@thirdfy/agent-cli 0.1.18 → 0.1.19

package/README.md

@@ -271,6 +271,7 @@ Provider and venue guides are kept outside `README` so this page stays stable as
 
 - Discovery: `catalogs list`, `actions`
 - Execution: `preflight`, `run`, `intent-status`, `jeff preflight`, `jeff trade`, `jeff status`
+- Managed signer execution: `wallet execute`, `wallet sign`, `wallet submit`, `agent run`
 - Profiles: `profile init`, `profile use`, `profile show`, `whoami`
 - Onboarding: `bootstrap begin`, `bootstrap complete`, `onboarding begin`, `onboarding complete`, `agent auth challenge`, `agent auth verify`, `agent register`, `agent key rotate`, `agent key revoke`, `developer bootstrap`
 - Governance readiness: `delegation create`, `delegation activate`, `delegation status`, `credentials upsert`, `credentials status`
@@ -369,9 +370,24 @@ thirdfy-agent managed wallet init --auth-token "$THIRDFY_AUTH_TOKEN" --json
 # or: --owner-session-token "$THIRDFY_OWNER_SESSION_TOKEN"
 thirdfy-agent managed wallet grant --auth-token "$THIRDFY_AUTH_TOKEN" --agent-key "0xYOUR_AGENT_KEY" --token-address "0x..." --max-usd-per-day 250 --json
 # or: --owner-session-token "$THIRDFY_OWNER_SESSION_TOKEN"
-thirdfy-agent managed run --agent-api-key "$AGENT_API_KEY" --run-mode thirdfy --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000"}' --json
+thirdfy-agent agent run --agent-api-key "$AGENT_API_KEY" --signer-method fanout_intent --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000"}' --json
 ```
 
+### Signer command model (managed + BYOW)
+
+The CLI now supports the same signer primitives used by the MCP:
+
+- `wallet execute` -> direct managed self-wallet execution (`/api/v1/agent/execute`)
+- `wallet sign` -> unsigned tx packaging for BYOW signing flow
+- `wallet submit` -> signed tx broadcast
+- `agent run` -> signer router (`managed_wallet_server`, `fanout_intent`, `byow`)
+
+Managed-self execution performs strict wallet preflight and returns deterministic blockers:
+
+- `blockedReason`
+- `blockedStage`
+- `executionWalletAddress`
+
 ## More docs
 
 - OpenClaw CLI onboarding flow:

package/bin/thirdfy-agent.mjs

@@ -155,8 +155,8 @@ async function main() {
   const capabilities = await negotiateCapabilities(context);
 
   switch (commandKey) {
-    case 'managed run':
-      await commandManagedRun(context, subFlags, capabilities);
+    case 'agent run':
+      await commandAgentRun(context, subFlags, capabilities);
       return;
     case 'managed setup':
       await commandManagedSetup(context, subFlags, capabilities);
@@ -253,6 +253,18 @@ async function main() {
     await commandDelegationCustodialGrant(context, subFlags, capabilities);
     return;
   }
+  if (commandKey3 === 'wallet execute') {
+    await commandWalletExecute(context, subFlags, capabilities);
+    return;
+  }
+  if (commandKey3 === 'wallet sign') {
+    await commandWalletSign(context, subFlags, capabilities);
+    return;
+  }
+  if (commandKey3 === 'wallet submit') {
+    await commandWalletSubmit(context, subFlags, capabilities);
+    return;
+  }
 
   const rootCommand = parsed.positionals[0];
   switch (rootCommand) {
@@ -640,6 +652,129 @@ async function commandRun(ctx, flags, capabilities) {
   if (!normalized.success) process.exit(1);
 }
 
+async function commandAgentRun(ctx, flags, capabilities) {
+  const signerMethod = String(flags.signerMethod || '').trim().toLowerCase();
+  const strategyIntent = String(flags.strategyIntent || '').trim().toLowerCase();
+  const requestedRunMode = String(flags.runMode || '').trim().toLowerCase();
+  if (signerMethod && !['managed_wallet_server', 'byow', 'fanout_intent'].includes(signerMethod)) {
+    throw createCliError(
+      'SIGNER_METHOD_INVALID',
+      `Unsupported --signer-method "${signerMethod}". Use managed_wallet_server, fanout_intent, or byow.`
+    );
+  }
+  if (signerMethod === 'byow' || requestedRunMode === 'self') {
+    await commandWalletSign(ctx, { ...flags, runMode: 'self' }, capabilities);
+    return;
+  }
+  if (signerMethod === 'fanout_intent') {
+    await commandRun(ctx, { ...flags, runMode: 'thirdfy' }, capabilities);
+    return;
+  }
+  if (signerMethod === 'managed_wallet_server') {
+    await commandWalletExecute(ctx, { ...flags, runMode: 'agent_wallet' }, capabilities);
+    return;
+  }
+  if (requestedRunMode) {
+    const runMode = normalizeRunMode(requestedRunMode);
+    if (runMode === 'self') {
+      await commandWalletSign(ctx, { ...flags, runMode }, capabilities);
+      return;
+    }
+    if (runMode === 'thirdfy' || runMode === 'hybrid') {
+      await commandRun(ctx, { ...flags, runMode }, capabilities);
+      return;
+    }
+    await commandWalletExecute(ctx, { ...flags, runMode: 'agent_wallet' }, capabilities);
+    return;
+  }
+  if (strategyIntent === 'fanout') {
+    await commandRun(ctx, { ...flags, runMode: 'thirdfy' }, capabilities);
+    return;
+  }
+  await commandWalletExecute(ctx, { ...flags, runMode: 'agent_wallet' }, capabilities);
+}
+
+async function commandWalletExecute(ctx, flags, capabilities) {
+  const normalizedFlags = { ...flags, runMode: 'agent_wallet' };
+  const resolved = await resolveActionSelection(ctx, normalizedFlags);
+  prepareActionParamsForFlags(normalizedFlags, resolved.resolvedAction);
+  enforceChainCompatibility(capabilities, normalizedFlags, 'agent_wallet');
+  const skipPreflight = Boolean(normalizedFlags.skipPreflight);
+  const result = await executeManagedWalletRun(ctx, normalizedFlags, resolved, { skipPreflight });
+  printEnvelope({
+    success: result.success,
+    code: result.success ? 'WALLET_EXECUTED' : result.preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
+    message: result.success ? 'Managed wallet execution completed' : result.error || 'Managed wallet execution failed',
+    data: result,
+    meta: {
+      apiBase: ctx.apiBase,
+      requestedAction: resolved.requestedAction,
+      resolvedAction: resolved.resolvedAction,
+      runMode: 'agent_wallet',
+      idempotencyKey: result.idempotencyKey || null,
+      executionWalletAddress: result.executionWalletAddress || null,
+      profile: ctx.profile || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+  if (!result.success) process.exit(1);
+}
+
+async function commandWalletSign(ctx, flags, capabilities) {
+  const normalizedFlags = { ...flags, runMode: 'self' };
+  const resolved = await resolveActionSelection(ctx, normalizedFlags);
+  prepareActionParamsForFlags(normalizedFlags, resolved.resolvedAction);
+  enforceChainCompatibility(capabilities, normalizedFlags, 'self');
+  const selfResult = await executeSelfRun(ctx, normalizedFlags, resolved, {
+    skipPreflight: Boolean(normalizedFlags.skipPreflight),
+    runMode: 'self',
+  });
+  printEnvelope({
+    success: selfResult.success,
+    code: selfResult.success ? 'WALLET_SIGN_READY' : selfResult.preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'WALLET_SIGN_FAILED',
+    message: selfResult.success ? 'Unsigned transaction prepared for BYOW signing' : selfResult.error || 'wallet sign failed',
+    data: selfResult,
+    meta: {
+      apiBase: ctx.apiBase,
+      requestedAction: resolved.requestedAction,
+      resolvedAction: resolved.resolvedAction,
+      runMode: 'self',
+      profile: ctx.profile || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+  if (!selfResult.success) process.exit(1);
+}
+
+async function commandWalletSubmit(ctx, flags, capabilities) {
+  const signedTxHex = String(flags.signedTxHex || flags.signedTx || '').trim();
+  if (!signedTxHex) {
+    throw createCliError('MISSING_SIGNED_TX', 'wallet submit requires --signed-tx-hex');
+  }
+  const chainId = Number(flags.chainId || 8453);
+  const rpcUrl = String(
+    flags.rpcUrl || process.env.BASE_RPC_URL || process.env.BASE_RPC_HTTP_URL || process.env.RPC_URL || 'https://mainnet.base.org'
+  ).trim();
+  const txHash = await submitSignedTx({ rpcUrl, chainId, signedTxHex });
+  printEnvelope({
+    success: true,
+    code: 'WALLET_SUBMITTED',
+    message: 'Signed transaction broadcasted',
+    data: {
+      txHash,
+      chainId,
+      signerMethod: 'byow',
+      executionMode: 'byow_submit',
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      rpcUrl,
+      profile: ctx.profile || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
 async function commandIntentStatus(ctx, flags, capabilities) {
   const intentId = requireFlag(flags, 'intentId', 'Missing --intent-id');
   const response = await apiGet(ctx, `/api/v1/agent/execute-intent/status?intentId=${encodeURIComponent(intentId)}`);
@@ -1565,41 +1700,6 @@ async function commandDoctorSelf(ctx, flags) {
   if (!ok) process.exit(1);
 }
 
-async function commandManagedRun(ctx, flags, capabilities) {
-  const mode = normalizeManagedRunMode(flags.runMode || 'thirdfy');
-  const managedFlags = { ...flags, runMode: mode };
-  const resolved = await resolveActionSelection(ctx, managedFlags);
-  prepareActionParamsForFlags(managedFlags, resolved.resolvedAction);
-  enforceChainCompatibility(capabilities, managedFlags, mode);
-  const skipPreflight = Boolean(managedFlags.skipPreflight);
-  const backendResult = await runExecutionByMode(mode, ctx, managedFlags, resolved, {
-    skipPreflight,
-  });
-  const normalized = backendResult.normalized;
-  printEnvelope({
-    success: normalized.success,
-    code: normalized.success ? 'MANAGED_RUN_QUEUED' : backendResult.code,
-    message: normalized.success
-      ? mode === 'hybrid'
-        ? 'Managed easy-wallet hybrid execution prepared'
-        : 'Managed easy-wallet execution queued'
-      : backendResult.message,
-    data: normalized,
-    meta: {
-      apiBase: ctx.apiBase,
-      requestedAction: resolved.requestedAction,
-      resolvedAction: resolved.resolvedAction,
-      lane: 'managed_easy_wallet',
-      runMode: mode,
-      skippedPreflight: skipPreflight,
-      profile: ctx.profile || null,
-      swapInput: managedFlags.__swapInput || null,
-      capabilitiesVersion: capabilities?.contractVersion || null,
-    },
-  });
-  if (!normalized.success) process.exit(1);
-}
-
 async function commandManagedSetup(ctx, flags, capabilities) {
   const mode = normalizeManagedRunMode(flags.runMode || 'agent_wallet');
   const authHeaders = buildOwnerAuthHeaders(
@@ -2189,6 +2289,34 @@ function shouldUseBuildTxPreflight(runMode, resolved) {
 
 async function runPreflightByMode(runMode, ctx, flags, resolved, options = {}) {
   const resolvedAction = resolved.resolvedAction;
+  if (runMode === 'agent_wallet') {
+    const preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
+      runMode,
+      requireFundingCheck: true,
+    });
+    const normalized = normalizeIntentResponse({
+      success: preflight.success,
+      status: preflight.success ? 'ready' : 'failed',
+      mode: 'agent_wallet',
+      executionWalletAddress: preflight.executionWalletAddress || null,
+      signerMethod: preflight.signerMethod || 'managed_wallet_server',
+      blockedReason: preflight.blockedReason || null,
+      blockedStage: preflight.blockedStage || null,
+      error: preflight.success ? null : preflight.error || 'Managed wallet preflight failed',
+      preflightBlocked: !preflight.success,
+      fundingTokenBalance: preflight.fundingTokenBalance || null,
+      executionWalletPreflight: preflight,
+    });
+    normalized.executionWalletAddress = preflight.executionWalletAddress || null;
+    normalized.signerMethod = preflight.signerMethod || 'managed_wallet_server';
+    normalized.executionWalletPreflight = preflight;
+    normalized.fundingTokenBalance = preflight.fundingTokenBalance || null;
+    return {
+      message: preflight.success ? 'Managed wallet preflight completed' : 'Managed wallet preflight failed',
+      route: 'execution_wallet_preflight',
+      normalized,
+    };
+  }
   if (runMode === 'self') {
     const route = shouldUseBuildTxPreflight(runMode, resolved) ? 'build_tx' : 'execute_intent_validation';
     const normalized = await executeSelfRun(
@@ -2269,7 +2397,7 @@ async function runPreflightByMode(runMode, ctx, flags, resolved, options = {}) {
 }
 
 async function runExecutionByMode(runMode, ctx, flags, resolved, options) {
-  if (runMode === 'thirdfy' || runMode === 'agent_wallet') {
+  if (runMode === 'thirdfy') {
     const normalized = await executeThirdfyRun(ctx, flags, resolved, options, runMode);
     const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
     return {
@@ -2283,6 +2411,20 @@ async function runExecutionByMode(runMode, ctx, flags, resolved, options) {
       normalized,
     };
   }
+  if (runMode === 'agent_wallet') {
+    const normalized = await executeManagedWalletRun(ctx, flags, resolved, options);
+    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
+    return {
+      code: normalized.success ? 'WALLET_EXECUTED' : preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
+      message: normalized.success
+        ? 'Managed wallet execution completed'
+        : preflightBlocked
+          ? 'Managed wallet preflight blocked execution'
+          : 'Managed wallet execution failed',
+      idempotencyKey: normalized.idempotencyKey || null,
+      normalized,
+    };
+  }
   if (runMode === 'self') {
     const normalized = await executeSelfRun(ctx, flags, resolved, options);
     const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
@@ -2355,6 +2497,61 @@ async function executeThirdfyRun(ctx, flags, resolved, options, runMode = 'third
   return normalized;
 }
 
+async function executeManagedWalletRun(ctx, flags, resolved, options) {
+  const skipPreflight = Boolean(options?.skipPreflight);
+  let preflight = null;
+  if (!skipPreflight) {
+    preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
+      runMode: 'agent_wallet',
+      requireFundingCheck: true,
+    });
+    if (!preflight.success) {
+      const normalized = normalizeIntentResponse({
+        success: false,
+        status: 'failed',
+        mode: 'agent_wallet',
+        blockedReason: preflight.blockedReason || 'PRECHECK_FAILED',
+        blockedStage: preflight.blockedStage || 'routing',
+        error: preflight.error || 'Managed wallet preflight failed',
+        preflightBlocked: true,
+        executionWalletAddress: preflight.executionWalletAddress || null,
+        executionWalletPreflight: preflight,
+      });
+      normalized.executionWalletAddress = preflight.executionWalletAddress || null;
+      normalized.executionWalletPreflight = preflight;
+      return normalized;
+    }
+  }
+  const payload = buildManagedExecutePayload(flags, {
+    resolvedAction: resolved.resolvedAction,
+    runMode: 'agent_wallet',
+    forceIdempotency: true,
+  });
+  const response = await apiPost(ctx, '/api/v1/agent/execute', payload);
+  const normalized = normalizeIntentResponse({
+    success: Boolean(response?.success),
+    status: response?.success ? 'completed' : 'failed',
+    mode: 'agent_wallet',
+    txHash: response?.txHash || null,
+    blockedReason: response?.blockedReason || response?.data?.blockedReason || null,
+    blockedStage: response?.blockedStage || response?.data?.blockedStage || null,
+    error: response?.error || null,
+    executionWalletAddress: response?.executionWalletAddress || response?.data?.executionWalletAddress || null,
+    signerMethod: 'managed_wallet_server',
+    idempotencyKey: payload.executionIdempotencyKey || null,
+    executionWalletPreflight: preflight,
+    amountNormalization: response?.amountNormalization || response?.data?.amountNormalization || null,
+    raw: response,
+  });
+  normalized.executionWalletAddress = response?.executionWalletAddress || response?.data?.executionWalletAddress || null;
+  normalized.signerMethod = 'managed_wallet_server';
+  normalized.executionWalletPreflight = preflight;
+  normalized.amountNormalization = response?.amountNormalization || response?.data?.amountNormalization || null;
+  normalized.raw = response;
+  normalized.idempotencyKey = payload.executionIdempotencyKey || null;
+  return normalized;
+}
+
 async function executeSelfRun(ctx, flags, resolved, options) {
   const skipPreflight = Boolean(options?.skipPreflight);
   const blockedReasonCode = String(options?.blockedReasonCode || 'SELF_MODE_REQUIRES_BUILD_TX');
@@ -2401,7 +2598,7 @@ async function executeSelfRun(ctx, flags, resolved, options) {
 async function executeHybridRun(ctx, flags, resolved, options) {
   const hybridWalletMode = normalizeHybridWalletMode(options?.hybridWalletMode || flags.hybridWalletMode || 'self');
   if (hybridWalletMode === 'agent_wallet') {
-    const managedResult = await executeThirdfyRun(ctx, flags, resolved, options, 'agent_wallet');
+    const managedResult = await executeManagedWalletRun(ctx, { ...flags, runMode: 'agent_wallet' }, resolved, options);
     if (!managedResult.success) {
       return normalizeIntentResponse({
         ...managedResult,
@@ -2468,6 +2665,122 @@ function buildBuildTxPayload(flags, resolvedAction) {
   return payload;
 }
 
+function buildManagedExecutePayload(flags, options) {
+  const runMode = String(options.runMode || flags.runMode || 'agent_wallet').trim().toLowerCase();
+  const payload = {
+    agentApiKey: resolveAgentApiKey(flags, runMode),
+    action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
+    userDid: String(flags.userDid || process.env.THIRDFY_USER_DID || '').trim(),
+    params: getPreparedParams(flags),
+    chainId: Number(flags.chainId || 8453),
+    executionStrategy: {
+      runMode,
+      mirrorOnly: false,
+    },
+  };
+  if (!payload.userDid) {
+    throw createCliError(
+      'MISSING_USER_DID',
+      'Managed wallet execution requires --user-did (or THIRDFY_USER_DID).'
+    );
+  }
+  if (flags.estimatedAmountUsd) payload.estimatedAmountUsd = Number(flags.estimatedAmountUsd);
+  if (options.forceIdempotency) {
+    payload.executionIdempotencyKey = String(
+      flags.idempotencyKey || `cli:walletExecute:${payload.action}:${Date.now()}:${randomUUID()}`
+    );
+  } else if (flags.idempotencyKey) {
+    payload.executionIdempotencyKey = String(flags.idempotencyKey);
+  }
+  return payload;
+}
+
+function resolveTokenInForFunding(params) {
+  if (!params || typeof params !== 'object') return '';
+  const tokenIn = String(params.tokenIn || params.tokenAddress || params.token || '').trim();
+  return tokenIn;
+}
+
+async function resolveManagedExecutionPreflight(ctx, flags, resolved, options = {}) {
+  const chainId = Number(flags.chainId || 8453);
+  const runMode = String(options.runMode || 'agent_wallet').trim().toLowerCase();
+  const agentApiKey = resolveAgentApiKey(flags, runMode);
+  const userDid = String(flags.userDid || process.env.THIRDFY_USER_DID || '').trim();
+  if (!userDid) {
+    return {
+      success: false,
+      blockedReason: 'MISSING_USER_DID',
+      blockedStage: 'routing',
+      error: 'Managed wallet execution requires --user-did (or THIRDFY_USER_DID).',
+      signerMethod: 'managed_wallet_server',
+    };
+  }
+  const tokenIn = resolveTokenInForFunding(getPreparedParams(flags));
+  const payload = {
+    agentApiKey,
+    userDid,
+    chainId,
+    runMode,
+    ...(tokenIn ? { tokenIn } : {}),
+  };
+  const response = await apiPost(ctx, '/api/v1/agent/execution-wallet', payload);
+  const executionWalletAddress = String(response?.executionWalletAddress || '').trim().toLowerCase();
+  const signerMethod = String(response?.signerMethod || 'managed_wallet_server').trim();
+  const rawBalance = String(response?.fundingTokenBalance?.raw || '').trim();
+  let parsedRawBalance = null;
+  if (rawBalance) {
+    try {
+      parsedRawBalance = BigInt(rawBalance);
+    } catch {
+      return {
+        success: false,
+        blockedReason: 'INVALID_FUNDING_BALANCE',
+        blockedStage: 'sizing',
+        error: `Execution wallet ${executionWalletAddress || 'unknown'} returned invalid funding token balance.`,
+        executionWalletAddress,
+        signerMethod,
+        fundingTokenBalance: response?.fundingTokenBalance || null,
+      };
+    }
+  }
+  const expectedWallet = String(flags.walletAddress || flags.executionWalletAddress || '').trim().toLowerCase();
+  const allowWalletMismatch = parseBooleanFlag(flags.allowWalletMismatch, false);
+
+  if (expectedWallet && executionWalletAddress && expectedWallet !== executionWalletAddress && !allowWalletMismatch) {
+    return {
+      success: false,
+      blockedReason: 'EXECUTION_WALLET_MISMATCH',
+      blockedStage: 'routing',
+      error: `Funded wallet (${expectedWallet}) does not match execution wallet (${executionWalletAddress}). Use --allow-wallet-mismatch to override.`,
+      executionWalletAddress,
+      signerMethod,
+      fundingTokenBalance: response?.fundingTokenBalance || null,
+    };
+  }
+
+  if (options.requireFundingCheck && parsedRawBalance !== null && parsedRawBalance <= 0n) {
+    return {
+      success: false,
+      blockedReason: 'INSUFFICIENT_FUNDS',
+      blockedStage: 'sizing',
+      error: `Execution wallet ${executionWalletAddress || 'unknown'} has insufficient tokenIn balance.`,
+      executionWalletAddress,
+      signerMethod,
+      fundingTokenBalance: response?.fundingTokenBalance || null,
+    };
+  }
+
+  return {
+    success: true,
+    executionWalletAddress,
+    signerMethod,
+    fundingTokenBalance: response?.fundingTokenBalance || null,
