@thirdfy/agent-cli 0.1.24 → 0.1.27

package/CHANGELOG.md

@@ -4,6 +4,60 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+### Added
+
+- **`npm run publish:npm:local`** (`scripts/local-npm-publish.sh`): loads gitignored `.env`, exports `NODE_AUTH_TOKEN` from `NPM_TOKEN`, then runs `release:npm` via **node** (`scripts/release-npm.mjs`, `--dry-run` or `--publish`) so the outer `npm run` does not strip registry auth before the release script runs. Documented in `docs/releasing.md` Path B.
+
+### Fixed
+
+- `release:npm`: `npm publish` now uses a short-lived `NPM_CONFIG_USERCONFIG` file with `//registry.npmjs.org/:_authToken=…` when a token is present, so npm 10+ authenticates reliably (Bearer env alone was not enough in this repo’s CLI runs).
+- `release:npm -- --publish`: when both `NODE_AUTH_TOKEN` and `NPM_TOKEN` are set but `NODE_AUTH_TOKEN` is much shorter than `NPM_TOKEN` (common placeholder), use `NPM_TOKEN` for the publish subprocess and print a warning.
+
+### Changed
+
+- **CI:** Release workflow no longer requests `id-token: write` (npm publish uses `secrets.NPM_TOKEN` only).
+
+## [0.1.27] - 2026-05-05
+
+**npm:** [`@thirdfy/agent-cli@0.1.27`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.27)  
+**Git tag:** [`v0.1.27`](https://github.com/thirdfy/agent-cli/releases/tag/v0.1.27)
+
+### Added
+
+- Maintainer [docs/releasing.md](./docs/releasing.md) runbook for npm + GitHub Actions, `.env.example` template, and `npm run release:npm` (`scripts/release-npm.mjs`) with dry-run default and stricter checks for `--publish`.
+
+### Fixed
+
+- **Bugbot (PR #24):** `release:npm` maps `NPM_TOKEN` → `NODE_AUTH_TOKEN` for the publish subprocess; `npm publish` uses `--ignore-scripts` after explicit checks so `prepublishOnly` does not run twice. **Release** GitHub Action uses the same `npm publish --ignore-scripts` after its validation steps.
+
+## [0.1.26] - 2026-05-05
+
+**Git tag:** [`v0.1.26`](https://github.com/thirdfy/agent-cli/releases/tag/v0.1.26) — provider parity merged to `main`; not published to the npm registry (use **0.1.27** for the first npm build that includes PR #23 plus release tooling from PR #24).
+
+### Fixed
+
+- **Provider discovery parity:** Align `actions --provider` filtering with MCP/API provider taxonomy for provider-less spot, Hyperliquid/perps, bridge, DogeOS, prediction, and earn catalog rows.
+- **Metadata-first discovery:** Prefer API-supplied `providerId`, `domain`, and `category` for provider filtering, keeping action-name inference as a legacy fallback only.
+- **Bugbot:** `actions --provider` key fallback now matches provider suffix patterns (e.g. `execute_bridge` for `--provider bridge`).
+- **Bugbot:** After metadata mismatch, hyperliquid/polymarket/bridge/DogeOS branches use action-key matching only (removed redundant `provider ===` checks and dead final equality).
+
+## [0.1.25] - 2026-05-04
+
+**npm:** [`@thirdfy/agent-cli@0.1.25`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.25)  
+**Git tag:** [`v0.1.25`](https://github.com/thirdfy/agent-cli/releases/tag/v0.1.25)
+
+### Changed
+
+- **Capabilities negotiation:** Cache negotiated Thirdfy CLI capabilities and derive provider hints from the live API response to reduce static hint drift.
+
+### Fixed
+
+- **Managed wallet payloads:** Align swap and related `params` with human-readable amount fields expected by the Thirdfy API when using `amountInHuman`.
+
+### Added
+
+- **Tests:** `test/managed-wallet-payload.test.cjs` for managed-wallet payload shape.
+
 ## [0.1.24] - 2026-05-02
 
 **npm:** [`@thirdfy/agent-cli@0.1.24`](https://www.npmjs.com/package/@thirdfy/agent-cli/v/0.1.24)  

package/README.md

@@ -40,7 +40,9 @@ npx @thirdfy/agent-cli --help
 
 ## Release notes
 
-Version history and highlights: [CHANGELOG.md](./CHANGELOG.md). Recent CLI releases document earn/prediction provider discovery, case-insensitive `actions --provider` filtering, self-lane guards for offchain venue orders, and npm-facing README refresh (**v0.1.24**).
+Version history and highlights: [CHANGELOG.md](./CHANGELOG.md). Recent CLI releases document provider discovery parity, metadata-first `actions --provider` filtering, earn deposit guards, and README refresh through **v0.1.27**.
+
+**Maintainers — npm:** follow [docs/releasing.md](./docs/releasing.md). From a clone with gitignored `.env`, use `npm run publish:npm:local -- --dry-run` then `npm run publish:npm:local`. Or run `npm run release:npm` after exporting tokens in the shell. Never commit npm tokens — use [.env.example](./.env.example) as a template only.
 
 ## Quick start
 

package/bin/thirdfy-agent.mjs

@@ -27,6 +27,7 @@ const RUN_MODES = ['thirdfy', 'self', 'hybrid', 'agent_wallet'];
 const HYBRID_WALLET_MODES = ['self', 'agent_wallet'];
 const CUSTODY_MODES = ['managed', 'external'];
 const EFFECT_CHECK_MODES = ['strict', 'relaxed', 'off'];
+let negotiatedCapabilitiesCache = null;
 const PROFILE_DEFAULTS = {
   personal: 'self',
   builder: 'hybrid',
@@ -153,6 +154,7 @@ async function main() {
   }
 
   const capabilities = await negotiateCapabilities(context);
+  negotiatedCapabilitiesCache = capabilities;
 
   switch (commandKey) {
     case 'agent run':
@@ -556,8 +558,57 @@ function getTradingProviderHint(providerId) {
   return null;
 }
 
-function getCachedProviderHintFromCapabilities(_provider) {
-  return null;
+function getCachedProviderHintFromCapabilities(provider) {
+  const normalizedProvider = String(provider || '').trim().toLowerCase();
+  if (!normalizedProvider) return null;
+  const manifests = Array.isArray(negotiatedCapabilitiesCache?.providers?.manifests)
+    ? negotiatedCapabilitiesCache.providers.manifests
+    : [];
+  const match = manifests.find((entry) => String(entry?.providerId || '').trim().toLowerCase() === normalizedProvider);
+  if (!match) return null;
+  const canonicalWriteActions = {
+    trading: 'swap',
+    hyperliquid: 'place_hyperliquid_perps_order',
+    polymarket: 'place_polymarket_order',
+    prediction: 'place_prediction_order',
+    earn: 'deposit_earn_position',
+    morpho: 'deposit_earn_position',
+    curve: 'deposit_earn_position',
+  };
+  const canonicalReadActions = {
+    earn: 'get_earn_opportunities',
+    morpho: 'get_morpho_vaults',
+    curve: 'get_curve_pools',
+    prediction: 'get_prediction_markets',
+  };
+  return {
+    provider: normalizedProvider,
+    category: match.category || match.domain || match.providerKind || null,
+    ...(canonicalReadActions[normalizedProvider] ? { canonicalReadAction: canonicalReadActions[normalizedProvider] } : {}),
+    ...(canonicalWriteActions[normalizedProvider] ? { canonicalWriteAction: canonicalWriteActions[normalizedProvider] } : {}),
+    providerKind: match.providerKind || null,
+    capabilities: Array.isArray(match.capabilities) ? match.capabilities : [],
+    supportedChains: Array.isArray(match.supportedChains) ? match.supportedChains : [],
+    custodyMode: match.custodyMode || null,
+    description: match.description || null,
+    source: 'cli_capabilities_manifest',
+  };
+}
+
+function formatProviderAmbiguousActionHint(providerHint) {
+  if (!providerHint) return '';
+  const p = providerHint.provider;
+  const w = providerHint.canonicalWriteAction;
+  if (w) return ` Provider ${p} expects ${w}.`;
+  return ` Provider ${p} did not declare a canonical write action in capabilities; run actions --provider ${p} first.`;
+}
+
+function formatProviderUnknownActionHint(providerHint) {
+  if (!providerHint) return '';
+  const p = providerHint.provider;
+  const w = providerHint.canonicalWriteAction;
+  if (w) return ` Provider ${p} expects ${w}; run actions --provider ${p} first.`;
+  return ` Provider ${p} did not declare a canonical write action in capabilities; run actions --provider ${p} first.`;
 }
 
 const OFFCHAIN_VENUE_ORDER_ACTIONS = new Set([
@@ -2966,11 +3017,16 @@ function buildBuildTxPayload(flags, resolvedAction) {
 
 function buildManagedExecutePayload(flags, options) {
   const runMode = String(options.runMode || flags.runMode || 'agent_wallet').trim().toLowerCase();
+  const params = getPreparedParams(flags);
+  const managedParams = { ...params };
+  if (flags.__swapInput?.unitSource === 'human' && flags.__swapInput.amountInHuman) {
+    managedParams.amountIn = flags.__swapInput.amountInHuman;
+  }
   const payload = {
     agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
     userDid: String(flags.userDid || process.env.THIRDFY_USER_DID || '').trim(),
-    params: getPreparedParams(flags),
+    params: managedParams,
     chainId: Number(flags.chainId || 8453),
     executionStrategy: {
       runMode,
@@ -3172,6 +3228,172 @@ function formatActionList(items) {
     .join(', ');
 }
 
+function normalizeProviderId(value) {
+  return String(value || '').trim().toLowerCase();
+}
+
+function rowActionKey(action) {
+  return getActionKey(action)
+    .replace(/-/g, '_')
+    .toLowerCase();
+}
+
+function canonicalActionKey(action) {
+  return getActionKey(action)
+    .replace(/_/g, '-')
+    .toLowerCase();
+}
+
+function inferActionProvider(action) {
+  // API catalog metadata (`providerId`, `domain`, `category`) is the source of truth.
+  // This fallback only keeps older catalog rows / older API deployments discoverable.
+  const key = canonicalActionKey(action);
+  const knownMap = {
+    swap: 'trading',
+    'execute-optimal-swap': 'trading',
+    'get-best-trading-quote': 'trading',
+    'dogeos-barkswap-get-quote': 'dogeos-barkswap',
+    'dogeos-barkswap-execute-swap': 'dogeos-barkswap',
+    'dogeos-get-ecosystem-overview': 'dogeos-ecosystem',
+    'dogeos-get-wallet-actionability': 'dogeos-ecosystem',
+    'dogeos-prepare-trade': 'dogeos-ecosystem',
+    'dogeos-prepare-token-launch': 'dogeos-ecosystem',
+    'dogeos-get-chain-insights': 'dogeos-ecosystem',
+    'dogeos-get-trending-tokens': 'dogeos-ecosystem',
+    'dogeos-get-new-tokens': 'dogeos-ecosystem',
+    'dogeos-get-early-bird-tokens': 'dogeos-ecosystem',
+    'dogeos-get-only-moon-tokens': 'dogeos-ecosystem',
+    'dogeos-get-big-wins-tokens': 'dogeos-ecosystem',
+    'dogeos-get-related-tokens': 'dogeos-ecosystem',
+    'dogeos-laika-read-contract': 'dogeos-laika',
+    'dogeos-laika-execute-raw': 'dogeos-laika',
+    'dogeos-laika-launch-token': 'dogeos-laika',
+    'dogeos-laika-buy-token': 'dogeos-laika',
+    'dogeos-laika-claim': 'dogeos-laika',
+    'dogeos-laika-token-state': 'dogeos-laika',
+    'get-governance-v2-overview': 'governance-v2',
+    'get-governance-v2-timeseries': 'governance-v2',
+    'get-governance-v2-breakdowns': 'governance-v2',
+    'get-hyperliquid-perps-meta': 'hyperliquid',
+    'get-hyperliquid-all-mids': 'hyperliquid',
+    'get-hyperliquid-l2-book': 'hyperliquid',
+    'get-hyperliquid-candles': 'hyperliquid',
+    'get-hyperliquid-user-state': 'hyperliquid',
+    'get-hyperliquid-open-orders': 'hyperliquid',
+    'get-hyperliquid-setup-status': 'hyperliquid',
+    'get-hyperliquid-onboarding-plan': 'hyperliquid',
+    'prepare-hyperliquid-onboarding': 'hyperliquid',
+    'claim-hyperliquid-testnet-faucet': 'hyperliquid',
+    'get-hyperliquid-builder-fee-status': 'hyperliquid',
+    'approve-hyperliquid-agent': 'hyperliquid',
+    'approve-hyperliquid-builder-fee': 'hyperliquid',
+    'register-hyperliquid-referrer': 'hyperliquid',
+    'set-hyperliquid-referrer': 'hyperliquid',
+    'get-hyperliquid-referral-status': 'hyperliquid',
+    'deposit-hyperliquid-staking': 'hyperliquid',
+    'deposit-hyperliquid-bridge': 'hyperliquid',
+    'place-hyperliquid-perps-order': 'hyperliquid',
+    'get-perps-markets': 'hyperliquid',
+    'get-perps-account': 'hyperliquid',
+    'get-perps-position': 'hyperliquid',
+    'place-perps-order': 'hyperliquid',
+    'cancel-perps-order': 'hyperliquid',
+    'get-earn-opportunities': 'earn',
+    'get-earn-provider': 'earn',
+    'get-earn-position': 'earn',
+    'deposit-earn-position': 'earn',
+    'withdraw-earn-position': 'earn',
+    'get-morpho-vaults': 'morpho',
+    'deposit-morpho-vault': 'morpho',
+    'withdraw-morpho-vault': 'morpho',
+    'get-curve-pools': 'curve',
+    'get-curve-pool-details': 'curve',
+    'deposit-curve-pool': 'curve',
+    'withdraw-curve-pool': 'curve',
+    'get-prediction-markets': 'polymarket',
+    'get-prediction-market': 'polymarket',
+    'get-prediction-order-book': 'polymarket',
+    'get-prediction-position': 'polymarket',
+    'place-prediction-order': 'polymarket',
