@exagent/agent 0.1.0 → 0.1.2

package/dist/cli.js

@@ -27,11 +27,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_commander = require("commander");
 var import_dotenv2 = require("dotenv");
 var readline = __toESM(require("readline"));
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
 
 // src/runtime.ts
 var import_sdk = require("@exagent/sdk");
+var import_viem2 = require("viem");
+var import_chains2 = require("viem/chains");
 
 // src/llm/openai.ts
 var import_openai = __toESM(require("openai"));
@@ -76,7 +78,7 @@ var OpenAIAdapter = class extends BaseLLMAdapter {
   async chat(messages) {
     try {
       const response = await this.client.chat.completions.create({
-        model: this.config.model || "gpt-4-turbo-preview",
+        model: this.config.model || "gpt-4.1",
         messages: messages.map((m) => ({
           role: m.role,
           content: m.content
@@ -121,7 +123,7 @@ var AnthropicAdapter = class extends BaseLLMAdapter {
     const systemMessage = messages.find((m) => m.role === "system");
     const chatMessages = messages.filter((m) => m.role !== "system");
     const body = {
-      model: this.config.model || "claude-3-opus-20240229",
+      model: this.config.model || "claude-opus-4-5-20251101",
       max_tokens: this.config.maxTokens || 4096,
       temperature: this.config.temperature,
       system: systemMessage?.content,
@@ -158,6 +160,256 @@ var AnthropicAdapter = class extends BaseLLMAdapter {
   }
 };
 
+// src/llm/google.ts
+var GoogleAdapter = class extends BaseLLMAdapter {
+  apiKey;
+  baseUrl;
+  constructor(config) {
+    super(config);
+    if (!config.apiKey) {
+      throw new Error("Google AI API key required");
+    }
+    this.apiKey = config.apiKey;
+    this.baseUrl = config.endpoint || "https://generativelanguage.googleapis.com/v1beta";
+  }
+  async chat(messages) {
+    const model = this.config.model || "gemini-2.5-flash";
+    const systemMessage = messages.find((m) => m.role === "system");
+    const chatMessages = messages.filter((m) => m.role !== "system");
+    const contents = chatMessages.map((m) => ({
+      role: m.role === "assistant" ? "model" : "user",
+      parts: [{ text: m.content }]
+    }));
+    const body = {
+      contents,
+      generationConfig: {
+        temperature: this.config.temperature,
+        maxOutputTokens: this.config.maxTokens || 4096
+      }
+    };
+    if (systemMessage) {
+      body.systemInstruction = {
+        parts: [{ text: systemMessage.content }]
+      };
+    }
+    const url = `${this.baseUrl}/models/${model}:generateContent?key=${this.apiKey}`;
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Google AI API error: ${response.status} - ${error}`);
+    }
+    const data = await response.json();
+    const candidate = data.candidates?.[0];
+    if (!candidate?.content?.parts) {
+      throw new Error("No response from Google AI");
+    }
+    const content = candidate.content.parts.map((part) => part.text || "").join("");
+    const usageMetadata = data.usageMetadata;
+    return {
+      content,
+      usage: usageMetadata ? {
+        promptTokens: usageMetadata.promptTokenCount || 0,
+        completionTokens: usageMetadata.candidatesTokenCount || 0,
+        totalTokens: usageMetadata.totalTokenCount || 0
+      } : void 0
+    };
+  }
+};
+
+// src/llm/deepseek.ts
+var import_openai2 = __toESM(require("openai"));
+var DeepSeekAdapter = class extends BaseLLMAdapter {
+  client;
+  constructor(config) {
+    super(config);
+    if (!config.apiKey) {
+      throw new Error("DeepSeek API key required");
+    }
+    this.client = new import_openai2.default({
+      apiKey: config.apiKey,
+      baseURL: config.endpoint || "https://api.deepseek.com/v1"
+    });
+  }
+  async chat(messages) {
+    try {
+      const response = await this.client.chat.completions.create({
+        model: this.config.model || "deepseek-chat",
+        messages: messages.map((m) => ({
+          role: m.role,
+          content: m.content
+        })),
+        temperature: this.config.temperature,
+        max_tokens: this.config.maxTokens
+      });
+      const choice = response.choices[0];
+      if (!choice || !choice.message) {
+        throw new Error("No response from DeepSeek");
+      }
+      return {
+        content: choice.message.content || "",
+        usage: response.usage ? {
+          promptTokens: response.usage.prompt_tokens,
+          completionTokens: response.usage.completion_tokens,
+          totalTokens: response.usage.total_tokens
+        } : void 0
+      };
+    } catch (error) {
+      if (error instanceof import_openai2.default.APIError) {
+        throw new Error(`DeepSeek API error: ${error.message}`);
+      }
+      throw error;
+    }
+  }
+};
+
+// src/llm/mistral.ts
+var MistralAdapter = class extends BaseLLMAdapter {
+  apiKey;
+  baseUrl;
+  constructor(config) {
+    super(config);
+    if (!config.apiKey) {
+      throw new Error("Mistral API key required");
+    }
+    this.apiKey = config.apiKey;
+    this.baseUrl = config.endpoint || "https://api.mistral.ai/v1";
+  }
+  async chat(messages) {
+    const body = {
+      model: this.config.model || "mistral-large-latest",
+      messages: messages.map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      temperature: this.config.temperature,
+      max_tokens: this.config.maxTokens
+    };
+    const response = await fetch(`${this.baseUrl}/chat/completions`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.apiKey}`
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Mistral API error: ${response.status} - ${error}`);
+    }
+    const data = await response.json();
+    const choice = data.choices?.[0];
+    if (!choice || !choice.message) {
+      throw new Error("No response from Mistral");
+    }
+    return {
+      content: choice.message.content || "",
+      usage: data.usage ? {
+        promptTokens: data.usage.prompt_tokens,
+        completionTokens: data.usage.completion_tokens,
+        totalTokens: data.usage.total_tokens
+      } : void 0
+    };
+  }
+};
+
+// src/llm/groq.ts
+var import_openai3 = __toESM(require("openai"));
+var GroqAdapter = class extends BaseLLMAdapter {
+  client;
+  constructor(config) {
+    super(config);
+    if (!config.apiKey) {
+      throw new Error("Groq API key required");
+    }
+    this.client = new import_openai3.default({
+      apiKey: config.apiKey,
+      baseURL: config.endpoint || "https://api.groq.com/openai/v1"
+    });
+  }
+  async chat(messages) {
+    try {
+      const response = await this.client.chat.completions.create({
+        model: this.config.model || "llama-3.1-70b-versatile",
+        messages: messages.map((m) => ({
+          role: m.role,
+          content: m.content
+        })),
+        temperature: this.config.temperature,
+        max_tokens: this.config.maxTokens
+      });
