - Use ccc Client for RPC calls
+  - Use ccc molecule codecs for dep_group unpacking
+
+  **Key implementation**:
+
+  ```typescript
+  import { ccc } from '@ckb-ccc/core';
+
+  // OutPoint codec for dep_group unpacking
+  const OutPointCodec = ccc.molecule.struct({
+    txHash: ccc.Byte32,
+    index: ccc.Uint32LE,
+  });
+
+  const OutPointVecCodec = ccc.molecule.vector(OutPointCodec);
+
+  // Unpack dep_group data
+  function unpackDepGroup(data: string): ccc.OutPoint[] {
+    return OutPointVecCodec.decode(data).map((o) =>
+      ccc.OutPoint.from({ txHash: o.txHash, index: '0x' + o.index.toString(16) }),
+    );
+  }
+  ```
+
+  **Acceptance Criteria**:
+
+  - [ ] Uses ccc Client for RPC
+  - [ ] Uses ccc molecule for dep_group
+  - [ ] Same output format
+
+  **QA Scenarios**:
+
+  ```
+  Scenario: Compiles successfully
+    Tool: Bash
+    Steps: npm run typecheck
+    Expected: No errors
+  ```
+
+  **Commit**: `feat: implement transaction dumper with ccc`
+
+---
+
+- [ ] 2. Remove ckb-transaction-dumper dependency
+
+  **What to do**:
+
+  - Remove from `package.json`
+  - Run `pnpm install`
+
+  **Commit**: `chore: remove ckb-transaction-dumper`
+
+---
+
+## Verification
+
+```bash
+npm run typecheck
+npm run lint
+grep -c "ckb-transaction-dumper" package.json || echo "Clean"
+```
+
+## Key Implementation Notes
+
+### Dep Group Unpacking with ccc
+
+```typescript
+const OutPointCodec = ccc.molecule.struct({
+  txHash: ccc.Byte32,
+  index: ccc.Uint32LE,
+});
+const OutPointVecCodec = ccc.molecule.vector(OutPointCodec);
+
+// Usage
+const outpoints = OutPointVecCodec.decode(cellData);
+```
+
+### Mock Transaction Structure
+
+```typescript
+interface MockTransaction {
+  mock_info: {
+    inputs: MockInput[];
+    cell_deps: MockCellDep[];
+    header_deps: any[];
+  };
+  tx: Transaction;
+}
+```
+
+### Algorithm
+
+1. Load tx from file
+2. For each cell_dep:
+   - Fetch cell
+   - If dep_type === 'dep_group':
+     - Decode cell.data as OutPointVec
+     - Fetch each referenced cell
+   - Add to mock_info.cell_deps
+3. For each input:
+   - Fetch referenced cell
+   - Add to mock_info.inputs
+4. Write JSON output

CHANGELOG.md

@@ -1,5 +1,17 @@
 # @offckb/cli
 
+## 0.4.7
+
+### Patch Changes
+
+- 1c17600: Bump @ckb-ccc/core to 1.14.0 to fix the ws vulnerability (ws >= 8.21.0).
+- a687c6f: Bump default CKB version to 0.207.0
+- 3da9777: Replace ckb-transaction-dumper with ccc-based implementation
+
+  - Rewrite transaction dumper to use ccc Client and molecule codecs
+  - Implement dep_group unpacking using ccc.mol
+  - Remove ckb-transaction-dumper npm dependency
+
 ## 0.4.6
 
 ### Patch Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@offckb/cli",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "ckb development network for your first try",
   "author": "CKB EcoFund",
   "license": "MIT",
@@ -78,15 +78,14 @@
     "typescript": "^5.3.3"
   },
   "dependencies": {
-    "@ckb-ccc/core": "1.5.3",
+    "@ckb-ccc/core": "1.14.0",
     "@iarna/toml": "^2.2.5",
     "@inquirer/prompts": "^7.8.6",
     "@types/http-proxy": "^1.17.15",
     "adm-zip": "^0.5.10",
     "blessed": "0.1.81",
     "chalk": "4.1.2",
     "child_process": "^1.0.2",
-    "ckb-transaction-dumper": "^0.4.2",
     "commander": "^12.0.0",
     "http-proxy": "^1.18.1",
     "https-proxy-agent": "^7.0.5",