@thirdfy/agent-cli 0.1.6 → 0.1.7

package/README.md

@@ -42,8 +42,8 @@ export THIRDFY_OWNER_SESSION_TOKEN="..."
 
 thirdfy-agent actions --agent-api-key "$AGENT_API_KEY" --json
 thirdfy-agent profile init --profile personal --json
-thirdfy-agent preflight --agent-api-key "$AGENT_API_KEY" --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountIn":"1000000"}' --estimated-amount-usd 25 --json
-thirdfy-agent run --agent-api-key "$AGENT_API_KEY" --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountIn":"1000000"}' --estimated-amount-usd 25 --json
+thirdfy-agent preflight --agent-api-key "$AGENT_API_KEY" --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000"}' --estimated-amount-usd 25 --json
+thirdfy-agent run --agent-api-key "$AGENT_API_KEY" --action swap --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000"}' --estimated-amount-usd 25 --json
 thirdfy-agent intent-status --intent-id "<intentId>" --json
 ```
 
@@ -51,12 +51,37 @@ By default, the CLI targets production (`https://api.thirdfy.com`). Use `--api-b
 
 ## Auth model
 
-- `AGENT_API_KEY`: execution identity and policy-aware action access (`actions --agent-api-key`, `preflight`, `run`)
-- `THIRDFY_AUTH_TOKEN`: Privy-native owner/account auth (`agent register`, `agent key *`, `delegation *`, `credentials *`, `credits balance`)
-- `THIRDFY_OWNER_SESSION_TOKEN`: wallet-sign owner auth session (`agent register`, `agent key *`)
+- `AGENT_API_KEY`: execution identity for `preflight`, `run`, `self-exec`, and policy-aware discovery.
+- `THIRDFY_AUTH_TOKEN`: owner/account auth for onboarding and delegation commands.
+- `THIRDFY_OWNER_SESSION_TOKEN`: wallet-sign owner session for onboarding and owner operations.
+
+CLI precedence now supports login/config defaults:
+
+1. explicit flag
+2. environment variable
+3. `~/.thirdfy/config.json` (from `thirdfy-agent login` / `config set`)
 
 Execution-only workflows can run with only `AGENT_API_KEY` after onboarding is complete.
 
+### Login / logout / config UX
+
+```bash
+# Store auth defaults once
+thirdfy-agent login --auth-token "$THIRDFY_AUTH_TOKEN" --agent-api-key "$AGENT_API_KEY" --json
+
+# Inspect config
+thirdfy-agent whoami --json
+thirdfy-agent config set --key runMode --value self --json
+
+# Local-only logout (default)
+thirdfy-agent logout --json
+
+# Local clear + server owner-session revoke (if present)
+thirdfy-agent logout --all --json
+```
+
+`logout --all` is provider-agnostic: it attempts owner-session revocation when a session token exists, then always clears local credentials.
+
 ### Wallet-sign onboarding path
 
 ```bash
@@ -85,6 +110,12 @@ thirdfy-agent agent register --owner-session-token "$THIRDFY_OWNER_SESSION_TOKEN
 - `--run-mode self` -> self-custody rail (`build-tx` flow; default for `profile=personal`)
 - `--run-mode hybrid` -> self-custody + governance mirror metadata (default for `profile=builder`)
 
+Auth expectations by mode:
+
+- `self`: requires execution identity (`agentApiKey`) today; keyless self lane is blocked with deterministic `SELF_OPEN_DISABLED`.
+- `hybrid`: requires execution identity and governed mirror semantics.
+- `thirdfy`: requires execution identity and delegated governance path.
+
 Selection precedence:
 
 1. `--run-mode`
@@ -102,6 +133,28 @@ thirdfy-agent whoami --json
 
 `profile use --profile <name>` resets run mode to that profile default unless `--run-mode` is explicitly provided.
 
+## Swap amount contract (agent-safe)
+
+For `--action swap`, CLI enforces an explicit amount unit contract:
+
+- Provide exactly one of:
+  - `amountInRaw` (base units integer string), or
+  - `amountInHuman` + `tokenInDecimals` (CLI converts to `amountInRaw`)
+- Legacy `amountIn` is accepted only as raw integer compatibility input.
+- Ambiguous payloads (both/none) fail with `AMOUNT_UNIT_AMBIGUOUS`.
