@bnbagent/studio-cli 0.0.14-alpha.1 → 0.0.14-alpha.2

package/dist/bag.js

@@ -36,6 +36,7 @@ import {
   nativeProtocolOf,
   normalizeB402PriceUsd,
   normalizeProtocolFaces,
+  platformHostMismatchMessage,
   pnpmVersion,
   printErr,
   printOut,
@@ -70,7 +71,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-QVYWAJEK.js";
+} from "./chunk-CFMETPKS.js";
 import {
   validateAgentcoreName
 } from "./chunk-U7IDQ3K5.js";
@@ -769,7 +770,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-F3AOM5UO.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-AVWKY3GN.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -988,6 +989,7 @@ import * as path3 from "path";
 
 // src/cli/utils/prompt.ts
 import * as readline from "readline/promises";
+import { Writable } from "stream";
 var PromptCancelled = class extends Error {
   constructor() {
     super("prompt cancelled");
@@ -1032,17 +1034,25 @@ async function promptUserStderr(question) {
   }
 }
 async function promptHidden(question) {
-  process.stderr.write(question);
+  const wasRaw = process.stdin.isRaw;
+  const muted = new Writable({
+    write(_chunk, _encoding, done) {
+      done();
+    }
+  });
   const rl = readline.createInterface({
     input: process.stdin,
-    // No output stream — the answer is not echoed. (readline still needs
-    // terminal:false handling; we simply don't attach stdout.)
-    terminal: false
+    output: muted,
+    terminal: Boolean(process.stdin.isTTY),
+    historySize: 0
   });
   try {
+    process.stderr.write(question);
     return await ask(rl, "");
   } finally {
     rl.close();
+    if (process.stdin.isTTY && wasRaw) process.stdin.setRawMode(true);
+    muted.end();
     process.stderr.write("\n");
   }
 }
@@ -1063,22 +1073,22 @@ function stdinIsTty() {
 
 // src/cli/feedback.ts
 var FEEDBACK_FORM_TEMPLATE_ENV = "BAG_FEEDBACK_DEVELOPMENT_FORM_URL_TEMPLATE";
-var FEEDBACK_FORM_URL_SLOT = "https://docs.google.com/forms/d/e/<BNB_AGENT_STUDIO_FORM_ID>/viewform";
+var FEEDBACK_ISSUES_URL = "https://github.com/bnb-chain/bnbagent-studio/issues/new";
 var DEPLOY_FEEDBACK_NUDGE_MARKER = "feedback-deploy-nudge-v1";
 var TRUSTED_FEEDBACK_FORMS = [];
 function feedbackFormDisplayUrl() {
   const template = TRUSTED_FEEDBACK_FORMS[0]?.template;
-  if (!template) return FEEDBACK_FORM_URL_SLOT;
+  if (!template) return FEEDBACK_ISSUES_URL;
   try {
     const url = new URL(template);
     url.search = "";
     return url.toString();
   } catch {
-    return FEEDBACK_FORM_URL_SLOT;
+    return FEEDBACK_ISSUES_URL;
   }
 }
 function feedbackErrorHint() {
-  return `feedback: run \`bag feedback\` to create a local redacted report; form: ${feedbackFormDisplayUrl()}`;
+  return `feedback: run \`bag feedback\` to create a local redacted report; submit: ${feedbackFormDisplayUrl()}`;
 }
 function deployFeedbackNudgeLines(projectRoot, environment = process.env) {
   if (!feedbackIsInteractive(environment)) return [];
@@ -1095,8 +1105,8 @@ function deployFeedbackNudgeLines(projectRoot, environment = process.env) {
   }
   return [
     "\nFeedback (shown once after a successful deploy):",
-    "  Run `bag feedback` to review a local redacted report and open the survey.",
-    `  Google Form: ${feedbackFormDisplayUrl()}`
+    "  Run `bag feedback` to review a local redacted report and open the feedback page.",
+    `  Feedback: ${feedbackFormDisplayUrl()}`
   ];
 }
 var PREFILL_KEYS = /* @__PURE__ */ new Set([
@@ -1141,7 +1151,7 @@ var ERROR_CODE_SET2 = /* @__PURE__ */ new Set([
 var WALLET_SET2 = /* @__PURE__ */ new Set(["altana", "evm-local", "twak"]);
 function registerFeedback(program) {
   program.command("feedback").description(
-    "Create a redacted local diagnostic bundle and open the feedback form."
+    "Create a redacted local diagnostic bundle and open the feedback form or issue tracker."
   ).option("--project-root <path>", "Override project root.").option(
     "--allow-development-form",
     "Use the explicitly configured untrusted development form instead of a release-pinned production form."
@@ -1172,6 +1182,21 @@ async function cmdFeedback(opts) {
   printOut(
     "Nothing is uploaded by bag. Review the JSON before attaching it, then submit the form yourself."
   );
+  if (!opts.allowDevelopmentForm && TRUSTED_FEEDBACK_FORMS.length === 0) {
+    printOut(`Feedback: ${FEEDBACK_ISSUES_URL}`);
+    if (feedbackIsInteractive()) {
+      const answer2 = await promptUser(
+        "Open the GitHub feedback page? Review the local bundle before attaching it. [y/N] "
+      );
+      if (/^(y|yes)$/iu.test(answer2.trim())) {
+        if (!await openFeedbackUrl(FEEDBACK_ISSUES_URL))
+          printErr(
+            "warning: could not open a browser; use the feedback URL above."
+          );
+      }
+    }
+    return 0;
+  }
   let formUrl;
   let formId;
   try {
@@ -1187,7 +1212,7 @@ async function cmdFeedback(opts) {
     formId = googleFormId(new URL(formUrl).pathname);
   } catch {
     printErr(
-      opts.allowDevelopmentForm ? `error: the explicit development feedback form is missing or invalid. The local bundle remains available; configure ${FEEDBACK_FORM_TEMPLATE_ENV} and retry with --allow-development-form.` : "error: no release-pinned production feedback form is provisioned in this release. The local bundle remains available; a reviewed form ID and entry mapping must be added to the trusted release allowlist."
+      opts.allowDevelopmentForm ? `error: the explicit development feedback form is missing or invalid. The local bundle remains available; set ${FEEDBACK_FORM_TEMPLATE_ENV} to a Google Forms prefilled URL such as https://docs.google.com/forms/d/e/FORM_ID/viewform?entry.123={feedback_id} (replace FORM_ID and entry.123 with your form IDs), then retry with --allow-development-form.` : "error: no release-pinned production feedback form is provisioned in this release. The local bundle remains available; a reviewed form ID and entry mapping must be added to the trusted release allowlist."
     );
     return 2;
   }
@@ -5022,15 +5047,22 @@ async function checkTwakWalletExists(root, _target) {
     if (home) {
       env.HOME = home;
     }
-    const result = await runCapture("twak", ["wallet", "address"], {
-      env,
-      timeoutMs: 15e3
-    });
+    env.TWAK_WALLET_PASSWORD = getEnvVar(envLocalPath8(agentRoot2), "TWAK_WALLET_PASSWORD") || process.env.TWAK_WALLET_PASSWORD;
+    const twakBin = await whichTwak(agentRoot2);
+    if (twakBin === null) throw new Error(twakMissingHint());
+    const result = await runCapture(
+      twakBin,
+      ["wallet", "address", "--chain", "bsc", "--json"],
+      {
+        env,
+        timeoutMs: 15e3
+      }
+    );
     if (result.code !== 0) {
       failure = result.stderr.trim() || `twak wallet address exit ${result.code}`;
     } else {
-      const m = /0x[0-9a-fA-F]{40}/.exec(result.stdout);
-      actual = m ? m[0] : null;
+      const payload = JSON.parse(result.stdout);
+      actual = typeof payload.address === "string" && /^0x[0-9a-fA-F]{40}$/.test(payload.address) ? payload.address : null;
       if (actual === null) {
         failure = "no address in `twak wallet address` output";
       }
@@ -7752,27 +7784,6 @@ function acceptChoices(option, accepted, advertised) {
   });
 }
 
-// src/cli/utils/randomPassword.ts
-import { randomBytes as randomBytes2 } from "crypto";
-var LOCAL_WALLET_PASSWORD_BYTES = 32;
-function generateLocalWalletPassword() {
-  let bytes;
-  try {
-    bytes = randomBytes2(LOCAL_WALLET_PASSWORD_BYTES);
-  } catch (cause) {
-    throw new Error(
-      "failed to generate the local wallet password from the OS cryptographic random source; refusing to create the wallet",
-      { cause }
-    );
-  }
-  if (bytes.length !== LOCAL_WALLET_PASSWORD_BYTES) {
-    throw new Error(
-      "the OS cryptographic random source returned an invalid local wallet password; refusing to create the wallet"
-    );
-  }
-  return bytes.toString("base64url");
-}
-
 // src/cli/wallet.ts
 import * as fs25 from "fs";
 import * as path25 from "path";
@@ -7784,6 +7795,7 @@ import {
 } from "@bnbagent/studio-runtime/config";
 import { tbnbFaucetHint as tbnbFaucetHint2, uFaucetHint as uFaucetHint2 } from "@bnbagent/studio-runtime/networks";
 import { buildPolicy, buildWallet as buildWallet2 } from "@bnbagent/studio-runtime/wallet";
+import lockfile from "proper-lockfile";
 import { getAddress as toChecksumAddress } from "viem";
 
 // src/cli/_walletCfg.ts
@@ -8013,17 +8025,6 @@ async function currentInteractiveSession() {
       "The faucet requires an interactive GitHub login; unset BNBAGENT_API_TOKEN and run `bag platform login`."
     );
   }
-  const refreshed = await runPlatformAccountCommand(["whoami"], {
-    json: true,
-    quiet: true
-  });
-  if (refreshed.code !== 0) {
-    throw new FaucetClientError(
-      "auth.signed_out",
-      "Sign in with GitHub first: `bag platform login`.",
-      401
-    );
-  }
   const file = sessionFile();
   let stat;
   let parsed;
@@ -8032,8 +8033,8 @@ async function currentInteractiveSession() {
     parsed = record(JSON.parse(fs23.readFileSync(file, "utf8")));
   } catch {
     throw new FaucetClientError(
-      "auth.session_missing",
-      "The platform login succeeded but its local session could not be read; run `bag platform login` again.",
+      "auth.signed_out",
+      "No readable platform login was found. Sign in with GitHub first: `bag platform login`.",
       401
     );
   }
@@ -8056,10 +8057,25 @@ async function currentInteractiveSession() {
   if (new URL(configuredBase).origin !== new URL(sessionBase).origin) {
     throw new FaucetClientError(
       "auth.host_mismatch",
-      `The platform session belongs to ${sessionBase}, but Studio targets ${configuredBase}. Run \`bag platform login\` against the intended API.`,
+      platformHostMismatchMessage(
+        new URL(sessionBase).origin,
+        new URL(configuredBase).origin
+      ),
       401
     );
   }
+  const refreshed = await runPlatformAccountCommand(["trial"], {
+    json: true,
+    quiet: true
+  });
+  if (refreshed.code !== 0) {
+    throw new FaucetClientError(
+      "auth.signed_out",
+      "Could not verify platform login. Run `bag platform login` and retry.",
+      401
+    );
+  }
+  parsed = record(JSON.parse(fs23.readFileSync(file, "utf8")));
   return {
     apiUrl: configuredBase,
     accessToken: requiredString(parsed.access_token, "session access token")
@@ -8160,9 +8176,13 @@ async function requestJson(session, method, endpoint, fetchImpl, opts = {}, retr
       continue;
     }
     const error = record(record(payload).error);
+    let message = typeof error.message === "string" ? error.message : `The faucet request failed with HTTP ${response.status}.`;
+    if (error.code === "faucet.claim_cooldown") {
+      message = `Check your current funds with \`bag wallet balance\`. This cooldown applies to your GitHub account across all wallets. ${message.replace("per GitHub account and wallet address", "per GitHub account (across all wallets)")}`;
+    }
     throw new FaucetClientError(
       typeof error.code === "string" ? error.code : "faucet.request_failed",
-      typeof error.message === "string" ? error.message : `The faucet request failed with HTTP ${response.status}.`,
+      message,
       response.status
     );
   }
@@ -8384,7 +8404,9 @@ async function fundWalletFromFaucet(wallet, deps = {}) {
     );
   }
   return {
-    outcome: claim.status === "confirmed" ? "confirmed" : claim.status === "partial" ? "partial" : "failed",
+    outcome: claim.status === "confirmed" ? Object.values(claim.assets).some(
+      (asset) => !["confirmed", "skipped_balance_cap"].includes(asset.status)
+    ) ? "partial" : "confirmed" : claim.status === "partial" ? "partial" : "failed",
     claim,
     ...balances ? { balances } : {}
   };
@@ -8395,13 +8417,19 @@ async function fundProjectWallet(projectRoot, deps = {}) {
   if (kind !== "evm-local" && kind !== "altana") {
     throw new FaucetClientError(
       "faucet.wallet_unsupported",
-      "Automatic faucet funding currently supports wallet.kind='evm-local' and 'altana'."
+      kind === "twak" ? "This faucet supports local and Altana wallets. TWAK uses sponsored gas for supported testnet operations; use `bag wallet balance` to check funds and the public testnet faucet if tokens are still needed." : "This faucet supports local and Altana wallets. Use `bag wallet balance` and fund this wallet through an external wallet or a public testnet faucet."
     );
   }
   if (projectNetwork(projectRoot) !== "bsc-testnet") {
     throw new FaucetClientError(
       "faucet.network_unsupported",
-      "Automatic faucet funding is testnet-only; [network].default must be 'bsc-testnet'."
+      "This faucet only provides testnet tokens. Mainnet has no faucet; transfer BNB and U from an external wallet, then check `bag wallet balance`."
+    );
+  }
+  if (!String(walletCfg.address ?? "").trim()) {
+    throw new FaucetClientError(
+      "faucet.wallet_missing",
+      "This project has no wallet yet. Run `bag wallet new` first (use --generate-password for a new local wallet), then `bag wallet fund`."
     );
   }
   const wallet = kind === "altana" ? (deps.adminWalletFactory ?? buildLocalAdminWallet)(
@@ -8428,12 +8456,17 @@ function printFaucetResult(result) {
     printOut(`  claim: ${claim.claimId}`);
     for (const [asset, transfer] of Object.entries(claim.assets)) {
       const tx = transfer.transactionHash ? ` tx=${transfer.transactionHash}` : "";
+      if (transfer.status === "skipped_balance_cap") {
+        printErr(
+          `warning: ${asset} was not sent because its balance cap was reached.`
+        );
+      }
       printOut(`  ${asset}: ${transfer.amount} \u2014 ${transfer.status}${tx}`);
     }
   }
   if (result.balances) {
     printOut(
-      `\u2713 verified wallet balance: ${result.balances.native} ${result.balances.nativeSymbol}, ${result.balances.u} U`
+      `Current wallet balance: ${result.balances.native} ${result.balances.nativeSymbol}, ${result.balances.u} U`
     );
   } else if (result.outcome === "confirmed") {
     printErr(
@@ -8442,9 +8475,12 @@ function printFaucetResult(result) {
   }
   if (result.outcome === "partial") {
     printErr(
-      "warning: faucet funding completed only partially; do not retry blindly if an asset is marked unknown. Keep the claim/transaction details above for support."
+      "warning: faucet funding completed only partially. Assets marked confirmed were sent; unknown or pending transfers are not yet confirmed. Check `bag wallet balance` and the transaction details before retrying; keep the claim ID for support."
     );
   }
+  printOut(
+    "Check funds with `bag wallet balance`; when ready, run `bag doctor`."
+  );
 }
 async function maybeAutoFundProject(projectRoot, deps = {}) {
   try {
@@ -8472,6 +8508,27 @@ async function maybeAutoFundProject(projectRoot, deps = {}) {
   }
 }
 
+// src/cli/utils/randomPassword.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var LOCAL_WALLET_PASSWORD_BYTES = 32;
+function generateLocalWalletPassword() {
+  let bytes;
+  try {
+    bytes = randomBytes2(LOCAL_WALLET_PASSWORD_BYTES);
+  } catch (cause) {
+    throw new Error(
+      "failed to generate the local wallet password from the OS cryptographic random source; refusing to create the wallet",
+      { cause }
+    );
+  }
+  if (bytes.length !== LOCAL_WALLET_PASSWORD_BYTES) {
+    throw new Error(
+      "the OS cryptographic random source returned an invalid local wallet password; refusing to create the wallet"
+    );
+  }
+  return bytes.toString("base64url");
+}
+
 // src/cli/walletSession.ts
 import * as fs24 from "fs";
 import * as path24 from "path";
@@ -9132,6 +9189,15 @@ function isFile8(p) {
 }
 function printNextAfterNew(projectRoot, address) {
   const network = projectNetwork(projectRoot);
+  if (network === "bsc-testnet" && ["evm-local", "altana"].includes(
+    walletKind(
+      isFile8(path25.join(projectRoot, "studio.toml")) ? loadWalletCfg(projectRoot) : {}
+    )
+  )) {
+    printErr(
+      "Next: `bag platform login`, then `bag wallet fund` to request testnet tBNB + U."
+    );
+  }
   const fund = network === "bsc-testnet" ? `fund it (free, only needed for paid models / on-chain settle):
       tBNB: ${tbnbFaucetHint2(address)}
       U: ${uFaucetHint2(address)}` : "fund it with BNB (gas) + U before selling paid work";
@@ -9149,7 +9215,7 @@ function requirePassword2() {
   const pw = process.env[PASSWORD_ENV2];
   if (!pw) {
     throw new Error(
-      `${PASSWORD_ENV2} env var is required. Set it in your shell or .env.local before running this command.`
+      `${PASSWORD_ENV2} env var is required. For a new wallet, run \`bag wallet new --generate-password\` to generate and save it privately, or set it in .studio/.env.local. For an existing wallet, restore its original password.`
     );
   }
   return pw;
@@ -9271,7 +9337,7 @@ function registerWallet(program) {
     )
   );
   p.command("fund").description(
-    "Claim the operator-configured tBNB/U testnet grant using the current GitHub login."
+    "Fund this project wallet with testnet tBNB + U. Requires `bag wallet new` and GitHub login via `bag platform login`."
   ).option("--project-root <path>", "Override project root.").action(
     act(wrap2((opts) => cmdFund(opts.projectRoot)))
   );
@@ -9314,6 +9380,25 @@ async function cmdNew(opts) {
     }
     projectRoot = process.cwd();
   }
+  const lockTarget = path25.dirname(privateEnvPath(projectRoot));
+  let release2;
+  try {
+    release2 = lockfile.lockSync(lockTarget, { realpath: true, retries: 0 });
+  } catch (error) {
+    if (error.code === "ELOCKED") {
+      throw new Error(
+        "Another wallet creation is in progress for this project. Wait for it to finish, then retry."
+      );
+    }
+    throw error;
+  }
+  try {
+    return await createProjectWallet(opts, projectRoot);
+  } finally {
+    release2();
+  }
+}
+async function createProjectWallet(opts, projectRoot) {
   let walletCfg = {};
   if (isFile8(path25.join(projectRoot, "studio.toml"))) {
     walletCfg = loadWalletCfg(projectRoot);
@@ -9345,7 +9430,7 @@ async function cmdNew(opts) {
   }
   if (opts.generatePassword && (anchored !== "" || existingKeystores.length > 0)) {
     printErr(
-      "error: refusing to generate a replacement password for an existing or anchored evm-local wallet."
+      "error: refusing to generate a replacement password for an existing or anchored evm-local wallet. To adopt a saved wallet, run `bag wallet new` without --generate-password using its original saved password."
     );
     return 1;
   }
@@ -9372,9 +9457,9 @@ async function cmdNew(opts) {
   if (opts.generatePassword) {
     setEnvVar(privateEnvPath(projectRoot), PASSWORD_ENV2, password);
   }
-  fs25.mkdirSync(keystoreDir, { recursive: true });
   let provider;
   try {
+    fs25.mkdirSync(keystoreDir, { recursive: true });
     provider = new EVMWalletProvider({
       password,
       ...privateKey !== null ? { privateKey } : {},
@@ -9397,8 +9482,28 @@ async function cmdNew(opts) {
     }
     throw error;
   }
+  try {
+    persistAddress(projectRoot, provider.address, opts.keystoreDir);
+  } catch (cause) {
+    throw new Error(
+      "The wallet and its password were saved, but writing the address to studio.toml failed. Restore file permissions, then run `bag wallet new` without --generate-password to adopt the saved wallet.",
+      { cause }
+    );
+  }
   printOut(provider.address);
-  persistAddress(projectRoot, provider.address, opts.keystoreDir);
+  if (opts.generatePassword) {
+    printErr(
+      `Password stored (0600): ${envLocalPath12(projectRoot)} (WALLET_PASSWORD)`
+    );
+    printErr(
+      `Keystore JSON (0600): ${path25.join(keystoreDir, `${provider.address}.json`)}`
+    );
+    if (process.env[PASSWORD_ENV2] && process.env[PASSWORD_ENV2] !== password) {
+      printErr(
+        "Your shell has a different WALLET_PASSWORD. Run `unset WALLET_PASSWORD` before the next bag command so it loads the saved password."
+      );
+    }
+  }
   if (kind === "altana") {
     const network = projectNetwork(projectRoot);
     printErr(
@@ -9581,7 +9686,7 @@ async function collectTwakCredentials() {
   }
   if (!stdinIsTty()) {
     printErr(
-      "error: Trust Wallet NaaS credentials are required. In a non-interactive run, set TWAK_ACCESS_ID and TWAK_HMAC_SECRET in .studio/.env.local, then retry `bag wallet twak-init`."
+      "error: Trust Wallet NaaS credentials are required. In a non-interactive run, set TWAK_ACCESS_ID and TWAK_HMAC_SECRET in .studio/.env.local, then retry `bag wallet twak-init`. Create a NaaS app at https://portal.trustwallet.com/dashboard/apps. If you already have ~/.twak/credentials.json, copy accessId and hmacSecret into these variables; Studio uses a separate project credentials file."
     );
     return null;
   }
@@ -9713,7 +9818,7 @@ ${detail}` : `error: \`twak init --json\` did not produce ${credentialsFile}.`
   fs25.chmodSync(credentialsFile, 384);
   const authenticatedRead = await runCapture(
     twakBin,
-    ["price", "BNB", "--chain", "bsc", "--json"],
+    ["search", "BNB", "--networks", "20000714", "--limit", "1", "--json"],
     {
       env: twakChildEnv(homeDir),
       timeoutMs: 12e4
@@ -9741,11 +9846,12 @@ ${detail}` : "error: Trust Wallet credential verification failed."
     "TWAK_WALLET_PASSWORD"
   );
   if (walletExisted) {
-    const existing = twakPasswordForExistingWallet(projectRoot);
+    const explicitPassword = opts.passwordStdin || opts.passwordFile;
+    const existing = explicitPassword ? await resolveTwakInitPassword(opts) : twakPasswordForExistingWallet(projectRoot);
     if (existing === null) {
       if (!stdinIsTty()) {
         printErr(
-          "error: the project twak wallet already exists but TWAK_WALLET_PASSWORD is missing from .studio/.env.local."
+          "error: the project twak wallet already exists but TWAK_WALLET_PASSWORD is missing from .studio/.env.local. Restore the original password with --password-stdin or --password-file <0600 file>."
         );
         return 1;
       }
@@ -9799,9 +9905,6 @@ ${detail}` : `error: \`twak wallet create --no-keychain --json\` did not produce
     }
   }
   fs25.chmodSync(walletFile, 384);
-  printErr(
-    `\u2713 Studio verified Trust Wallet credentials and prepared the project wallet under ${twakDir}`
-  );
   const address = await readTwakAddress(
     twakBin,
     projectRoot,
@@ -9820,6 +9923,9 @@ ${detail}` : `error: \`twak wallet create --no-keychain --json\` did not produce
   if (persistAfterVerification) {
     persistTwakPassword(projectRoot, password);
   }
+  printErr(
+    `\u2713 Studio verified Trust Wallet credentials and prepared the project wallet under ${twakDir}`
+  );
   printOut(address);
   persistAddress(projectRoot, address);
   printNextAfterNew(projectRoot, address);
@@ -12145,7 +12251,8 @@ async function runOnboarding(o) {
     );
     return false;
   }
-  let password;
+  const generatePassword = o.walletKind === "evm-local" && o.evmKeystore === void 0;
+  let password = "";
   if (o.walletKind === "evm-local" && o.evmKeystore !== void 0) {
     password = (await promptHidden("Existing evm-local keystore password (hidden): ")).trim();
     if (!password) {
@@ -12158,9 +12265,8 @@ async function runOnboarding(o) {
       "Onboarding (TTY) \u2014 reusing the encrypted evm-local keystore with its original password."
     );
   } else if (o.walletKind === "evm-local") {
-    password = generateLocalWalletPassword();
     printOut(
-      "Onboarding (TTY) \u2014 generated a private local-wallet password and stored it in .studio/.env.local."
+      "Onboarding (TTY) \u2014 generating a private local-wallet password and saving it in .studio/.env.local."
     );
   } else {
     const prompted = await promptAltanaAdminPassword();
@@ -12173,32 +12279,32 @@ async function runOnboarding(o) {
   const { envLocalPath: envLocalPath21 } = await import("@bnbagent/studio-runtime/config");
   const localEnvPath = envLocalPath21(agentRoot2);
   const priorPersistedPassword = getEnvVar(localEnvPath, "WALLET_PASSWORD");
-  setEnvVar(localEnvPath, "WALLET_PASSWORD", password);
+  if (!generatePassword) setEnvVar(localEnvPath, "WALLET_PASSWORD", password);
   const savedCwd = process.cwd();
   const savedPw = process.env.WALLET_PASSWORD;
   let address = null;
   let existingKeystoreVerified = false;
   try {
     process.chdir(agentRoot2);
-    process.env.WALLET_PASSWORD = password;
+    if (!generatePassword) process.env.WALLET_PASSWORD = password;
     let rc;
     try {
-      rc = await cmdNew({ projectRoot: agentRoot2 });
+      rc = await cmdNew({ projectRoot: agentRoot2, generatePassword });
     } catch (exc) {
       if (exc instanceof CliExit) {
         rc = exc.code;
       } else {
-        printErr(
-          `warning: wallet creation failed: ${exc instanceof Error ? exc.message : exc}`
+        throw new Error(
+          `Wallet creation failed: ${exc instanceof Error ? exc.message : exc}. Fix the problem, then run \`bag wallet new${generatePassword ? " --generate-password" : ""}\` in app/agent.`,
+          { cause: exc }
         );
-        return false;
       }
     }
     if (rc !== 0) {
-      printErr(
-        "warning: wallet creation returned non-zero; skipping activation."
-      );
-      return false;
+      throw new CliExit(rc);
+    }
+    if (generatePassword) {
+      process.env.WALLET_PASSWORD = getEnvVar(localEnvPath, "WALLET_PASSWORD") ?? "";
     }
     address = readWalletAddress(path26.join(agentRoot2, "studio.toml"));
     existingKeystoreVerified = address !== null;
@@ -12219,6 +12325,10 @@ async function runOnboarding(o) {
   if (o.storageProvider === "ipfs") {
     await onboardIpfsKey(envLocalPath21(agentRoot2), o.ipfsKey);
   }
+  if (o.network === "bsc-testnet")
+    printOut(
+      "Run `bag platform login`, then `bag wallet fund` to request testnet tBNB + U."
+    );
   if (address) {
     await printFaucetHint(o.network, address);
     if (o.walletKind === "altana") {
@@ -12821,7 +12931,7 @@ function printNextSteps(name, provider, o = {}) {
     printOut("  (cd app/agent && bag wallet new)");
   } else {
     printOut(
-      o.evmKeystore ? "  # 1. edit .studio/.env.local and set WALLET_PASSWORD to the imported keystore's original password" : "  # 1. edit .studio/.env.local and set WALLET_PASSWORD (encrypts the keystore + signs all on-chain ops)"
+      o.evmKeystore ? "  # 1. edit .studio/.env.local and set WALLET_PASSWORD to the imported keystore's original password" : "  # 1. let Studio generate and privately save the local wallet password"
     );
     printOut(
       "  #    bag auto-loads it from the owner-only file; never pass it on argv"
@@ -12830,11 +12940,19 @@ function printNextSteps(name, provider, o = {}) {
     printOut(
       o.evmKeystore ? "  # 2. verify, adopt, and anchor the copied encrypted keystore" : "  # 2. generate the agent's EOA wallet (the SOLE signer key)"
     );
-    printOut("  (cd app/agent && bag wallet new)");
+    printOut(
+      o.evmKeystore ? "  (cd app/agent && bag wallet new)" : "  (cd app/agent && bag wallet new --generate-password)"
+    );
     printOut(
       "  (cd app/agent && bag wallet show)   # print address \u2014 copy it for funding"
     );
   }
+  if (o.network === "bsc-testnet" && ["evm-local", "altana"].includes(o.walletKind ?? "evm-local")) {
+    printOut("  bag platform login   # sign in with GitHub");
+    printOut(
+      "  (cd app/agent && bag wallet fund)   # request testnet tBNB + U"
+    );
+  }
   printOut("");
   let nextStep;
   if (provider === "pieverse-llm") {
@@ -18872,13 +18990,21 @@ function formatTrialRemaining(seconds) {
   const minutes = Math.floor(safe % 3600 / 60);
   return `${hours}h ${String(minutes).padStart(2, "0")}m`;
 }
-async function trialForProviderSelection() {
+async function trialForProviderSelection(required = false) {
   try {
     const result = await runPlatformAccountCommand(["trial"], {
       json: true,
       quiet: true
     });
-    if (result.code !== 0) return UNKNOWN_TRIAL;
+    if (result.code !== 0) {
+      if (required)
+        throw new Error(
+          String(
+            tableOf13(result.data, "error").message ?? "Could not check platform login. Run `bag platform login` and retry."
+          )
+        );
+      return UNKNOWN_TRIAL;
+    }
     const trial = trialFromDeployCliJson(result.data);
     return {
       state: trial.case,
@@ -18886,7 +19012,8 @@ async function trialForProviderSelection() {
       expiresAt: trial.expiresAt,
       remainingSeconds: trial.remainingSeconds
     };
-  } catch {
+  } catch (error) {
+    if (required) throw error;
     return UNKNOWN_TRIAL;
   }
 }
@@ -18927,11 +19054,12 @@ async function cmdDeploy(opts, deployArgs) {
   const unavailable = unavailableProvidersForProject(root);
   const interactive = stdinIsTty();
   const needsTrial = opts.provider === "bnb" || !opts.provider && interactive;
-  const trial = needsTrial ? await trialForProviderSelection() : UNKNOWN_TRIAL;
+  const trial = needsTrial ? await trialForProviderSelection(opts.provider === "bnb") : UNKNOWN_TRIAL;
   const visibleDeployments = deployments.map(
     (deployment) => deployment.provider === "bnb" && trial.state === "expired" ? { ...deployment, status: "expired" } : deployment
   );
-  renderProviderSelection(visibleDeployments, trial, unavailable);
+  if (!opts.provider)
+    renderProviderSelection(visibleDeployments, trial, unavailable);
   const selection = await selectDeployProvider({
     requested: opts.provider,
     deployments: visibleDeployments,
@@ -20256,15 +20384,11 @@ async function cmdInfo(opts) {
     return 2;
   }
   if (opts.provider === "bnb" && !bnbDeployment) {
-    printErr(
-      "no recorded BNB deployment; run `bag deploy status` to inspect providers."
-    );
+    printMissingDeployment("bnb", opts.json);
     return 1;
   }
   if (opts.provider === "azure" && !azureDeployment) {
-    printErr(
-      "no recorded Azure deployment; run `bag deploy status` to inspect providers."
-    );
+    printMissingDeployment("azure", opts.json);
     return 1;
   }
   if ((opts.provider === "bnb" || !opts.provider) && bnbDeployment) {
@@ -20277,11 +20401,15 @@ async function cmdInfo(opts) {
   if ((opts.provider === "azure" || !opts.provider) && azureDeployment) {
     return printAzureInfo(root, azureDeployment, opts);
   }
-  printErr(
-    "`bag deploy info` reports the platform buyer-access surface; this project has no recorded BNB deployment. Use `bag deploy status` to inspect recorded providers."
-  );
+  printMissingDeployment("bnb", opts.json);
   return 1;
 }
+function printMissingDeployment(provider, json) {
+  const message = `no recorded ${provider === "bnb" ? "BNB" : "Azure"} deployment. Run \`bag deploy status\` or \`bag deploy --provider ${provider}\`.`;
+  if (json)
+    printOut(JSON.stringify({ provider, status: "not_deployed", message }));
+  else printErr(message);
+}
 async function selectRecordedForLifecycle(root, requested, operation) {
   const deployments = discoverRecordedDeployments(root);
   if (requested) {
@@ -22102,7 +22230,15 @@ function printChecks(checks) {
 // src/cli/env.ts
 import * as fs42 from "fs";
 import * as path43 from "path";
-var SECRET_KEY_PARTS = ["PASSWORD", "SECRET", "TOKEN", "API_KEY"];
+var SECRET_KEY_PARTS = [
+  "PASSWORD",
+  "SECRET",
+  "TOKEN",
+  "KEY",
+  "CREDENTIAL",
+  "ACCESS_ID",
+  "SESSION"
+];
 var WALLET_PASSWORD_KEYS = /* @__PURE__ */ new Set([
   "WALLET_PASSWORD",
   "TWAK_WALLET_PASSWORD"
@@ -22133,7 +22269,9 @@ function registerEnv(program) {
       (key, value, opts) => cmdSet2(key, value, opts.file, opts.projectRoot)
     )
   );
-  p.command("get").description("Print current value of KEY.").argument("<key>").option("--file <path>").option(
+  p.command("get").description(
+    "Print current value of KEY; secret values are always redacted."
+  ).argument("<key>").option("--file <path>").option(
     "--project-root <path>",
     "Resolve .env.local under this project root; ignored when --file is given."
   ).action(
@@ -22211,7 +22349,7 @@ function cmdGet2(key, fileArg, rootArg) {
   if (val === null) {
     return 1;
   }
-  printOut(val);
+  printOut(isSecretKey(key) && val ? "<secret value set>" : val);
   return 0;
 }
 

package/dist/{chunk-QVYWAJEK.js → chunk-CFMETPKS.js}

@@ -622,7 +622,7 @@ async function runCaptureOut(cmd, args, opts = {}) {
     reject: false,
     stripFinalNewline: false,
     stdout: "pipe",
-    stderr: "inherit"
+    stderr: opts.quiet ? "pipe" : "inherit"
   });
   return {
     code: result.exitCode ?? 1,
@@ -947,8 +947,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.14-alpha.1") {
-    return "0.0.14-alpha.1";
+  if ("0.0.14-alpha.2") {
+    return "0.0.14-alpha.2";
   }
   const file = path4.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs4.readFileSync(file, "utf-8"));
@@ -1610,6 +1610,7 @@ async function runDeployCliJson(argv, opts = {}) {
     (result) => result.code !== 0,
     () => runCaptureOut(bin, [...prefix, ...argv, "--json"], {
       cwd: opts.cwd,
+      quiet: opts.quiet,
       env: opts.env ? { ...process.env, ...opts.env } : void 0
     })
   );
@@ -1620,7 +1621,7 @@ async function runDeployCliJson(argv, opts = {}) {
       const parsed = JSON.parse(trimmed);
       data = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     } catch {
-      printErr("error: bnbagent-deploy returned invalid JSON");
+      if (!opts.quiet) printErr("error: bnbagent-deploy returned invalid JSON");
       return { code: code === 0 ? 1 : code, data: {} };
     }
   }
@@ -1646,7 +1647,38 @@ function bnbEnv() {
     BNBAGENT_CLI_SURFACE: "studio"
   };
 }
+function platformSessionFile() {
+  return path7.join(
+    process.env.BNBAGENT_DEPLOY_HOME?.trim() || path7.join(os2.homedir(), ".bnbagent-deploy"),
+    "bnb",
+    "session.json"
+  );
+}
+function platformHostMismatchMessage(recorded, target) {
+  return `Your platform login points at ${recorded}, but this command targets ${target}. Run \`bag platform logout && bag platform login\` to switch, then retry. If you intended to use the previous host, set BNBAGENT_API_URL to ${recorded} for login and subsequent commands.`;
+}
+function platformSessionHostError() {
+  if (process.env.BNBAGENT_API_TOKEN?.trim()) return null;
+  try {
+    const session = JSON.parse(fs6.readFileSync(platformSessionFile(), "utf8"));
+    const recorded = new URL(session.apiUrl).origin;
+    const target = new URL(bnbPlatformApiUrl()).origin;
+    return recorded === target ? null : platformHostMismatchMessage(recorded, target);
+  } catch {
+    return null;
+  }
+}
 async function runPlatformAccountCommand(argv, opts = {}) {
+  if (!["login", "logout"].includes(argv[0] ?? "")) {
+    const message = platformSessionHostError();
+    if (message) {
+      if (!opts.quiet) printErr(`error: ${message}`);
+      return {
+        code: 1,
+        data: { error: { code: "auth.host_mismatch", message } }
+      };
+    }
+  }
   const run = async (args, cwd) => {
     if (opts.json) {
       return runDeployCliJson(args, { cwd, env: bnbEnv(), quiet: opts.quiet });
@@ -1755,5 +1787,7 @@ export {
   runDeployCliJson,
   trialFromDeployCliJson,
   bnbEnv,
+  platformSessionFile,
+  platformHostMismatchMessage,
   runPlatformAccountCommand
 };

package/dist/{deployCli-F3AOM5UO.js → deployCli-AVWKY3GN.js}

@@ -12,6 +12,8 @@ import {
   bunxInstallDir,
   deployCommand,
   deployEndpointValue,
+  platformHostMismatchMessage,
+  platformSessionFile,
   providerPassthrough,
   renderSecretEnvFile,
   runDeployCliJson,
@@ -19,7 +21,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-QVYWAJEK.js";
+} from "./chunk-CFMETPKS.js";
 export {
   BNB_PLATFORM_API_URL,
   BNB_PLATFORM_API_URL_ENV,
@@ -33,6 +35,8 @@ export {
   bunxInstallDir,
   deployCommand,
   deployEndpointValue,
+  platformHostMismatchMessage,
+  platformSessionFile,
   providerPassthrough,
   renderSecretEnvFile,
   runDeployCliJson,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.14-alpha.1",
+  "version": "0.0.14-alpha.2",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@bnbagent/deploy-cli": "0.5.15",
-    "@bnbagent/sdk": "0.5.5",
+    "@bnbagent/sdk": "0.5.6",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",
@@ -55,7 +55,7 @@
     "tar": "^7.4.0",
     "viem": "^2.54.0",
     "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.14-alpha.1"
+    "@bnbagent/studio-runtime": "0.0.14-alpha.2"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",

package/recipes/agent/recipe.toml

@@ -11,7 +11,7 @@ node = [
     # neutral. The agent project's serving deps (@a2a-js/sdk / MCP SDK / ai)
     # come from the runtimes/<R>/ recipe selected at `bag init` time.
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.5",
+    "@bnbagent/sdk@0.5.6",
     "zod@^3.25.0",
 ]
 

package/recipes/mpp-buyer/recipe.toml

@@ -6,7 +6,7 @@ status = "v0.0.x"
 [dependencies]
 node = [
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.5",
+    "@bnbagent/sdk@0.5.6",
     "ai@^7.0.29",
     "zod@^3.25.0",
 ]

package/recipes/runtimes/agentcore/recipe.toml

@@ -32,7 +32,7 @@ node = [
     # BNBAGENT_RUNTIME_SECRET_ID is set (default secretsmanager mode + platform).
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.5",
+    "@bnbagent/sdk@0.5.6",
     # The LLM work hook (generateText + tools) and the model factory.
     "ai@^7.0.29",
     # Tool input schemas (AI SDK tools + MCP registerTool).

package/recipes/runtimes/azure-foundry/recipe.toml

@@ -29,7 +29,7 @@ node = [
     # on either cloud.
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.5",
+    "@bnbagent/sdk@0.5.6",
     # The LLM work hook (generateText + tools) and the model factory
     # (model.ts buildModel — studio.toml [llm] + the provider key env).
     "ai@^7.0.29",

package/recipes/x402-buyer/recipe.toml

@@ -6,7 +6,7 @@ status = "v0.0.x"
 [dependencies]
 node = [
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.5",
+    "@bnbagent/sdk@0.5.6",
     "ai@^7.0.29",   # AI SDK `tool` wrappers around the buyer functions
     "zod@^3.25.0",  # tool input schemas
 ]

package/skills/references/bnbagent-studio-using-altana-wallet.md

@@ -11,7 +11,7 @@ Altana separates trusted administration from runtime authority:
 - `.studio/wallets/altana-session.json` is the one bounded, expiring runtime session and must stay mode `0600`.
 - `WALLET_PASSWORD` is admin-only. The Agent gets `ALTANA_SESSION`, never the password or admin keystore.
 - Generic signing is refused. ERC-8183 uses `sessionQuoteSigner()` and the approved quote checker.
-- The generated project pins `@bnbagent/sdk@0.5.5` and `@altananetwork/sdk@0.7.1`; doctor, readiness, and runtime loading reject version drift. SDK 0.5.4 introduced selector-bound calls, removed session-key token approvals, and requires an admin-provisioned bounded Commerce allowance. Projects upgrading from an older SDK must update it, re-grant with `bag wallet session grant --force`, and redeploy.
+- The generated project pins `@bnbagent/sdk@0.5.6` and `@altananetwork/sdk@0.7.1`; doctor, readiness, and runtime loading reject version drift. SDK 0.5.4 introduced selector-bound calls, removed session-key token approvals, and requires an admin-provisioned bounded Commerce allowance. Projects upgrading from SDK versions older than 0.5.4 must update it, re-grant with `bag wallet session grant --force`, and redeploy.
 - Deployment ships ONLY the serialized session as the `ALTANA_SESSION` runtime secret; the admin keystore and `WALLET_PASSWORD` never leave the operator machine. Renewal after expiry: `bag wallet session grant --force`, then re-run `bag deploy`. Readiness fails on a missing/expired/address-mismatched session, a group/world-readable session file, a session inside the artifact root, or an unresolvable project-local `@altananetwork/sdk`; it warns under 7 days remaining. `bag deploy verify` needs `--skip-register` (no generic signing for the ERC-8004 register).
 - Altana refuses generic message signing, so Pieverse SIWE cannot authenticate `bag llm activate` or runtime credit renewal. `bag init --wallet-kind altana --llm-provider pieverse-llm` is rejected outright; use OpenRouter, OpenAI, or Anthropic (API-key providers). `bag llm activate` and `bag doctor` also flag the combination on projects edited by hand.
 

package/skills/references/bnbagent-studio-using-twak-wallet.md

@@ -25,7 +25,7 @@ This one Studio command:
 
 1. Collects the NaaS Access ID and HMAC secret through hidden Studio prompts. It never starts `twak setup` or asks which AI harnesses to wire.
 2. Runs the project-pinned `twak init --json` with the two credentials in the child environment.
-3. Performs an authenticated `twak price BNB --chain bsc --json` read. Newly written credentials are removed if this verification fails; pre-existing credentials are never deleted.
+3. Performs an authenticated `twak search BNB --networks 20000714 --limit 1 --json` read. Newly written credentials are removed if this verification fails; pre-existing credentials are never deleted.
 4. Generates `TWAK_WALLET_PASSWORD` from 32 bytes of the OS cryptographic random source and writes it to `.studio/.env.local` (0600). There is no weak-random fallback and the value is never printed.
 5. Creates the project-dedicated wallet with `--no-keychain --json`, tightens `.twak/` to 0700 and its credential/wallet files to 0600, reads the BSC address, and anchors it into `studio.toml`.
 6. Refuses to replace an anchored identity and never overwrites an existing wallet or credential file.
@@ -42,7 +42,7 @@ bag llm activate
 bag doctor
 ```
 
-No separate `bag wallet new` step is required. An existing wallet is adopted only after Studio verifies its password and reads its address. If its password is not already in `.studio/.env.local`, the user enters it through a hidden Studio prompt; Studio never invents a replacement password for an existing wallet.
+No separate `bag wallet new` step is required. An existing wallet is adopted only after Studio verifies its password and reads its address. If its password is not already in `.studio/.env.local`, the user enters it through a hidden Studio prompt or supplies the original password using `--password-stdin` / `--password-file <0600 file>`; Studio never invents a replacement password for an existing wallet.
 
 ### Other wallet placements