@thirdfy/agent-cli 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.1.11] - 2026-04-16
+
+**npm:** [`@thirdfy/agent-cli@0.1.11`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.11)  
+**Git tag:** `v0.1.11`
+
+### Added
+
+- **Self identity bootstrap during login:** `thirdfy-agent login` can now auto-bootstrap scoped self identity when `--agent-key` is provided, and persist the returned `agentApiKey` without manual env injection.
+- **Custody mode profile contract:** Added persisted `custodyMode` (`managed` or `external`) across `profile init`, `profile use`, and `whoami`/config UX.
+- **Self custody validation E2E:** Added `e2e:self:managed-custody-validation` and wired it into production certification flow.
+
 ## [0.1.9] - 2026-04-08
 
 **npm:** [`@thirdfy/agent-cli@0.1.9`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.9)  

package/README.md

@@ -81,9 +81,13 @@ Execution-only workflows can run with only `AGENT_API_KEY` after onboarding is c
 # Store auth defaults once
 thirdfy-agent login --auth-token "$THIRDFY_AUTH_TOKEN" --agent-api-key "$AGENT_API_KEY" --json
 
+# Bootstrap scoped self identity + custody mode in one step
+thirdfy-agent login --auth-token "$THIRDFY_AUTH_TOKEN" --agent-key "0xYOUR_AGENT_KEY" --run-mode self --custody-mode external --wallet-address "0xYOUR_AGENT_KEY" --json
+
 # Inspect config
 thirdfy-agent whoami --json
 thirdfy-agent config set --key runMode --value self --json
+thirdfy-agent config set --key custodyMode --value external --json
 
 # Local-only logout (default)
 thirdfy-agent logout --json
@@ -136,6 +140,9 @@ Auth expectations by mode:
 - `self`: requires execution identity (`agentApiKey`) today; keyless self lane is blocked with deterministic `SELF_OPEN_DISABLED`.
 - `hybrid`: requires execution identity and governed mirror semantics.
 - `thirdfy`: requires execution identity and delegated governance path.
+- custody mode defaults are profile-aware:
+  - `managed` default for `thirdfy`
+  - `external` default for `self` and `hybrid`
 
 Selection precedence:
 
@@ -344,6 +351,7 @@ thirdfy-agent managed run --agent-api-key "$AGENT_API_KEY" --run-mode thirdfy --
 npm run validate:cli-contract-schemas
 npm test
 npm run smoke:cli
+npm run e2e:self:managed-custody-validation
 npm run e2e:managed:delegation:parity
 ```
 

package/bin/thirdfy-agent.mjs

@@ -24,6 +24,7 @@ const BITFINEX_REQUIRED_SCOPE_PERMISSIONS = {
   wallets: { read: 1, write: 1 },
 };
 const RUN_MODES = ['thirdfy', 'self', 'hybrid'];
+const CUSTODY_MODES = ['managed', 'external'];
 const EFFECT_CHECK_MODES = ['strict', 'relaxed', 'off'];
 const PROFILE_DEFAULTS = {
   personal: 'self',
@@ -94,6 +95,7 @@ async function main() {
   const profileState = resolveProfileState(globalFlags);
   context.profile = profileState.profile;
   context.runMode = profileState.runMode;
+  context.custodyMode = profileState.custodyMode;
   context.profileConfigPath = profileState.configPath;
 
   if (globalFlags.version) {
@@ -212,6 +214,14 @@ async function main() {
     case 'developer bootstrap':
       await commandDeveloperBootstrap(context, subFlags, capabilities);
       return;
+    case 'bootstrap begin':
+    case 'onboarding begin':
+      await commandBootstrapBegin(context, subFlags, capabilities);
+      return;
+    case 'bootstrap complete':
+    case 'onboarding complete':
+      await commandBootstrapComplete(context, subFlags, capabilities);
+      return;
     default:
       break;
   }
@@ -1089,11 +1099,11 @@ async function commandDeveloperBootstrap(ctx, flags, capabilities) {
     if (!challengeId) {
       throw new Error('Missing --challenge-id for wallet bootstrap. Run `agent auth challenge` first.');
     }
-    const verify = await apiPost(ctx, '/api/v1/agent/onboarding/wallet/verify', {
+    const verify = await verifyOwnerWalletChallenge(ctx, {
+      ...flags,
       challengeId,
       signature,
       agentKey,
-      ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
     });
     ownerSessionToken = String(verify?.ownerSessionToken || verify?.data?.ownerSessionToken || '').trim();
     usedWalletFlow = true;
@@ -1127,23 +1137,30 @@ async function commandDeveloperBootstrap(ctx, flags, capabilities) {
     },
   };
   persistProfileConfig(next);
-  printEnvelope({
-    success: true,
-    code: 'DEVELOPER_BOOTSTRAP_OK',
-    message: 'Developer bootstrap completed',
-    data: {
-      registration: registerResponse,
-      persisted: {
-        ownerSessionTokenSaved: Boolean(ownerSessionToken),
-        source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
-        configPath: getProfileConfigPath(),
+  if (!flags.__suppressOutput) {
+    printEnvelope({
+      success: true,
+      code: 'DEVELOPER_BOOTSTRAP_OK',
+      message: 'Developer bootstrap completed',
+      data: {
+        registration: registerResponse,
+        persisted: {
+          ownerSessionTokenSaved: Boolean(ownerSessionToken),
+          source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+          configPath: getProfileConfigPath(),
+        },
       },
-    },
-    meta: {
-      apiBase: ctx.apiBase,
-      capabilitiesVersion: capabilities?.contractVersion || null,
-    },
-  });
+      meta: {
+        apiBase: ctx.apiBase,
+        capabilitiesVersion: capabilities?.contractVersion || null,
+      },
+    });
+  }
+  return {
+    registration: registerResponse,
+    ownerSessionTokenSaved: Boolean(ownerSessionToken),
+    source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+  };
 }
 
 async function commandAgentKeyRotate(ctx, flags, capabilities) {
@@ -1186,14 +1203,21 @@ async function commandAgentKeyRevoke(ctx, flags, capabilities) {
   });
 }
 
-async function commandAgentAuthChallenge(ctx, flags, capabilities) {
+function buildWalletChallengePayload(flags) {
   const payload = {
     agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
     chainId: Number(flags.chainId || 8453),
   };
   if (flags.walletAddress) payload.walletAddress = String(flags.walletAddress).trim();
+  return payload;
+}
 
-  const response = await apiPost(ctx, '/api/v1/agent/onboarding/wallet/challenge', payload);
+async function commandAgentAuthChallenge(ctx, flags, capabilities) {
+  const response = await apiPost(
+    ctx,
+    '/api/v1/agent/onboarding/wallet/challenge',
+    buildWalletChallengePayload(flags)
+  );
   printEnvelope({
     success: true,
     code: 'OWNER_CHALLENGE_CREATED',
@@ -1207,21 +1231,186 @@ async function commandAgentAuthChallenge(ctx, flags, capabilities) {
 }
 
 async function commandAgentAuthVerify(ctx, flags, capabilities) {
+  const response = await verifyOwnerWalletChallenge(ctx, flags);
+  printEnvelope({
+    success: true,
+    code: 'OWNER_VERIFIED',
+    message: 'Wallet challenge verified',
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function verifyOwnerWalletChallenge(ctx, flags) {
   const payload = {
     challengeId: requireFlag(flags, 'challengeId', 'Missing --challenge-id'),
     signature: requireFlag(flags, 'signature', 'Missing --signature'),
     agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
   };
   if (flags.walletAddress) payload.walletAddress = String(flags.walletAddress).trim();
+  return apiPost(ctx, '/api/v1/agent/onboarding/wallet/verify', payload);
+}
 
-  const response = await apiPost(ctx, '/api/v1/agent/onboarding/wallet/verify', payload);
+function resolveMcpBase(flags) {
+  return String(flags.mcpBase || process.env.THIRDFY_MCP_BASE_URL || 'https://mcp.thirdfy.com').trim().replace(/\/+$/, '');
+}
+
+async function issueBootstrapToken(ctx, flags, payload) {
+  const mcpBase = resolveMcpBase(flags);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), Number(ctx.timeoutMs || DEFAULT_TIMEOUT_MS));
+  let response;
+  let text = '';
+  try {
+    response = await fetch(`${mcpBase}/auth/bootstrap/issue`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'x-cli-version': CLI_VERSION,
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    });
+    text = await response.text();
+  } catch (error) {
+    if (error?.name === 'AbortError') {
+      throw createCliError('TIMEOUT', `Request timed out after ${ctx.timeoutMs}ms`, {
+        routes: ['/auth/bootstrap/issue'],
+      });
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+  const data = text ? safeJsonParse(text) : {};
+  if (!response.ok) {
+    const message = data?.error || data?.message || 'Bootstrap token issuance failed';
+    throw createCliError('BOOTSTRAP_TOKEN_ISSUE_FAILED', message, data);
+  }
+  return {
+    mcpBase,
+    data,
+  };
+}
+
+async function commandBootstrapBegin(ctx, flags, capabilities) {
+  const challenge = await apiPost(
+    ctx,
+    '/api/v1/agent/onboarding/wallet/challenge',
+    buildWalletChallengePayload(flags)
+  );
   printEnvelope({
     success: true,
-    code: 'OWNER_VERIFIED',
-    message: 'Wallet challenge verified',
-    data: response,
+    code: 'BOOTSTRAP_BEGIN_OK',
+    message: 'Bootstrap challenge created',
+    data: {
+      challenge,
+      nextStep:
+        'Run `thirdfy-agent bootstrap complete --agent-key <key> --challenge-id <id> --signature <hex> [--name <agent-name>]`',
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandBootstrapComplete(ctx, flags, capabilities) {
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const lane = normalizeRunMode(flags.lane || flags.runMode || 'self', flags.lane ? '--lane' : '--run-mode');
+  const proofType = String(flags.proofType || '').trim() || 'session_token';
+  if (proofType !== 'session_token' && proofType !== 'wallet_signature') {
+    throw new Error('Invalid --proof-type. Supported values: session_token (preferred) or wallet_signature (challenge exchange only).');
+  }
+  let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
+  let challengeId = String(flags.challengeId || '').trim();
+  let signature = String(flags.signature || '').trim();
+  if (proofType === 'wallet_signature' && (!challengeId || !signature)) {
+    throw new Error('wallet_signature bootstrap is not supported directly. Provide --owner-session-token or --auth-token.');
+  }
+  if (!ownerSessionToken && !authToken && challengeId && signature) {
+    const verify = await verifyOwnerWalletChallenge(ctx, {
+      ...flags,
+      agentKey,
+      challengeId,
+      signature,
+    });
+    ownerSessionToken = String(verify?.ownerSessionToken || verify?.data?.ownerSessionToken || '').trim();
+    if (!ownerSessionToken) {
+      throw new Error('Wallet verify did not return owner session token required for bootstrap registration.');
+    }
+  }
+  if (ownerSessionToken || authToken) {
+    // Avoid replaying a single-use challenge across bootstrap and register calls.
+    challengeId = '';
+    signature = '';
+  }
+  if (!ownerSessionToken && !authToken) {
+    throw new Error(
+      'Bootstrap currently supports session_token proof only. Provide --owner-session-token/--auth-token, or --challenge-id + --signature to exchange into a session token.'
+    );
+  }
+
+  const bootstrapPayload = {
+    sub: agentKey,
+    lane,
+    scope: ['onboarding:bootstrap'],
+    proof_type: 'session_token',
+    ...(ownerSessionToken ? { ownerSessionToken } : {}),
+    ...(authToken ? { authToken } : {}),
+    agentKey,
+  };
+  const issued = await issueBootstrapToken(ctx, flags, bootstrapPayload);
+  const bootstrapToken = String(issued.data?.token || '').trim();
+
+  const config = loadProfileConfig();
+  const next = {
+    ...config,
+    auth: {
+      ...(config.auth && typeof config.auth === 'object' ? config.auth : {}),
+      bootstrapToken,
+      bootstrapTokenIssuedAt: new Date().toISOString(),
+      bootstrapLane: lane,
+    },
+  };
+  persistProfileConfig(next);
+
+  let registration = null;
+  if (flags.name) {
+    registration = await commandDeveloperBootstrap(
+      ctx,
+      {
+        ...flags,
+        agentKey,
+        name: String(flags.name).trim(),
+        challengeId,
+        signature,
+        ...(ownerSessionToken ? { ownerSessionToken } : {}),
+        __suppressOutput: true,
+      },
+      capabilities
+    );
+  }
+
+  printEnvelope({
+    success: true,
+    code: 'BOOTSTRAP_COMPLETE_OK',
+    message: 'Bootstrap token issued',
+    data: {
+      bootstrap: issued.data,
+      registration,
+      persisted: {
+        configPath: getProfileConfigPath(),
+        hasBootstrapToken: Boolean(bootstrapToken),
+      },
+    },
     meta: {
       apiBase: ctx.apiBase,
+      mcpBase: issued.mcpBase,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });
@@ -1401,13 +1590,16 @@ async function commandProfileInit(ctx, flags) {
   const current = loadProfileConfig();
   const profile = normalizeProfileName(flags.profile || flags.name || 'personal');
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
+  const custodyMode = normalizeCustodyMode(flags.custodyMode, runMode);
   persistProfileConfig({
     ...current,
     profile,
     runMode,
+    custodyMode,
   });
   ctx.profile = profile;
   ctx.runMode = runMode;
+  ctx.custodyMode = custodyMode;
   printEnvelope({
     success: true,
     code: 'PROFILE_INITIALIZED',
@@ -1415,6 +1607,7 @@ async function commandProfileInit(ctx, flags) {
     data: {
       profile,
       runMode,
+      custodyMode,
       configPath: getProfileConfigPath(),
     },
     meta: { apiBase: ctx.apiBase },
@@ -1426,13 +1619,16 @@ async function commandProfileUse(ctx, flags) {
   const profile = normalizeProfileName(flags.profile || flags.name || current.profile || 'personal');
   // `profile use` intentionally re-applies profile defaults unless caller pins a mode.
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
+  const custodyMode = normalizeCustodyMode(flags.custodyMode || current.custodyMode, runMode);
   persistProfileConfig({
     ...current,
     profile,
     runMode,
+    custodyMode,
   });
   ctx.profile = profile;
   ctx.runMode = runMode;
+  ctx.custodyMode = custodyMode;
   printEnvelope({
     success: true,
     code: 'PROFILE_UPDATED',
@@ -1440,6 +1636,7 @@ async function commandProfileUse(ctx, flags) {
     data: {
       profile,
       runMode,
+      custodyMode,
       defaults: PROFILE_DEFAULTS,
       configPath: getProfileConfigPath(),
     },
@@ -1456,6 +1653,7 @@ async function commandProfileShow(ctx, _flags) {
     data: {
       profile: ctx.profile || config.profile || 'personal',
       runMode: ctx.runMode || config.runMode || 'thirdfy',
+      custodyMode: ctx.custodyMode || config.custodyMode || defaultCustodyModeForRunMode(ctx.runMode || config.runMode || 'thirdfy'),
       profileDefaults: PROFILE_DEFAULTS,
       configPath: getProfileConfigPath(),
       config,
@@ -1478,6 +1676,10 @@ async function commandConfigSet(ctx, flags) {
   if (canonicalKey === 'runmode' && hasValue) {
     normalizeRunMode(value);
   }
+  if (canonicalKey === 'custodymode' && hasValue) {
+    const runModeHint = normalizeRunMode(flags.runMode || loadProfileConfig().runMode || 'thirdfy');
+    normalizeCustodyMode(value, runModeHint);
+  }
 
   const current = loadProfileConfig();
   const next = setNestedConfigValue(current, key, value);
@@ -1499,6 +1701,11 @@ async function commandLogin(ctx, flags) {
   const current = loadProfileConfig();
   const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
   let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  const loginRunMode = normalizeRunMode(flags.runMode || current.runMode || process.env.THIRDFY_RUN_MODE || 'thirdfy');
+  const custodyMode = normalizeCustodyMode(
+    flags.custodyMode || current.custodyMode || process.env.THIRDFY_CUSTODY_MODE,
+    loginRunMode
+  );
   let loginSource = 'token';
 
   if (!authToken && !ownerSessionToken) {
@@ -1529,8 +1736,40 @@ async function commandLogin(ctx, flags) {
     );
   }
 
+  let bootstrapAgentApiKey = '';
+  let bootstrapPerformed = false;
+  const requestedAgentApiKey = String(flags.agentApiKey || '').trim();
+  const bootstrapAgentKey = String(flags.agentKey || '').trim();
+  if (!requestedAgentApiKey && bootstrapAgentKey) {
+    const bootstrapHeaders = ownerSessionToken
+      ? { 'x-owner-session-token': ownerSessionToken }
+      : authToken
+        ? { Authorization: `Bearer ${authToken}` }
+        : null;
+    if (bootstrapHeaders) {
+      const bootstrapResponse = await requestWithRouteFallback(ctx, {
+        method: 'POST',
+        routes: ['/api/v1/agent/onboarding/me/bootstrap-self'],
+        headers: bootstrapHeaders,
+        body: {
+          agentKey: bootstrapAgentKey,
+          runMode: loginRunMode,
+          custodyMode,
+          ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
+          rotate: parseBooleanFlag(flags.rotateAgentKey, false),
+        },
+      });
+      bootstrapAgentApiKey = String(
+        bootstrapResponse?.agentApiKey || bootstrapResponse?.data?.agentApiKey || ''
+      ).trim();
+      bootstrapPerformed = true;
+    }
+  }
+
   const next = {
     ...current,
+    runMode: loginRunMode,
+    custodyMode,
     auth: {
       ...(current.auth && typeof current.auth === 'object' ? current.auth : {}),
       lastLoginAt: new Date().toISOString(),
@@ -1547,7 +1786,12 @@ async function commandLogin(ctx, flags) {
   if (flags.agentApiKey) {
     next.agent = {
       ...(current.agent && typeof current.agent === 'object' ? current.agent : {}),
-      apiKey: String(flags.agentApiKey).trim(),
+      apiKey: requestedAgentApiKey,
+    };
+  } else if (bootstrapAgentApiKey) {
+    next.agent = {
+      ...(current.agent && typeof current.agent === 'object' ? current.agent : {}),
+      apiKey: bootstrapAgentApiKey,
     };
   }
   persistProfileConfig(next);
@@ -1558,7 +1802,10 @@ async function commandLogin(ctx, flags) {
     data: {
       hasAuthToken: Boolean(authToken),
       hasOwnerSessionToken: Boolean(ownerSessionToken),
-      hasAgentApiKey: Boolean(flags.agentApiKey),
+      hasAgentApiKey: Boolean(requestedAgentApiKey || bootstrapAgentApiKey),
+      bootstrapPerformed,
+      runMode: loginRunMode,
+      custodyMode,
       configPath: getProfileConfigPath(),
     },
     meta: { apiBase: ctx.apiBase },
@@ -1622,9 +1869,14 @@ function resolveProfileState(flags) {
       PROFILE_DEFAULTS[profile] ||
       'thirdfy'
   );
+  const custodyMode = normalizeCustodyMode(
+    flags.custodyMode || process.env.THIRDFY_CUSTODY_MODE || persisted.custodyMode,
+    runMode
+  );
   return {
     profile,
     runMode,
+    custodyMode,
     configPath: getProfileConfigPath(),
   };
 }
@@ -1635,11 +1887,23 @@ function normalizeProfileName(value) {
   throw new Error(`Unsupported profile "${value}". Supported: ${Object.keys(PROFILE_DEFAULTS).join(', ')}`);
 }
 
-function normalizeRunMode(value) {
+function normalizeRunMode(value, flagName = '--run-mode') {
   const normalized = String(value || '').trim().toLowerCase();
   if (!normalized) return 'thirdfy';
   if (RUN_MODES.includes(normalized)) return normalized;
-  throw new Error(`Unsupported --run-mode "${value}". Supported: ${RUN_MODES.join(', ')}`);
+  throw new Error(`Unsupported ${flagName} "${value}". Supported: ${RUN_MODES.join(', ')}`);
+}
+
+function defaultCustodyModeForRunMode(runMode) {
+  return runMode === 'thirdfy' ? 'managed' : 'external';
+}
+
+function normalizeCustodyMode(value, runModeHint = 'thirdfy') {
+  const fallback = defaultCustodyModeForRunMode(runModeHint);
+  const normalized = String(value || '').trim().toLowerCase();
+  if (!normalized) return fallback;
+  if (CUSTODY_MODES.includes(normalized)) return normalized;
+  throw new Error(`Unsupported custody mode "${value}". Supported: ${CUSTODY_MODES.join(', ')}`);
 }
 
 function normalizeManagedRunMode(value) {
@@ -2700,11 +2964,11 @@ function printHelp() {
 thirdfy-agent ${CLI_VERSION}
 
 Core commands:
-  thirdfy-agent profile init [--profile personal|builder|network] [--run-mode thirdfy|self|hybrid] [--json]
-  thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid] [--json]
+  thirdfy-agent profile init [--profile personal|builder|network] [--run-mode thirdfy|self|hybrid] [--custody-mode managed|external] [--json]
+  thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid] [--custody-mode managed|external] [--json]
   thirdfy-agent profile show [--json]
   thirdfy-agent config set --key <path> --value <value> [--json]
-  thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--json]
+  thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--agent-key <key>] [--run-mode <mode>] [--custody-mode managed|external] [--wallet-address <addr>] [--json]
   thirdfy-agent logout [--all] [--clear-agent-key] [--json]
   thirdfy-agent whoami [--json]
   thirdfy-agent catalogs list [--json]
@@ -2726,6 +2990,10 @@ Core commands:
   thirdfy-agent credentials status --auth-token <token> [--venue <id>] [--json]
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]
+  thirdfy-agent bootstrap begin --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
+  thirdfy-agent bootstrap complete --agent-key <key> [--proof-type session_token] [--lane self|hybrid|thirdfy] [--owner-session-token <token> | --auth-token <token> | --challenge-id <id> --signature <hex>] [--name <agent-name>] [--mcp-base <url>] [--json]
+  thirdfy-agent onboarding begin ...      # alias of bootstrap begin
+  thirdfy-agent onboarding complete ...   # alias of bootstrap complete
   thirdfy-agent developer bootstrap --agent-key <key> --name <name> [--owner-session-token <token> | --challenge-id <id> --signature <hex>] [--json]
   thirdfy-agent agent register --agent-key <key> --name <name> [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent agent key rotate [--agent-key <key>] [--auth-token <token> | --owner-session-token <token>] [--json]
@@ -2743,7 +3011,9 @@ Core commands:
 
 Global flags:
   --api-base <url>   default: https://api.thirdfy.com
+  --mcp-base <url>   default: https://mcp.thirdfy.com (bootstrap token issuance)
   --run-mode <mode>  thirdfy | self | hybrid
+  --custody-mode <mode>  managed | external
   --profile <name>   personal | builder | network
   --env <file>       load env vars from file
   --timeout <ms>     request timeout

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -27,6 +27,7 @@
     "e2e:delegation:lifecycle": "node ./scripts/e2e/delegation-lifecycle.mjs",
     "e2e:delegation:commands": "node ./scripts/e2e/delegation-command-parity.mjs",
     "e2e:self:delegation:parity": "node ./scripts/e2e/self-delegation-parity.mjs",
+    "e2e:self:managed-custody-validation": "node ./scripts/e2e/self-managed-custody-validation.mjs",
     "e2e:managed:delegation:parity": "node ./scripts/e2e/managed-custodial-lifecycle.mjs",
     "e2e:delegation:prod:certify": "node ./scripts/e2e/prod-delegation-certify.mjs",
     "e2e:report:last": "node ./scripts/e2e/report-last.mjs",
@@ -53,6 +54,7 @@
   },
   "homepage": "https://github.com/thirdfy/agent-cli#readme",
   "dependencies": {
+    "@open-wallet-standard/core": "^1.3.0",
     "ethers": "^6.16.0"
   }
 }