+    'cancel-prediction-order': 'polymarket',
+    'get-polymarket-markets': 'polymarket',
+    'get-polymarket-market': 'polymarket',
+    'get-polymarket-setup-status': 'polymarket',
+    'get-polymarket-order': 'polymarket',
+    'place-polymarket-order': 'polymarket',
+  };
+  if (knownMap[key]) return knownMap[key];
+  if (key.includes('hyperliquid')) return 'hyperliquid';
+  if (key.includes('polymarket') || key.includes('prediction')) return 'polymarket';
+  if (key.includes('morpho')) return 'morpho';
+  if (key.includes('curve')) return 'curve';
+  if (key.includes('earn')) return 'earn';
+  if (key.includes('bridge')) return 'bridge';
+  if (key.includes('dogeos-barkswap')) return 'dogeos-barkswap';
+  if (key.includes('dogeos-laika')) return 'dogeos-laika';
+  if (key.includes('dogeos')) return 'dogeos-ecosystem';
+  return '';
+}
+
+function getActionProviderWithInference(action) {
+  return getActionProvider(action) || inferActionProvider(action);
+}
+
+function isEarnCatalogAction(action) {
+  const actionKey = rowActionKey(action);
+  return (
+    actionKey.includes('_earn_') ||
+    normalizeProviderId(action?.domain) === 'earn' ||
+    normalizeProviderId(action?.category) === 'earn'
+  );
+}
+
+function isSpotTradingCatalogAction(action) {
+  const actionKey = rowActionKey(action);
+  return actionKey === 'swap' || actionKey === 'execute_optimal_swap' || actionKey === 'get_best_trading_quote';
+}
+
+function isProviderActionKey(action, provider) {
+  const actionKey = rowActionKey(action);
+  const normalizedProvider = normalizeProviderId(provider).replace(/-/g, '_');
+  if (!actionKey || !normalizedProvider) return false;
+  return (
+    actionKey === normalizedProvider ||
+    actionKey.startsWith(`${normalizedProvider}_`) ||
+    actionKey.includes(`_${normalizedProvider}_`) ||
+    actionKey.endsWith(`_${normalizedProvider}`)
+  );
+}
+
+function actionMatchesProvider(action, requestedProvider, allActions) {
+  const provider = getActionProviderWithInference(action);
+  const actionKey = rowActionKey(action);
+  if (provider === requestedProvider) return true;
+  if (requestedProvider === 'trading') return isSpotTradingCatalogAction(action);
+  // Here resolved metadata already disagrees with the filter; fall back to action-key shape only.
+  if (requestedProvider === 'hyperliquid') return isProviderActionKey(action, 'hyperliquid');
+  if (requestedProvider === 'polymarket') return isProviderActionKey(action, 'polymarket');
+  if (requestedProvider === 'bridge') return isProviderActionKey(action, 'bridge');
+  if (requestedProvider.startsWith('dogeos')) return isProviderActionKey(action, requestedProvider);
+  if (requestedProvider === 'earn') {
+    return provider === 'earn' || provider === 'morpho' || provider === 'curve' || isEarnCatalogAction(action);
+  }
+  if (requestedProvider === 'morpho' || requestedProvider === 'curve') {
+    const hasProtocolSpecificEarnRows = allActions.some((candidate) => getActionProviderWithInference(candidate) === requestedProvider);
+    return isProviderActionKey(action, requestedProvider) || (!hasProtocolSpecificEarnRows && isEarnCatalogAction(action));
+  }
+  if (requestedProvider === 'prediction') {
+    return (
+      provider === 'polymarket' ||
+      provider === 'prediction' ||
+      actionKey.includes('_prediction_') ||
+      normalizeProviderId(action?.domain) === 'prediction' ||
+      normalizeProviderId(action?.category) === 'prediction'
+    );
+  }
+  return isProviderActionKey(action, requestedProvider);
+}
+
 function applyActionFilters(actions, flags) {
   let filtered = actions;
   if (flags.catalog) {
@@ -3179,21 +3401,14 @@ function applyActionFilters(actions, flags) {
     filtered = filtered.filter((a) => String(a.catalog || a.catalogId || 'default').trim().toLowerCase() === expectedCatalog);
   }
   if (flags.provider) {
-    const expectedProvider = String(flags.provider).trim().toLowerCase();
-    filtered = filtered.filter((a) => {
-      const provider = getActionProvider(a);
-      const actionKey = getActionKey(a).replace(/-/g, '_').toLowerCase();
-      if (provider === expectedProvider) return true;
-      if (expectedProvider === 'earn') return provider === 'morpho' || provider === 'curve' || actionKey.includes('_earn_');
-      if (expectedProvider === 'prediction') return provider === 'polymarket' || actionKey.includes('_prediction_');
-      return false;
-    });
+    const expectedProvider = normalizeProviderId(flags.provider);
+    filtered = filtered.filter((a) => actionMatchesProvider(a, expectedProvider, filtered));
   }
   return filtered;
 }
 
 function getActionProvider(action) {
-  return String(action?.provider || action?.providerId || action?.provider_id || action?.catalog || '').trim().toLowerCase();
+  return normalizeProviderId(action?.provider || action?.providerId || action?.provider_id || action?.catalog || '');
 }
 
 async function resolveActionSelection(ctx, flags) {
@@ -3235,7 +3450,7 @@ async function resolveActionSelection(ctx, flags) {
     throw new Error(
       `Ambiguous --action "${requestedAction}". Alias matches multiple actions: ${formatActionList(
         exactAlias.map((v) => v.key)
-      )}.${providerHint ? ` Provider ${providerHint.provider} expects ${providerHint.canonicalWriteAction}.` : ''}`
+      )}.${formatProviderAmbiguousActionHint(providerHint)}`
     );
   }
 
@@ -3252,14 +3467,14 @@ async function resolveActionSelection(ctx, flags) {
     throw new Error(
       `Ambiguous --action "${requestedAction}". Did you mean one of: ${formatActionList(
         fuzzy.slice(0, 10).map((v) => v.key)
-      )}?${providerHint ? ` Provider ${providerHint.provider} expects ${providerHint.canonicalWriteAction}.` : ''}`
+      )}?${formatProviderAmbiguousActionHint(providerHint)}`
     );
   }
   const providerHint = flags.provider ? getTradingProviderHint(flags.provider) : null;
   throw new Error(
-    `Unknown --action "${requestedAction}". No compatible action found in current catalog/provider scope.${
-      providerHint ? ` Provider ${providerHint.provider} expects ${providerHint.canonicalWriteAction}; run actions --provider ${providerHint.provider} first.` : ''
-    }`
+    `Unknown --action "${requestedAction}". No compatible action found in current catalog/provider scope.${formatProviderUnknownActionHint(
+      providerHint
+    )}`
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.24",
+  "version": "0.1.27",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -18,6 +18,8 @@
   "scripts": {
     "test": "node --test \"test/**/*.test.cjs\"",
     "lint": "node --check ./bin/thirdfy-agent.mjs",
+    "release:npm": "node ./scripts/release-npm.mjs",
+    "publish:npm:local": "bash ./scripts/local-npm-publish.sh",
     "validate:public-docs": "node ./scripts/validate-public-docs.mjs",
     "validate:cli-contract-schemas": "node ./scripts/validate-cli-contract-schemas.mjs",
     "validate:actions": "node ./scripts/e2e/validate-actions.mjs",