@bnbagent/studio-cli 0.0.6-alpha.8 → 0.0.6-alpha.9

package/dist/bag.js

@@ -4533,7 +4533,17 @@ function printUBalanceShortfall(walletAddress, currentRaw, neededRaw, neededUsd,
 function writeEnvLocal(key, value, envPath = ".env.local") {
   return setEnvVar(envPath, key, value);
 }
+function ensureSiweCapable(wallet) {
+  const probe = wallet.supports;
+  if (typeof probe !== "function") return;
+  if (probe.call(wallet, "sign.message")) return;
+  const kind = wallet.kind;
+  throw new PieverseCliError(
+    `the ${kind ? `'${kind}' ` : ""}wallet cannot log in to Pieverse: SIWE requires an EIP-191 personal-sign ('sign.message'), which this wallet kind never supports. Pieverse LLM is not usable with this wallet \u2014 set [llm].provider in studio.toml to 'openrouter', 'openai', or 'anthropic' (with the matching API key in .studio/.env.local), or use an 'evm-local' or 'twak' wallet.`
+  );
+}
 async function withSiweRetry(wallet, call, opts = {}) {
+  ensureSiweCapable(wallet);
   let token = opts.sessionToken ?? await siweLogin(wallet);
   try {
     return await call(token);
@@ -4801,6 +4811,15 @@ async function cmdActivate(opts) {
   if (wallet === null) {
     return 2;
   }
+  try {
+    ensureSiweCapable(wallet);
+  } catch (exc) {
+    if (exc instanceof PieverseCliError) {
+      printErr(`error: ${exc.message}`);
+      return 2;
+    }
+    throw exc;
+  }
   const pvCfg = loadPieverseConfig(cfg);
   const replace = opts.replace === true;
   let existingHash = !replace && pvCfg.key_hash ? String(pvCfg.key_hash) : null;
@@ -4824,6 +4843,10 @@ async function cmdActivate(opts) {
     try {
       await withSiweRetry(wallet, (token) => inspectKey(token, derivedHash));
     } catch (exc) {
+      if (exc instanceof PieverseCliError) {
+        printErr(`error: ${exc.message}`);
+        return 2;
+      }
       if (!(exc instanceof PieverseKeyNotFoundError)) {
         printErr(
           `error: could not verify the existing ${PIEVERSE_ENV_KEY} against Pieverse: ${errMessage(
@@ -7829,6 +7852,9 @@ async function cmdInit(nameArg, opts) {
     opts.llmProviderSource,
     isTty
   );
+  if (llmProvider === null) {
+    return 2;
+  }
   let rails = await resolveRails(opts.rails, isTty);
   if (hasX402Face(faces) && rails === "8183") {
     rails = "both";
@@ -8902,8 +8928,9 @@ async function resolveLlmProviderForWallet(walletKind2, configuredProvider, valu
   if (explicitlyConfigured) {
     if (configuredProvider === "pieverse-llm") {
       printErr(
-        "warning: Altana + pieverse-llm has limited compatibility: `bag llm activate` and paid-model runtime credit renewal both require SIWE message signing, which Altana intentionally does not expose. An existing Pieverse API key is usable only with the free `auto/free` model; use openrouter, openai, or anthropic for paid models."
+        "error: --wallet-kind altana cannot be combined with --llm-provider pieverse-llm: `bag llm activate` and paid-model runtime credit renewal both require SIWE message signing, which Altana intentionally does not expose \u2014 activation can never succeed. Use --llm-provider openrouter, openai, or anthropic (each needs only an API key)."
       );
+      return null;
     }
     return configuredProvider;
   }
@@ -9751,20 +9778,7 @@ function printNextSteps(name, provider, o = {}) {
   }
   printOut("");
   let nextStep;
-  if (provider === "pieverse-llm" && walletKind2 === "altana") {
-    printOut(
-      "  # Pieverse `bag llm activate` needs generic SIWE message signing, which"
-    );
-    printOut(
-      "  # Altana intentionally does not expose. Runtime paid-model credit renewal"
-    );
-    printOut(
-      "  # needs the same SIWE flow, so an existing key works only with auto/free."
-    );
-    printOut("  # Use openrouter/openai/anthropic for paid models.");
-    printOut("");
-    nextStep = 3;
-  } else if (provider === "pieverse-llm") {
+  if (provider === "pieverse-llm") {
     printOut("  # 3. activate Pieverse LLM (zero-deposit by default)");
     printOut(
       "  #    SIWE login + create API key with $0 allocation. Default model"
@@ -11641,12 +11655,18 @@ async function checkAgentcoreQuotaHeadroom(root, target) {
       }
     ];
   }
+  const quotaRunbook = `Raising ${AGENTCORE_AGENT_QUOTA_CODE} ("Total Agents per Account") is a manual AWS step \u2014 \`bag\` cannot request it for you:
+    1. Open the AWS Service Quotas console (service "Amazon Bedrock AgentCore", region ${region}) and request an increase; low requests may need an AWS support case, and a first request can be rejected.
+    2. Check where an earlier request stands: aws service-quotas list-requested-service-quota-change-history --service-code bedrock-agentcore --region ${region}
+    3. While the increase is pending, deploy to the managed platform instead: bag deploy --provider bnb`;
+  const message = limit <= 0 ? `AgentCore quota is 0 in ${region} (new accounts can start at zero), so ANY deploy would fail with \`maxAgents limit exceeded\` AFTER pushing the image and creating the secret, M2M client, and execution role (all orphans). ${quotaRunbook}` : `AgentCore runtimes: ${used}/${limit} used in ${region} \u2014 no slots left, so the deploy would fail with \`maxAgents limit exceeded\` AFTER pushing the image and creating the secret, M2M client, and execution role (all orphans). Delete a runtime you no longer need (\`bag deploy destroy\` in its workspace), or raise the quota. ${quotaRunbook}`;
   return [
     {
       level: Level.CRITICAL,
       name: "agentcore_quota_headroom",
-      message: `AgentCore runtimes: ${used}/${limit} used in ${region} \u2014 no slots left, so the deploy would fail with \`maxAgents limit exceeded\` AFTER pushing the image and creating the secret, M2M client, and execution role (all orphans). Delete a runtime you no longer need (\`bag deploy destroy\` in its workspace) or request a quota increase for ${AGENTCORE_AGENT_QUOTA_CODE} ("Total Agents per Account") in the Service Quotas console.`,
-      details
+      message,
+      details,
+      fixCmd: `# raise ${AGENTCORE_AGENT_QUOTA_CODE} in the AWS Service Quotas console (manual), or deploy with: bag deploy --provider bnb`
     }
   ];
 }
@@ -16956,6 +16976,14 @@ async function checkLlm(data, projectRoot) {
     });
   }
   if (provider === "pieverse-llm") {
+    const walletKind2 = String(tableOf14(data, "wallet").kind ?? "");
+    if (walletKind2 === "altana") {
+      out.push({
+        name: "pieverse wallet compatibility",
+        status: FAIL,
+        detail: "wallet kind 'altana' cannot log in to Pieverse (SIWE needs EIP-191 'sign.message', which altana never exposes) \u2014 `bag llm activate` will always fail. Set [llm].provider to 'openrouter', 'openai', or 'anthropic' in studio.toml."
+      });
+    }
     out.push(...await checkPieverse(data, keyValue));
   }
   return out;
@@ -20580,7 +20608,7 @@ function buildProgram() {
   return program;
 }
 function cliVersion() {
-  return "0.0.6-alpha.8";
+  return "0.0.6-alpha.9";
 }
 
 // src/cli/updateCheck.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.6-alpha.8",
+  "version": "0.0.6-alpha.9",
   "description": "The `bag` CLI: scaffold, run, deploy, and monetize a single seller agent on BNB Chain (ERC-8004 identity, ERC-8183 commerce, x402 payments).",
   "license": "Apache-2.0",
   "repository": {
@@ -38,7 +38,7 @@
     "tar": "^7.4.0",
     "viem": "^2.54.0",
     "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.6-alpha.8"
+    "@bnbagent/studio-runtime": "0.0.6-alpha.9"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",

package/skills/references/bnbagent-studio-use-aws-agentcore.md

@@ -87,6 +87,7 @@ bag deploy --provider aws
 - **Permission denials (AccessDenied)** - the deploy identity is missing one of the least-privilege statements; apply the policy JSON from `docs/guides/agentcore-deploy-iam.md`. The deploy CLI preflight-simulates its permissions when it can and names the denied actions.
 - **Wrong account** - the credentials in the environment resolve to an account that does not match `agentcore/aws-targets.json`; fix the env vars / `~/.aws/credentials` profile, not the descriptor.
 - **Container build fails / hangs** (twak) - the image is built LOCALLY for linux/arm64 and pushed to ECR; Docker must be running (x86 machines need buildx/containerd cross-build support).
+- **`agentcore_quota_headroom` CRITICAL (quota 0 or full)** - the `L-F4575653` ("Total Agents per Account") quota has no free slot; new accounts can start at an applied quota of ZERO even though the console shows a higher default. Raising it is a manual AWS step (`bag` and the AWS CLI cannot request it): open the Service Quotas console for "Amazon Bedrock AgentCore" in the target region and request an increase — low first requests are sometimes rejected and need an AWS support case. Check where an earlier request stands with `aws service-quotas list-requested-service-quota-change-history --service-code bedrock-agentcore --region <region>` (a `CASE_CLOSED` entry without a quota change means it was rejected — escalate via support). While the increase is pending, deploy to the managed platform instead: `bag deploy --provider bnb`. If the quota is full but nonzero, `bag deploy destroy` in an old workspace frees a slot.
 
 ### C. Inspect / operate
 

package/skills/references/bnbagent-studio-using-altana-wallet.md

@@ -12,7 +12,7 @@ Altana separates trusted administration from runtime authority:
 - `WALLET_PASSWORD` is admin-only. The Agent gets `ALTANA_SESSION`, never the password or admin keystore.
 - Generic signing is refused. ERC-8183 uses `sessionQuoteSigner()` and the approved quote checker.
 - Deployment ships ONLY the serialized session as the `ALTANA_SESSION` runtime secret; the admin keystore and `WALLET_PASSWORD` never leave the operator machine. Renewal after expiry: `bag wallet session grant --force`, then re-run `bag deploy` (readiness warns under 7 days remaining). `bag deploy verify` needs `--skip-register` (no generic signing for the ERC-8004 register).
-- Altana refuses generic message signing, so Pieverse SIWE cannot authenticate either `bag llm activate` or runtime credit renewal. An existing Pieverse key is usable only with `auto/free`; use OpenRouter, OpenAI, or Anthropic for paid models.
+- Altana refuses generic message signing, so Pieverse SIWE cannot authenticate `bag llm activate` or runtime credit renewal. `bag init --wallet-kind altana --llm-provider pieverse-llm` is rejected outright; use OpenRouter, OpenAI, or Anthropic (API-key providers). `bag llm activate` and `bag doctor` also flag the combination on projects edited by hand.
 
 ## Procedure