@bankr/cli 0.3.35 → 0.3.38

package/README.md

@@ -58,6 +58,8 @@ bankr whoami
 bankr logout
 ```
 
+Accounts with two-factor authentication enabled get a browser step during `bankr login email`: the CLI prints (and, when interactive, opens) an approval link on bankr.bot, you verify with your passkey there, and the CLI continues once it sees the approval. The link is valid for five minutes; in a headless run, pass it along to whoever holds the passkey. The approval also covers the rest of that login for five minutes, so if you linger on the key-name prompts past that you'll get a second link. If it expires, or you'd rather skip the hop, generate a key at [bankr.bot/api-keys](https://bankr.bot/api-keys) and use `bankr login --api-key`.
+
 ### Prompts
 
 ```bash
@@ -94,9 +96,11 @@ bankr launch --name "TESTCOIN" --image "https://example.com/img.png" \
 # Quick launch (name only, skip confirmation)
 bankr launch --name "TESTCOIN" -y
 
-# Pair the pool with a tokenized stock instead of WETH (Robinhood Chain or Base)
+# Pair the pool with a tokenized stock or another listed quote token instead of WETH (Robinhood Chain or Base)
 bankr launch quotes --chain robinhood        # list the quote tokens you can pair with
 bankr launch --name "TESTCOIN" --chain robinhood --quote TSLA -y
+bankr launch --name "TESTCOIN" --chain robinhood --quote musebook -y
+bankr launch --name "TESTCOIN" --chain robinhood --quote BNKR -y      # the Robinhood Chain BNKR contract
 
 # Fee recipient types: x, farcaster, ens, wallet
 bankr launch --name "TESTCOIN" --fee "vitalik.eth" --fee-type ens -y
@@ -178,12 +182,13 @@ Credentials are stored in `~/.bankr/config.json`.
 
 Environment variables override stored values:
 
-| Variable        | Description                                                |
-| --------------- | ---------------------------------------------------------- |
-| `BANKR_API_KEY` | API key (overrides stored key)                             |
-| `BANKR_API_URL` | API URL (default: `https://api.bankr.bot`)                 |
-| `BANKR_LLM_KEY` | LLM gateway key (falls back to `BANKR_API_KEY` if not set) |
-| `BANKR_LLM_URL` | LLM gateway URL (default: `https://llm.bankr.bot`)         |
+| Variable        | Description                                                                |
+| --------------- | -------------------------------------------------------------------------- |
+| `BANKR_API_KEY` | API key (overrides stored key)                                             |
+| `BANKR_API_URL` | API URL (default: `https://api.bankr.bot`)                                 |
+| `BANKR_WEB_URL` | Web app URL for browser approval links (default: derived from the API URL) |
+| `BANKR_LLM_KEY` | LLM gateway key (falls back to `BANKR_API_KEY` if not set)                 |
+| `BANKR_LLM_URL` | LLM gateway URL (default: `https://llm.bankr.bot`)                         |
 
 ## API Key
 

package/dist/cli.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
 import { Command } from "commander";
 import { input } from "@inquirer/prompts";
 import { balancesCommand } from "./commands/balances.js";
@@ -9,7 +8,7 @@ import { swapCommand } from "./commands/swap.js";
 import { skillsCommand } from "./commands/capabilities.js";
 import { cancelCommand } from "./commands/cancel.js";
 import { configGetCommand, configSetCommand } from "./commands/config.js";
-import { setConfigPath } from "./lib/config.js";
+import { CLI_VERSION, setConfigPath } from "./lib/config.js";
 import { getErrorMessage } from "./lib/errors.js";
 import { passthroughArgs } from "./lib/passthrough.js";
 import { claudeCommand, creditsCommand, creditsAddCommand, creditsAutoCommand, modelsCommand, opencodeCommand, setupClaudeCodeCommand, setupCursorCommand, setupOpenclawCommand, setupOpenCodeCommand, } from "./commands/llm.js";
@@ -33,7 +32,6 @@ import { filesListCommand, filesUploadCommand, filesDownloadCommand, filesMkdirC
 import { clubStatusCommand, clubSignupCommand, clubCancelCommand, } from "./commands/club.js";
 import * as output from "./lib/output.js";
 import { checkForUpdate } from "./lib/updateCheck.js";
-const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
 /**
  * Read prompt text from stdin (piped) or interactively.
  * Bypasses shell expansion so dollar signs and special characters are preserved.
@@ -81,7 +79,7 @@ function colorizeHelp(text) {
 program
     .name("bankr")
     .description("Bankr AI agent CLI\n\n  Docs:   https://docs.bankr.bot\n  Skills: https://docs.bankr.bot/skills/overview")
-    .version(pkg.version, "-v, --version", "Show CLI version")
+    .version(CLI_VERSION, "-v, --version", "Show CLI version")
     .helpOption("-h, --help", "Display help")
     .helpCommand(false)
     .option("--config <path>", "Path to config file (default: ~/.bankr/config.json)")
@@ -126,8 +124,10 @@ loginCmd
     .option("--accept-terms", "Accept Terms of Service (skips prompt)")
     .option("--key-name <name>", "API key name (default: CLI)")
     .optionsGroup("API Permissions")
-    .option("--read-write", "Disable read-only mode (allow transactions)")
+    .option("--read-only", "Restrict the API key to read operations")
+    .option("--read-write", "Allow transactions (the default for new keys)")
     .option("--no-wallet-api", "Disable Wallet API (enabled by default)")
+    .option("--no-agent-api", "Disable Agent API (enabled by default)")
     .option("--no-token-launch", "Disable Token Launch API (enabled by default)")
     .option("--llm", "Enable LLM gateway on the API key")
     .optionsGroup("Security")
@@ -142,8 +142,10 @@ loginCmd
         code: opts.code,
         acceptTerms: opts.acceptTerms,
         keyName: opts.keyName,
+        readOnly: opts.readOnly,
         readWrite: opts.readWrite,
         walletApi: opts.walletApi,
+        agentApi: opts.agentApi,
         tokenLaunch: opts.tokenLaunch,
         llm: opts.llm,
         allowedIps: opts.allowedIps,
@@ -158,6 +160,7 @@ loginCmd
     .optionsGroup("API Permissions")
     .option("--read-write", "Disable read-only mode (allow transactions)")
     .option("--no-wallet-api", "Disable Wallet API (enabled by default)")
+    .option("--no-agent-api", "Disable Agent API (enabled by default)")
     .option("--no-token-launch", "Disable Token Launch API (enabled by default)")
     .optionsGroup("Security")
     .option("--allowed-ips <ips>", "Comma-separated IP/CIDR allowlist, e.g. 1.2.3.4,10.0.0.0/24")
@@ -171,6 +174,7 @@ loginCmd
         keyName: opts.keyName,
         readWrite: opts.readWrite,
         walletApi: opts.walletApi,
+        agentApi: opts.agentApi,
         tokenLaunch: opts.tokenLaunch,
         allowedIps: opts.allowedIps,
         allowedRecipients: opts.allowedRecipients,
@@ -1078,7 +1082,7 @@ async function main() {
         }
         output.fatal(getErrorMessage(err));
     }
-    await checkForUpdate(pkg.version);
+    await checkForUpdate(CLI_VERSION);
 }
 main();
 //# sourceMappingURL=cli.js.map

package/dist/commands/llm.js

@@ -869,10 +869,10 @@ export async function modelsCommand(opts = {}) {
     output.dim(`  Gateway: ${getLlmUrl()}`);
     output.dim(`  ${shown.length} model${shown.length === 1 ? "" : "s"}${view?.countSuffix ?? " available"}${live ? "" : " (cached)"}`);
     if (!view && shown.some((m) => m.private)) {
-        output.dim("  Private (TEE) — append :private to the model id (e.g. glm-5.2:private). List: bankr llm models --private");
+        output.dim("  Private (TEE) — append :private to the model id (e.g. glm-5.3-flash:private). List: bankr llm models --private");
     }
     if (!view && shown.some((m) => m.zdr)) {
-        output.dim("  Zero data retention — append :zdr to the model id (e.g. glm-5.2:zdr), or turn it on account-wide under Settings in the web terminal. List: bankr llm models --zdr");
+        output.dim("  Zero data retention — append :zdr to the model id (e.g. glm-5.3-flash:zdr), or turn it on account-wide under Settings in the web terminal. List: bankr llm models --zdr");
     }
 }
 /* ─────────────────────── bankr llm credits ─────────────────────────────────── */

package/dist/commands/login.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Thrown when a login-gated call answers with the MFA step-up envelope. A
+ * passkey ceremony can't run in a terminal, so the email flow can't recover;
+ * the caller turns this into the browser-key guidance instead of the server's
+ * fallback text.
+ */
+export declare class MfaStepUpError extends Error {
+    readonly context: string;
+    constructor(context: string);
+}
+/** Keyed on `code`, never on message text, so a server wording change can't
+ * silently turn this back into the opaque failure. */
+export declare function mfaStepUpErrorFrom(body: unknown): MfaStepUpError | null;
+/** The web app that fronts an API URL: `BANKR_WEB_URL` when set (local dev,
+ * staging), bankr.bot for the official API, else the API host with its
+ * `api.`/`api-` prefix dropped. */
+export declare function deriveWebOrigin(apiUrl: string): string;
 /**
  * Both Privy credentials minted by the OTP exchange. The identity token alone
  * authenticates, but only the ACCESS token carries the session `sid` claim —
@@ -11,6 +28,39 @@ interface CliAuthTokens {
 /** The auth headers every authenticated CLI call sends — one place, so a new
  * endpoint can't silently omit the access token and go unrevocable again. */
 export declare function authHeaders(tokens: CliAuthTokens): Record<string, string>;
+/**
+ * Maps the permission opt-out flags to the create-key body. Omitted fields
+ * are dropped by JSON.stringify so the server's API_KEY_CREATE_DEFAULTS
+ * decide them; only an explicit flag sends a value.
+ */
+export declare function resolveKeyPermissionOverrides(opts: {
+    readOnly?: boolean;
+    readWrite?: boolean;
+    agentApi?: boolean;
+}): {
+    readOnly?: boolean;
+    agentApiEnabled?: boolean;
+};
+declare const CHALLENGE_STATUSES: readonly ["pending", "verified", "expired", "abandoned", "failed"];
+export type ChallengeStatus = (typeof CHALLENGE_STATUSES)[number];
+/**
+ * One poll's outcome from its HTTP status. Only a definitive refusal ends the
+ * wait: the gate (401, an API without this route yet), another wallet's token
+ * (403) or a gone challenge (404). Anything else — 429, 5xx, a dropped
+ * connection — is a blip, so the wait keeps polling as if still pending.
+ */
+export declare function pollOutcome(httpStatus: number, body: unknown): ChallengeStatus;
+/**
+ * Poll until the challenge leaves `pending` or the deadline passes: once at
+ * once, then every 2s for the first 30s, then every 5s. Pure over its
+ * collaborators so the loop is unit-testable without a network.
+ */
+export declare function waitForChallengeApproval(deps: {
+    poll: () => Promise<ChallengeStatus>;
+    sleep: (ms: number) => Promise<void>;
+    deadlineMs: number;
+    now?: () => number;
+}): Promise<ChallengeStatus>;
 export declare function loginCommand(opts: {
     apiUrl?: string;
     apiKey?: string;
@@ -18,8 +68,10 @@ export declare function loginCommand(opts: {
     code?: string;
     acceptTerms?: boolean;
     keyName?: string;
+    readOnly?: boolean;
     readWrite?: boolean;
     walletApi?: boolean;
+    agentApi?: boolean;
     tokenLaunch?: boolean;
     llm?: boolean;
     llmKey?: string;

package/dist/commands/login.js

@@ -8,12 +8,50 @@ import { getErrorMessage } from "../lib/errors.js";
 const DEFAULT_DASHBOARD_URL = "https://bankr.bot/api-keys";
 const MAX_OTP_ATTEMPTS = 3;
 const INVALID_CODE_STATUSES = [400, 401, 422];
+/** The `code` the API's MFA gates send on every step-up 401 envelope
+ * (`sendStepUpRequired` in packages/api/src/middleware/mfaGate.ts). Duplicated
+ * here because the CLI can't import `@bankr/*` packages. */
+const MFA_STEP_UP_CODE = "MFA_STEP_UP_REQUIRED";
+/**
+ * Thrown when a login-gated call answers with the MFA step-up envelope. A
+ * passkey ceremony can't run in a terminal, so the email flow can't recover;
+ * the caller turns this into the browser-key guidance instead of the server's
+ * fallback text.
+ */
+export class MfaStepUpError extends Error {
+    constructor(context) {
+        super("MFA step-up required");
+        this.context = context;
+        this.name = "MfaStepUpError";
+    }
+}
+/** Keyed on `code`, never on message text, so a server wording change can't
+ * silently turn this back into the opaque failure. */
+export function mfaStepUpErrorFrom(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const { code, context } = body;
+    if (code !== MFA_STEP_UP_CODE)
+        return null;
+    return new MfaStepUpError(typeof context === "string" ? context : "unknown");
+}
+/** The web app that fronts an API URL: `BANKR_WEB_URL` when set (local dev,
+ * staging), bankr.bot for the official API, else the API host with its
+ * `api.`/`api-` prefix dropped. */
+export function deriveWebOrigin(apiUrl) {
+    const override = process.env.BANKR_WEB_URL?.trim();
+    if (override)
+        return override.replace(/\/+$/, "");
+    if (apiUrl === DEFAULT_API_URL)
+        return "https://bankr.bot";
+    // Anchored to the host's start so a host merely containing "api." is intact.
+    return apiUrl.replace(/\/+$/, "").replace(/^(https?:\/\/)api[.-]/, "$1");
+}
 function deriveDashboardUrl(apiUrl) {
     if (apiUrl === DEFAULT_API_URL) {
         return DEFAULT_DASHBOARD_URL;
     }
-    return (apiUrl.replace(/\/+$/, "").replace("api.", "").replace("api-", "") +
-        "/api-keys");
+    return `${deriveWebOrigin(apiUrl)}/api-keys`;
 }
 async function fetchPrivyConfig(apiUrl) {
     const res = await fetch(`${apiUrl}/cli/config`, {
@@ -52,6 +90,26 @@ export function authHeaders(tokens) {
         "x-access-token": tokens.accessToken,
     };
 }
+/**
+ * Maps the permission opt-out flags to the create-key body. Omitted fields
+ * are dropped by JSON.stringify so the server's API_KEY_CREATE_DEFAULTS
+ * decide them; only an explicit flag sends a value.
+ */
+export function resolveKeyPermissionOverrides(opts) {
+    if (opts.readOnly && opts.readWrite) {
+        throw new Error("--read-only and --read-write are mutually exclusive");
+    }
+    // Build conditionally: an own `undefined` key would clobber a value the
+    // caller set before spreading this in.
+    const overrides = {};
+    if (opts.readOnly)
+        overrides.readOnly = true;
+    else if (opts.readWrite)
+        overrides.readOnly = false;
+    if (opts.agentApi === false)
+        overrides.agentApiEnabled = false;
+    return overrides;
+}
 async function verifyPrivyOtp(privyConfig, email, code) {
     const res = await fetch("https://auth.privy.io/api/v1/passwordless/authenticate", {
         method: "POST",
@@ -80,7 +138,10 @@ async function callGenerateWallet(apiUrl, tokens) {
     });
     const body = (await res.json());
     if (!res.ok) {
-        throw new Error(body.message || body.error || `Wallet generation failed (${res.status})`);
+        throw (mfaStepUpErrorFrom(body) ??
+            new Error(body.message ||
+                body.error ||
+                `Wallet generation failed (${res.status})`));
     }
     return body;
 }
@@ -91,7 +152,8 @@ async function callAcceptTerms(apiUrl, tokens) {
     });
     if (!res.ok) {
         const body = (await res.json().catch(() => ({})));
-        throw new Error(body.message || body.error || `Accept terms failed (${res.status})`);
+        throw (mfaStepUpErrorFrom(body) ??
+            new Error(body.message || body.error || `Accept terms failed (${res.status})`));
     }
 }
 async function callGenerateApiKey(apiUrl, tokens, opts) {
@@ -102,10 +164,115 @@ async function callGenerateApiKey(apiUrl, tokens, opts) {
     });
     const body = (await res.json());
     if (!res.ok) {
-        throw new Error(body.message || body.error || `API key generation failed (${res.status})`);
+        throw (mfaStepUpErrorFrom(body) ??
+            new Error(body.message ||
+                body.error ||
+                `API key generation failed (${res.status})`));
     }
     return body;
 }
+// ── Out-of-band MFA approval ─────────────────────────────────────────
+// Mirrors `MFA_CHALLENGE_STATUSES` in @bankr/shared (the CLI can't import it).
+const CHALLENGE_STATUSES = [
+    "pending",
+    "verified",
+    "expired",
+    "abandoned",
+    "failed",
+];
+/** Narrow the status poll body; anything unrecognised reads as `failed`. */
+function parseChallengeStatus(body) {
+    const status = body?.status;
+    return CHALLENGE_STATUSES.includes(status)
+        ? status
+        : "failed";
+}
+/**
+ * One poll's outcome from its HTTP status. Only a definitive refusal ends the
+ * wait: the gate (401, an API without this route yet), another wallet's token
+ * (403) or a gone challenge (404). Anything else — 429, 5xx, a dropped
+ * connection — is a blip, so the wait keeps polling as if still pending.
+ */
+export function pollOutcome(httpStatus, body) {
+    if (httpStatus >= 200 && httpStatus < 300)
+        return parseChallengeStatus(body);
+    return [401, 403, 404].includes(httpStatus) ? "failed" : "pending";
+}
+/** Poll cadence: 2s while an approval is likely imminent, then 5s. */
+const POLL_FAST_MS = 2000;
+const POLL_SLOW_MS = 5000;
+const POLL_FAST_WINDOW_MS = 30000;
+/**
+ * Poll until the challenge leaves `pending` or the deadline passes: once at
+ * once, then every 2s for the first 30s, then every 5s. Pure over its
+ * collaborators so the loop is unit-testable without a network.
+ */
+export async function waitForChallengeApproval(deps) {
+    const now = deps.now ?? Date.now;
+    const startedAt = now();
+    for (;;) {
+        const status = await deps.poll();
+        if (status !== "pending")
+            return status;
+        if (now() >= deps.deadlineMs)
+            return "expired";
+        await deps.sleep(now() - startedAt < POLL_FAST_WINDOW_MS ? POLL_FAST_MS : POLL_SLOW_MS);
+    }
+}
+async function createMfaChallenge(apiUrl, tokens, context) {
+    const res = await fetch(`${apiUrl}/user/mfa/challenge`, {
+        method: "POST",
+        headers: authHeaders(tokens),
+        body: JSON.stringify({ context }),
+    });
+    if (!res.ok) {
+        throw new Error(`Couldn't start passkey approval (${res.status})`);
+    }
+    return (await res.json());
+}
+async function readMfaChallengeStatus(apiUrl, tokens, token) {
+    try {
+        const res = await fetch(`${apiUrl}/user/mfa/challenge/${token}`, {
+            headers: authHeaders(tokens),
+        });
+        return pollOutcome(res.status, await res.json().catch(() => null));
+    }
+    catch {
+        return "pending";
+    }
+}
+/** Mirrors the server's challenge TTL; the deadline is kept on the local clock
+ * so a skewed machine can't expire the wait early (the poll reports a real
+ * server-side expiry as `expired` regardless). */
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/**
+ * The browser hop for an MFA-enabled account: create a challenge for THIS
+ * session, hand the user the confirm link, and wait for their passkey on the
+ * web to mint the grants. Resolves true once approved.
+ */
+async function approveInBrowser(apiUrl, tokens) {
+    const { token } = await createMfaChallenge(apiUrl, tokens, "api-key:generate");
+    const url = `${deriveWebOrigin(apiUrl)}/mfa/confirm/${token}`;
+    output.blank();
+    output.warn("Two-factor authentication is enabled on this account.");
+    output.info("Approve this login with your passkey:");
+    output.brandBold(`  ${url}`);
+    if (!output.isNonInteractive()) {
+        await open(url).catch(() => undefined);
+    }
+    const spin = output.spinner("Waiting for approval in your browser...");
+    const status = await waitForChallengeApproval({
+        poll: () => readMfaChallengeStatus(apiUrl, tokens, token),
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        deadlineMs: Date.now() + CHALLENGE_TTL_MS,
+    });
+    if (status === "verified") {
+        spin.succeed("Approved");
+        return true;
+    }
+    spin.fail(`Approval ${status}`);
+    return false;
+}
 // ── OTP verification helpers ─────────────────────────────────────────
 async function fetchPrivyConfigOrFail(apiUrl) {
     const config = await fetchPrivyConfig(apiUrl).catch(() => null);
@@ -200,20 +367,57 @@ async function authenticateWithEmail(apiUrl, providedEmail, providedCode) {
     }
     output.fatal("Verification failed. Please try again.");
 }
+/**
+ * Run a login-gated call; on the MFA step-up envelope, take the browser
+ * approval hop once and retry. A second refusal, or an approval that expires
+ * or fails, exits with the browser-key guidance.
+ */
+async function runGatedStep(apiUrl, tokens, label, run) {
+    for (const retry of [false, true]) {
+        const spin = output.spinner(label);
+        try {
+            const result = await run();
+            spin.stop();
+            return result;
+        }
+        catch (err) {
+            spin.stop();
+            if (!(err instanceof MfaStepUpError) || retry) {
+                return failLoginStep(`${label} failed`, err, apiUrl);
+            }
+        }
+        const approved = await approveInBrowser(apiUrl, tokens).catch((err) => {
+            output.error(getErrorMessage(err));
+            return false;
+        });
+        if (!approved)
+            return exitWithApiKeyGuidance(apiUrl);
+    }
+    throw new Error("unreachable");
+}
+/** Exit with the generic epilogue, or the browser-key path on a step-up
+ * refusal the approval hop didn't clear. */
+function failLoginStep(label, err, apiUrl) {
+    if (!(err instanceof MfaStepUpError)) {
+        return output.fatal(`${label}: ${getErrorMessage(err)}`);
+    }
+    return exitWithApiKeyGuidance(apiUrl);
+}
+/** The remediation is the point of this message, so every line stays on
+ * stderr with the headline: a scripted caller capturing stderr sees all of it. */
+function exitWithApiKeyGuidance(apiUrl) {
+    output.error("Two-factor authentication is enabled on this account.");
+    output.errorDetail("  The passkey approval didn't complete.");
+    output.errorDetail(`  Generate an API key at ${deriveDashboardUrl(apiUrl)} instead (verify with your passkey there), then run:`);
+    output.errorDetail("    bankr login --api-key bk_YOUR_KEY");
+    process.exit(1);
+}
 // ── Email login flow ────────────────────────────────────────────────
 async function emailLoginFlow(apiUrl, opts) {
     // Step 1: Authenticate via email OTP
     const { tokens } = await authenticateWithEmail(apiUrl, opts.email, opts.code);
     // Step 2: Generate/resolve wallet
-    const walletSpin = output.spinner("Setting up wallet...");
-    let wallet;
-    try {
-        wallet = await callGenerateWallet(apiUrl, tokens);
-        walletSpin.stop();
-    }
-    catch (err) {
-        output.failWith(walletSpin, "Wallet setup failed", err);
-    }
+    const wallet = await runGatedStep(apiUrl, tokens, "Setting up wallet...", () => callGenerateWallet(apiUrl, tokens));
     // Show wallet info
     output.blank();
     if (wallet.isNewUser) {
@@ -244,14 +448,8 @@ async function emailLoginFlow(apiUrl, opts) {
         if (!accepted) {
             output.fatal("Terms must be accepted to continue.");
         }
-        const termsSpin = output.spinner("Accepting terms...");
-        try {
-            await callAcceptTerms(apiUrl, tokens);
-            termsSpin.succeed("Terms accepted");
-        }
-        catch (err) {
-            output.failWith(termsSpin, "Failed to accept terms", err);
-        }
+        await runGatedStep(apiUrl, tokens, "Accepting terms...", () => callAcceptTerms(apiUrl, tokens));
+        output.success("Terms accepted");
     }
     // Step 4: Generate API key
     output.blank();
@@ -266,10 +464,12 @@ async function emailLoginFlow(apiUrl, opts) {
                 validate: (v) => v.trim().length >= 3 ? true : "Name must be at least 3 characters.",
             }));
     // Fine-grained API flags. walletApi and tokenLaunch default to enabled.
-    // --read-write only controls readOnly, not which APIs are enabled.
+    // --read-only/--read-write only control readOnly, not which APIs are enabled.
     const enableWallet = opts.walletApi ?? true;
-    // Agent API must be enabled from the website (bankr.bot/api-keys), not the CLI.
-    const enableAgent = false;
+    // readOnly and agentApiEnabled are only sent when a flag asks for it, so the
+    // server's API_KEY_CREATE_DEFAULTS (the bankr.bot/api-keys form) decide them.
+    // The --read-only/--read-write conflict was already rejected in loginCommand.
+    const overrides = resolveKeyPermissionOverrides(opts);
     const enableTokenLaunch = opts.tokenLaunch ?? true;
     const enableLlm = opts.llm ??
         (headless
@@ -279,32 +479,20 @@ async function emailLoginFlow(apiUrl, opts) {
                 default: false,
                 theme: output.bankrTheme,
             }));
-    if (opts.readWrite && !enableWallet) {
-        output.warn("--read-write has no effect when Wallet API is disabled");
-    }
-    const keySpin = output.spinner("Generating API key...");
-    let apiKeyResult;
-    try {
-        apiKeyResult = await callGenerateApiKey(apiUrl, tokens, {
-            name: keyName.trim(),
-            walletApiEnabled: enableWallet,
-            agentApiEnabled: enableAgent,
-            readOnly: opts.readWrite ? false : undefined,
-            tokenLaunchApiEnabled: enableTokenLaunch,
-            llmGatewayEnabled: enableLlm,
-            allowedIps: opts.allowedIps,
-            allowedRecipients: opts.allowedRecipients,
-        });
-        keySpin.stop();
-    }
-    catch (err) {
-        output.failWith(keySpin, "Failed to generate API key", err);
-    }
+    const apiKeyResult = await runGatedStep(apiUrl, tokens, "Generating API key...", () => callGenerateApiKey(apiUrl, tokens, {
+        name: keyName.trim(),
+        walletApiEnabled: enableWallet,
+        ...overrides,
+        tokenLaunchApiEnabled: enableTokenLaunch,
+        llmGatewayEnabled: enableLlm,
+        allowedIps: opts.allowedIps,
+        allowedRecipients: opts.allowedRecipients,
+    }));
     // Show result
     output.blank();
     const features = [
         enableWallet && "Wallet",
-        enableAgent && "Agent",
+        apiKeyResult.agentApiEnabled && "Agent",
         enableTokenLaunch && "Token Launch",
         enableLlm && "LLM",
     ].filter(Boolean);
@@ -321,7 +509,6 @@ async function emailLoginFlow(apiUrl, opts) {
         ];
         output.dim(`  Recipients: ${parts.join(", ")}`);
     }
-    output.dim("  Agent API: enable at bankr.bot/api-keys");
     output.dim("  Manage keys at bankr.bot/api-keys");
     return apiKeyResult.apiKey;
 }
@@ -372,7 +559,7 @@ async function siweLoginFlow(apiUrl, opts) {
             keyName: opts.keyName ?? `SIWE-${new Date().toISOString().slice(0, 10)}`,
             readOnly: opts.readOnly ?? false,
             walletApiEnabled: opts.walletApi ?? true,
-            agentApiEnabled: false,
+            ...resolveKeyPermissionOverrides({ agentApi: opts.agentApi }),
             tokenLaunchApiEnabled: opts.tokenLaunch ?? true,
             allowedIps: opts.allowedIps,
             allowedRecipients: opts.allowedRecipients,
@@ -492,6 +679,11 @@ export async function loginCommand(opts) {
     if (opts.apiKey !== undefined && !opts.apiKey.trim()) {
         output.fatal("--api-key requires a non-empty value");
     }
+    // Reject conflicting permission flags before any network call, so a
+    // headless step-2 login doesn't burn its one-time code on a usage error.
+    if (opts.readOnly && opts.readWrite) {
+        output.fatal("--read-only and --read-write are mutually exclusive");
+    }
     // Non-interactive mode requires a headless flag combo. Without one, the
     // command would hang on a prompt — fail fast with the available paths.
     // Email step 1 (`login email <addr>` without --code) is also headless:
@@ -569,6 +761,7 @@ export async function loginCommand(opts) {
             keyName: opts.keyName,
             readOnly: !opts.readWrite,
             walletApi: opts.walletApi,
+            agentApi: opts.agentApi,
             tokenLaunch: opts.tokenLaunch,
             ...getParsedRestrictions(),
         });

package/dist/commands/update.js

@@ -1,7 +1,7 @@
-import { readFileSync } from "node:fs";
 import { execSync } from "node:child_process";
 import * as output from "../lib/output.js";
 import { getErrorMessage } from "../lib/errors.js";
+import { CLI_VERSION } from "../lib/config.js";
 const PACKAGE_NAME = "@bankr/cli";
 /**
  * Compare two semver version strings.
@@ -31,8 +31,7 @@ async function fetchLatestVersion() {
     return data.version;
 }
 function getCurrentVersion() {
-    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8"));
-    return pkg.version;
+    return CLI_VERSION;
 }
 /**
  * Detect which package manager installed the CLI globally.

package/dist/lib/api.d.ts

@@ -224,7 +224,8 @@ export interface DeployTokenRequest {
     provider?: LaunchProvider;
     /** Quote the pool in a tokenized stock (Robinhood Chain / Base, Doppler). */
     pairedStockAddress?: string;
-    /** Quote the pool in one of the fixed Base allowlist tokens (Doppler). */
+    /** Quote the pool in one of the chain's fixed Doppler allowlist tokens
+     *  (Base or Robinhood Chain). */
     pairedTokenAddress?: string;
     /** Bankr Launch v3 options; `quoteAddress` picks the pool's quote token. */
     launchV3?: {
@@ -243,7 +244,7 @@ export interface LaunchQuoteTokenOption {
     deployField: LaunchQuoteTokenDeployField | null;
     /** Stocks only: advisory thin-pool verdict, null when unmeasured. */
     illiquid?: boolean | null;
-    /** Base allowlist only: reviewed-liquidity gate. */
+    /** Doppler allowlist tokens only (pairedTokenAddress): reviewed-liquidity gate. */
     readiness?: "live" | "pending" | "unknown";
 }
 export interface LaunchQuoteTokensResponse {

package/dist/lib/config.d.ts

@@ -11,7 +11,8 @@ export declare function setConfigPath(path: string): void;
 export declare function getConfigPath(): string;
 export declare const DEFAULT_API_URL = "https://api.bankr.bot";
 export declare const DEFAULT_LLM_URL = "https://llm.bankr.bot";
-export declare const CLI_USER_AGENT = "bankr-cli/0.1";
+export declare const CLI_VERSION: string;
+export declare const CLI_USER_AGENT: string;
 export declare function readConfig(): BankrConfig;
 export declare function writeConfig(config: BankrConfig): void;
 export declare function clearConfig(): void;

package/dist/lib/config.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "fs";
-import { homedir } from "os";
+import { homedir, platform, release } from "os";
 import { dirname, join } from "path";
 let configPathOverride;
 const DEFAULT_CONFIG_FILE = join(homedir(), ".bankr", "config.json");
@@ -11,7 +11,23 @@ export function getConfigPath() {
 }
 export const DEFAULT_API_URL = "https://api.bankr.bot";
 export const DEFAULT_LLM_URL = "https://llm.bankr.bot";
-export const CLI_USER_AGENT = "bankr-cli/0.1";
+export const CLI_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8")).version;
+/** Browser-style platform token so the API's shared user-agent parser (which
+ * clamps to known families) names the OS on an out-of-band approval screen
+ * as "Bankr CLI · macOS". Never the hostname or username. */
+function platformToken() {
+    switch (platform()) {
+        case "darwin":
+            return "Macintosh";
+        case "win32":
+            return "Windows NT";
+        case "linux":
+            return "Linux";
+        default:
+            return platform();
+    }
+}
+export const CLI_USER_AGENT = `bankr-cli/${CLI_VERSION} (${platformToken()}; ${platform()} ${release()})`;
 function ensureConfigDir() {
     const configDir = dirname(getConfigPath());
     if (!existsSync(configDir)) {

package/dist/lib/output.d.ts

@@ -22,6 +22,8 @@ export declare function brand(msg: string): void;
 export declare function brandBold(msg: string): void;
 export declare function success(msg: string): void;
 export declare function error(msg: string): void;
+/** Dim follow-up line for an error, on stderr so it stays with the headline. */
+export declare function errorDetail(msg: string): void;
 /** Collapses the error-then-exit epilogue every command repeats. */
 export declare function fatal(message: string): never;
 /** Same epilogue, for the spinner-driven variant that reports a caught error. */

package/dist/lib/output.js

@@ -40,6 +40,10 @@ export function success(msg) {
 export function error(msg) {
     console.error(chalk.red(`✗ ${msg}`));
 }
+/** Dim follow-up line for an error, on stderr so it stays with the headline. */
+export function errorDetail(msg) {
+    console.error(chalk.dim(msg));
+}
 /** Collapses the error-then-exit epilogue every command repeats. */
 export function fatal(message) {
     error(message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bankr/cli",
-  "version": "0.3.35",
+  "version": "0.3.38",
   "description": "Official CLI for the Bankr AI agent platform",
   "type": "module",
   "bin": {