+
+Examples:
+
+```bash
+# Raw/base units
+thirdfy-agent run --agent-api-key "$AGENT_API_KEY" --action swap \
+  --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000","chainId":8453}' --json
+
+# Human units + decimals
+thirdfy-agent run --agent-api-key "$AGENT_API_KEY" --action swap \
+  --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInHuman":"1.5","tokenInDecimals":6,"chainId":8453}' --json
+```
+
 ## Jeff shorthand rail
 
 Jeff-friendly aliases map directly to core commands:
@@ -118,6 +171,8 @@ Jeff-friendly aliases map directly to core commands:
 - Profiles: `profile init`, `profile use`, `profile show`, `whoami`
 - Onboarding: `agent auth challenge`, `agent auth verify`, `agent register`, `agent key rotate`, `agent key revoke`
 - Governance readiness: `delegation create`, `delegation activate`, `delegation status`, `credentials upsert`, `credentials status`
+- Delegation operations: `delegation show`, `delegation inspect`, `delegation revoke`
+- Delegation execution helpers: `delegation balance`, `delegation redeem`
 - Account: `credits balance`
 
 ## Delegation lifecycle (canonical)
@@ -149,8 +204,53 @@ thirdfy-agent delegation status \
   --agent-key "0xYOUR_AGENT_KEY" \
   --verify \
   --json
+
+thirdfy-agent delegation inspect \
+  --auth-token "$THIRDFY_AUTH_TOKEN" \
+  --agent-key "0xYOUR_AGENT_KEY" \
+  --verify \
+  --json
+
+thirdfy-agent delegation revoke \
+  --auth-token "$THIRDFY_AUTH_TOKEN" \
+  --agent-key "0xYOUR_AGENT_KEY" \
+  --reason "user_revoked" \
+  --json
+
+thirdfy-agent delegation balance \
+  --auth-token "$THIRDFY_AUTH_TOKEN" \
+  --agent-key "0xYOUR_AGENT_KEY" \
+  --json
+
+thirdfy-agent delegation redeem \
+  --run-mode thirdfy \
+  --agent-api-key "$AGENT_API_KEY" \
+  --action swap \
+  --params '{"tokenIn":"0x...","tokenOut":"0x...","amountInRaw":"1000000"}' \
+  --estimated-amount-usd 5 \
+  --json
 ```
 
+### MetaMask custodial-compatible lifecycle (new)
+
+```bash
+thirdfy-agent delegation init-custodial \
+  --auth-token "$THIRDFY_AUTH_TOKEN" \
+  --chain-id 8453 \
+  --json
+
+thirdfy-agent delegation custodial-grant \
+  --auth-token "$THIRDFY_AUTH_TOKEN" \
+  --agent-key "0xYOUR_AGENT_KEY" \
+  --token-address "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" \
+  --max-usd-per-day 250 \
+  --json
+```
+
+The CLI keeps compatibility with legacy `delegation create` + `delegation activate` during migration.
+
+`delegation show` is a direct alias to `delegation status` for gator-style operator ergonomics.
