Fix one-click deploy: valid WASM, icp-cli manifest, wasm auto-discovery

[johnnyclem]

Fixes the init → package → deploy --network local onboarding flow, which failed at every step past packaging.

Root causes found

1. generateWasm emitted structurally invalid WASM — the replica rejected it with IC0505 ("Failed to decode wasm module ... offset 0xb"). The hand-rolled encoder had a missing custom-section name-length prefix, wrong func-type encodings (no result count), 4 exports pointing at only 2 declared functions, malformed memory/code/data sections, and unsigned LEB where signed is required.
2. deploy routed to icp-cli with no project manifest and no project root — icp-cli walked up the directory tree and choked on unrelated icp.yaml files (e.g. AgentVault's own internal-format one), and could never deploy a bare WASM anyway.
3. init's next-steps said deploy --network local but the wasm argument was required.

Changes

• Rewrote the WASM section encoding in compiler.ts; every generated module is now checked with WebAssembly.validate before being returned, and validateWasmFile runs full engine validation instead of magic-byte checks.
• agentvault package now writes an icp-cli-compatible icp.yaml (script build step copying the packaged WASM — avoids the remote recipe registry, whose templates aren't compatible with all icp-cli binary versions). Marker-guarded: user-managed manifests are never overwritten.
• deployWithIcpCli pins --project-root-override to the agent project, generates the manifest if missing, and auto-starts the local network in the background when it isn't running.
• deploy's wasm argument is now optional — auto-discovers dist/<name>.wasm via agent.json.
• Version bumped to 1.0.6 (1.0.5 on npm lacks these fixes).

Verification

• 1,516 tests pass (16 new: manifest generation, icp-cli deploy path, WASM validity/instantiation).
• Full E2E from a packed tarball in a clean directory with icp-cli 0.1.0 and no dfx:
  npx agentvault init clem-agent --template minimal → package ./ → deploy --network local --yes deploys a canister to the auto-started local network (Canister ID 4ld2s-rd777-77775-aaaaq-cai).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-vault	Canceled		Jul 13, 2026 7:21pm
agentvault	Ready	Preview, Comment	Jul 13, 2026 7:21pm