@bnbagent/studio-cli 0.0.14-alpha.4 → 0.0.14-alpha.6

package/README.md

@@ -316,7 +316,7 @@ This package is licensed under Apache-2.0 and provided **as is**, without warran
 
 ### CreateOS (NodeOps)
 
-Studio pins deploy 0.6.2 and loads its published Node.js SDK. Configure the agent:
+Studio pins deploy 0.6.4 and loads its published Node.js SDK. Configure the agent:
 
 ```toml
 [deploy.nodeops]
@@ -339,6 +339,6 @@ bag deploy destroy --provider nodeops                 # preview
 bag deploy destroy --provider nodeops --execute --yes # delete project
 ```
 
-Account mode supports ZIP/container deployment, runtime secrets and updates. An unhealthy endpoint makes deploy exit nonzero while preserving `.studio/deployments/nodeops.json`; inspect logs and retry verification. Wallet runtime variables use `settings.runEnvs` through the pinned deploy 0.6.2; the pinned SDK 0.5.7-alpha.2 supports BSC nested Permit2 signing with explicit policy opt-in. The Studio bridge now supports bounded approval transactions with an explicit gas budget during authorized payments. Hosting renewal is not yet integrated. `bag deploy wallet --json` reads Gateway chains and USDC balances without signing or paying. CreateOS uses NodeOps infrastructure; AWS and Azure providers deploy into your own cloud account.
+Account mode supports ZIP/container deployment, runtime secrets and updates. An unhealthy endpoint makes deploy exit nonzero while preserving `.studio/deployments/nodeops.json`; inspect logs and retry verification. Wallet runtime variables use `settings.runEnvs` through the pinned deploy 0.6.4; the pinned SDK 0.5.7-alpha.2 supports BSC nested Permit2 signing with explicit policy opt-in. The Studio bridge now supports bounded approval transactions with an explicit gas budget during authorized payments. Hosting renewal is not yet integrated. `bag deploy wallet --json` reads Gateway chains and USDC balances without signing or paying. CreateOS uses NodeOps infrastructure; AWS and Azure providers deploy into your own cloud account.
 
 The installed skill includes `references/bnbagent-studio-use-createos.md` with configuration, capability limits and recovery steps.

package/dist/bag.js

@@ -72,7 +72,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-NSZXF5VL.js";
+} from "./chunk-P4YB7JBD.js";
 import {
   validateAgentcoreName
 } from "./chunk-U7IDQ3K5.js";
@@ -771,7 +771,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-MG3GJCHM.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-3E2EMAEW.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -3612,9 +3612,13 @@ async function signNodeOpsApproval(wallet, tx, policy) {
     "gas",
     "gasPrice",
     "data",
-    "from"
+    "from",
+    "account",
+    "chain"
   ]);
-  if (Object.entries(tx).some(([k, v]) => v !== void 0 && !fields.has(k)) || tx.chainId !== 56 || tx.type !== "legacy" || typeof tx.to !== "string" || tx.to.toLowerCase() !== USDC.toLowerCase() || tx.from !== void 0 && String(tx.from).toLowerCase() !== wallet.address.toLowerCase() || tx.value !== void 0 && tx.value !== 0n || !Number.isSafeInteger(tx.nonce) || Number(tx.nonce) < 0 || typeof tx.gas !== "bigint" || tx.gas <= 0n || typeof tx.gasPrice !== "bigint" || tx.gasPrice <= 0n || tx.gas * tx.gasPrice > BigInt(policy.maxApprovalGasWei) || typeof tx.data !== "string")
+  if (Object.entries(tx).some(([k, v]) => v !== void 0 && !fields.has(k)) || tx.chainId !== 56 || tx.chain !== void 0 && (tx.chain === null || typeof tx.chain !== "object" || tx.chain.id !== 56) || tx.account !== void 0 && String(
+    typeof tx.account === "string" ? tx.account : tx.account?.address
+  ).toLowerCase() !== wallet.address.toLowerCase() || tx.type !== "legacy" || typeof tx.to !== "string" || tx.to.toLowerCase() !== USDC.toLowerCase() || tx.from !== void 0 && String(tx.from).toLowerCase() !== wallet.address.toLowerCase() || tx.value !== void 0 && tx.value !== 0n || !Number.isSafeInteger(tx.nonce) || Number(tx.nonce) < 0 || typeof tx.gas !== "bigint" || tx.gas <= 0n || typeof tx.gasPrice !== "bigint" || tx.gasPrice <= 0n || tx.gas * tx.gasPrice > BigInt(policy.maxApprovalGasWei) || typeof tx.data !== "string")
     throw new Error(
       "Rejected a transaction outside the bounded BSC USDC approval policy."
     );
@@ -9041,7 +9045,7 @@ function requireDurablePassword(projectRoot) {
   const persisted = getEnvVar(envPath, PASSWORD_ENV2);
   if (!persisted) {
     throw new Error(
-      `refusing to create a keystore with an unpersisted ${PASSWORD_ENV2}. Edit ${envPath}, set ${PASSWORD_ENV2} there, and retry; do not pass wallet passwords on the command line.`
+      `refusing to create a keystore with an unpersisted ${PASSWORD_ENV2}. For a new wallet/import, add --save-password to privately save the current shell password in ${envPath}, or use --generate-password to generate one. Do not pass wallet passwords on the command line.`
     );
   }
   if (persisted !== password) {
@@ -9101,6 +9105,9 @@ function registerWallet(program) {
   ).option(
     "--generate-password",
     "For a new evm-local wallet, generate a CSPRNG password and persist it privately before creating the keystore."
+  ).option(
+    "--save-password",
+    "For a new evm-local wallet/import, privately persist WALLET_PASSWORD from the current shell; never accepts a password argument."
   ).option("--project-root <path>", "Override project root.").action(
     act(
       wrap2(
@@ -9219,6 +9226,11 @@ async function createProjectWallet(opts, projectRoot) {
     walletCfg = loadWalletCfg(projectRoot);
   }
   const kind = walletKind(walletCfg);
+  if (opts.savePassword && (kind !== "evm-local" || opts.generatePassword)) {
+    throw new Error(
+      "--save-password requires evm-local and cannot be combined with --generate-password."
+    );
+  }
   if (kind === "twak") {
     return cmdNewTwak(projectRoot, walletCfg);
   }
@@ -9263,13 +9275,24 @@ async function createProjectWallet(opts, projectRoot) {
     );
     return 1;
   }
+  if (opts.savePassword && (anchored || existingKeystores.length)) {
+    throw new Error(
+      "--save-password is only for a new wallet/import; use the existing wallet's original saved password."
+    );
+  }
   const privateKey = await resolvePrivateKeyArg(opts.privateKey);
   const priorPersistedPassword = getEnvVar(
     envLocalPath10(projectRoot),
     PASSWORD_ENV2
   );
-  const password = opts.generatePassword ? generateLocalWalletPassword() : requireDurablePassword(projectRoot);
-  if (opts.generatePassword) {
+  const password = opts.generatePassword ? generateLocalWalletPassword() : opts.savePassword ? requirePassword2() : requireDurablePassword(projectRoot);
+  if (opts.savePassword && priorPersistedPassword && priorPersistedPassword !== password) {
+    throw new Error(
+      "Refusing to replace a different saved WALLET_PASSWORD; make the existing durable password authoritative first."
+    );
+  }
+  const savedPassword = opts.generatePassword || opts.savePassword;
+  if (savedPassword) {
     setEnvVar(privateEnvPath(projectRoot), PASSWORD_ENV2, password);
   }
   let provider;
@@ -9288,7 +9311,7 @@ async function createProjectWallet(opts, projectRoot) {
     } catch {
       walletWasWritten = false;
     }
-    if (opts.generatePassword && !walletWasWritten) {
+    if (savedPassword && !walletWasWritten) {
       setEnvVar(
         privateEnvPath(projectRoot),
         PASSWORD_ENV2,
@@ -9301,12 +9324,12 @@ async function createProjectWallet(opts, projectRoot) {
     persistAddress(projectRoot, provider.address, opts.keystoreDir);
   } catch (cause) {
     throw new Error(
-      "The wallet and its password were saved, but writing the address to studio.toml failed. Restore file permissions, then run `bag wallet new` without --generate-password to adopt the saved wallet.",
+      "The wallet and its password were saved, but writing the address to studio.toml failed. Restore file permissions, then run `bag wallet new` without --generate-password or --save-password to adopt the saved wallet.",
       { cause }
     );
   }
   printOut(provider.address);
-  if (opts.generatePassword) {
+  if (savedPassword) {
     printErr(
       `Password stored (0600): ${envLocalPath10(projectRoot)} (WALLET_PASSWORD)`
     );
@@ -15177,7 +15200,7 @@ async function loadNodeOpsSdk() {
       ).resolve("@bnbagent/deploy-provider-nodeops/sdk");
     } catch {
       throw new Error(
-        "Installed deploy package lacks the NodeOps Node.js SDK. Reinstall Studio with its pinned @bnbagent/deploy-cli 0.6.2 dependency."
+        "Installed deploy package lacks the NodeOps Node.js SDK. Reinstall Studio with its pinned @bnbagent/deploy-cli 0.6.4 dependency."
       );
     }
   }
@@ -15628,7 +15651,7 @@ async function inspectNodeOpsWallet(root, deps = {}) {
   const sdk = await (deps.sdk ?? loadNodeOpsSdk)();
   if (!sdk.createGatewayWalletClient)
     throw new Error(
-      "The installed deploy SDK lacks Gateway wallet queries. Reinstall Studio with its pinned deploy 0.6.2 dependency."
+      "The installed deploy SDK lacks Gateway wallet queries. Reinstall Studio with its pinned deploy 0.6.4 dependency."
     );
   const address = cfg.options.walletAddress ?? (deps.wallet ?? getWallet3)().address;
   if (typeof address !== "string" || !address)
@@ -19266,7 +19289,7 @@ function resolveTarget(opts, root, destination = agentDeployDestination(root)) {
   return readStackRuntime(root) ?? "agentcore";
 }
 function validateRuntimeAgainstStack(target, force, root) {
-  if (target === "platform" || target === "platform-azure") {
+  if (target === "platform" || target === "platform-azure" || target === "nodeops") {
     return null;
   }
   const stackRuntime2 = readStackRuntime(root);
@@ -19800,14 +19823,20 @@ async function cmdDeploy(opts, deployArgs) {
       printErr("error: --backend does not apply to CreateOS");
       return 2;
     }
-    const readiness = await runPrepare({
-      target: "nodeops",
-      projectRoot: root
-    });
-    if (readiness.exitCode() !== 0) {
-      for (const check of readiness.checks)
-        printErr(`${check.level}: ${check.message}`);
-      return readiness.exitCode();
+    const storageExit = enforceSkipPrepareStorageGate(opts, root, "nodeops");
+    if (storageExit !== null) return storageExit;
+    if (!opts.skipPrepare) {
+      let readiness = await runPrepare({
+        target: "nodeops",
+        projectRoot: root,
+        force: opts.force
+      });
+      readiness = applyStorageGuard(readiness, root);
+      readiness = bypassBrokenStorageIfForced(opts, readiness, root);
+      if (readiness.exitCode() !== 0) {
+        renderPrepareHuman(readiness, true);
+        return readiness.exitCode();
+      }
     }
     try {
       const record2 = await deployNodeOps(root, { pay: opts.pay === true });
@@ -23078,7 +23107,7 @@ function registerEnv(program) {
     "Resolve .env.local under this project root (mirrors `bag config --project-root`); ignored when --file is given."
   ).addHelpText(
     "after",
-    "\nNote: wallet unlock passwords are intentionally REJECTED here \u2014 studio\nnever accepts them as command-line arguments. Keep evm-local in the shell:\n  export WALLET_PASSWORD=...\nFor twak, edit .studio/.env.local yourself and set:\n  TWAK_WALLET_PASSWORD=...\nNever pass either value through chat or argv. See docs/guides/user-guide.md \xA710."
+    "\nNote: wallet unlock passwords are intentionally REJECTED here \u2014 studio\nnever accepts them as command-line arguments. For a NEW evm-local wallet/import,\nread the password privately in your terminal, export WALLET_PASSWORD, then use\n  bag wallet new --save-password\nAdd --private-key to import through a hidden prompt, or --private-key - for stdin.\nFor an existing wallet, keep its original password in the owner-only .studio/.env.local.\nFor twak, edit .studio/.env.local yourself and set:\n  TWAK_WALLET_PASSWORD=...\nNever pass either value through chat or argv. See docs/guides/user-guide.md \xA710."
   ).action(
     act(
       (key, value, opts) => cmdSet2(key, value, opts.file, opts.projectRoot)
@@ -23119,7 +23148,7 @@ function resolveEnvPath(fileArg, rootArg) {
 }
 function cmdSet2(key, value, fileArg, rootArg) {
   if (WALLET_PASSWORD_KEYS.has(key)) {
-    let guidance = "Set it for this shell instead:\n  export WALLET_PASSWORD=...\n\u2014 every `bag` command reads it from the environment.";
+    let guidance = "For a NEW evm-local wallet/import, read the password privately in your terminal, export WALLET_PASSWORD, then run `bag wallet new --save-password` (add --private-key for a hidden key prompt, or --private-key - for stdin). For an existing wallet, keep its original password in the owner-only .studio/.env.local. Never replace an existing wallet password.";
     if (key === "TWAK_WALLET_PASSWORD") {
       guidance = "Edit .studio/.env.local yourself and add:\n  TWAK_WALLET_PASSWORD=...";
     }

package/dist/{chunk-NSZXF5VL.js → chunk-P4YB7JBD.js}

@@ -947,8 +947,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.14-alpha.4") {
-    return "0.0.14-alpha.4";
+  if ("0.0.14-alpha.6") {
+    return "0.0.14-alpha.6";
   }
   const file = path4.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs4.readFileSync(file, "utf-8"));
@@ -1230,7 +1230,7 @@ function isTable(value) {
 }
 
 // src/cli/_deploy/deployCli.ts
-var DEPLOY_CLI_VERSION = "0.6.2";
+var DEPLOY_CLI_VERSION = "0.6.4";
 var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
 var require2 = createRequire(import.meta.url);
 function resolveLocalDeployCli() {

package/dist/{deployCli-MG3GJCHM.js → deployCli-3E2EMAEW.js}

@@ -21,7 +21,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-NSZXF5VL.js";
+} from "./chunk-P4YB7JBD.js";
 export {
   BNB_PLATFORM_API_URL,
   BNB_PLATFORM_API_URL_ENV,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.14-alpha.4",
+  "version": "0.0.14-alpha.6",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -42,7 +42,7 @@
     "bag": "./dist/bag.js"
   },
   "dependencies": {
-    "@bnbagent/deploy-cli": "0.6.2",
+    "@bnbagent/deploy-cli": "0.6.4",
     "@bnbagent/sdk": "0.5.7-alpha.2",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
@@ -55,7 +55,7 @@
     "tar": "^7.4.0",
     "viem": "^2.56.3",
     "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.14-alpha.4"
+    "@bnbagent/studio-runtime": "0.0.14-alpha.6"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",

package/skills/bnbagent-studio.md

@@ -67,7 +67,7 @@ Treat ERC-8183 amounts as decimal strings at CLI/config boundaries and `bigint`
 
 ## CLI groups at a glance
 
-`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `mpp`, `agents`, `config`, `env`, `dev`, `doctor`, `feedback`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws\|azure\|nodeops] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `list`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.6.2`.
+`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `mpp`, `agents`, `config`, `env`, `dev`, `doctor`, `feedback`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws\|azure\|nodeops] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `list`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.6.4`.
 
 ## Tool surface
 

package/skills/references/bnbagent-studio-scaffolding-agent.md

@@ -166,7 +166,7 @@ Build a TodoWrite list. The shape depends on the `wallet kind`. The canonical 8-
 
      Do not run or explain the upstream `twak setup` wizard. `twak-init` uses the project-pinned binary, runs `twak init --json`, verifies an authenticated read, generates and persists `TWAK_WALLET_PASSWORD`, creates/adopts the project-dedicated no-keychain wallet, and anchors the address. No separate `bag wallet new` step exists. For CI, the user may place `TWAK_ACCESS_ID` + `TWAK_HMAC_SECRET` in `.studio/.env.local` themselves; never route them through chat. Reuse an existing wallet only with explicit `--twak-home <home-style-path>`; `--twak-home ~` is a discouraged opt-in to the main wallet. Load `bnbagent-studio-using-twak-wallet.md` for the exact security and deploy contract.
 