+      const choice = response.choices[0];
+      if (!choice || !choice.message) {
+        throw new Error("No response from Groq");
+      }
+      return {
+        content: choice.message.content || "",
+        usage: response.usage ? {
+          promptTokens: response.usage.prompt_tokens,
+          completionTokens: response.usage.completion_tokens,
+          totalTokens: response.usage.total_tokens
+        } : void 0
+      };
+    } catch (error) {
+      if (error instanceof import_openai3.default.APIError) {
+        throw new Error(`Groq API error: ${error.message}`);
+      }
+      throw error;
+    }
+  }
+};
+
+// src/llm/together.ts
+var import_openai4 = __toESM(require("openai"));
+var TogetherAdapter = class extends BaseLLMAdapter {
+  client;
+  constructor(config) {
+    super(config);
+    if (!config.apiKey) {
+      throw new Error("Together AI API key required");
+    }
+    this.client = new import_openai4.default({
+      apiKey: config.apiKey,
+      baseURL: config.endpoint || "https://api.together.xyz/v1"
+    });
+  }
+  async chat(messages) {
+    try {
+      const response = await this.client.chat.completions.create({
+        model: this.config.model || "meta-llama/Meta-Llama-3.1-405B-Instruct-Turbo",
+        messages: messages.map((m) => ({
+          role: m.role,
+          content: m.content
+        })),
+        temperature: this.config.temperature,
+        max_tokens: this.config.maxTokens
+      });
+      const choice = response.choices[0];
+      if (!choice || !choice.message) {
+        throw new Error("No response from Together AI");
+      }
+      return {
+        content: choice.message.content || "",
+        usage: response.usage ? {
+          promptTokens: response.usage.prompt_tokens,
+          completionTokens: response.usage.completion_tokens,
+          totalTokens: response.usage.total_tokens
+        } : void 0
+      };
+    } catch (error) {
+      if (error instanceof import_openai4.default.APIError) {
+        throw new Error(`Together AI API error: ${error.message}`);
+      }
+      throw error;
+    }
+  }
+};
+
 // src/llm/ollama.ts
 var OllamaAdapter = class extends BaseLLMAdapter {
   baseUrl;
@@ -190,7 +442,7 @@ var OllamaAdapter = class extends BaseLLMAdapter {
   }
   async chat(messages) {
     const body = {
-      model: this.config.model || "mistral",
+      model: this.config.model || "llama3.2",
       messages: messages.map((m) => ({
         role: m.role,
         content: m.content
@@ -225,7 +477,7 @@ var OllamaAdapter = class extends BaseLLMAdapter {
   getMetadata() {
     return {
       provider: "ollama",
-      model: this.config.model || "mistral",
+      model: this.config.model || "llama3.2",
       isLocal: true
     };
   }
@@ -238,6 +490,16 @@ async function createLLMAdapter(config) {
       return new OpenAIAdapter(config);
     case "anthropic":
       return new AnthropicAdapter(config);
+    case "google":
+      return new GoogleAdapter(config);
+    case "deepseek":
+      return new DeepSeekAdapter(config);
+    case "mistral":
+      return new MistralAdapter(config);
+    case "groq":
+      return new GroqAdapter(config);
+    case "together":
+      return new TogetherAdapter(config);
     case "ollama":
       const adapter = new OllamaAdapter(config);
       await adapter.healthCheck();
@@ -291,7 +553,7 @@ async function loadStrategy(strategyPath) {
   console.log("No custom strategy found, using default (hold) strategy");
   return defaultStrategy;
 }
-async function loadTypeScriptModule(path2) {
+async function loadTypeScriptModule(path3) {
   try {
     const tsxPath = require.resolve("tsx");
     const { pathToFileURL } = await import("url");
@@ -302,7 +564,7 @@ async function loadTypeScriptModule(path2) {
           "--import",
           "tsx/esm",
           "-e",
-          `import('${pathToFileURL(path2).href}').then(m => console.log(JSON.stringify({ exports: Object.keys(m) }))).catch(e => console.error('ERROR:', e.message))`
+          `import('${pathToFileURL(path3).href}').then(m => console.log(JSON.stringify({ exports: Object.keys(m) }))).catch(e => console.error('ERROR:', e.message))`
         ],
         {
           cwd: process.cwd(),
@@ -325,7 +587,7 @@ async function loadTypeScriptModule(path2) {
     const tsx = await import("tsx/esm/api");
     const unregister = tsx.register();
     try {
-      const module2 = await import(path2);
+      const module2 = await import(path3);
       return module2;
     } finally {
       unregister();
@@ -1119,7 +1381,268 @@ var VaultManager = class {
   }
 };
 
+// src/relay.ts
+var import_ws = __toESM(require("ws"));
+var import_accounts2 = require("viem/accounts");
+var RelayClient = class {
+  config;
+  ws = null;
+  authenticated = false;
+  reconnectAttempts = 0;
+  maxReconnectAttempts = 50;
+  reconnectTimer = null;
+  heartbeatTimer = null;
+  stopped = false;
+  constructor(config) {
+    this.config = config;
+  }
+  /**
+   * Connect to the relay server
+   */
+  async connect() {
+    if (this.stopped) return;
+    const wsUrl = this.config.relay.apiUrl.replace(/^https?:\/\//, (m) => m.includes("https") ? "wss://" : "ws://").replace(/\/$/, "") + "/ws/agent";
+    return new Promise((resolve, reject) => {
+      try {
+        this.ws = new import_ws.default(wsUrl);
+      } catch (error) {
+        console.error("Relay: Failed to create WebSocket:", error);
+        this.scheduleReconnect();
+        reject(error);
+        return;
+      }
+      const connectTimeout = setTimeout(() => {
+        if (!this.authenticated) {
+          console.error("Relay: Connection timeout");
+          this.ws?.close();
+          this.scheduleReconnect();
+          reject(new Error("Connection timeout"));
+        }
+      }, 15e3);
+      this.ws.on("open", async () => {
+        console.log("Relay: Connected, authenticating...");
+        this.reconnectAttempts = 0;
+        try {
+          await this.authenticate();
+        } catch (error) {
+          console.error("Relay: Authentication failed:", error);
+          this.ws?.close();
+          clearTimeout(connectTimeout);
+          reject(error);
+        }
+      });
+      this.ws.on("message", (raw) => {
+        try {
+          const data = JSON.parse(raw.toString());
+          this.handleMessage(data);
+          if (data.type === "auth_success") {
+            clearTimeout(connectTimeout);
+            this.authenticated = true;
+            this.startHeartbeat();
+            console.log("Relay: Authenticated successfully");
+            resolve();
+          } else if (data.type === "auth_error") {
+            clearTimeout(connectTimeout);
+            console.error(`Relay: Auth rejected: ${data.message}`);
+            reject(new Error(data.message));
+          }
+        } catch {
+        }
+      });
+      this.ws.on("close", (code, reason) => {