+    userDid,
+    chainId,
+    tokenIn: tokenIn || null,
+  };
+}
+
 function buildIntentPayload(flags, options) {
   const runMode = String(options.runMode || flags.runMode || '').trim().toLowerCase() || 'thirdfy';
   const payload = {
@@ -2938,6 +3251,14 @@ async function signAndBroadcastWithOws({ txd, chainId, walletAddress, owsWalletN
   return { sent };
 }
 
+async function submitSignedTx({ rpcUrl, chainId, signedTxHex }) {
+  const ethers = await loadEthers();
+  const { JsonRpcProvider } = ethers;
+  const provider = new JsonRpcProvider(rpcUrl, chainId);
+  const sent = await provider.broadcastTransaction(String(signedTxHex));
+  return sent?.hash || null;
+}
+
 async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress) {
   const ethers = await loadEthers();
   const { JsonRpcProvider, Interface } = ethers;
@@ -3170,7 +3491,10 @@ Core commands:
   thirdfy-agent managed wallet init [--auth-token <token> | --owner-session-token <token>] [--chain-id <id>] [--json]
   thirdfy-agent managed wallet grant [--auth-token <token> | --owner-session-token <token>] --agent-key <key> --token-address <addr> --max-usd-per-day <usd> [--chain-id <id>] [--period-duration <sec>] [--expiry-seconds <sec>] [--json]
   thirdfy-agent managed setup [--auth-token <token> | --owner-session-token <token>] --agent-key <key> [--run-mode thirdfy|hybrid|agent_wallet] [--token-address <addr>] [--max-usd-per-day <usd>] [--chain-id <id>] [--json]
-  thirdfy-agent managed run --agent-api-key <key> --action <id> --params <json> [--run-mode thirdfy|hybrid|agent_wallet] [--idempotency-key <key>] [--json]
+  thirdfy-agent wallet execute --agent-api-key <key> --user-did <did> --action <id> --params <json> [--chain-id <id>] [--idempotency-key <key>] [--wallet-address <expected>] [--allow-wallet-mismatch] [--json]
+  thirdfy-agent wallet sign --agent-api-key <key> --action <id> --params <json> [--chain-id <id>] [--json]
+  thirdfy-agent wallet submit --signed-tx-hex <hex> [--chain-id <id>] [--rpc-url <url>] [--json]
+  thirdfy-agent agent run --agent-api-key <key> --action <id> --params <json> [--signer-method managed_wallet_server|byow|fanout_intent] [--strategy-intent single_wallet|fanout] [--run-mode <mode>] [--user-did <did>] [--json]
   thirdfy-agent credentials upsert --auth-token <token> --venue <id> --api-key <key> --api-secret <secret> [--verify-permissions] [--skip-permissions-probe] [--bitfinex-base-url <url>] [--json]
   thirdfy-agent credentials status --auth-token <token> [--venue <id>] [--json]
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
@@ -3205,6 +3529,8 @@ Global flags:
   --timeout <ms>     request timeout
   --params <json>    for swap: exactly one of {amountInRaw} or {amountInHuman + tokenInDecimals}
   --broadcast        with run --run-mode self, sign and broadcast using OWS
+  --user-did <did>   required for managed wallet server execution paths
+  --allow-wallet-mismatch  bypass strict funded-wallet vs execution-wallet guard
   --effect-check <mode>  self-exec check mode: strict | relaxed | off (default: relaxed)
   --owner-session-token <token>  owner session token (or THIRDFY_OWNER_SESSION_TOKEN)
   --json             stable machine-readable output

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {

package/src/utils/cli/intentNormalization.cjs

@@ -54,6 +54,7 @@ function normalizeIntentResponse(response) {
     mode: response?.mode || null,
     unsignedTx: response?.unsignedTx || null,
     estimatedGas: response?.estimatedGas || null,
+    txHash: response?.txHash || null,
     idempotencyKey: response?.idempotencyKey || null,
     mirror: response?.mirror || null,
     self: response?.self || null,