-   - **evm-local** (default): the new-wallet TTY happy path generates `WALLET_PASSWORD` with the OS CSPRNG, persists it privately, then creates the encrypted keystore in-process. After `--no-onboard`, run `(cd app/agent && bag wallet new --generate-password)` for the same non-interactive safe path. It refuses to replace an existing or anchored wallet. For an existing encrypted v3 file, prefer `bag init ... --wallet-kind evm-local --evm-keystore <path>` and use the file's original password; Studio copies and verifies the file without re-encrypting it. To import a raw key, use the hidden `bag wallet new --private-key` prompt or stdin; never pass the key inline.
+   - **evm-local** (default): the new-wallet TTY happy path generates `WALLET_PASSWORD` with the OS CSPRNG, persists it privately, then creates the encrypted keystore in-process. After `--no-onboard`, run `(cd app/agent && bag wallet new --generate-password)` for the same non-interactive safe path. It refuses to replace an existing or anchored wallet. For an existing encrypted v3 file, prefer `bag init ... --wallet-kind evm-local --evm-keystore <path>` and use the file's original password; Studio copies and verifies the file without re-encrypting it. To import a raw key into a new wallet, use `bag wallet new --private-key --generate-password` (hidden key prompt) or `--private-key - --generate-password` (stdin). For a user-selected password, the user privately reads/exports `WALLET_PASSWORD` in their own terminal and replaces `--generate-password` with `--save-password`, which persists it privately and refuses existing wallets or a different saved password. Never pass a key or password inline.
 
 5. **Fund the wallet - OPTIONAL; do NOT block on it.** The default `auto/free` LLM model runs at $0 and AgentCore deploy consumes no wallet balance, so a brand-new seller can scaffold, run `bag dev`, and deploy with an empty wallet. `bag doctor` and `bag deploy` only **WARN** (never block) on zero balance. Funding is needed later only for: a paid LLM model, on-chain settle, paying positive-price ERC-8183 job buys, or buying/smoking a PAID B402 request. A FREE ERC-8183 buy needs no U escrow or ERC-20 approval, but still needs the ERC-8183 state-changing calls and their gas/paymaster path. A FREE B402/x402 request needs neither token funding nor a facilitator call. When funding is needed, the wallet uses **TWO distinct U balances on TWO chains** (same wallet address, same private key, different chains):
    - **tBNB (gas)** on BSC testnet: message the official Telegram bot https://t.me/bnbchain_official_bot with `I would like to get tBNB to my wallet <address>` (up to 0.3 tBNB/day; replies with the tx hash). More options: https://docs.bnbchain.org/bnb-smart-chain/developers/faucet/

package/skills/references/bnbagent-studio-use-aws-agentcore.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-aws-agentcore
-description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.6.2`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
+description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.6.4`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.

package/skills/references/bnbagent-studio-use-azure-foundry.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-azure-foundry
-description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.6.2`. Native MCP is not supported on Azure; use AgentCore for MCP.
+description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.6.4`. Native MCP is not supported on Azure; use AgentCore for MCP.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.
@@ -31,7 +31,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 1. **Bun 1.3+ (`bunx`) on PATH** - the pinned `@bnbagent/deploy-cli` runs through it.
 2. **Docker running** - the image is built locally (linux/amd64) before push.
-3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.6.2 login --provider azure`; use OIDC/service-principal credentials in CI.
+3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.6.4 login --provider azure`; use OIDC/service-principal credentials in CI.
 
 ## ⚠️ Foundry gotchas (read before deploying)
 

package/skills/references/bnbagent-studio-use-bnb-trial.md

@@ -9,7 +9,7 @@ description: Use when deploying or operating a bnbagent-studio seller on the BNB
 
 Treat this provider as a temporary testnet sandbox. Require a throwaway wallet, keep `bsc-testnet`, and explain that the runtime signing material is transmitted to the operator's managed secret store for the trial. Never use a mainnet key. Exception: `wallet.kind='altana'` ships only the bounded, budget-limited, revocable session - the throwaway-wallet advice does not apply; tighten the session instead (`bag wallet session grant --force --budget-u <small> --expiry-days <short>`) and never run `bag wallet new` on an altana project (it breaks the session's `[wallet].address` anchor).
 
-All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.6.2` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
+All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.6.4` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
 
 ## Select and authenticate
 

package/skills/references/bnbagent-studio-use-createos.md

@@ -1,17 +1,17 @@
 ---
 name: bnbagent-studio-use-createos
-description: Deploy and operate Studio agents on CreateOS through the nodeops provider and published deploy 0.6.2 SDK. Covers account credentials, ZIP/container packaging, runtime secrets, health recovery, project lifecycle and wallet payment restrictions.
+description: Deploy and operate Studio agents on CreateOS through the nodeops provider and published deploy 0.6.4 SDK. Covers account credentials, ZIP/container packaging, runtime secrets, health recovery, project lifecycle and wallet payment restrictions.
 ---
 
 # Deploy and operate on CreateOS
 
-Use Studio's `nodeops` provider for NodeOps-hosted infrastructure. AWS and Azure providers remain separate choices for infrastructure in the user's own cloud account. Studio pins `@bnbagent/deploy-cli@0.6.2` and resolves the published `@bnbagent/deploy-provider-nodeops/sdk` through that dependency. No local deploy checkout, source override or Bun process is required for NodeOps.
+Use Studio's `nodeops` provider for NodeOps-hosted infrastructure. AWS and Azure providers remain separate choices for infrastructure in the user's own cloud account. Studio pins `@bnbagent/deploy-cli@0.6.4` and resolves the published `@bnbagent/deploy-provider-nodeops/sdk` through that dependency. No local deploy checkout, source override or Bun process is required for NodeOps.
 
 ## Check the installed CLI
 
 Run `bag --version` and `bag deploy --help`. Confirm that `nodeops` is advertised before following this reference; older Studio releases lack the adapter. If absent, use the main skill's approved upgrade workflow. Do not bypass Studio with a raw provider deployment, because it omits Studio packaging, secrets and resource records.
 
-The generic router's minimum version does not establish NodeOps compatibility. Use the release's documented CLI version with deploy 0.6.2; an alpha may be required while npm `latest` lacks this integration. Do not repeatedly install `latest` without checking its capabilities. Reuse existing installation authorization and verify the selected CLI's version and provider after installation.
+The generic router's minimum version does not establish NodeOps compatibility. Use the release's documented CLI version with deploy 0.6.4; an alpha may be required while npm `latest` lacks this integration. Do not repeatedly install `latest` without checking its capabilities. Reuse existing installation authorization and verify the selected CLI's version and provider after installation.
 
 ## Complete a build-and-deploy request
 
@@ -106,11 +106,11 @@ Deletion removes project environments too; registry images and payment history r
 
 Read this section before choosing a wallet for NodeOps. Use `evm-local` for the currently tested Studio signing path. Turnkey implements the required public signing interfaces but still needs provider-specific live acceptance testing. TWAK lacks generic EIP-712 signing; Altana's session `x402.pay` is not wired into Gateway authentication/payment. Do not silently replace an existing wallet to work around these limits.
 
-Studio pins published deploy 0.6.2, which supports runtime credentials through `settings.runEnvs`, independently of the uploaded archive. The 2026-09-10 standalone live probe confirmed Dockerfile deployment, BSC MPP settlement and runtime variable injection; the installed-package integration suite covers the Studio path with injected HTTP responses. These do not establish secret-vault encryption, redaction or variable rotation. If readiness reports an older SDK without runtime variable support, follow the approved CLI upgrade workflow; do not use a source override or embed credentials in the artifact.
+Studio pins published deploy 0.6.4, which supports runtime credentials through `settings.runEnvs`, independently of the uploaded archive. The 2026-09-10 standalone live probe confirmed Dockerfile deployment, BSC MPP settlement and runtime variable injection; the installed-package integration suite covers the Studio path with injected HTTP responses. These do not establish secret-vault encryption, redaction or variable rotation. If readiness reports an older SDK without runtime variable support, follow the approved CLI upgrade workflow; do not use a source override or embed credentials in the artifact.
 
 For evm-local workloads, runtime variables include the encrypted `WALLET_KEYSTORE_JSON` and its `WALLET_PASSWORD`. NodeOps therefore receives the material needed by the deployed agent to unlock and use that wallet. The claim "no private-key export" applies to the hosting-payment signer, not to runtime custody. Explain this boundary when choosing the deployment wallet, honor existing custody authorization and prefer a dedicated wallet for new third-party-hosted agents. Do not display or log the secret payload or imply that keystore encryption keeps it inaccessible to a runtime that also receives the password.
 
-For a new project, use the explicit business-interface initialization above, install dependencies, and run `(cd app/agent && bag wallet new --generate-password)`. Reuse an initialized wallet within its authorized custody scope instead of generating another. Configure model/storage credentials using the existing local secret workflow; never collect private keys, passwords or API keys in chat. A wallet used to pay NodeOps is not automatically compatible with every runtime wallet backend.
+For a new project, use the explicit business-interface initialization above, install dependencies, and run `(cd app/agent && bag wallet new --generate-password)`. To import a raw key with a new generated password, use `bag wallet new --private-key - --generate-password` with the key supplied by the user through stdin. If the user requires their own password, they privately read/export `WALLET_PASSWORD` in their terminal and run `bag wallet new --private-key - --save-password`; the flag persists it in `.studio/.env.local` (0600) and refuses existing wallets or a different saved password. Never put passwords or private keys in argv. Reuse an initialized wallet within its authorized custody scope instead of generating another. Configure model/storage credentials using the existing local secret workflow; never collect private keys, passwords or API keys in chat. A wallet used to pay NodeOps is not automatically compatible with every runtime wallet backend.
 
 Merge the following into `app/agent/studio.toml`. These amounts are example spending caps, **not a NodeOps quote**; use the user's approved limits. Keep existing signing-policy entries.
 
@@ -164,11 +164,13 @@ bag deploy status --provider nodeops --json
 bag deploy verify --provider nodeops --skip-register
 ```
 
+`--skip-prepare` skips readiness checks only; the fatal storage guard and deploy SDK validation still run. `--force` does not override fatal storage or wallet signing checks. The explicit `--force-deploy-broken-storage` override permits knowingly deploying broken/local storage with a warning; do not add it merely to get a deployment through. `prepare --provider nodeops` selects the cloud provider, not a local runtime named nodeops.
+
 `deploy wallet` is read-only and reports on-chain USDC. `createosCredits: null` means unknown hosting credits, not zero. Funding and hidden credential entry may require the user's terminal/wallet. Base/Arbitrum require their exact USDC domain and validity-window policy instead of the BSC Permit2 configuration. `RPC_URL_BSC` overrides the default `https://bsc-dataseed.bnbchain.org`; RPC requests have bounded timeouts and do not retry broadcasts automatically.
 
 `--yes` confirms deployment; `--pay` additionally authorizes payment within the caps. An initial deploy POST may consume existing credits and create a project even without a payment challenge. `use_existing_credits` is the separate choice for credits shared by active projects. `auto_pay=true` additionally requires the approved `pay_to` recipient pin. It automates payment when deployment is invoked; it does not schedule renewal.
 
-Wallet deployments are create-only. Use `status` and `verify` after an acknowledged build failure, timeout or uncertain response; retain `.studio/deployments/nodeops.json` and deploy's durable journal under `~/.bnbagent-deploy/nodeops/payments/`. All callers of a wallet must share one journal for budget aggregation and locking. Do not change names, clear the journal or submit another payment to recover an unknown outcome. Logs, existing-image deployment, named-environment management and in-place updates are not exposed by the current wallet adapter.
+Wallet deployments are create-only. Use `status` and `verify` after an acknowledged build failure, timeout or uncertain response; retain `.studio/deployments/nodeops.json` and deploy's durable journal under `~/.bnbagent-deploy/nodeops/payments/`. With deploy 0.6.4, a verified pre-broadcast failure releases the reservation and a retry can resume the same deployment. An ambiguous approval broadcast, a submitted payment, or an old reservation without preparation evidence must remain blocked for reconciliation; missing resource IDs are not proof that payment failed. All callers of a wallet must share one journal for budget aggregation and locking. Do not change names, clear the journal or submit another payment to recover an unknown outcome. Logs, existing-image deployment, named-environment management and in-place updates are not exposed by the current wallet adapter.
 
 ## When the user asks to renew