@thirdfy/agent-cli 0.1.39 → 0.1.40

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.1.40] - 2026-05-17
+
+### Fixed
+
+- Email login and bootstrap commands now persist agent credentials from nested API response shapes such as `registration.registration.agentApiKey`, so owner-session onboarding can resolve the hidden execution identity without requiring users to pass a raw agent API key manually.
+
 ## [0.1.39] - 2026-05-17
 
 ### Added

package/README.md

@@ -42,7 +42,7 @@ npx @thirdfy/agent-cli --help
 
 ## Release notes
 
-Version history and highlights: [CHANGELOG.md](./CHANGELOG.md). **v0.1.39** makes `agent_wallet` the fresh solo default, adds framework guidance for Hermes/OpenClaw/Claude Managed Agents, clarifies Gator/ERC-7710 delegation flows, and keeps BYOW/self plus hybrid/thirdfy mode switching explicit. **v0.1.38** is a **documentation and metadata patch**: it republishes to npm so the package homepage matches the updated `README.md` on `main`, and aligns root `package-lock.json` version fields with `package.json`. **v0.1.37** adds **email OTP** `thirdfy-agent login email` (send code, then complete with `--code --accept-terms`), **`help onboarding`**, **`doctor auth`**, **`wallet list`**, and **masked `whoami`** output so agents and operators get first-run guidance without dumping secrets. Earlier releases added provider discovery parity, portfolio analytics, managed-wallet swap normalization, and **self/build-tx** swap human-decimal `amountIn` parity when using `amountInHuman` + `tokenInDecimals`.
+Version history and highlights: [CHANGELOG.md](./CHANGELOG.md). **v0.1.40** fixes email/bootstrap credential persistence when the API returns nested registration payloads, so owner-session onboarding can save the hidden execution identity without exposing a raw agent API key. **v0.1.39** makes `agent_wallet` the fresh solo default, adds framework guidance for Hermes/OpenClaw/Claude Managed Agents, clarifies Gator/ERC-7710 delegation flows, and keeps BYOW/self plus hybrid/thirdfy mode switching explicit. **v0.1.38** is a **documentation and metadata patch**: it republishes to npm so the package homepage matches the updated `README.md` on `main`, and aligns root `package-lock.json` version fields with `package.json`. **v0.1.37** adds **email OTP** `thirdfy-agent login email` (send code, then complete with `--code --accept-terms`), **`help onboarding`**, **`doctor auth`**, **`wallet list`**, and **masked `whoami`** output so agents and operators get first-run guidance without dumping secrets. Earlier releases added provider discovery parity, portfolio analytics, managed-wallet swap normalization, and **self/build-tx** swap human-decimal `amountIn` parity when using `amountInHuman` + `tokenInDecimals`.
 
 **Maintainers — npm:** follow [docs/releasing.md](./docs/releasing.md). From a clone with gitignored `.env`, use `npm run publish:npm:local -- --dry-run` then `npm run publish:npm:local`. Or run `npm run release:npm` after exporting tokens in the shell. Never commit npm tokens — use [.env.example](./.env.example) as a template only.
 

package/bin/thirdfy-agent.mjs

@@ -113,6 +113,43 @@ function buildTopLevelOnboardingHint(payload) {
   return null;
 }
 
+function extractAgentApiKey(value) {
+  if (!value || typeof value !== 'object') return '';
+  const candidates = [
+    value.agentApiKey,
+    value.apiKey,
+    value.data?.agentApiKey,
+    value.data?.apiKey,
+    value.bootstrap?.agentApiKey,
+    value.bootstrap?.apiKey,
+    value.registration?.agentApiKey,
+    value.registration?.apiKey,
+    value.registration?.registration?.agentApiKey,
+    value.registration?.registration?.apiKey,
+    value.data?.registration?.agentApiKey,
+    value.data?.registration?.apiKey,
+    value.data?.registration?.registration?.agentApiKey,
+    value.data?.registration?.registration?.apiKey,
+  ];
+  return String(candidates.find((candidate) => String(candidate || '').trim()) || '').trim();
+}
+
+function extractAgentKey(value) {
+  if (!value || typeof value !== 'object') return '';
+  const candidates = [
+    value.agentKey,
+    value.data?.agentKey,
+    value.bootstrap?.agentKey,
+    value.registration?.agentKey,
+    value.registration?.registration?.agentKey,
+    value.data?.registration?.agentKey,
+    value.data?.registration?.registration?.agentKey,
+    value.owner?.creatorWallet,
+    value.data?.owner?.creatorWallet,
+  ];
+  return String(candidates.find((candidate) => String(candidate || '').trim()) || '').trim();
+}
+
 async function main() {
   const profileState = resolveProfileState(globalFlags);
   context.profile = profileState.profile;
@@ -1874,6 +1911,8 @@ async function commandDeveloperBootstrap(ctx, flags, capabilities) {
     { ...registerFlags, __suppressOutput: true },
     capabilities
   );
+  const agentApiKey = extractAgentApiKey(registerResponse || {});
+  const responseAgentKey = extractAgentKey(registerResponse || {}) || agentKey;
 
   const config = loadProfileConfig();
   const next = {
@@ -1890,6 +1929,13 @@ async function commandDeveloperBootstrap(ctx, flags, capabilities) {
       bootstrapCompletedAt: new Date().toISOString(),
     },
   };
+  if (agentApiKey || responseAgentKey) {
+    next.agent = {
+      ...(config.agent && typeof config.agent === 'object' ? config.agent : {}),
+      ...(agentApiKey ? { apiKey: agentApiKey } : {}),
+      ...(responseAgentKey ? { agentKey: responseAgentKey } : {}),
+    };
+  }
   persistProfileConfig(next);
   if (!flags.__suppressOutput) {
     printEnvelope({
@@ -2154,6 +2200,19 @@ async function commandBootstrapComplete(ctx, flags, capabilities) {
       capabilities
     );
   }
+  const registrationAgentApiKey = extractAgentApiKey(registration || {});
+  const registrationAgentKey = extractAgentKey(registration || {}) || agentKey;
+  if (registrationAgentApiKey || registrationAgentKey) {
+    const latest = loadProfileConfig();
+    persistProfileConfig({
+      ...latest,
+      agent: {
+        ...(latest.agent && typeof latest.agent === 'object' ? latest.agent : {}),
+        ...(registrationAgentApiKey ? { apiKey: registrationAgentApiKey } : {}),
+        ...(registrationAgentKey ? { agentKey: registrationAgentKey } : {}),
+      },
+    });
+  }
 
   printEnvelope({
     success: true,
@@ -2901,8 +2960,8 @@ async function commandLoginEmail(ctx, flags) {
   const data = response?.data || response || {};
   const ownerSessionToken = String(data.ownerSessionToken || '').trim();
   const bootstrap = data.bootstrap && typeof data.bootstrap === 'object' ? data.bootstrap : {};
-  const agentApiKey = String(bootstrap.agentApiKey || '').trim();
-  const agentKey = String(bootstrap.agentKey || data.owner?.creatorWallet || '').trim();
+  const agentApiKey = extractAgentApiKey(data);
+  const agentKey = extractAgentKey(data);
   const wallets = data.wallets && typeof data.wallets === 'object' ? data.wallets : {};
   const userDid = String(data.owner?.creatorDid || wallets.userDid || '').trim();
   const primaryEvmWallet = String(wallets.primaryEvmWallet || data.owner?.creatorWallet || '').trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {