@bnbagent/studio-cli 0.0.13 → 0.0.14-alpha.2

package/dist/{chunk-H4X2OOLA.js → chunk-CFMETPKS.js}

@@ -1,17 +1,10 @@
 #!/usr/bin/env node
-import {
-  TWAK_CLI_VERSION,
-  runCapture,
-  runCaptureOut,
-  runStream,
-  whichTwak
-} from "./chunk-RO726HJG.js";
 
 // src/cli/_deploy/deployCli.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import { createRequire } from "module";
-import * as os from "os";
-import * as path6 from "path";
+import * as os2 from "os";
+import * as path7 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot2,
   loadStudioToml as loadStudioToml3
@@ -587,6 +580,152 @@ function deployCommandOverrideAllowed(environment = process.env, argv = process.
   return !inCi && ["development", "test"].includes(environment.NODE_ENV ?? "");
 }
 
+// src/cli/_twak.ts
+import * as fs2 from "fs";
+import * as os from "os";
+import * as path2 from "path";
+import { resolveTwakHome } from "@bnbagent/studio-runtime/wallet";
+
+// src/cli/proc.ts
+import { execa } from "execa";
+async function runCapture(cmd, args, opts = {}) {
+  const result = await execa(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env,
+    input: opts.input,
+    timeout: opts.timeoutMs,
+    reject: false,
+    stripFinalNewline: false
+  });
+  return {
+    code: result.exitCode ?? 1,
+    stdout: typeof result.stdout === "string" ? result.stdout : "",
+    stderr: typeof result.stderr === "string" ? result.stderr : ""
+  };
+}
+async function runStream(cmd, args, opts = {}) {
+  const result = await execa(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env,
+    timeout: opts.timeoutMs,
+    reject: false,
+    stdio: "inherit"
+  });
+  return result.exitCode ?? 1;
+}
+async function runCaptureOut(cmd, args, opts = {}) {
+  const result = await execa(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env,
+    input: opts.input,
+    timeout: opts.timeoutMs,
+    reject: false,
+    stripFinalNewline: false,
+    stdout: "pipe",
+    stderr: opts.quiet ? "pipe" : "inherit"
+  });
+  return {
+    code: result.exitCode ?? 1,
+    stdout: typeof result.stdout === "string" ? result.stdout : ""
+  };
+}
+
+// src/cli/_twak.ts
+var TWAK_CLI_VERSION = "0.20.0";
+var TWAK_CLI_MIN_VERSION = [
+  0,
+  20,
+  0
+];
+function twakVersionBelowFloor(installed) {
+  const floor = TWAK_CLI_MIN_VERSION;
+  for (let i = 0; i < floor.length; i += 1) {
+    const a = installed[i] ?? 0;
+    const b = floor[i];
+    if (a !== b) {
+      return a < b;
+    }
+  }
+  return false;
+}
+function projectTwakBin(projectRoot) {
+  const name = process.platform === "win32" ? "twak.cmd" : "twak";
+  const candidate = path2.join(projectRoot, "node_modules", ".bin", name);
+  return fs2.existsSync(candidate) ? candidate : null;
+}
+async function whichTwak(projectRoot) {
+  if (projectRoot != null) {
+    const pinned = projectTwakBin(projectRoot);
+    if (pinned !== null) {
+      return pinned;
+    }
+  }
+  const cmd = process.platform === "win32" ? "where" : "which";
+  const result = await runCapture(cmd, ["twak"]);
+  if (result.code !== 0) {
+    return null;
+  }
+  const line = result.stdout.split("\n")[0]?.trim();
+  return line ? line : null;
+}
+async function twakInstalledVersion(projectRoot) {
+  const twakBin = await whichTwak(projectRoot);
+  if (twakBin === null) {
+    return null;
+  }
+  return twakVersionForBin(twakBin);
+}
+async function twakVersionForBin(twakBin) {
+  try {
+    const result = await runCapture(twakBin, ["--version"], {
+      timeoutMs: 15e3
+    });
+    const m = /(\d+)\.(\d+)\.(\d+)/.exec(result.stdout || "");
+    if (result.code !== 0 || m === null) {
+      return null;
+    }
+    return [
+      Number.parseInt(m[1], 10),
+      Number.parseInt(m[2], 10),
+      Number.parseInt(m[3], 10)
+    ];
+  } catch {
+    return null;
+  }
+}
+function twakHomeDir(walletCfg, projectRoot) {
+  const home = resolveTwakHome(walletCfg ?? {}, projectRoot ?? null);
+  return path2.join(home ?? os.homedir(), ".twak");
+}
+function twakWalletFile(walletCfg, projectRoot) {
+  return path2.join(twakHomeDir(walletCfg, projectRoot), "wallet.json");
+}
+function twakDoubledHomeHint(walletFile) {
+  const doubled = `${path2.sep}.twak${path2.sep}.twak${path2.sep}`;
+  if (!walletFile.includes(doubled)) {
+    return null;
+  }
+  return `hint: the resolved wallet path ${walletFile} nests .twak/.twak \u2014 [wallet].twak_home in studio.toml likely points at the .twak directory itself. Set it to the PARENT directory (the runtime appends .twak/wallet.json) and re-run.`;
+}
+function twakMissingHint() {
+  return `Run \`pnpm install\` in the Studio workspace (app/agent/package.json pins @trustwallet/cli@${TWAK_CLI_VERSION}). Projects scaffolded before that pin can add "@trustwallet/cli": "${TWAK_CLI_VERSION}" to app/agent/package.json, or install it on PATH with \`npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}\`.`;
+}
+function twakCreateGuidance(fields) {
+  return `error: wallet.kind = "twak" \u2014 \`bag wallet new\` only adopts an existing
+twak wallet's address. Let Studio prepare the project-dedicated wallet with the
+project-pinned @trustwallet/cli@${fields.version}:
+
+    bag wallet twak-init
+
+Create a NaaS app at https://portal.trustwallet.com/dashboard/apps. Studio
+collects its Access ID + HMAC secret through hidden prompts, runs
+\`twak init --json\`, verifies an authenticated read, generates a
+cryptographically secure wallet password, stores it in .studio/.env.local
+(0600), creates the wallet without the keychain, and anchors its address.
+For non-interactive runs, set TWAK_ACCESS_ID and TWAK_HMAC_SECRET first.
+Guide: the bnbagent-studio-using-twak-wallet.md reference (installed by \`bag skills install\`).`;
+}
+
 // src/cli/preflight.ts
 var OK = "ok";
 var WARN = "warn";
@@ -703,25 +842,25 @@ async function checkDocker() {
     fix: "start Docker Desktop (or `open -a Docker` on macOS)"
   };
 }
-async function checkTwak() {
-  const found = await whichTwak() !== null;
+async function checkTwak(projectRoot) {
+  const found = await whichTwak(projectRoot) !== null;
   return {
     name: "twak CLI",
     ok: found,
     level: found ? OK : WARN,
-    detail: found ? "on PATH" : "not found (needed only for wallet.kind='twak' projects)",
-    fix: found ? "" : `npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
+    detail: found ? projectRoot ? "found (project-pinned or on PATH)" : "on PATH" : projectRoot ? "not found, neither project-pinned nor on PATH (needed for wallet.kind='twak')" : "not found (needed only for wallet.kind='twak' projects)",
+    fix: found ? "" : projectRoot ? `pnpm install (or npm install -g @trustwallet/cli@${TWAK_CLI_VERSION})` : `npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
   };
 }
 function requiredChecks() {
   return [checkNode()];
 }
-async function deployChecks() {
+async function deployChecks(projectRoot) {
   return [
     await checkBunx(),
     checkAws(),
     await checkDocker(),
-    await checkTwak()
+    await checkTwak(projectRoot)
   ];
 }
 function render(checks) {
@@ -736,8 +875,8 @@ function render(checks) {
 }
 
 // src/cli/_deploy/awsTargets.ts
-import * as fs2 from "fs";
-import * as path2 from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 var DEFAULT_TARGET_NAME = "default";
 function isDict(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -746,10 +885,10 @@ function pickAccount(entry) {
   return entry.account || entry.accountId;
 }
 function readAwsTarget(root, targetName = DEFAULT_TARGET_NAME) {
-  const p = path2.join(root, "agentcore", "aws-targets.json");
+  const p = path3.join(root, "agentcore", "aws-targets.json");
   let data;
   try {
-    data = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    data = JSON.parse(fs3.readFileSync(p, "utf-8"));
   } catch {
     return [null, null];
   }
@@ -784,7 +923,7 @@ function readAwsTarget(root, targetName = DEFAULT_TARGET_NAME) {
 }
 
 // src/cli/_deploy/x402.ts
-import * as path5 from "path";
+import * as path6 from "path";
 import {
   envLocalPath,
   findSubProjectRoot,
@@ -792,15 +931,15 @@ import {
 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_packageMetadata.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 import { fileURLToPath } from "url";
 function packageRoot() {
-  let dir = path3.dirname(fileURLToPath(import.meta.url));
+  let dir = path4.dirname(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const packageJson = path3.join(dir, "package.json");
-    if (fs3.existsSync(packageJson)) return dir;
-    const parent = path3.dirname(dir);
+    const packageJson = path4.join(dir, "package.json");
+    if (fs4.existsSync(packageJson)) return dir;
+    const parent = path4.dirname(dir);
     if (parent === dir) {
       throw new Error("cannot locate the studio-cli package root");
     }
@@ -808,11 +947,11 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.13") {
-    return "0.0.13";
+  if ("0.0.14-alpha.2") {
+    return "0.0.14-alpha.2";
   }
-  const file = path3.join(packageRoot(), "package.json");
-  const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));
+  const file = path4.join(packageRoot(), "package.json");
+  const pkg = JSON.parse(fs4.readFileSync(file, "utf-8"));
   const value = String(pkg.version ?? "");
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value)) {
     throw new Error(
@@ -825,8 +964,8 @@ function pnpmVersion() {
   if ("10.24.0") {
     return "10.24.0";
   }
-  const file = path3.join(packageRoot(), "package.json");
-  const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));
+  const file = path4.join(packageRoot(), "package.json");
+  const pkg = JSON.parse(fs4.readFileSync(file, "utf-8"));
   const value = String(pkg.packageManager ?? "");
   const match = /^pnpm@(.+)$/u.exec(value);
   if (!match?.[1]) {
@@ -838,28 +977,28 @@ function pnpmVersion() {
 }
 
 // src/cli/utils/envFile.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 var KEY_LINE_RE = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/;
 function isValidKey(key) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
 }
 function writePrivate(filePath, text) {
-  fs4.writeFileSync(filePath, text, { encoding: "utf-8", mode: 384 });
-  fs4.chmodSync(filePath, 384);
+  fs5.writeFileSync(filePath, text, { encoding: "utf-8", mode: 384 });
+  fs5.chmodSync(filePath, 384);
 }
 function setEnvVar(filePath, key, value) {
   if (!isValidKey(key)) {
     throw new Error(`invalid env var name: '${key}'`);
   }
   const newLine = `${key}=${value}`;
-  fs4.mkdirSync(path4.dirname(filePath), { recursive: true });
-  if (!fs4.existsSync(filePath)) {
+  fs5.mkdirSync(path5.dirname(filePath), { recursive: true });
+  if (!fs5.existsSync(filePath)) {
     writePrivate(filePath, `${newLine}
 `);
     return true;
   }
-  const original = fs4.readFileSync(filePath, "utf-8");
+  const original = fs5.readFileSync(filePath, "utf-8");
   const lines = original.split(/\r?\n/);
   if (lines.length > 0 && lines[lines.length - 1] === "") {
     lines.pop();
@@ -890,10 +1029,10 @@ function setEnvVar(filePath, key, value) {
   return true;
 }
 function getEnvVar(filePath, key) {
-  if (!fs4.existsSync(filePath)) {
+  if (!fs5.existsSync(filePath)) {
     return null;
   }
-  for (const line of fs4.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
+  for (const line of fs5.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
     const m = KEY_LINE_RE.exec(line);
     if (m && m[1] === key) {
       const eq = line.indexOf("=");
@@ -919,12 +1058,15 @@ var X402_CAPABLE_RUNTIMES = /* @__PURE__ */ new Set([
 function commerceRails(cfg) {
   const payments = table3(cfg.payments);
   return {
-    erc8183: isTable(payments.erc8183),
+    erc8183: railEnabled(payments.erc8183),
     // Historical property name retained for callers; this means the common
     // B402 seller rail, whether its public adapter is x402 or MPP.
     x402: b402SellerConfig(cfg).enabled === true
   };
 }
+function railEnabled(value) {
+  return isTable(value) && value.enabled !== false;
+}
 function b402Credentials(agentRoot) {
   const values = /* @__PURE__ */ new Map();
   const envPath = envLocalPath(agentRoot);
@@ -966,7 +1108,7 @@ function loadDeployConfig(root) {
   try {
     return {
       agentRoot,
-      cfg: loadStudioToml2(path5.join(agentRoot, "studio.toml"))
+      cfg: loadStudioToml2(path6.join(agentRoot, "studio.toml"))
     };
   } catch {
     return { agentRoot, cfg: {} };
@@ -1016,14 +1158,14 @@ function x402DeploySummary(root, destination, publicUrl) {
 }
 function x402DeploySummaryFromSnapshot(snapshot, runtime, destination, publicUrl, protocol = "x402") {
   const label = protocol === "mpp" ? "MPP" : "x402";
-  const path7 = `/${protocol}`;
+  const path8 = `/${protocol}`;
   const activation = `${B402_PAID_ONBOARDING_GUIDANCE} Then run the bnbagent-studio-selling-via-b402 skill, fill the four B402_* variables${protocol === "mpp" ? " plus MPP_SECRET_KEY and MPP_REALM in .studio/.env.local, inject a durable atomic replayStore for production," : " in .studio/.env.local,"} and redeploy.`;
   if (destination !== "platform" && !X402_CAPABLE_RUNTIMES.has(runtime)) {
-    return `${protocol} rail is FORCED DORMANT: the ${runtime} runtime has no ${path7} path. Deploy to AgentCore or Azure Foundry (managed platform or self-hosted) to activate the rail.`;
+    return `${protocol} rail is FORCED DORMANT: the ${runtime} runtime has no ${path8} path. Deploy to AgentCore or Azure Foundry (managed platform or self-hosted) to activate the rail.`;
   }
   const azure = runtime === "azure-foundry";
   const runtimeLabel = azure ? "Azure Foundry" : "AgentCore";
-  const tunnelLine = azure ? `The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"${path7}","headers":{...},"body":"<base64>"}, inside an Entra-authenticated Foundry invocation (POST \u2026/agents/<name>/endpoint/protocols/invocations with an https://ai.azure.com bearer). Limits: 1 MiB request, 5 MiB response, no streaming.` : `The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"${path7}","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.`;
+  const tunnelLine = azure ? `The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"${path8}","headers":{...},"body":"<base64>"}, inside an Entra-authenticated Foundry invocation (POST \u2026/agents/<name>/endpoint/protocols/invocations with an https://ai.azure.com bearer). Limits: 1 MiB request, 5 MiB response, no streaming.` : `The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"${path8}","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.`;
   const gatewayDocLine = azure ? protocol === "mpp" ? "Gateway contract: docs/guides/mpp-b402-selling.md" : `Gateway example: https://unpkg.com/@bnbagent/studio-cli@${studioCliVersion()}/skills/references/bnbagent-studio-use-azure-foundry.md#x402-external-gateway` : protocol === "mpp" ? "Gateway contract: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/mpp-b402-selling.md" : "Gateway example: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway.md";
   if (snapshot.priceMode === "invalid") {
     return `${protocol} rail is DORMANT: price_usd is invalid; run \`bag doctor\`.`;
@@ -1033,7 +1175,7 @@ function x402DeploySummaryFromSnapshot(snapshot, runtime, destination, publicUrl
       return [
         `${protocol} rail is ACTIVE in FREE mode (self-hosted ${runtimeLabel}).`,
         "B402 verify/settle is bypassed; no credentials, token payment, or settlement audit is used.",
-        `This target has no anonymous public URL; expose ${path7} with your own HTTP front.`,
+        `This target has no anonymous public URL; expose ${path8} with your own HTTP front.`,
         tunnelLine,
         `You may invoke ${runtimeLabel} with envelope-v1 directly, but that is not a standard public ${label} HTTP endpoint.`,
         gatewayDocLine
@@ -1063,7 +1205,7 @@ function x402DeploySummaryFromSnapshot(snapshot, runtime, destination, publicUrl
     const egressLine = azure ? "PAID also needs fixed facilitator egress. Host the gateway on Azure Container Apps in a workload-profiles environment with a VNet + NAT Gateway static IP and allowlist that IP with B402 \u2014 no relay needed." : "PAID also needs fixed facilitator egress. Operate a restricted B402 Relay on a fixed-IP host such as a user-managed VPS, or use AgentCore VPC mode with a private subnet, NAT Gateway, and Elastic IP.";
     return [
       `${protocol} rail is ACTIVE (self-hosted ${runtimeLabel}).`,
-      `This target has no anonymous public URL; expose ${path7} with your own HTTP front.`,
+      `This target has no anonymous public URL; expose ${path8} with your own HTTP front.`,
       tunnelLine,
       `You may invoke ${runtimeLabel} with envelope-v1 directly, but the caller must unpack the inner HTTP response and the result is not a standard public ${label} endpoint.`,
       egressLine,
@@ -1094,12 +1236,12 @@ var require2 = createRequire(import.meta.url);
 function resolveLocalDeployCli() {
   try {
     const manifest = require2.resolve("@bnbagent/deploy-cli/package.json");
-    const pkg = JSON.parse(fs5.readFileSync(manifest, "utf-8"));
+    const pkg = JSON.parse(fs6.readFileSync(manifest, "utf-8"));
     if (pkg.version !== DEPLOY_CLI_VERSION) return null;
     const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["bnbagent-deploy"];
     if (typeof bin !== "string") return null;
-    const entry = path6.resolve(path6.dirname(manifest), bin);
-    return fs5.statSync(entry).isFile() ? entry : null;
+    const entry = path7.resolve(path7.dirname(manifest), bin);
+    return fs6.statSync(entry).isFile() ? entry : null;
   } catch {
     return null;
   }
@@ -1148,7 +1290,7 @@ function tableOf(data, key) {
 function descriptorName(root) {
   try {
     const raw = JSON.parse(
-      fs5.readFileSync(path6.join(root, "agentcore", "agentcore.json"), "utf-8")
+      fs6.readFileSync(path7.join(root, "agentcore", "agentcore.json"), "utf-8")
     );
     if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
       const name = raw.name;
@@ -1193,9 +1335,9 @@ function providerPassthrough(studio, table4) {
 }
 function buildDeploySpec(root, opts) {
   const agentRoot = findSubProjectRoot2("agent", root) ?? root;
-  const studio = loadStudioToml3(path6.join(agentRoot, "studio.toml"));
+  const studio = loadStudioToml3(path7.join(agentRoot, "studio.toml"));
   const name = String(
-    opts.nameOverride || descriptorName(root) || tableOf(studio, "project").name || path6.basename(root)
+    opts.nameOverride || descriptorName(root) || tableOf(studio, "project").name || path7.basename(root)
   );
   const stack = tableOf(studio, "stack");
   const payments = tableOf(studio, "payments");
@@ -1217,7 +1359,7 @@ function buildDeploySpec(root, opts) {
     OTEL_TRACES_EXPORTER: "none"
   };
   if (isContainer) {
-    deploy.dockerfile = path6.join(agentRoot, "Dockerfile");
+    deploy.dockerfile = path7.join(agentRoot, "Dockerfile");
   } else {
     if (!opts.zip) {
       throw new Error("zip packaging requires a prebuilt zip artifact");
@@ -1349,28 +1491,28 @@ function renderSecretEnvFile(payload) {
 `).join("");
 }
 function writePrivateSync(filePath, content) {
-  fs5.writeFileSync(filePath, content, { mode: 384 });
-  fs5.chmodSync(filePath, 384);
+  fs6.writeFileSync(filePath, content, { mode: 384 });
+  fs6.chmodSync(filePath, 384);
 }
 async function withDeployFiles(root, opts, fn) {
-  const scratch = fs5.mkdtempSync(path6.join(os.tmpdir(), "bag-deploy-"));
+  const scratch = fs6.mkdtempSync(path7.join(os2.tmpdir(), "bag-deploy-"));
   try {
     let zip;
     if (opts.packaging === "zip") {
       const agentRoot = findSubProjectRoot2("agent", root) ?? root;
       const studio = loadStudioToml3(
-        path6.join(agentRoot, "studio.toml")
+        path7.join(agentRoot, "studio.toml")
       );
       const stack = tableOf(studio, "stack");
       const faces = stackFaces(stack, tableOf(studio, "payments"));
-      const outZip = path6.join(scratch, "code.zip");
+      const outZip = path7.join(scratch, "code.zip");
       const built = await (opts.buildZipFn ?? buildZip)(agentRoot, outZip, {
         protocols: faces,
         managedPlatform: opts.target === "bnb/trial"
       });
       zip = { path: outZip, entrypoint: built.entrypoint };
     }
-    const secretFile = path6.join(scratch, "secrets.env");
+    const secretFile = path7.join(scratch, "secrets.env");
     const inline = opts.inlineSecrets;
     const payload = opts.secrets ?? {};
     const spec = buildDeploySpec(root, {
@@ -1384,11 +1526,11 @@ async function withDeployFiles(root, opts, fn) {
     if (!inline && Object.keys(payload).length > 0) {
       writePrivateSync(secretFile, renderSecretEnvFile(payload));
     }
-    const configPath = path6.join(scratch, "agent-deploy.toml");
+    const configPath = path7.join(scratch, "agent-deploy.toml");
     writePrivateSync(configPath, tomlStringify(spec.doc));
     return await fn({ configPath, scratchDir: scratch }, spec);
   } finally {
-    fs5.rmSync(scratch, { recursive: true, force: true });
+    fs6.rmSync(scratch, { recursive: true, force: true });
   }
 }
 var DEPLOY_CLI_HINT = "error: could not start the lockfile-pinned bnbagent-deploy; install Bun 1.3+ and reinstall @bnbagent/studio-cli.";
@@ -1413,7 +1555,7 @@ function bunxInstallDir(environment = process.env) {
     return null;
   }
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
-  return uid === null ? null : path6.join(os.tmpdir(), `bunx-${uid}-${DEPLOY_CLI_PACKAGE}`);
+  return uid === null ? null : path7.join(os2.tmpdir(), `bunx-${uid}-${DEPLOY_CLI_PACKAGE}`);
 }
 async function bunxTreeIsIncomplete() {
   const [bin, ...prefix] = deployCommand();
@@ -1432,14 +1574,14 @@ async function withBunxSelfHeal(hasFailed, attempt) {
   if (dir === null || !await bunxTreeIsIncomplete()) {
     return first;
   }
-  if (!fs5.existsSync(dir)) {
+  if (!fs6.existsSync(dir)) {
     printErr(BUNX_TREE_HINT);
     return first;
   }
   printErr(
     `note: ${DEPLOY_CLI_PACKAGE} failed to load its dependencies; clearing its incomplete bunx install and retrying once (${dir}).`
   );
-  fs5.rmSync(dir, { recursive: true, force: true });
+  fs6.rmSync(dir, { recursive: true, force: true });
   const second = await attempt();
   if (hasFailed(second)) {
     printErr(BUNX_TREE_HINT);
@@ -1468,6 +1610,7 @@ async function runDeployCliJson(argv, opts = {}) {
     (result) => result.code !== 0,
     () => runCaptureOut(bin, [...prefix, ...argv, "--json"], {
       cwd: opts.cwd,
+      quiet: opts.quiet,
       env: opts.env ? { ...process.env, ...opts.env } : void 0
     })
   );
@@ -1478,7 +1621,7 @@ async function runDeployCliJson(argv, opts = {}) {
       const parsed = JSON.parse(trimmed);
       data = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     } catch {
-      printErr("error: bnbagent-deploy returned invalid JSON");
+      if (!opts.quiet) printErr("error: bnbagent-deploy returned invalid JSON");
       return { code: code === 0 ? 1 : code, data: {} };
     }
   }
@@ -1504,7 +1647,38 @@ function bnbEnv() {
     BNBAGENT_CLI_SURFACE: "studio"
   };
 }
+function platformSessionFile() {
+  return path7.join(
+    process.env.BNBAGENT_DEPLOY_HOME?.trim() || path7.join(os2.homedir(), ".bnbagent-deploy"),
+    "bnb",
+    "session.json"
+  );
+}
+function platformHostMismatchMessage(recorded, target) {
+  return `Your platform login points at ${recorded}, but this command targets ${target}. Run \`bag platform logout && bag platform login\` to switch, then retry. If you intended to use the previous host, set BNBAGENT_API_URL to ${recorded} for login and subsequent commands.`;
+}
+function platformSessionHostError() {
+  if (process.env.BNBAGENT_API_TOKEN?.trim()) return null;
+  try {
+    const session = JSON.parse(fs6.readFileSync(platformSessionFile(), "utf8"));
+    const recorded = new URL(session.apiUrl).origin;
+    const target = new URL(bnbPlatformApiUrl()).origin;
+    return recorded === target ? null : platformHostMismatchMessage(recorded, target);
+  } catch {
+    return null;
+  }
+}
 async function runPlatformAccountCommand(argv, opts = {}) {
+  if (!["login", "logout"].includes(argv[0] ?? "")) {
+    const message = platformSessionHostError();
+    if (message) {
+      if (!opts.quiet) printErr(`error: ${message}`);
+      return {
+        code: 1,
+        data: { error: { code: "auth.host_mismatch", message } }
+      };
+    }
+  }
   const run = async (args, cwd) => {
     if (opts.json) {
       return runDeployCliJson(args, { cwd, env: bnbEnv(), quiet: opts.quiet });
@@ -1515,9 +1689,9 @@ async function runPlatformAccountCommand(argv, opts = {}) {
   if (!opts.slug) {
     return run([...argv, "--provider", "bnb"]);
   }
-  const scratch = fs5.mkdtempSync(path6.join(os.tmpdir(), "bag-platform-"));
+  const scratch = fs6.mkdtempSync(path7.join(os2.tmpdir(), "bag-platform-"));
   try {
-    const configPath = path6.join(scratch, "agent-deploy.toml");
+    const configPath = path7.join(scratch, "agent-deploy.toml");
     writePrivateSync(
       configPath,
       tomlStringify({
@@ -1528,11 +1702,13 @@ async function runPlatformAccountCommand(argv, opts = {}) {
     );
     return await run([...argv, "--provider", "bnb", "-f", configPath], scratch);
   } finally {
-    fs5.rmSync(scratch, { recursive: true, force: true });
+    fs6.rmSync(scratch, { recursive: true, force: true });
   }
 }
 
 export {
+  studioCliVersion,
+  pnpmVersion,
   setEnvVar,
   getEnvVar,
   CliExit,
@@ -1562,6 +1738,20 @@ export {
   x402SellerIsFree,
   b402PaymentProtocol,
   deployCommandOverrideAllowed,
+  runCapture,
+  runStream,
+  TWAK_CLI_VERSION,
+  TWAK_CLI_MIN_VERSION,
+  twakVersionBelowFloor,
+  projectTwakBin,
+  whichTwak,
+  twakInstalledVersion,
+  twakVersionForBin,
+  twakHomeDir,
+  twakWalletFile,
+  twakDoubledHomeHint,
+  twakMissingHint,
+  twakCreateGuidance,
   whichBin,
   agentcoreFlavor,
   checkBunx,
@@ -1571,8 +1761,6 @@ export {
   deployChecks,
   render,
   readAwsTarget,
-  studioCliVersion,
-  pnpmVersion,
   B402_RUNTIME_KEYS,
   MPP_RUNTIME_KEYS,
   X402_CAPABLE_RUNTIMES,
@@ -1599,5 +1787,7 @@ export {
   runDeployCliJson,
   trialFromDeployCliJson,
   bnbEnv,
+  platformSessionFile,
+  platformHostMismatchMessage,
   runPlatformAccountCommand
 };

package/dist/{deployCli-22NMZ4G7.js → deployCli-AVWKY3GN.js}

@@ -12,6 +12,8 @@ import {
   bunxInstallDir,
   deployCommand,
   deployEndpointValue,
+  platformHostMismatchMessage,
+  platformSessionFile,
   providerPassthrough,
   renderSecretEnvFile,
   runDeployCliJson,
@@ -19,8 +21,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-H4X2OOLA.js";
-import "./chunk-RO726HJG.js";
+} from "./chunk-CFMETPKS.js";
 export {
   BNB_PLATFORM_API_URL,
   BNB_PLATFORM_API_URL_ENV,
@@ -34,6 +35,8 @@ export {
   bunxInstallDir,
   deployCommand,
   deployEndpointValue,
+  platformHostMismatchMessage,
+  platformSessionFile,
   providerPassthrough,
   renderSecretEnvFile,
   runDeployCliJson,