@thirdfy/agent-cli 0.1.13 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.1.14] - 2026-04-19
+
+**npm:** [`@thirdfy/agent-cli@0.1.14`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.14)  
+**Git tag:** `v0.1.14`
+
+### Changed
+
+- **Dual-proof bootstrap completion:** `bootstrap complete` now supports direct `wallet_signature` proof (`challengeId` + `signature`) while preserving the `session_token` path and challenge->session fallback semantics.
+- **Onboarding docs and command contract alignment:** Updated README and command/provider docs to reflect the final MCP dual-proof bootstrap contract and usage.
+
 ## [0.1.13] - 2026-04-19
 
 **npm:** [`@thirdfy/agent-cli@0.1.13`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.13)  

package/README.md

@@ -125,7 +125,7 @@ thirdfy-agent bootstrap complete --agent-key "0xYOUR_AGENT_KEY" --owner-session-
 thirdfy-agent bootstrap complete --agent-key "0xYOUR_AGENT_KEY" --challenge-id "<challengeId>" --signature "0x..." --lane self --json
 ```
 
-`bootstrap complete` is session-proof-first in the current deployment. Direct `wallet_signature` proof is not accepted as a final issuance proof.
+`bootstrap complete` supports both proof modes. Prefer `session_token` for operator-managed flows; use `wallet_signature` for direct wallet proof when verifier support is enabled.
 
 ### Idempotency behavior (`run`)
 

package/bin/thirdfy-agent.mjs

@@ -1321,18 +1321,21 @@ async function commandBootstrapBegin(ctx, flags, capabilities) {
 async function commandBootstrapComplete(ctx, flags, capabilities) {
   const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
   const lane = normalizeRunMode(flags.lane || flags.runMode || 'self', flags.lane ? '--lane' : '--run-mode');
-  const proofType = String(flags.proofType || '').trim() || 'session_token';
+  let proofType = String(flags.proofType || '').trim() || 'session_token';
   if (proofType !== 'session_token' && proofType !== 'wallet_signature') {
-    throw new Error('Invalid --proof-type. Supported values: session_token (preferred) or wallet_signature (challenge exchange only).');
+    throw new Error('Invalid --proof-type. Supported values: session_token (preferred) or wallet_signature.');
   }
   let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
   const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
   let challengeId = String(flags.challengeId || '').trim();
   let signature = String(flags.signature || '').trim();
+  if (!String(flags.proofType || '').trim() && !ownerSessionToken && !authToken && challengeId && signature) {
+    proofType = 'wallet_signature';
+  }
   if (proofType === 'wallet_signature' && (!challengeId || !signature)) {
-    throw new Error('wallet_signature bootstrap is not supported directly. Provide --owner-session-token or --auth-token.');
+    throw new Error('wallet_signature proof requires --challenge-id and --signature.');
   }
-  if (!ownerSessionToken && !authToken && challengeId && signature) {
+  if (proofType === 'session_token' && !ownerSessionToken && !authToken && challengeId && signature) {
     const verify = await verifyOwnerWalletChallenge(ctx, {
       ...flags,
       agentKey,
@@ -1344,12 +1347,12 @@ async function commandBootstrapComplete(ctx, flags, capabilities) {
       throw new Error('Wallet verify did not return owner session token required for bootstrap registration.');
     }
   }
-  if (ownerSessionToken || authToken) {
+  if (proofType === 'session_token' && (ownerSessionToken || authToken)) {
     // Avoid replaying a single-use challenge across bootstrap and register calls.
     challengeId = '';
     signature = '';
   }
-  if (!ownerSessionToken && !authToken) {
+  if (proofType === 'session_token' && !ownerSessionToken && !authToken) {
     throw new Error(
       'Bootstrap currently supports session_token proof only. Provide --owner-session-token/--auth-token, or --challenge-id + --signature to exchange into a session token.'
     );
@@ -1359,9 +1362,11 @@ async function commandBootstrapComplete(ctx, flags, capabilities) {
     sub: agentKey,
     lane,
     scope: ['onboarding:bootstrap'],
-    proof_type: 'session_token',
+    proof_type: proofType,
     ...(ownerSessionToken ? { ownerSessionToken } : {}),
     ...(authToken ? { authToken } : {}),
+    ...(challengeId ? { challengeId } : {}),
+    ...(signature ? { signature } : {}),
     agentKey,
   };
   const issued = await issueBootstrapToken(ctx, flags, bootstrapPayload);
@@ -2991,7 +2996,7 @@ Core commands:
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]
   thirdfy-agent bootstrap begin --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
-  thirdfy-agent bootstrap complete --agent-key <key> [--proof-type session_token] [--lane self|hybrid|thirdfy] [--owner-session-token <token> | --auth-token <token> | --challenge-id <id> --signature <hex>] [--name <agent-name>] [--mcp-base <url>] [--json]
+  thirdfy-agent bootstrap complete --agent-key <key> [--proof-type session_token|wallet_signature] [--lane self|hybrid|thirdfy] [--owner-session-token <token> | --auth-token <token> | --challenge-id <id> --signature <hex>] [--name <agent-name>] [--mcp-base <url>] [--json]
   thirdfy-agent onboarding begin ...      # alias of bootstrap begin
   thirdfy-agent onboarding complete ...   # alias of bootstrap complete
   thirdfy-agent developer bootstrap --agent-key <key> --name <name> [--owner-session-token <token> | --challenge-id <id> --signature <hex>] [--json]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {