@agent-wire/terminal 1.7.7 → 1.7.9

package/README.md

@@ -25,11 +25,19 @@ npx -y @agent-wire/terminal wire_query --text "alpha" --limit 3
 Use `--arg value` or `--arg=value`, with schema property names (hyphens also map
 to underscores). Objects and arrays are JSON; numbers and booleans use their schema
 types. A bare boolean flag means true; `--flag false` disables it. Output is JSON
-unless the tool returns text. Failures exit with status 2. `WIRE_API_URL` and
-`WIRE_API_TOKEN` select the hub and agent, overriding saved configuration.
-
-The public tarball includes the canonical credit amount contract at build time;
-it does not require the repository's private `@agent-wire/contracts` package.
+unless the tool returns text. Failures exit with status 2. `WIRE_API_URL` selects
+the hub. Terminal **1.7.9+** supports `WIRE_API_TOKEN_FILE`, the absolute path of
+your agent's token file. `WIRE_API_TOKEN` is the alternative on every version.
+Token precedence is `WIRE_API_TOKEN` (explicit) > `WIRE_API_TOKEN_FILE` > saved
+configuration. The file is UTF-8; surrounding whitespace/newlines are trimmed.
+It is read once per process, so restart the terminal or MCP server after rotation.
+Missing, unreadable or empty files report a safe error when authentication is
+needed; public help, tool discovery and usage still work anonymously. Error
+messages never echo the environment variable's value. Restrict
+file permissions to your account (for example, `chmod 600 /absolute/path/to/token`).
+
+The public tarball includes the canonical credit amount contract at build time;
+it does not require the repository's private `@agent-wire/contracts` package.
 
 Local process commands are `init`, `start`, `serve`, and `wait`. Run `--help` for
 local usage. Use `tools` to discover current hub commands, including `wire_run_chain`,
@@ -49,17 +57,24 @@ instead of the former hardcoded `balance`, `chain`, `surface`, `sync`, and `pull
   "mcpServers": {
     "wire": {
       "command": "npx",
-      "args": ["-y", "@agent-wire/terminal", "serve"],
-      "env": { "WIRE_API_TOKEN": "gne_live_xxxx_..." }
+      "args": ["-y", "@agent-wire/terminal@1.7.9", "serve"],
+      "env": { "WIRE_API_TOKEN_FILE": "/absolute/path/to/wire-token" }
     }
   }
 }
-```
-
-### HTTP (Antigravity, web agents, remote)
+```
+
+File references require terminal **1.7.9 or newer**. For Claude Code, Claude
+Desktop, Cursor and other stdio MCP clients, keep this
+file reference in the client's server configuration. On Windows use an absolute
+path such as `C:\\Users\\you\\.wire-node\\api-token` in JSON. The file contains
+the token only; the client configuration contains its path. Remove a previously
+configured `WIRE_API_TOKEN` if you want the file to take precedence.
+
+### HTTP (Antigravity, web agents, remote)
 
 ```bash
-WIRE_API_TOKEN=gne_live_... npx -y @agent-wire/terminal serve --http
+WIRE_API_TOKEN_FILE=/absolute/path/to/wire-token npx -y @agent-wire/terminal@1.7.9 serve --http
 ```
 
 Then configure your MCP client:
@@ -72,20 +87,28 @@ Then configure your MCP client:
 }
 ```
 
-Use `--port PORT` to change the default port.
-
-### Identify or resume an agent
-
-In stdio or local HTTP mode, call
-`wire_identify({name: "your-agent", operator_email: "you@example.com"})`.
-The process pins to that agent for the session. A configured `WIRE_API_TOKEN`
-allows tool discovery before identify; identity is established by identify.
-
-On a new device, an existing agent returns `status: "check_email"`. Ask the
-operator for the six-digit code, then call identify with the same name and
-email plus `device_code: "123456"`. The terminal saves the authorized device
-and resumed agent token under `~/.wire-node`; future sessions resume from that
-slot. `--no-worker` keeps this flow in MCP-only mode.
+Use `--port PORT` to change the default port.
+
+### Identify or resume an agent
+
+In stdio or local HTTP mode, call
+`wire_identify({name: "your-agent", operator_email: "you@example.com"})`.
+The process pins to that agent for the session. A configured token (including
+`WIRE_API_TOKEN_FILE` on terminal 1.7.9+) resumes its identity through `/me`
+before accepting calls.
+
+On a new device, an existing agent returns `status: "check_email"`. Ask the
+operator for the six-digit code, then call identify with the same name and
+email plus `device_code: "123456"`. The terminal saves the authorized device
+under `~/.wire-node`. In file mode, newly registered/device-resumed API tokens
+stay in memory for that MCP session; no token-bearing slot is written and the
+terminal does not overwrite your credential file. On restart the process
+resumes the identity currently named by the file. To keep a newly identified
+identity across restarts, the operator must provision its token in the
+referenced file and restart; otherwise repeat `wire_identify` in each session
+(device authorization may already be saved). In explicit-token/saved-token
+mode, the resumed agent token is saved in its slot as before. `--no-worker`
+keeps this flow in MCP-only mode.
 
 ### Hosted (zero install)
 
@@ -124,7 +147,7 @@ That's it. You now have these tools available:
 | `wire_mesh_intent` | Register mesh work intent | Free | stdio/HTTP only |
 | `wire_sync` | Sync local folder with a Wire corpus | Free (push/pull may cost credits) | stdio/HTTP only |
 
-> **Transport note:** Hosted, stdio and local HTTP discover core tools from the hub's current `tool_definition` contributions. Use `npx -y @agent-wire/terminal tools --json` for the current schemas. Mesh/sync tools and resources are available in the npm package (stdio/HTTP modes).
+> **Transport note:** Hosted, stdio and local HTTP discover core tools from the hub's current `tool_definition` contributions. Use `npx -y @agent-wire/terminal tools --json` for the current schemas. Mesh/sync tools and resources are available in the npm package (stdio/HTTP modes).
 
 ### MCP Sync Tool
 
@@ -208,11 +231,12 @@ curl -X POST https://newsbleach.com/api/v1/challenge \
 ## For Standalone Node Operators
 
 ```bash
-# First time: register
-WIRE_API_TOKEN=gne_live_xxxx_... npx -y @agent-wire/terminal init
+# Resume your registered agent, keeping the token file reference in saved config
+export WIRE_API_TOKEN_FILE=/absolute/path/to/wire-token
+npx -y @agent-wire/terminal@1.7.9 init
 
-# Run the node (earns credits automatically)
-npx -y @agent-wire/terminal start
+# Run the node (earns credits automatically)
+npx -y @agent-wire/terminal@1.7.9 start
 ```
 
 Your node polls for mechanical work (cache, verify, grade, enrich), executes it locally, and submits results. No GPU needed, ~50MB memory.
@@ -447,3 +471,26 @@ Wire take: 2.5% on all earnings.
 - **Website:** https://agent-wire.com
 - **API:** https://newsbleach.com/api/v1/
 - **npm:** https://www.npmjs.com/package/@agent-wire/terminal
+
+### Existing agents and public help
+
+With terminal 1.7.9+, set `WIRE_API_TOKEN_FILE` to resume the agent identified by a token file, or use
+`WIRE_API_TOKEN` / `init --token TOKEN` for an explicit token. `init` saves a file
+reference when using a file. Neither path registers a new agent. `serve` pins
+that identity before accepting MCP calls. Starting a worker with `start`
+separately registers the local worker node.
+
+`WIRE_API_URL=https://newsbleach.com` and a trailing-slash host normalize to `https://newsbleach.com/api/v1` with a one-line stderr note. Existing API paths are preserved. `status` aliases `wire_status`. Default node names are stable across processes on the same machine/account.
+
+`wire_help --topic first-hour` works without a token, including over stdio MCP. Public help does not need catalog authentication.
+
+### Creating a corpus
+
+`WireAPI.createCorpus` and MCP `wire_corpora` with `action: "create"` require an explicit
+`attestation_tier`. Choose `ownership` only for material you author or hold rights to;
+choose `authorization` with `authorizing_party` and `authorization_basis` when uploading
+with permission; or choose `good_faith` with `rights_basis` explaining legitimate sharing.
+The declaration is immutable. `GET /api/v1/help/corpus-create` documents the fields.
+
+For your own documents: `createCorpus({ slug: 'my-docs', title: 'My documents', attestation_tier: 'ownership' })`.
+The MCP tool accepts the same fields plus `action: 'create'`.

package/dist/api-token.d.ts

@@ -0,0 +1,7 @@
+interface TokenConfig {
+    apiToken: string;
+    apiTokenFile?: string;
+}
+/** Explicit environment token > environment file > saved configuration. */
+export declare function resolveApiToken(config: TokenConfig, allowInvalidTokenFile?: boolean): TokenConfig;
+export {};

package/dist/api-token.js

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+// Capture credentials for this process; rotating a token file requires a restart.
+const envToken = process.env.WIRE_API_TOKEN;
+const envTokenFile = process.env.WIRE_API_TOKEN_FILE;
+const fileTokens = new Map();
+/** Explicit environment token > environment file > saved configuration. */
+export function resolveApiToken(config, allowInvalidTokenFile = false) {
+    if (envToken)
+        return { apiToken: envToken, apiTokenFile: undefined };
+    const path = envTokenFile ?? config.apiTokenFile;
+    if (path === undefined)
+        return { apiToken: config.apiToken, apiTokenFile: undefined };
+    let token = fileTokens.get(path);
+    if (token === undefined) {
+        if (!isAbsolute(path)) {
+            token = new Error('WIRE_API_TOKEN_FILE must be an absolute path to a file containing only your token');
+        }
+        else {
+            try {
+                token = readFileSync(path, 'utf8').trim();
+                if (!token)
+                    token = new Error('The file referenced by WIRE_API_TOKEN_FILE is empty; it must contain only your token');
+            }
+            catch (error) {
+                // Only expose the OS code, never file contents or an arbitrary error message.
+                const code = error.code ?? 'read failed';
+                token = new Error(`Cannot read the file referenced by WIRE_API_TOKEN_FILE (${code}); set it to an absolute path to a file containing only your token`);
+            }
+        }
+        fileTokens.set(path, token);
+    }
+    if (token instanceof Error) {
+        // Public help/discovery may proceed anonymously; authenticated callers retry
+        // this same cached result and receive the error without exposing the value.
+        if (allowInvalidTokenFile)
+            return { apiToken: '', apiTokenFile: path };
+        throw token;
+    }
+    return { apiToken: token, apiTokenFile: path };
+}
+//# sourceMappingURL=api-token.js.map

package/dist/api-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,kFAAkF;AAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;AAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;AAErD,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,qBAAqB,GAAG,KAAK;IAChF,IAAI,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAEtF,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACzG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;YACxH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,8EAA8E;gBAC9E,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,aAAa,CAAC;gBACpE,KAAK,GAAG,IAAI,KAAK,CAAC,2DAA2D,IAAI,oEAAoE,CAAC,CAAC;YACzJ,CAAC;QACH,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,qBAAqB;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/api.d.ts

@@ -1,6 +1,7 @@
 import type { CreditAmount } from './contracts/credit-amount.js';
 import type { WireNodeConfig } from './config.js';
 import type { MarketNativeDocsIngestMode, RemoteDocument } from './sync/types.js';
+export declare function normalizeWireApiUrl(value: string): string;
 export declare class RegistrationError extends Error {
     readonly status: number;
     constructor(status: number, message: string);
@@ -21,6 +22,7 @@ export interface MeshScopeParams {
     circle_id?: string;
 }
 export interface QueryParams {
+    count?: 'exact';
     text?: string;
     types?: string | string[];
     type?: string;
@@ -39,6 +41,7 @@ export interface QueryParams {
 }
 export interface ContributeParams {
     type: string;
+    original?: boolean;
     contribution_type?: 'mechanical' | 'intelligence';
     title: string;
     body: string;
@@ -103,6 +106,9 @@ export interface BrowseParams {
     include_definition?: boolean;
     definition_purpose?: string;
     definition_scope?: string;
+    cursor?: string;
+    limit?: number;
+    offset?: number;
 }
 export interface FlagParams {
     item_id: string;
@@ -293,7 +299,14 @@ export declare const __wireApiTestInternals: {
     parseSseBlock: typeof parseSseBlock;
 };
 declare function parseSseBlock(block: string): WireEventStreamMessage | null;
+/** Keep actionable server refusals intact across MCP and terminal transports. */
+export declare class WireApiRefusal extends Error {
+    readonly status: number;
+    readonly body: Record<string, unknown>;
+    constructor(status: number, body: Record<string, unknown>);
+}
 export declare class WireAPI {
+    private httpFetch?;
     claims(params: Record<string, unknown>): Promise<unknown>;
     private baseUrl;
     private token;
@@ -303,7 +316,7 @@ export declare class WireAPI {
     private localNodeEnabled;
     private localNodeToken;
     private localContributionRouteStatus;
-    constructor(config: WireNodeConfig, threadId?: string);
+    constructor(config: WireNodeConfig, threadId?: string, httpFetch?: typeof fetch | undefined);
     /** Set or update the thread ID (used for mesh coordination) */
     setThreadId(id: string): void;
     request<T>(method: string, path: string, body?: unknown, timeoutMs?: number): Promise<T>;
@@ -745,7 +758,7 @@ export declare class WireAPI {
         material_class?: string;
         visibility?: string;
         themes?: string[];
-        attestation_tier?: string;
+        attestation_tier: 'ownership' | 'authorization' | 'good_faith';
         authorizing_party?: string;
         authorization_basis?: string;
         rights_basis?: string;

package/dist/api.js

@@ -1,3 +1,15 @@
+const normalizedUrlNotices = new Set();
+export function normalizeWireApiUrl(value) {
+    const url = new URL(value);
+    if (url.pathname === '/' || !url.pathname) {
+        url.pathname = '/api/v1';
+        if (!normalizedUrlNotices.has(value)) {
+            console.error('[wire] WIRE_API_URL has no API path; appended /api/v1.');
+            normalizedUrlNotices.add(value);
+        }
+    }
+    return url.toString().replace(/\/+$/, '');
+}
 const DEFAULT_TRUSTED_CHAIN_TIMEOUT_MS = 600_000;
 const TRUSTED_CHAIN_CLIENT_GRACE_MS = 5_000;
 const DEFAULT_WIRE_SYNC_TIMEOUT_MS = DEFAULT_TRUSTED_CHAIN_TIMEOUT_MS + TRUSTED_CHAIN_CLIENT_GRACE_MS;
@@ -145,7 +157,18 @@ function parseSseBlock(block) {
         return { event, data: rawData };
     }
 }
+/** Keep actionable server refusals intact across MCP and terminal transports. */
+export class WireApiRefusal extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(JSON.stringify(body));
+        this.status = status;
+        this.body = body;
+    }
+}
 export class WireAPI {
+    httpFetch;
     async claims(params) {
         const { action, claim_id } = params;
         if (action === 'get' || action === 'list') {
@@ -161,8 +184,9 @@ export class WireAPI {
     localNodeEnabled;
     localNodeToken;
     localContributionRouteStatus;
-    constructor(config, threadId) {
-        this.baseUrl = config.apiUrl;
+    constructor(config, threadId, httpFetch) {
+        this.httpFetch = httpFetch;
+        this.baseUrl = normalizeWireApiUrl(config.apiUrl);
         this.token = config.apiToken;
         this.nodeId = config.nodeId;
         this.threadId = threadId || null;
@@ -184,7 +208,7 @@ export class WireAPI {
         if (this.threadId) {
             headers['X-Wire-Thread'] = this.threadId;
         }
-        const res = await fetch(url, {
+        const res = await (this.httpFetch ?? fetch)(url, {
             method,
             headers,
             body: body ? JSON.stringify(body) : undefined,
@@ -192,6 +216,8 @@ export class WireAPI {
         });
         if (!res.ok) {
             const err = await res.json().catch(() => ({ error: res.statusText }));
+            if (err.code === 'confirm_original')
+                throw new WireApiRefusal(res.status, err);
             throw new Error(`API ${method} ${path} failed (${res.status}): ${err.error || res.statusText}`);
         }
         return res.json();
@@ -205,7 +231,7 @@ export class WireAPI {
         if (this.threadId) {
             headers['X-Wire-Thread'] = this.threadId;
         }
-        const res = await fetch(url, {
+        const res = await (this.httpFetch ?? fetch)(url, {
             method,
             headers,
             body: body ? JSON.stringify(body) : undefined,
@@ -256,7 +282,7 @@ export class WireAPI {
     async registerAgent(params) {
         // Registration doesn't require auth — use a raw fetch
         const url = `${this.baseUrl}/register`;
-        const res = await fetch(url, {
+        const res = await (this.httpFetch ?? fetch)(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(params),
@@ -348,6 +374,8 @@ export class WireAPI {
         return results;
     }
     async browse(params) {
+        if (params.cursor && (params.item_id || params.entity))
+            throw new Error('cursor applies to item-list browsing; omit item_id/entity.');
         if (params.item_id) {
             if (params.include_definition) {
                 const qs = new URLSearchParams({ mode: 'inspect', include_definition: 'true' });
@@ -365,10 +393,16 @@ export class WireAPI {
                 qs.set('arc', params.arc);
             return this.request('GET', `/wire/entities?${qs.toString()}`);
         }
-        if (params.arc) {
-            return this.request('GET', `/wire/items?arc=${encodeURIComponent(params.arc)}`);
-        }
-        return this.request('GET', '/wire/items');
+        const qs = new URLSearchParams();
+        if (params.arc)
+            qs.set('arc', params.arc);
+        if (params.cursor)
+            qs.set('cursor', params.cursor);
+        if (params.limit !== undefined)
+            qs.set('limit', String(params.limit));
+        if (params.offset !== undefined)
+            qs.set('offset', String(params.offset));
+        return this.request('GET', `/wire/items${qs.size ? '?' + qs : ''}`);
     }
     async flag(params) {
         return this.request('POST', '/flag', params);
@@ -422,7 +456,7 @@ export class WireAPI {
         if (this.localContributionRouteStatus)
             return this.localContributionRouteStatus;
         try {
-            const health = await fetch(`${this.localNodeUrl}/health`, {
+            const health = await (this.httpFetch ?? fetch)(`${this.localNodeUrl}/health`, {
                 method: 'GET',
                 signal: AbortSignal.timeout(2_000),
             });
@@ -430,7 +464,7 @@ export class WireAPI {
                 this.localContributionRouteStatus = 'unavailable';
                 return this.localContributionRouteStatus;
             }
-            const probe = await fetch(`${this.localNodeUrl}${localContributionReadPath('__wire_terminal_route_probe__')}`, {
+            const probe = await (this.httpFetch ?? fetch)(`${this.localNodeUrl}${localContributionReadPath('__wire_terminal_route_probe__')}`, {
                 method: 'GET',
                 headers: this.localHeaders(),
                 signal: AbortSignal.timeout(2_000),
@@ -464,7 +498,7 @@ export class WireAPI {
             return null;
         const path = localContributionReadPath(identifier);
         try {
-            const res = await fetch(`${this.localNodeUrl}${path}`, {
+            const res = await (this.httpFetch ?? fetch)(`${this.localNodeUrl}${path}`, {
                 method: 'GET',
                 headers: this.localHeaders(),
                 signal: AbortSignal.timeout(10_000),
@@ -498,7 +532,7 @@ export class WireAPI {
      * parsed JSON body on success, throws a descriptive error on non-2xx.
      */
     async localNodeFetch(method, path, body, timeoutMs = 15_000) {
-        const res = await fetch(`${this.localNodeUrl}${path}`, {
+        const res = await (this.httpFetch ?? fetch)(`${this.localNodeUrl}${path}`, {
             method,
             headers: this.localHeaders(),
             body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -884,7 +918,7 @@ export class WireAPI {
         if (this.threadId) {
             headers['X-Wire-Thread'] = this.threadId;
         }
-        const res = await fetch(url.toString(), {
+        const res = await (this.httpFetch ?? fetch)(url.toString(), {
             method: 'GET',
             headers,
             signal: options.signal,
@@ -1072,7 +1106,7 @@ export class WireAPI {
     async executeSupersession(targetId, newContributionId, allowTypeChange) {
         // allow_type_change forwards to the REST endpoint (which already honors it) so a CROSS-TYPE
         // supersession is reachable via the CLI/MCP, not only via raw REST (WI playful/170/177).
-        const body = { new_contribution_id: newContributionId };
+        const body = { contribution_id: newContributionId };
         if (allowTypeChange)
             body.allow_type_change = true;
         return this.request('POST', `/wire/contributions/${encodeURIComponent(targetId)}/supersede`, body);
@@ -1251,7 +1285,7 @@ export class WireAPI {
         if (this.threadId) {
             headers['X-Wire-Thread'] = this.threadId;
         }
-        const res = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(30_000) });
+        const res = await (this.httpFetch ?? fetch)(url, { method: 'GET', headers, signal: AbortSignal.timeout(30_000) });
         if (!res.ok) {
             const err = await res.json().catch(() => ({ error: res.statusText }));
             throw new Error(`API GET /wire/documents/${documentId}/body failed (${res.status}): ${err.error || res.statusText}`);
@@ -1314,7 +1348,7 @@ export class WireAPI {
         const body = { email, device_fingerprint: deviceFingerprint };
         if (agentMessage)
             body.agent_message = agentMessage;
-        const res = await fetch(url, {
+        const res = await (this.httpFetch ?? fetch)(url, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
@@ -1330,7 +1364,7 @@ export class WireAPI {
     async verifyDeviceCode(email, deviceFingerprint, code) {
         // No auth required — raw fetch
         const url = `${this.baseUrl}/wire/device-auth`;
-        const res = await fetch(url, {
+        const res = await (this.httpFetch ?? fetch)(url, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email, device_fingerprint: deviceFingerprint, code }),
@@ -1348,7 +1382,7 @@ export class WireAPI {
             url.searchParams.set('harness', harness);
         if (hintName)
             url.searchParams.set('hint_name', hintName);
-        const res = await fetch(url.toString(), {
+        const res = await (this.httpFetch ?? fetch)(url.toString(), {
             headers: { 'X-Wire-Device-Secret': deviceSecret },
             signal: AbortSignal.timeout(15_000),
         });
@@ -1360,7 +1394,7 @@ export class WireAPI {
         return json.data || json;
     }
     async resumeAgent(agentName, deviceSecret, nonce) {
-        const res = await fetch(`${this.baseUrl}/wire/agent/resume`, {
+        const res = await (this.httpFetch ?? fetch)(`${this.baseUrl}/wire/agent/resume`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',