@thirdfy/agent-cli 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.1.14] - 2026-04-19
+
+**npm:** [`@thirdfy/agent-cli@0.1.14`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.14)  
+**Git tag:** `v0.1.14`
+
+### Changed
+
+- **Dual-proof bootstrap completion:** `bootstrap complete` now supports direct `wallet_signature` proof (`challengeId` + `signature`) while preserving the `session_token` path and challenge->session fallback semantics.
+- **Onboarding docs and command contract alignment:** Updated README and command/provider docs to reflect the final MCP dual-proof bootstrap contract and usage.
+
+## [0.1.13] - 2026-04-19
+
+**npm:** [`@thirdfy/agent-cli@0.1.13`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.13)  
+**Git tag:** `v0.1.13`
+
+### Changed
+
+- **README and onboarding docs refresh:** Updated public README guidance to reflect latest bootstrap/onboarding command surface (`bootstrap begin/complete` plus aliases), session-proof-first issuance behavior, and current release references.
+
 ## [0.1.11] - 2026-04-16
 
 **npm:** [`@thirdfy/agent-cli@0.1.11`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.11)  

package/README.md

@@ -38,12 +38,12 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in 0.1.8
+## What's new in 0.1.12
 
-- Managed custodial lifecycle parity validation is now first-class in CLI E2E/certification.
-- `doctor self` runs as a local diagnostic command without capabilities negotiation.
-- Self-exec effect-check fallback payloads are hardened for deterministic automation parsing.
-- Managed wallet aliases (`managed wallet init/grant`) are wired directly to custodial delegation handlers.
+- Added Model D onboarding commands: `bootstrap begin` and `bootstrap complete`.
+- Added `onboarding begin` and `onboarding complete` aliases for clearer operator flows.
+- Aligned bootstrap completion to session-proof issuance (`session_token`), with wallet challenge/signature supported as an exchange step into session proof.
+- Hardened bootstrap path behavior for safer timeout and one-time challenge handling.
 
 ## Quick start
 
@@ -112,6 +112,21 @@ Use the returned session token:
 thirdfy-agent agent register --owner-session-token "$THIRDFY_OWNER_SESSION_TOKEN" --agent-key "0xYOUR_AGENT_KEY" --name "my-agent" --json
 ```
 
+### Bootstrap onboarding (Model D)
+
+```bash
+# Start wallet challenge flow
+thirdfy-agent bootstrap begin --agent-key "0xYOUR_AGENT_KEY" --json
+
+# Complete bootstrap with session proof (recommended)
+thirdfy-agent bootstrap complete --agent-key "0xYOUR_AGENT_KEY" --owner-session-token "$THIRDFY_OWNER_SESSION_TOKEN" --lane self --json
+
+# Or use challenge/signature as exchange step to obtain session proof first
+thirdfy-agent bootstrap complete --agent-key "0xYOUR_AGENT_KEY" --challenge-id "<challengeId>" --signature "0x..." --lane self --json
+```
+
+`bootstrap complete` supports both proof modes. Prefer `session_token` for operator-managed flows; use `wallet_signature` for direct wallet proof when verifier support is enabled.
+
 ### Idempotency behavior (`run`)
 
 - `run` auto-generates `idempotencyKey` by default when not provided.
@@ -240,7 +255,7 @@ Provider and venue guides are kept outside `README` so this page stays stable as
 - Discovery: `catalogs list`, `actions`
 - Execution: `preflight`, `run`, `intent-status`, `jeff preflight`, `jeff trade`, `jeff status`
 - Profiles: `profile init`, `profile use`, `profile show`, `whoami`
-- Onboarding: `agent auth challenge`, `agent auth verify`, `agent register`, `agent key rotate`, `agent key revoke`
+- Onboarding: `bootstrap begin`, `bootstrap complete`, `onboarding begin`, `onboarding complete`, `agent auth challenge`, `agent auth verify`, `agent register`, `agent key rotate`, `agent key revoke`, `developer bootstrap`
 - Governance readiness: `delegation create`, `delegation activate`, `delegation status`, `credentials upsert`, `credentials status`
 - Delegation operations: `delegation show`, `delegation inspect`, `delegation revoke`
 - Delegation execution helpers: `delegation balance`, `delegation redeem`
@@ -357,11 +372,11 @@ npm run e2e:managed:delegation:parity
 
 ## Release
 
-Version history and user-facing notes: [CHANGELOG.md](./CHANGELOG.md) (for example [0.1.7](https://github.com/thirdfy/agent-cli/releases/tag/v0.1.7) — login/config UX, custodial delegation helpers, swap and config hardening).
+Version history and user-facing notes: [CHANGELOG.md](./CHANGELOG.md) (for example [0.1.12](https://github.com/thirdfy/agent-cli/releases/tag/v0.1.12) — bootstrap onboarding commands and session-proof alignment).
 
 ```bash
 npm version patch
 npm publish --access public
 ```
 
-After publishing, push the matching tag (for example `v0.1.7`) so the [Release workflow](.github/workflows/release.yml) can create a GitHub release. If the package version is already on npm, the workflow skips republishing and still creates the release when triggered by a tag.
+After publishing, push the matching tag (for example `v0.1.12`) so the [Release workflow](.github/workflows/release.yml) can create a GitHub release. If the package version is already on npm, the workflow skips republishing and still creates the release when triggered by a tag.

package/bin/thirdfy-agent.mjs

@@ -1321,18 +1321,21 @@ async function commandBootstrapBegin(ctx, flags, capabilities) {
 async function commandBootstrapComplete(ctx, flags, capabilities) {
   const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
   const lane = normalizeRunMode(flags.lane || flags.runMode || 'self', flags.lane ? '--lane' : '--run-mode');
-  const proofType = String(flags.proofType || '').trim() || 'session_token';
+  let proofType = String(flags.proofType || '').trim() || 'session_token';
   if (proofType !== 'session_token' && proofType !== 'wallet_signature') {
-    throw new Error('Invalid --proof-type. Supported values: session_token (preferred) or wallet_signature (challenge exchange only).');
+    throw new Error('Invalid --proof-type. Supported values: session_token (preferred) or wallet_signature.');
   }
   let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
   const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
   let challengeId = String(flags.challengeId || '').trim();
   let signature = String(flags.signature || '').trim();
+  if (!String(flags.proofType || '').trim() && !ownerSessionToken && !authToken && challengeId && signature) {
+    proofType = 'wallet_signature';
+  }
   if (proofType === 'wallet_signature' && (!challengeId || !signature)) {
-    throw new Error('wallet_signature bootstrap is not supported directly. Provide --owner-session-token or --auth-token.');
+    throw new Error('wallet_signature proof requires --challenge-id and --signature.');
   }
-  if (!ownerSessionToken && !authToken && challengeId && signature) {
+  if (proofType === 'session_token' && !ownerSessionToken && !authToken && challengeId && signature) {
     const verify = await verifyOwnerWalletChallenge(ctx, {
       ...flags,
       agentKey,
@@ -1344,12 +1347,12 @@ async function commandBootstrapComplete(ctx, flags, capabilities) {
       throw new Error('Wallet verify did not return owner session token required for bootstrap registration.');
     }
   }
-  if (ownerSessionToken || authToken) {
+  if (proofType === 'session_token' && (ownerSessionToken || authToken)) {
     // Avoid replaying a single-use challenge across bootstrap and register calls.
     challengeId = '';
     signature = '';
   }
-  if (!ownerSessionToken && !authToken) {
+  if (proofType === 'session_token' && !ownerSessionToken && !authToken) {
     throw new Error(
       'Bootstrap currently supports session_token proof only. Provide --owner-session-token/--auth-token, or --challenge-id + --signature to exchange into a session token.'
     );
@@ -1359,9 +1362,11 @@ async function commandBootstrapComplete(ctx, flags, capabilities) {
     sub: agentKey,
     lane,
     scope: ['onboarding:bootstrap'],
-    proof_type: 'session_token',
+    proof_type: proofType,
     ...(ownerSessionToken ? { ownerSessionToken } : {}),
     ...(authToken ? { authToken } : {}),
+    ...(challengeId ? { challengeId } : {}),
+    ...(signature ? { signature } : {}),
     agentKey,
   };
   const issued = await issueBootstrapToken(ctx, flags, bootstrapPayload);
@@ -2991,7 +2996,7 @@ Core commands:
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]
   thirdfy-agent bootstrap begin --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
-  thirdfy-agent bootstrap complete --agent-key <key> [--proof-type session_token] [--lane self|hybrid|thirdfy] [--owner-session-token <token> | --auth-token <token> | --challenge-id <id> --signature <hex>] [--name <agent-name>] [--mcp-base <url>] [--json]
+  thirdfy-agent bootstrap complete --agent-key <key> [--proof-type session_token|wallet_signature] [--lane self|hybrid|thirdfy] [--owner-session-token <token> | --auth-token <token> | --challenge-id <id> --signature <hex>] [--name <agent-name>] [--mcp-base <url>] [--json]
   thirdfy-agent onboarding begin ...      # alias of bootstrap begin
   thirdfy-agent onboarding complete ...   # alias of bootstrap complete
   thirdfy-agent developer bootstrap --agent-key <key> --name <name> [--owner-session-token <token> | --challenge-id <id> --signature <hex>] [--json]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {