Use atomic writes for wallet storage, enhance balance command

saveWallet now writes to a temp file and renames into place to prevent
corruption on crash. Balance command shows on-chain USDC for both
Base Mainnet and Sepolia alongside the Run402 billing balance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: MajorTal

cli/lib/config.mjs

@@ -3,9 +3,10 @@
  * Kept in a separate module so credential reads stay isolated.
  */
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "fs";
-import { join } from "path";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, renameSync } from "fs";
+import { join, dirname } from "path";
 import { homedir } from "os";
+import { randomBytes } from "crypto";
 
 export const CONFIG_DIR = join(homedir(), ".config", "run402");
 export const WALLET_FILE = join(CONFIG_DIR, "wallet.json");
@@ -19,8 +20,10 @@ export function readWallet() {
 
 export function saveWallet(data) {
   mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(WALLET_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
-  try { chmodSync(WALLET_FILE, 0o600); } catch {}
+  const tmp = join(CONFIG_DIR, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
+  writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+  renameSync(tmp, WALLET_FILE);
+  chmodSync(WALLET_FILE, 0o600);
 }
 
 export function loadProjects() {

cli/lib/wallet.mjs

@@ -9,7 +9,7 @@ Subcommands:
   status    Show wallet address, network, and funding status
   create    Generate a new wallet and save it locally
   fund      Request test USDC from the Run402 faucet (Base Sepolia)
-  balance   Check billing balance for this wallet
+  balance   Show on-chain USDC (mainnet + testnet) and Run402 billing balance
   export    Print the wallet address (useful for scripting)
 
 Notes:
@@ -24,11 +24,15 @@ Examples:
   run402 wallet export
 `;
 
+const USDC_ABI = [{ name: "balanceOf", type: "function", stateMutability: "view", inputs: [{ name: "account", type: "address" }], outputs: [{ name: "", type: "uint256" }] }];
+const USDC_MAINNET = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+const USDC_SEPOLIA = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
+
 async function loadDeps() {
   const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
   const { createPublicClient, http } = await import("viem");
-  const { baseSepolia } = await import("viem/chains");
-  return { generatePrivateKey, privateKeyToAccount, createPublicClient, http, baseSepolia };
+  const { base, baseSepolia } = await import("viem/chains");
+  return { generatePrivateKey, privateKeyToAccount, createPublicClient, http, base, baseSepolia };
 }
 
 async function status() {
@@ -37,7 +41,7 @@ async function status() {
     console.log(JSON.stringify({ status: "no_wallet", message: "No wallet found. Run: run402 wallet create" }));
     return;
   }
-  console.log(JSON.stringify({ status: "ok", address: w.address, created: w.created, funded: w.funded || false }));
+  console.log(JSON.stringify({ status: "ok", address: w.address, created: w.created, funded: w.funded || false, path: WALLET_FILE }));
 }
 
 async function create() {
@@ -66,13 +70,35 @@ async function fund() {
   }
 }
 
+async function readUsdcBalance(client, usdc, address) {
+  const raw = await client.readContract({ address: usdc, abi: USDC_ABI, functionName: "balanceOf", args: [address] });
+  return Number(raw) / 1e6;
+}
+
 async function balance() {
   const w = readWallet();
   if (!w) { console.log(JSON.stringify({ status: "error", message: "No wallet. Run: run402 wallet create" })); process.exit(1); }
-  const res = await fetch(`${API}/v1/billing/accounts/${w.address.toLowerCase()}`);
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+
+  const { createPublicClient, http, base, baseSepolia } = await loadDeps();
+  const mainnetClient = createPublicClient({ chain: base, transport: http() });
+  const sepoliaClient = createPublicClient({ chain: baseSepolia, transport: http() });
+
+  const [mainnetUsdc, sepoliaUsdc, billingRes] = await Promise.all([
+    readUsdcBalance(mainnetClient, USDC_MAINNET, w.address).catch(() => null),
+    readUsdcBalance(sepoliaClient, USDC_SEPOLIA, w.address).catch(() => null),
+    fetch(`${API}/v1/billing/accounts/${w.address.toLowerCase()}`),
+  ]);
+
+  const billing = billingRes.ok ? await billingRes.json() : null;
+
+  console.log(JSON.stringify({
+    address: w.address,
+    onchain: {
+      "base-mainnet": mainnetUsdc !== null ? `${mainnetUsdc} USDC` : "unavailable",
+      "base-sepolia": sepoliaUsdc !== null ? `${sepoliaUsdc} USDC` : "unavailable",
+    },
+    run402: billing || "no billing account",
+  }, null, 2));
 }
 
 async function exportAddr() {