@bnbagent/studio-cli 0.0.6-alpha.4 → 0.0.6-alpha.5

package/skills/references/bnbagent-studio-using-altana-wallet.md

@@ -27,8 +27,8 @@ bag init <name> --wallet-kind altana --destination self --no-onboard
 # Non-TTY defaults to OpenRouter. In a TTY, choose OpenRouter, OpenAI, or
 # Anthropic from the provider menu; a flag remains available when desired:
 # bag init <name> --wallet-kind altana --llm-provider anthropic --destination self
+# Edit <name>/.studio/.env.local and set WALLET_PASSWORD first.
 cd <name>/app/agent
-export WALLET_PASSWORD='<strong password>'
 bag wallet new
 # fund the printed admin address with gas + U
 bag wallet session grant

package/skills/references/bnbagent-studio-using-twak-wallet.md

@@ -31,8 +31,9 @@ with "unknown option"); `bag doctor` and `bag deploy prepare` verify the floor.
 
 ## 2. Create the wallet — one time, in YOUR terminal
 
-studio can't create it for you (the twak CLI takes the password on argv, upstream
-S-8, and studio never puts secrets on argv). Do these steps yourself.
+`bag wallet twak-init` drives creation for you (step 3) so you never type the
+password on a command line; the NaaS setup wizard below still has to be run by
+hand once, because it is interactive.
 
 **Every twak command is prefixed with the dedicated home.** Without `HOME=$DH`,
 twak uses your real `~/.twak` (your MAIN wallet) and macOS pops a login-keychain
@@ -64,20 +65,22 @@ DH=<workspace>/.studio/twak     # e.g. ~/proj/.studio/twak
      your main/real wallet).
 
 **3. Create the wallet** (password UPPER + lower + digit, e.g. `Mypasswd01`;
-   `mypasswd01` is rejected). **RECOMMENDED — let studio drive it with the
-   password OFF argv** (it resolves the project home from studio.toml, so no
-   `HOME=` juggling):
+   `mypasswd01` is rejected). **RECOMMENDED — let studio drive it so you never
+   type the password on a command line** (it resolves the project home from
+   studio.toml, so no `HOME=` juggling):
    ```bash
    bag wallet twak-init                                       # interactive hidden prompt
    printf %s "$PW" | bag wallet twak-init --password-stdin    # CI / scripts
    bag wallet twak-init --password-file pw.txt                # file must be chmod 600
    ```
-   It wraps `twak wallet create --no-keychain` (password reaches twak via env +
-   piped stdin only), tightens `wallet.json` to mode 600, and adopts the
-   address into studio.toml in one go — so steps 5's `bag wallet new` is
-   already done.
-
-   Manual alternative (password lands on argv → `ps` / shell history;
+   It seeds this home's `credentials.json` from `~/.twak` when step 2 was run
+   there, wraps `twak wallet create --password … --no-keychain` (twak requires
+   the flag on its own argv, so the value reaches that short-lived child — it
+   never lands in YOUR shell history), tightens `wallet.json` to mode 600, and
+   adopts the address into studio.toml in one go — so step 5's `bag wallet new`
+   is already done.
+
+   Manual alternative (you type the password on argv → `ps` / shell history;
    acceptable only for a throwaway hot wallet):
    ```bash
    HOME="$DH" twak wallet create --password '<StrongPw>' --no-keychain
@@ -249,7 +252,7 @@ registers a `Container` runtime and `app/agent/Dockerfile` builds the image
 | Custom ERC-8183 targets unavailable | upstream feature request | twak v0.20.0 has no Commerce/Router/Policy address option. Studio doctor/prepare and the SDK fail closed instead of silently executing on canonical contracts; use `evm-local` for a custom ERC-8183 deployment. |
 | No generic EIP-712 signing | P0 (won't fix) | `[wallet.signing]` is ignored; payments go through the delegated payer's own prechecks + `--max-payment`. Endpoints needing an `Authorization` header *and* x402 are unavailable (e.g. `bag llm key new --initial-usd > 0` — use `--initial-usd 0` + topup + allocate instead, same end state). |
 | No wallet import | S-6 | Switching wallet kinds changes your address → re-run `bag 8004 register` (new on-chain identity). |
-| Programmatic wallet creation forces password onto argv | S-8 | Bridged by `bag wallet twak-init` (password via stdin / 0600 file / hidden prompt — never argv); the manual twak commands remain a fallback. |
+| Programmatic wallet creation forces password onto argv | S-8 | Bridged by `bag wallet twak-init` (you supply it via stdin / 0600 file / hidden prompt; studio forwards it on the child's argv because twak requires the flag); the manual twak commands remain a fallback. |
 | CLI has no daily/monthly caps | — | Studio's policy layer (`[budget].max_per_day_usd`, host allowlist, per-request caps) is the spend authority for both wallet kinds. |
 
 ## 7. Quick health checks