+        clearTimeout(connectTimeout);
+        this.authenticated = false;
+        this.stopHeartbeat();
+        if (!this.stopped) {
+          console.log(`Relay: Disconnected (${code}: ${reason.toString() || "unknown"})`);
+          this.scheduleReconnect();
+        }
+      });
+      this.ws.on("error", (error) => {
+        if (!this.stopped) {
+          console.error("Relay: WebSocket error:", error.message);
+        }
+      });
+    });
+  }
+  /**
+   * Authenticate with the relay server using wallet signature
+   */
+  async authenticate() {
+    const account = (0, import_accounts2.privateKeyToAccount)(this.config.privateKey);
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const message = `ExagentRelay:${this.config.agentId}:${timestamp}`;
+    const signature = await (0, import_accounts2.signMessage)({
+      message,
+      privateKey: this.config.privateKey
+    });
+    this.send({
+      type: "auth",
+      agentId: this.config.agentId,
+      wallet: account.address,
+      timestamp,
+      signature
+    });
+  }
+  /**
+   * Handle incoming messages from the relay server
+   */
+  handleMessage(data) {
+    switch (data.type) {
+      case "command":
+        if (data.command && this.config.onCommand) {
+          this.config.onCommand(data.command);
+        }
+        break;
+      case "auth_success":
+      case "auth_error":
+        break;
+      case "error":
+        console.error(`Relay: Server error: ${data.message}`);
+        break;
+    }
+  }
+  /**
+   * Send a status heartbeat
+   */
+  sendHeartbeat(status) {
+    if (!this.authenticated) return;
+    this.send({
+      type: "heartbeat",
+      agentId: this.config.agentId,
+      status
+    });
+  }
+  /**
+   * Send a status update (outside of regular heartbeat)
+   */
+  sendStatusUpdate(status) {
+    if (!this.authenticated) return;
+    this.send({
+      type: "status_update",
+      agentId: this.config.agentId,
+      status
+    });
+  }
+  /**
+   * Send a message to the command center
+   */
+  sendMessage(messageType, level, title, body, data) {
+    if (!this.authenticated) return;
+    this.send({
+      type: "message",
+      agentId: this.config.agentId,
+      messageType,
+      level,
+      title,
+      body,
+      data
+    });
+  }
+  /**
+   * Send a command execution result
+   */
+  sendCommandResult(commandId, success, result) {
+    if (!this.authenticated) return;
+    this.send({
+      type: "command_result",
+      agentId: this.config.agentId,
+      commandId,
+      success,
+      result
+    });
+  }
+  /**
+   * Start the heartbeat timer
+   */
+  startHeartbeat() {
+    this.stopHeartbeat();
+    const interval = this.config.relay.heartbeatIntervalMs || 3e4;
+    this.heartbeatTimer = setInterval(() => {
+      if (this.ws?.readyState === import_ws.default.OPEN) {
+        this.ws.ping();
+      }
+    }, interval);
+  }
+  /**
+   * Stop the heartbeat timer
+   */
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  /**
+   * Schedule a reconnection with exponential backoff
+   */
+  scheduleReconnect() {
+    if (this.stopped) return;
+    if (this.reconnectAttempts >= this.maxReconnectAttempts) {
+      console.error("Relay: Max reconnection attempts reached. Giving up.");
+      return;
+    }
+    const delay = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), 3e4);
+    this.reconnectAttempts++;
+    console.log(
+      `Relay: Reconnecting in ${delay / 1e3}s (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})`
+    );
+    this.reconnectTimer = setTimeout(() => {
+      this.connect().catch(() => {
+      });
+    }, delay);
+  }
+  /**
+   * Send a JSON message to the WebSocket
+   */
+  send(data) {
+    if (this.ws?.readyState === import_ws.default.OPEN) {
+      this.ws.send(JSON.stringify(data));
+    }
+  }
+  /**
+   * Check if connected and authenticated
+   */
+  get isConnected() {
+    return this.authenticated && this.ws?.readyState === import_ws.default.OPEN;
+  }
+  /**
+   * Disconnect and stop reconnecting
+   */
+  disconnect() {
+    this.stopped = true;
+    this.stopHeartbeat();
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.ws) {
+      this.ws.close(1e3, "Agent shutting down");
+      this.ws = null;
+    }
+    this.authenticated = false;
+    console.log("Relay: Disconnected");
+  }
+};
+
+// src/browser-open.ts
+var import_child_process2 = require("child_process");
+function openBrowser(url) {
+  const platform = process.platform;
+  try {
+    if (platform === "darwin") {
+      (0, import_child_process2.exec)(`open "${url}"`);
+    } else if (platform === "win32") {
+      (0, import_child_process2.exec)(`start "" "${url}"`);
+    } else {
+      (0, import_child_process2.exec)(`xdg-open "${url}"`);
+    }
+  } catch {
+  }
+}
+
 // src/runtime.ts
+var FUNDS_LOW_THRESHOLD = 5e-3;
 var AgentRuntime = class {
   config;
   client;
@@ -1129,9 +1652,14 @@ var AgentRuntime = class {
   riskManager;
   marketData;
   vaultManager;
+  relay = null;
   isRunning = false;
+  mode = "idle";
   configHash;
   lastVaultCheck = 0;
+  cycleCount = 0;
+  lastCycleAt = 0;
+  processAlive = true;
   VAULT_CHECK_INTERVAL = 3e5;
   // Check vault status every 5 minutes
   constructor(config) {
@@ -1163,8 +1691,44 @@ var AgentRuntime = class {
     this.riskManager = new RiskManager(this.config.trading);
     this.marketData = new MarketDataService(this.getRpcUrl());
     await this.initializeVaultManager();
+    await this.initializeRelay();
     console.log("Agent initialized successfully");
   }
+  /**
+   * Initialize the relay client for command center connectivity
+   */
+  async initializeRelay() {
+    const relayConfig = this.config.relay;
+    const relayEnabled = process.env.EXAGENT_RELAY_ENABLED !== "false";
+    if (!relayConfig?.enabled || !relayEnabled) {
+      console.log("Relay: Disabled");
+      return;
+    }
+    const apiUrl = process.env.EXAGENT_API_URL || relayConfig.apiUrl;
+    if (!apiUrl) {
+      console.log("Relay: No API URL configured, skipping");
+      return;
+    }
+    this.relay = new RelayClient({
+      agentId: String(this.config.agentId),
+      privateKey: this.config.privateKey,
+      relay: {
+        ...relayConfig,
+        apiUrl
+      },
+      onCommand: (cmd) => this.handleCommand(cmd)
+    });
+    try {
+      await this.relay.connect();
+      console.log("Relay: Connected to command center");
+      this.sendRelayStatus();
+    } catch (error) {
+      console.warn(
+        "Relay: Failed to connect (agent will work locally):",
+        error instanceof Error ? error.message : error
+      );
+    }
+  }
   /**
    * Initialize the vault manager based on config
    */
@@ -1194,7 +1758,9 @@ var AgentRuntime = class {
     }
   }
   /**
-   * Ensure the current wallet is linked to the agent
+   * Ensure the current wallet is linked to the agent.
+   * If the trading wallet differs from the owner, enters a recovery loop
+   * that waits for the owner to link it from the website.
    */
   async ensureWalletLinked() {
     const agentId = BigInt(this.config.agentId);
@@ -1204,9 +1770,31 @@ var AgentRuntime = class {
       console.log("Wallet not linked, linking now...");
       const agent = await this.client.registry.getAgent(agentId);
       if (agent?.owner.toLowerCase() !== address.toLowerCase()) {
-        throw new Error(
-          `Cannot link wallet: ${address} is not the owner of agent ${this.config.agentId}. Owner is ${agent?.owner}`
-        );
+        const ccUrl = `https://exagent.io/agents/${encodeURIComponent(this.config.name)}/command-center`;
+        console.log("");
+        console.log("=== WALLET LINKING REQUIRED ===");
+        console.log("");
+        console.log(`  Agent owner:    ${agent?.owner}`);
+        console.log(`  Trading wallet: ${address}`);
+        console.log("");
+        console.log("  Your trading wallet needs to be linked to your agent.");
+        console.log("  Opening the command center in your browser...");
+        console.log(`  ${ccUrl}`);
+        console.log("");
+        openBrowser(ccUrl);
+        console.log("  Waiting for wallet to be linked... (checking every 15s)");
+        console.log("  Press Ctrl+C to exit.");
+        console.log("");
+        while (true) {
+          await this.sleep(15e3);
+          const linked = await this.client.registry.isLinkedWallet(agentId, address);
+          if (linked) {
+            console.log("  Wallet linked! Continuing setup...");
+            console.log("");
+            return;
+          }
+          process.stdout.write(".");
+        }
       }
       await this.client.registry.linkOwnWallet(agentId);
       console.log("Wallet linked successfully");
@@ -1215,8 +1803,9 @@ var AgentRuntime = class {
     }
   }
   /**
-   * Sync the LLM config hash to chain for epoch tracking
-   * This ensures trades are attributed to the correct config epoch
+   * Sync the LLM config hash to chain for epoch tracking.
+   * If the wallet has insufficient gas, enters a recovery loop
+   * that waits for the user to fund the wallet.
    */
   async syncConfigHash() {
     const agentId = BigInt(this.config.agentId);
@@ -1226,9 +1815,50 @@ var AgentRuntime = class {
     const onChainHash = await this.client.registry.getConfigHash(agentId);
     if (onChainHash !== this.configHash) {
       console.log("Config changed, updating on-chain...");
-      await this.client.registry.updateConfig(agentId, this.configHash);
-      const newEpoch = await this.client.registry.getCurrentEpoch(agentId);
-      console.log(`Config updated, new epoch started: ${newEpoch}`);
+      try {
+        await this.client.registry.updateConfig(agentId, this.configHash);
+        const newEpoch = await this.client.registry.getCurrentEpoch(agentId);
+        console.log(`Config updated, new epoch started: ${newEpoch}`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("insufficient funds") || message.includes("gas") || message.includes("intrinsic gas too low") || message.includes("exceeds the balance")) {
+          const ccUrl = `https://exagent.io/agents/${encodeURIComponent(this.config.name)}/command-center`;
+          const chain = this.config.network === "mainnet" ? import_chains2.base : import_chains2.baseSepolia;
+          const publicClientInstance = (0, import_viem2.createPublicClient)({
+            chain,
+            transport: (0, import_viem2.http)(this.getRpcUrl())
+          });
+          console.log("");
+          console.log("=== ETH NEEDED FOR GAS ===");
+          console.log("");
+          console.log(`  Wallet: ${this.client.address}`);
+          console.log("  Your wallet needs ETH to pay for transaction gas.");
+          console.log("  Opening the command center to fund your wallet...");
+          console.log(`  ${ccUrl}`);
+          console.log("");
+          openBrowser(ccUrl);
+          console.log("  Waiting for ETH... (checking every 15s)");
+          console.log("  Press Ctrl+C to exit.");
+          console.log("");
+          while (true) {
+            await this.sleep(15e3);
+            const balance = await publicClientInstance.getBalance({
+              address: this.client.address
+            });
+            if (balance > BigInt(0)) {
+              console.log("  ETH detected! Retrying config update...");
+              console.log("");
+              await this.client.registry.updateConfig(agentId, this.configHash);
+              const newEpoch = await this.client.registry.getCurrentEpoch(agentId);
+              console.log(`Config updated, new epoch started: ${newEpoch}`);
+              return;
+            }
+            process.stdout.write(".");
+          }
+        } else {
+          throw error;
+        }
+      }
     } else {
       const currentEpoch = await this.client.registry.getCurrentEpoch(agentId);
       console.log(`Config hash matches on-chain (epoch ${currentEpoch})`);
@@ -1241,48 +1871,301 @@ var AgentRuntime = class {
     return this.configHash;
   }
   /**
-   * Start the trading loop
+   * Start the agent in daemon mode.
+   * The agent enters idle mode and waits for commands from the command center.
+   * Trading begins only when a start_trading command is received.
+   *
+   * If relay is not configured, falls back to immediate trading mode.
    */
   async run() {
-    if (this.isRunning) {
-      throw new Error("Agent is already running");
+    this.processAlive = true;
+    if (this.relay) {
+      console.log("");
+      console.log("Agent is in IDLE mode. Waiting for commands from command center.");
+      console.log("Visit https://exagent.io to start trading from the dashboard.");
+      console.log("");
+      this.mode = "idle";
+      this.sendRelayStatus();
+      this.relay.sendMessage(
+        "system",
+        "success",
+        "Agent Connected",
+        `${this.config.name} is online and waiting for commands.`,
+        { wallet: this.client.address }
+      );
+      while (this.processAlive) {
+        if (this.mode === "trading" && this.isRunning) {
+          try {
+            await this.runCycle();
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error("Error in trading cycle:", message);
+            this.relay?.sendMessage(
+              "system",
+              "error",
+              "Cycle Error",
+              message
+            );
+          }
+          await this.sleep(this.config.trading.tradingIntervalMs);
+        } else {
+          this.sendRelayStatus();
+          await this.sleep(3e4);
+        }
+      }
+    } else {
+      if (this.isRunning) {
+        throw new Error("Agent is already running");
+      }
+      this.isRunning = true;
+      this.mode = "trading";
+      console.log("Starting trading loop...");
+      console.log(`Interval: ${this.config.trading.tradingIntervalMs}ms`);
+      while (this.isRunning) {
+        try {
+          await this.runCycle();
+        } catch (error) {
+          console.error("Error in trading cycle:", error);
+        }
+        await this.sleep(this.config.trading.tradingIntervalMs);
+      }
     }
-    this.isRunning = true;
-    console.log("Starting trading loop...");
-    console.log(`Interval: ${this.config.trading.tradingIntervalMs}ms`);
-    while (this.isRunning) {
-      try {
-        await this.runCycle();
-      } catch (error) {
-        console.error("Error in trading cycle:", error);
+  }
+  /**
+   * Handle a command from the command center
+   */
+  async handleCommand(cmd) {
+    console.log(`Command received: ${cmd.type}`);
+    try {
+      switch (cmd.type) {
+        case "start_trading":
+          if (this.mode === "trading") {
+            this.relay?.sendCommandResult(cmd.id, true, "Already trading");
+            return;
+          }
+          this.mode = "trading";
+          this.isRunning = true;
+          console.log("Trading started via command center");
+          this.relay?.sendCommandResult(cmd.id, true, "Trading started");
+          this.relay?.sendMessage(
+            "system",
+            "success",
+            "Trading Started",
+            "Agent is now actively trading."
+          );
+          this.sendRelayStatus();
+          break;
+        case "stop_trading":
+          if (this.mode === "idle") {
+            this.relay?.sendCommandResult(cmd.id, true, "Already idle");
+            return;
+          }
+          this.mode = "idle";
+          this.isRunning = false;
+          console.log("Trading stopped via command center");
+          this.relay?.sendCommandResult(cmd.id, true, "Trading stopped");
+          this.relay?.sendMessage(
+            "system",
+            "info",
+            "Trading Stopped",
+            "Agent is now idle. Send start_trading to resume."
+          );
+          this.sendRelayStatus();
+          break;
+        case "update_risk_params": {
+          const params = cmd.params || {};
+          if (params.maxPositionSizeBps !== void 0) {
+            this.config.trading.maxPositionSizeBps = Number(params.maxPositionSizeBps);
+          }
+          if (params.maxDailyLossBps !== void 0) {
+            this.config.trading.maxDailyLossBps = Number(params.maxDailyLossBps);
+          }
+          this.riskManager = new RiskManager(this.config.trading);
+          console.log("Risk params updated via command center");
+          this.relay?.sendCommandResult(cmd.id, true, "Risk params updated");
+          this.relay?.sendMessage(
+            "config_updated",
+            "info",
+            "Risk Parameters Updated",
+            `Max position: ${this.config.trading.maxPositionSizeBps / 100}%, Max daily loss: ${this.config.trading.maxDailyLossBps / 100}%`
+          );
+          break;
+        }
+        case "update_trading_interval": {
+          const intervalMs = Number(cmd.params?.intervalMs);
+          if (intervalMs && intervalMs >= 1e3) {
+            this.config.trading.tradingIntervalMs = intervalMs;
+            console.log(`Trading interval updated to ${intervalMs}ms`);
+            this.relay?.sendCommandResult(cmd.id, true, `Interval set to ${intervalMs}ms`);
+          } else {
+            this.relay?.sendCommandResult(cmd.id, false, "Invalid interval (minimum 1000ms)");
+          }
+          break;
+        }
+        case "create_vault": {
+          const result = await this.createVault();
+          this.relay?.sendCommandResult(
+            cmd.id,
+            result.success,
+            result.success ? `Vault created: ${result.vaultAddress}` : result.error
+          );
+          if (result.success) {
+            this.relay?.sendMessage(
+              "vault_created",
+              "success",
+              "Vault Created",
+              `Vault deployed at ${result.vaultAddress}`,
+              { vaultAddress: result.vaultAddress }
+            );
+          }
+          break;
+        }
+        case "refresh_status":
+          this.sendRelayStatus();
+          this.relay?.sendCommandResult(cmd.id, true, "Status refreshed");
+          break;
+        case "shutdown":
+          console.log("Shutdown requested via command center");
+          this.relay?.sendCommandResult(cmd.id, true, "Shutting down");
+          this.relay?.sendMessage(
+            "system",
+            "info",
+            "Shutting Down",
+            "Agent is shutting down. Restart manually to reconnect."
+          );
+          await this.sleep(1e3);
+          this.stop();
+          break;
+        default:
+          console.warn(`Unknown command: ${cmd.type}`);
+          this.relay?.sendCommandResult(cmd.id, false, `Unknown command: ${cmd.type}`);
       }
-      await this.sleep(this.config.trading.tradingIntervalMs);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`Command ${cmd.type} failed:`, message);
+      this.relay?.sendCommandResult(cmd.id, false, message);
     }
   }
+  /**
+   * Send current status to the relay
+   */
+  sendRelayStatus() {
+    if (!this.relay) return;
+    const vaultConfig = this.config.vault || { policy: "disabled" };
+    const status = {
+      mode: this.mode,
+      agentId: String(this.config.agentId),
+      wallet: this.client?.address,
+      cycleCount: this.cycleCount,
+      lastCycleAt: this.lastCycleAt,
+      tradingIntervalMs: this.config.trading.tradingIntervalMs,
+      llm: {
+        provider: this.config.llm.provider,
+        model: this.config.llm.model || "default"
+      },
+      risk: this.riskManager?.getStatus() || {
+        dailyPnL: 0,
+        dailyLossLimit: 0,
+        isLimitHit: false
+      },
+      vault: {
+        policy: vaultConfig.policy,
+        hasVault: false,
+        vaultAddress: null
+      }
+    };
+    this.relay.sendHeartbeat(status);
+  }
   /**
    * Run a single trading cycle
    */
   async runCycle() {
     console.log(`
 --- Trading Cycle: ${(/* @__PURE__ */ new Date()).toISOString()} ---`);
+    this.cycleCount++;
+    this.lastCycleAt = Date.now();
     await this.checkVaultAutoCreation();
     const tokens = this.config.allowedTokens || this.getDefaultTokens();
     const marketData = await this.marketData.fetchMarketData(this.client.address, tokens);
     console.log(`Portfolio value: $${marketData.portfolioValue.toFixed(2)}`);
-    const signals = await this.strategy(marketData, this.llm, this.config);
+    this.checkFundsLow(marketData);
+    let signals;
+    try {
+      signals = await this.strategy(marketData, this.llm, this.config);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error("LLM/strategy error:", message);
+      this.relay?.sendMessage(
+        "llm_error",
+        "error",
+        "Strategy Error",
+        message
+      );
+      return;
+    }
     console.log(`Strategy generated ${signals.length} signals`);
     const filteredSignals = this.riskManager.filterSignals(signals, marketData);
     console.log(`${filteredSignals.length} signals passed risk checks`);
+    if (this.riskManager.getStatus().isLimitHit) {
+      this.relay?.sendMessage(
+        "risk_limit_hit",
+        "warning",
+        "Risk Limit Hit",
+        `Daily loss limit reached: ${this.riskManager.getStatus().dailyPnL.toFixed(2)}`
+      );
+    }
     if (filteredSignals.length > 0) {
       const results = await this.executor.executeAll(filteredSignals);
       for (const result of results) {
         if (result.success) {
           console.log(`Trade executed: ${result.signal.action} - ${result.txHash}`);
+          this.relay?.sendMessage(
+            "trade_executed",
+            "success",
+            "Trade Executed",
+            `${result.signal.action.toUpperCase()}: ${result.signal.reasoning || "No reason provided"}`,
+            {
+              action: result.signal.action,
+              txHash: result.txHash,
+              tokenIn: result.signal.tokenIn,
+              tokenOut: result.signal.tokenOut
+            }
+          );
         } else {
           console.warn(`Trade failed: ${result.error}`);
+          this.relay?.sendMessage(
+            "trade_failed",
+            "error",
+            "Trade Failed",
+            result.error || "Unknown error",
+            { action: result.signal.action }
+          );
         }
       }
     }
+    this.sendRelayStatus();
+  }
+  /**
+   * Check if ETH balance is below threshold and notify
+   */
+  checkFundsLow(marketData) {
+    if (!this.relay) return;
+    const wethAddress = "0x4200000000000000000000000000000000000006";
+    const ethBalance = marketData.balances[wethAddress] || BigInt(0);
+    const ethAmount = Number(ethBalance) / 1e18;
+    if (ethAmount < FUNDS_LOW_THRESHOLD) {
+      this.relay.sendMessage(
+        "funds_low",
+        "warning",
+        "Low Funds",
+        `ETH balance is ${ethAmount.toFixed(6)} ETH. Fund your trading wallet to continue trading.`,
+        {
+          ethBalance: ethAmount.toFixed(6),
+          wallet: this.client.address,
+          threshold: FUNDS_LOW_THRESHOLD
+        }
+      );
+    }
   }
   /**
    * Check for vault auto-creation based on policy
@@ -1296,7 +2179,14 @@ var AgentRuntime = class {
     const result = await this.vaultManager.checkAndAutoCreateVault();
     switch (result.action) {
       case "created":
-        console.log(`\u{1F389} Vault created automatically: ${result.vaultAddress}`);
+        console.log(`Vault created automatically: ${result.vaultAddress}`);
+        this.relay?.sendMessage(
+          "vault_created",
+          "success",
+          "Vault Auto-Created",
+          `Vault deployed at ${result.vaultAddress}`,
+          { vaultAddress: result.vaultAddress }
+        );
         break;
       case "already_exists":
         break;
@@ -1308,11 +2198,16 @@ var AgentRuntime = class {
     }
   }
   /**
-   * Stop the trading loop
+   * Stop the agent process completely
    */
   stop() {
     console.log("Stopping agent...");
     this.isRunning = false;
+    this.processAlive = false;
+    this.mode = "idle";
+    if (this.relay) {
+      this.relay.disconnect();
+    }
   }
   /**
    * Get RPC URL based on network
@@ -1350,6 +2245,7 @@ var AgentRuntime = class {
     const vaultConfig = this.config.vault || { policy: "disabled" };
     return {
       isRunning: this.isRunning,
+      mode: this.mode,
       agentId: Number(this.config.agentId),
       wallet: this.client?.address || "not initialized",
       llm: {
@@ -1363,7 +2259,11 @@ var AgentRuntime = class {
         hasVault: false,
         // Updated async via getVaultStatus
         vaultAddress: null
-      }
+      },
+      relay: {
+        connected: this.relay?.isConnected || false
+      },
+      cycleCount: this.cycleCount
     };
   }
   /**
@@ -1442,6 +2342,11 @@ var VaultConfigSchema = import_zod.z.object({
 var WalletConfigSchema = import_zod.z.object({
   setup: WalletSetupSchema.default("provide")
 }).optional();
+var RelayConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(false),
+  apiUrl: import_zod.z.string().url(),
+  heartbeatIntervalMs: import_zod.z.number().min(5e3).default(3e4)
+}).optional();
 var AgentConfigSchema = import_zod.z.object({
   // Identity (from on-chain registration)
   agentId: import_zod.z.union([import_zod.z.number().positive(), import_zod.z.string()]),
@@ -1457,6 +2362,8 @@ var AgentConfigSchema = import_zod.z.object({
   trading: TradingConfigSchema.default({}),
   // Vault configuration (copy trading)
   vault: VaultConfigSchema.default({}),
+  // Relay configuration (command center)
+  relay: RelayConfigSchema,
   // Allowed tokens (addresses)
   allowedTokens: import_zod.z.array(import_zod.z.string()).optional()
 });
@@ -1485,6 +2392,21 @@ function loadConfig(configPath) {
   if (process.env.ANTHROPIC_API_KEY && config.llm.provider === "anthropic") {
     llmConfig.apiKey = process.env.ANTHROPIC_API_KEY;
   }
+  if (process.env.GOOGLE_AI_API_KEY && config.llm.provider === "google") {
+    llmConfig.apiKey = process.env.GOOGLE_AI_API_KEY;
+  }
+  if (process.env.DEEPSEEK_API_KEY && config.llm.provider === "deepseek") {
+    llmConfig.apiKey = process.env.DEEPSEEK_API_KEY;
+  }
+  if (process.env.MISTRAL_API_KEY && config.llm.provider === "mistral") {
+    llmConfig.apiKey = process.env.MISTRAL_API_KEY;
+  }
+  if (process.env.GROQ_API_KEY && config.llm.provider === "groq") {
+    llmConfig.apiKey = process.env.GROQ_API_KEY;
+  }
+  if (process.env.TOGETHER_API_KEY && config.llm.provider === "together") {
+    llmConfig.apiKey = process.env.TOGETHER_API_KEY;
+  }
   if (process.env.EXAGENT_LLM_URL) {
     llmConfig.endpoint = process.env.EXAGENT_LLM_URL;
   }
@@ -1518,7 +2440,193 @@ function validateConfig(config) {
 }
 
 // src/cli.ts
-var import_accounts2 = require("viem/accounts");
+var import_accounts3 = require("viem/accounts");
+
+// src/secure-env.ts
+var crypto = __toESM(require("crypto"));
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var ALGORITHM = "aes-256-gcm";
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_LENGTH = 32;
+var IV_LENGTH = 16;
+var KEY_LENGTH = 32;
+var SENSITIVE_PATTERNS = [
+  /PRIVATE_KEY$/i,
+  /_API_KEY$/i,
+  /API_KEY$/i,
+  /_SECRET$/i,
+  /^OPENAI_API_KEY$/i,
+  /^ANTHROPIC_API_KEY$/i,
+  /^GOOGLE_AI_API_KEY$/i,
+  /^DEEPSEEK_API_KEY$/i,
+  /^MISTRAL_API_KEY$/i,
+  /^GROQ_API_KEY$/i,
+  /^TOGETHER_API_KEY$/i
+];
+function isSensitiveKey(key) {
+  return SENSITIVE_PATTERNS.some((pattern) => pattern.test(key));
+}
+function deriveKey(passphrase, salt) {
+  return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha256");
+}
+function encryptValue(value, key) {
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  let encrypted = cipher.update(value, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const tag = cipher.getAuthTag();
+  return {
+    iv: iv.toString("hex"),
+    encrypted,
+    tag: tag.toString("hex")
+  };
+}
+function decryptValue(encrypted, key, iv, tag) {
+  const decipher = crypto.createDecipheriv(
+    ALGORITHM,
+    key,
+    Buffer.from(iv, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tag, "hex"));
+  let decrypted = decipher.update(encrypted, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function parseEnvFile(content) {
+  const entries = [];
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = trimmed.slice(0, eqIndex).trim();
+    let value = trimmed.slice(eqIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key && value) {
+      entries.push({ key, value });
+    }
+  }
+  return entries;
+}
+function encryptEnvFile(envPath, passphrase, deleteOriginal = false) {
+  if (!fs.existsSync(envPath)) {
+    throw new Error(`File not found: ${envPath}`);
+  }
+  const content = fs.readFileSync(envPath, "utf-8");
+  const entries = parseEnvFile(content);
+  if (entries.length === 0) {
+    throw new Error("No environment variables found in file");
+  }
+  const salt = crypto.randomBytes(SALT_LENGTH);
+  const key = deriveKey(passphrase, salt);
+  const encryptedEntries = entries.map(({ key: envKey, value }) => {
+    if (isSensitiveKey(envKey)) {
+      const { iv, encrypted, tag } = encryptValue(value, key);
+      return {
+        key: envKey,
+        value: encrypted,
+        encrypted: true,
+        iv,
+        tag
+      };
+    }
+    return {
+      key: envKey,
+      value,
+      encrypted: false
+    };
+  });
+  const encryptedEnv = {
+    version: 1,
+    salt: salt.toString("hex"),
+    entries: encryptedEntries
+  };
+  const encPath = envPath + ".enc";
+  fs.writeFileSync(encPath, JSON.stringify(encryptedEnv, null, 2), { mode: 384 });
+  if (deleteOriginal) {
+    fs.unlinkSync(envPath);
+  }
+  const sensitiveCount = encryptedEntries.filter((e) => e.encrypted).length;
+  const plainCount = encryptedEntries.filter((e) => !e.encrypted).length;
+  console.log(
+    `Encrypted ${sensitiveCount} sensitive values (${plainCount} non-sensitive kept as plaintext)`
+  );
+  return encPath;
+}
+function decryptEnvFile(encPath, passphrase) {
+  if (!fs.existsSync(encPath)) {
+    throw new Error(`Encrypted env file not found: ${encPath}`);
+  }
+  const content = JSON.parse(fs.readFileSync(encPath, "utf-8"));
+  if (content.version !== 1) {
+    throw new Error(`Unsupported encrypted env version: ${content.version}`);
+  }
+  const salt = Buffer.from(content.salt, "hex");
+  const key = deriveKey(passphrase, salt);
+  const result = {};
+  for (const entry of content.entries) {
+    if (entry.encrypted) {
+      if (!entry.iv || !entry.tag) {
+        throw new Error(`Missing encryption metadata for ${entry.key}`);
+      }
+      try {
+        result[entry.key] = decryptValue(entry.value, key, entry.iv, entry.tag);
+      } catch {
+        throw new Error(
+          `Failed to decrypt ${entry.key}. Wrong passphrase or corrupted data.`
+        );
+      }
+    } else {
+      result[entry.key] = entry.value;
+    }
+  }
+  return result;
+}
+function loadSecureEnv(basePath, passphrase) {
+  const encPath = path.join(basePath, ".env.enc");
+  const envPath = path.join(basePath, ".env");
+  if (fs.existsSync(encPath)) {
+    if (!passphrase) {
+      passphrase = process.env.EXAGENT_PASSPHRASE;
+    }
+    if (!passphrase) {
+      console.warn("");
+      console.warn("WARNING: Found .env.enc but no passphrase provided.");
+      console.warn("  Set EXAGENT_PASSPHRASE environment variable or");
+      console.warn("  pass --passphrase when running the agent.");
+      console.warn("  Falling back to plaintext .env file.");
+      console.warn("");
+    } else {
+      const vars = decryptEnvFile(encPath, passphrase);
+      for (const [key, value] of Object.entries(vars)) {
+        process.env[key] = value;
+      }
+      return true;
+    }
+  }
+  if (fs.existsSync(envPath)) {
+    const content = fs.readFileSync(envPath, "utf-8");
+    const entries = parseEnvFile(content);
+    const sensitiveKeys = entries.filter(({ key }) => isSensitiveKey(key)).map(({ key }) => key);
+    if (sensitiveKeys.length > 0) {
+      console.warn("");
+      console.warn("WARNING: Sensitive values stored in plaintext .env file:");
+      for (const key of sensitiveKeys) {
+        console.warn(`  - ${key}`);
+      }
+      console.warn("");
+      console.warn('  Run "npx @exagent/agent encrypt" to secure your keys.');
+      console.warn("");
+    }
+    return false;
+  }
+  return false;
+}
+
+// src/cli.ts
 (0, import_dotenv2.config)();
 var program = new import_commander.Command();
 program.name("exagent").description("Exagent autonomous trading agent").version("0.1.0");
@@ -1563,9 +2671,13 @@ function prompt(question, hidden = false) {
   });
 }
 async function checkFirstRunSetup(configPath) {
-  const envPath = path.join(path.dirname(configPath), ".env");
-  if (fs.existsSync(envPath)) {
-    const envContent2 = fs.readFileSync(envPath, "utf-8");
+  const envPath = path2.join(path2.dirname(configPath), ".env");
+  const encPath = envPath + ".enc";
+  if (fs2.existsSync(encPath)) {
+    return;
+  }
+  if (fs2.existsSync(envPath)) {
+    const envContent2 = fs2.readFileSync(envPath, "utf-8");
     const hasPrivateKey = envContent2.includes("EXAGENT_PRIVATE_KEY=") && !envContent2.includes("EXAGENT_PRIVATE_KEY=\n") && !envContent2.includes("EXAGENT_PRIVATE_KEY=$");
     if (hasPrivateKey) {
       return;
@@ -1591,8 +2703,8 @@ async function checkFirstRunSetup(configPath) {
   if (walletSetup === "generate") {
     console.log("[WALLET] Generating a new wallet for your agent...");
     console.log("");
-    const generatedKey = (0, import_accounts2.generatePrivateKey)();
-    const account = (0, import_accounts2.privateKeyToAccount)(generatedKey);
+    const generatedKey = (0, import_accounts3.generatePrivateKey)();
+    const account = (0, import_accounts3.privateKeyToAccount)(generatedKey);
     privateKey = generatedKey;
     walletAddress = account.address;
     console.log("  New wallet created!");
@@ -1622,7 +2734,7 @@ async function checkFirstRunSetup(configPath) {
       process.exit(1);
     }
     try {
-      const account = (0, import_accounts2.privateKeyToAccount)(privateKey);
+      const account = (0, import_accounts3.privateKeyToAccount)(privateKey);
       walletAddress = account.address;
       console.log("");
       console.log(`  Wallet address: ${walletAddress}`);
@@ -1689,13 +2801,46 @@ EXAGENT_NETWORK=${config.network || "testnet"}
 # LLM (${llmProvider})
 ${llmEnvVar}EXAGENT_LLM_MODEL=${config.llm?.model || ""}
 `;
-  fs.writeFileSync(envPath, envContent, { mode: 384 });
+  fs2.writeFileSync(envPath, envContent, { mode: 384 });
   console.log("");
   console.log("=".repeat(60));
-  console.log("  SETUP COMPLETE");
+  console.log("  ENCRYPT YOUR SECRETS");
   console.log("=".repeat(60));
   console.log("");
-  console.log("  Your .env file has been created.");
+  console.log("  Your .env file contains private keys and API credentials.");
+  console.log("  Encrypting it protects you if someone accesses your files.");
+  console.log("");
+  console.log("  Press Enter to skip (you can encrypt later with: npx @exagent/agent encrypt)");
+  console.log("");
+  const passphrase = await prompt("  Choose encryption passphrase (or Enter to skip): ", true);
+  if (passphrase && passphrase.length >= 4) {
+    const confirmPassphrase = await prompt("  Confirm passphrase: ", true);
+    if (passphrase === confirmPassphrase) {
+      console.log("");
+      encryptEnvFile(envPath, passphrase, true);
+      process.env.EXAGENT_PASSPHRASE = passphrase;
+      console.log("  Your secrets are encrypted. Plaintext .env has been deleted.");
+      console.log("");
+      console.log("  Remember your passphrase \u2014 you need it every time the agent starts.");
+      console.log("  Or set: export EXAGENT_PASSPHRASE=<your-passphrase>");
+    } else {
+      console.log("");
+      console.log("  Passphrases did not match. Skipping encryption.");
+      console.log("  Run: npx @exagent/agent encrypt");
+    }
+  } else if (passphrase && passphrase.length < 4) {
+    console.log("");
+    console.log("  Passphrase too short (min 4 chars). Skipping encryption.");
+    console.log("  Run: npx @exagent/agent encrypt");
+  } else {
+    console.log("");
+    console.log("  Skipped encryption. Your .env is stored in plaintext.");
+    console.log("  To encrypt later: npx @exagent/agent encrypt --delete");
+  }
+  console.log("");
+  console.log("=".repeat(60));
+  console.log("  SETUP COMPLETE");
+  console.log("=".repeat(60));
   console.log("");
   console.log(`  Wallet: ${walletAddress}`);
   console.log(`  LLM:    ${llmProvider}`);
@@ -1707,11 +2852,20 @@ ${llmEnvVar}EXAGENT_LLM_MODEL=${config.llm?.model || ""}
   console.log("");
   console.log("  The agent will now start...");
   console.log("");
-  (0, import_dotenv2.config)({ path: envPath, override: true });
+  if (!process.env.EXAGENT_PASSPHRASE) {
+    (0, import_dotenv2.config)({ path: envPath, override: true });
+  }
 }
-program.command("run").description("Start the trading agent").option("-c, --config <path>", "Path to agent-config.json", "agent-config.json").action(async (options) => {
+program.command("run").description("Start the trading agent").option("-c, --config <path>", "Path to agent-config.json", "agent-config.json").option("-p, --passphrase <passphrase>", "Passphrase to decrypt .env.enc").action(async (options) => {
   try {
     await checkFirstRunSetup(options.config);
+    const configDir = path2.dirname(
+      options.config.startsWith("/") ? options.config : path2.join(process.cwd(), options.config)
+    );
+    const usedEncrypted = loadSecureEnv(configDir, options.passphrase);
+    if (usedEncrypted) {
+      console.log("Loaded encrypted environment (.env.enc)");
+    }
     console.log("Loading configuration...");
     const config = loadConfig(options.config);
     validateConfig(config);
@@ -1820,9 +2974,65 @@ program.command("api-keys").description("Show how to get API keys for each LLM p
   console.log("OLLAMA (Local - No API Key Required)");
   console.log("  Install: https://ollama.com/download");
   console.log("  Run: ollama serve");
-  console.log("  Pull model: ollama pull mistral");
+  console.log("  Pull model: ollama pull llama3.2");
   console.log("");
   console.log("Note: Your API keys are stored locally in .env and never sent to Exagent servers.");
   console.log("");
 });
+program.command("encrypt").description("Encrypt .env file to .env.enc for secure storage").option("-d, --dir <path>", "Directory containing .env file", ".").option("--delete", "Delete plaintext .env after encryption", false).action(async (options) => {
+  try {
+    const dir = options.dir.startsWith("/") ? options.dir : path2.join(process.cwd(), options.dir);
+    const envPath = path2.join(dir, ".env");
+    if (!fs2.existsSync(envPath)) {
+      console.error("No .env file found in", dir);
+      process.exit(1);
+    }
+    const encPath = envPath + ".enc";
+    if (fs2.existsSync(encPath)) {
+      const overwrite = await prompt("  .env.enc already exists. Overwrite? (y/n): ");
+      if (overwrite.toLowerCase() !== "y") {
+        console.log("Aborted.");
+        process.exit(0);
+      }
+    }
+    console.log("");
+    console.log("=".repeat(50));
+    console.log("  ENCRYPT ENVIRONMENT FILE");
+    console.log("=".repeat(50));
+    console.log("");
+    console.log("  This will encrypt your .env file using a passphrase.");
+    console.log("  You will need this passphrase every time the agent starts.");
+    console.log("");
+    console.log("  Alternatively, set EXAGENT_PASSPHRASE env var to skip");
+    console.log("  the prompt on startup.");
+    console.log("");
+    const passphrase = await prompt("  Enter encryption passphrase: ", true);
+    if (!passphrase || passphrase.length < 4) {
+      console.error("  Passphrase must be at least 4 characters.");
+      process.exit(1);
+    }
+    const confirm = await prompt("  Confirm passphrase: ", true);
+    if (passphrase !== confirm) {
+      console.error("  Passphrases do not match.");
+      process.exit(1);
+    }
+    console.log("");
+    encryptEnvFile(envPath, passphrase, options.delete);
+    console.log("");
+    console.log("  Encrypted file saved to: .env.enc");
+    if (options.delete) {
+      console.log("  Plaintext .env has been deleted.");
+    } else {
+      console.log("  Your plaintext .env file is still present.");
+      console.log("  Run with --delete to remove it after encryption.");
+    }
+    console.log("");
+    console.log("  To use: npx @exagent/agent run --passphrase <your-passphrase>");
+    console.log("  Or set: export EXAGENT_PASSPHRASE=<your-passphrase>");
+    console.log("");
+  } catch (error) {
+    console.error("Error:", error instanceof Error ? error.message : error);
+    process.exit(1);
+  }
+});
 program.parse();