+
 ## More docs
 
 - OpenClaw CLI onboarding flow:

package/bin/thirdfy-agent.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { randomUUID } from 'crypto';
+import { spawnSync } from 'child_process';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -105,6 +106,15 @@ async function main() {
     case 'config get':
       await commandProfileShow(context, subFlags);
       return;
+    case 'config set':
+      await commandConfigSet(context, subFlags);
+      return;
+    case 'login':
+      await commandLogin(context, subFlags);
+      return;
+    case 'logout':
+      await commandLogout(context, subFlags);
+      return;
     case 'whoami':
       await commandProfileShow(context, subFlags);
       return;
@@ -133,12 +143,33 @@ async function main() {
     case 'delegation create':
       await commandDelegationCreate(context, subFlags, capabilities);
       return;
+    case 'delegation init-custodial':
+      await commandDelegationInitCustodial(context, subFlags, capabilities);
+      return;
+    case 'delegation custodial-grant':
+      await commandDelegationCustodialGrant(context, subFlags, capabilities);
+      return;
     case 'delegation activate':
       await commandDelegationActivate(context, subFlags, capabilities);
       return;
     case 'delegation status':
       await commandDelegationStatus(context, subFlags, capabilities);
       return;
+    case 'delegation show':
+      await commandDelegationStatus(context, subFlags, capabilities);
+      return;
+    case 'delegation inspect':
+      await commandDelegationInspect(context, subFlags, capabilities);
+      return;
+    case 'delegation balance':
+      await commandDelegationBalance(context, subFlags, capabilities);
+      return;
+    case 'delegation revoke':
+      await commandDelegationRevoke(context, subFlags, capabilities);
+      return;
+    case 'delegation redeem':
+      await commandDelegationRedeem(context, subFlags, capabilities);
+      return;
     case 'credentials upsert':
       await commandCredentialsUpsert(context, subFlags, capabilities);
       return;
@@ -148,6 +179,9 @@ async function main() {
     case 'agent register':
       await commandAgentRegister(context, subFlags, capabilities);
       return;
+    case 'developer bootstrap':
+      await commandDeveloperBootstrap(context, subFlags, capabilities);
+      return;
     default:
       break;
   }
@@ -182,6 +216,9 @@ async function main() {
     case 'run':
       await commandRun(context, subFlags, capabilities);
       return;
+    case 'self-exec':
+      await commandSelfExec(context, subFlags, capabilities);
+      return;
     case 'intent-status':
       await commandIntentStatus(context, subFlags, capabilities);
       return;
@@ -256,6 +293,162 @@ function parseJsonFlag(flags, key) {
   }
 }
 
+function shouldApplySwapAmountContract(actionName) {
+  const action = String(actionName || '').trim().toLowerCase();
+  return action === 'swap' || /(^|:|-)swap$/.test(action);
+}
+
+function createCliError(code, message, payload = {}) {
+  const error = new Error(message);
+  error.payload = {
+    error: code,
+    blockedReason: code,
+    blockedStage: 'client_validation',
+    ...payload,
+  };
+  return error;
+}
+
+function normalizeIntegerRawAmount(input, code = 'AMOUNT_UNIT_INVALID') {
+  const raw = String(input ?? '').trim();
+  if (!/^\d+$/.test(raw)) {
+    throw createCliError(code, 'amountInRaw must be an integer base-unit string (example: "1000000").');
+  }
+  return raw;
+}
+
+function decimalToRawUnits(amountHuman, decimals) {
+  const s = String(amountHuman ?? '').trim();
+  if (!/^\d+(\.\d+)?$/.test(s)) {
+    throw createCliError('AMOUNT_UNIT_INVALID', 'amountInHuman must be a decimal string (example: "100.5").');
+  }
+  const [whole, frac = ''] = s.split('.');
+  if (decimals === 0) {
+    if (frac && /[1-9]/.test(frac)) {
+      throw createCliError(
+        'AMOUNT_PRECISION_EXCESS',
+        'amountInHuman has fractional digits but tokenInDecimals is 0 (example: use "2" not "2.5").'
+      );
+    }
+  } else if (frac.length > decimals && /[1-9]/.test(frac.slice(decimals))) {
+    throw createCliError(
+      'AMOUNT_PRECISION_EXCESS',
+      `amountInHuman has more than ${decimals} fractional digit(s) for tokenInDecimals; round or use amountInRaw.`
+    );
+  }
+  const fracNorm = (frac + '0'.repeat(decimals)).slice(0, decimals);
+  const wholePart = BigInt(whole || '0') * 10n ** BigInt(decimals);
+  const fracPart = BigInt(fracNorm || '0');
+  return (wholePart + fracPart).toString();
+}
+
+function normalizeSwapAmountContract(params) {
+  const hasRaw = params.amountInRaw !== undefined && params.amountInRaw !== null && String(params.amountInRaw).trim() !== '';
+  const hasHuman = params.amountInHuman !== undefined && params.amountInHuman !== null && String(params.amountInHuman).trim() !== '';
+  const hasLegacy = params.amountIn !== undefined && params.amountIn !== null && String(params.amountIn).trim() !== '';
+  const populated = [hasRaw, hasHuman, hasLegacy].filter(Boolean).length;
+  if (populated === 0) {
+    throw createCliError(
+      'AMOUNT_UNIT_MISSING',
+      'Missing swap amount: provide one of amountInRaw, amountInHuman, or legacy amountIn.'
+    );
+  }
+  if (populated > 1) {
+    throw createCliError(
+      'AMOUNT_UNIT_AMBIGUOUS',
+      'Provide exactly one of amountInRaw, amountInHuman, or legacy amountIn.'
+    );
+  }
+
+  if (hasRaw) {
+    const amountInRaw = normalizeIntegerRawAmount(params.amountInRaw);
+    return {
+      params: {
+        ...params,
+        amountInRaw,
+        amountIn: amountInRaw,
+      },
+      swapInput: {
+        amountInRaw,
+        amountInHuman: null,
+        tokenInDecimals: null,
+        unitSource: 'raw',
+      },
+    };
+  }
+
+  if (hasLegacy) {
+    const amountInRaw = normalizeIntegerRawAmount(params.amountIn, 'AMOUNT_UNIT_INVALID');
+    return {
+      params: {
+        ...params,
+        amountInRaw,
+        amountIn: amountInRaw,
+      },
+      swapInput: {
+        amountInRaw,
+        amountInHuman: null,
+        tokenInDecimals: null,
+        unitSource: 'legacy_raw',
+      },
+    };
+  }
+
+  const hasDecimals =
+    params.tokenInDecimals !== undefined &&
+    params.tokenInDecimals !== null &&
+    String(params.tokenInDecimals).trim() !== '';
+  if (!hasDecimals) {
+    throw createCliError(
+      'AMOUNT_UNIT_DECIMALS_REQUIRED',
+      'amountInHuman requires tokenInDecimals (integer 0-36).'
+    );
+  }
+  const decimals = Number(params.tokenInDecimals);
+  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36) {
+    throw createCliError(
+      'AMOUNT_UNIT_DECIMALS_REQUIRED',
+      'amountInHuman requires tokenInDecimals (integer 0-36).'
+    );
+  }
+  const amountInHuman = String(params.amountInHuman).trim();
+  const amountInRaw = decimalToRawUnits(amountInHuman, decimals);
+  return {
+    params: {
+      ...params,
+      amountInHuman,
+      amountInRaw,
+      amountIn: amountInRaw,
+      tokenInDecimals: decimals,
+    },
+    swapInput: {
+      amountInRaw,
+      amountInHuman,
+      tokenInDecimals: decimals,
+      unitSource: 'human',
+    },
+  };
+}
+
+function prepareActionParamsForFlags(flags, resolvedAction) {
+  const parsedParams = parseJsonFlag(flags, 'params');
+  if (!shouldApplySwapAmountContract(resolvedAction)) {
+    flags.__preparedParams = parsedParams;
+    flags.__swapInput = null;
+    return;
+  }
+  const normalized = normalizeSwapAmountContract(parsedParams);
+  flags.__preparedParams = normalized.params;
+  flags.__swapInput = normalized.swapInput;
+}
+
+function getPreparedParams(flags) {
+  if (flags.__preparedParams && typeof flags.__preparedParams === 'object') {
+    return flags.__preparedParams;
+  }
+  return parseJsonFlag(flags, 'params');
+}
+
 async function commandCatalogsList(ctx, flags, capabilities) {
   const response = await apiGet(ctx, '/api/v1/agent/actions/catalog');
   const actions = extractActions(response);
@@ -306,6 +499,7 @@ async function commandActions(ctx, flags, capabilities) {
 
 async function commandPreflight(ctx, flags, capabilities) {
   const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
   const runMode = getEffectiveRunMode(ctx, flags);
   enforceChainCompatibility(capabilities, flags, runMode);
   const backendResult = await runPreflightByMode(runMode, ctx, flags, resolved.resolvedAction);
@@ -322,6 +516,7 @@ async function commandPreflight(ctx, flags, capabilities) {
       resolvedAction: resolved.resolvedAction,
       runMode,
       profile: ctx.profile || null,
+      swapInput: flags.__swapInput || null,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });
@@ -330,6 +525,7 @@ async function commandPreflight(ctx, flags, capabilities) {
 
 async function commandRun(ctx, flags, capabilities) {
   const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
   const runMode = getEffectiveRunMode(ctx, flags);
   enforceChainCompatibility(capabilities, flags, runMode);
   const skipPreflight = Boolean(flags.skipPreflight);
@@ -350,6 +546,7 @@ async function commandRun(ctx, flags, capabilities) {
       runMode,
       profile: ctx.profile || null,
       skippedPreflight: skipPreflight,
+      swapInput: flags.__swapInput || null,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });
@@ -392,12 +589,15 @@ async function commandCreditsBalance(ctx, flags, capabilities) {
 }
 
 async function commandDelegationCreate(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation create');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation create'
+  );
   let sessionAccountAddress = String(flags.sessionAccountAddress || '').trim();
   if (!sessionAccountAddress) {
     try {
       const executorAddressResponse = await apiGet(ctx, '/api/v1/agent/delegation/executor-address', {
-        Authorization: `Bearer ${authToken}`,
+        ...authHeaders,
       });
       sessionAccountAddress = String(executorAddressResponse?.data?.executorAddress || '').trim();
     } catch (error) {
@@ -419,7 +619,7 @@ async function commandDelegationCreate(ctx, flags, capabilities) {
     expirySeconds: Number(flags.expirySeconds || 86_400),
   };
   const response = await apiPost(ctx, '/api/v1/agent/delegation/create', payload, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const success = Boolean(response?.success !== false);
   printEnvelope({
@@ -434,8 +634,74 @@ async function commandDelegationCreate(ctx, flags, capabilities) {
   });
 }
 
+async function commandDelegationInitCustodial(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation init-custodial'
+  );
+  const payload = {
+    chainId: Number(flags.chainId || 8453),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/init-custodial'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_CUSTODIAL_INITIALIZED' : 'DELEGATION_CUSTODIAL_INIT_FAILED',
+    message: response?.message || (success ? 'Custodial wallet initialized' : 'Custodial wallet init failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationCustodialGrant(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation custodial-grant'
+  );
+  const payload = {
+    chainId: Number(flags.chainId || 8453),
+    agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
+    tokenAddress: requireFlag(flags, 'tokenAddress', 'Missing --token-address'),
+    maxUsdPerDay: Number(requireFlag(flags, 'maxUsdPerDay', 'Missing --max-usd-per-day')),
+    periodDuration: Number(flags.periodDuration || 86_400),
+    expirySeconds: Number(flags.expirySeconds || 86_400),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/custodial-grant'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_CUSTODIAL_GRANTED' : 'DELEGATION_CUSTODIAL_GRANT_FAILED',
+    message: response?.message || (success ? 'Custodial delegation granted' : 'Custodial delegation grant failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
 async function commandDelegationActivate(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation activate');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation activate'
+  );
   const payload = {
     agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
     walletAddress: requireFlag(flags, 'walletAddress', 'Missing --wallet-address'),
@@ -454,7 +720,7 @@ async function commandDelegationActivate(ctx, flags, capabilities) {
   if (flags.permissionData) payload.permissionData = parseJsonFlag(flags, 'permissionData');
   if (flags.modelAConstraints) payload.modelAConstraints = parseJsonFlag(flags, 'modelAConstraints');
   const response = await apiPost(ctx, '/api/v1/agent/delegation/activate', payload, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const success = Boolean(response?.success !== false);
   printEnvelope({
@@ -470,7 +736,10 @@ async function commandDelegationActivate(ctx, flags, capabilities) {
 }
 
 async function commandDelegationStatus(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation status');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation status'
+  );
   const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
   const chainId = Number(flags.chainId || 8453);
   const verify = Boolean(flags.verify);
@@ -478,7 +747,7 @@ async function commandDelegationStatus(ctx, flags, capabilities) {
     ? `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`
     : `/api/v1/agent/delegation/check?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
   const response = await apiGet(ctx, route, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const normalized = normalizeDelegationStatus(response);
   printEnvelope({
@@ -495,6 +764,129 @@ async function commandDelegationStatus(ctx, flags, capabilities) {
   });
 }
 
+async function commandDelegationInspect(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation inspect'
+  );
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const chainId = Number(flags.chainId || 8453);
+  const includeOnchain = Boolean(flags.verify || flags.includeOnchain || flags.onchain);
+  const checkRoute = `/api/v1/agent/delegation/check?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+  const checkResponse = await apiGet(ctx, checkRoute, {
+    ...authHeaders,
+  });
+  const checkNormalized = normalizeDelegationStatus(checkResponse);
+
+  let verifyNormalized = null;
+  if (includeOnchain) {
+    const verifyRoute = `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+    const verifyResponse = await apiGet(ctx, verifyRoute, {
+      ...authHeaders,
+    });
+    verifyNormalized = normalizeDelegationStatus(verifyResponse);
+  }
+
+  printEnvelope({
+    success: true,
+    code: 'DELEGATION_INSPECT_OK',
+    message: includeOnchain ? 'Delegation inspect loaded (with onchain verification)' : 'Delegation inspect loaded',
+    data: {
+      check: checkNormalized,
+      verify: verifyNormalized,
+      state: verifyNormalized?.state || checkNormalized.state,
+      rawStatus: verifyNormalized?.rawStatus || checkNormalized.rawStatus,
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      includeOnchain,
+      governanceState: verifyNormalized?.state || checkNormalized.state || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationRevoke(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation revoke'
+  );
+  const payload = {
+    agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
+    reason: String(flags.reason || 'user_revoked').trim(),
+    chainId: Number(flags.chainId || 8453),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/revoke'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_REVOKED' : 'DELEGATION_REVOKE_FAILED',
+    message: response?.message || (success ? 'Delegation revoked' : 'Delegation revoke failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationBalance(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation balance'
+  );
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const chainId = Number(flags.chainId || 8453);
+  const route = `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+  const response = await apiGet(ctx, route, {
+    ...authHeaders,
+  });
+  const normalized = normalizeDelegationStatus(response);
+  const verifyData = normalized?.data?.onChainVerification || {};
+  printEnvelope({
+    success: true,
+    code: 'DELEGATION_BALANCE_OK',
+    message: 'Delegation allowance balance loaded',
+    data: {
+      state: normalized.state,
+      rawStatus: normalized.rawStatus,
+      delegatedWalletAddress: normalized?.data?.delegatedWalletAddress || null,
+      periodAvailableUsd: verifyData?.periodAvailableUsd ?? null,
+      periodAvailableBaseUnits: verifyData?.periodAvailableBaseUnits ?? null,
+      verified: verifyData?.verified ?? null,
+      isRevoked: verifyData?.isRevoked ?? null,
+      onChainVerification: verifyData || null,
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      governanceState: normalized.state || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationRedeem(ctx, flags, capabilities) {
+  const selectedRunMode = getEffectiveRunMode(ctx, flags);
+  if (!['thirdfy', 'hybrid'].includes(selectedRunMode)) {
+    throw createCliError('DELEGATION_REDEEM_MODE_INVALID', 'delegation redeem supports only --run-mode thirdfy|hybrid');
+  }
+  const delegatedFlags = {
+    ...flags,
+    runMode: selectedRunMode,
+  };
+  if (!delegatedFlags.estimatedAmountUsd) {
+    delegatedFlags.estimatedAmountUsd = '5';
+  }
+  await commandRun(ctx, delegatedFlags, capabilities);
+}
+
 async function commandCredentialsUpsert(ctx, flags, capabilities) {
   const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for credentials upsert');
   const payload = {
@@ -587,11 +979,83 @@ async function commandAgentRegister(ctx, flags, capabilities) {
     ? '/api/v1/agent/onboarding/register-with-wallet'
     : '/api/v1/agent/onboarding/register-with-privy';
   const response = await apiPost(ctx, route, payload, ownerHeaders);
+  if (!flags.__suppressOutput) {
+    printEnvelope({
+      success: true,
+      code: 'AGENT_REGISTERED',
+      message: 'Agent registered',
+      data: response,
+      meta: {
+        apiBase: ctx.apiBase,
+        capabilitiesVersion: capabilities?.contractVersion || null,
+      },
+    });
+  }
+  return response;
+}
+
+async function commandDeveloperBootstrap(ctx, flags, capabilities) {
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const name = requireFlag(flags, 'name', 'Missing --name');
+  let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  let usedWalletFlow = false;
+  const challengeId = String(flags.challengeId || '').trim();
+  const signature = String(flags.signature || '').trim();
+
+  if (!ownerSessionToken && signature) {
+    if (!challengeId) {
+      throw new Error('Missing --challenge-id for wallet bootstrap. Run `agent auth challenge` first.');
+    }
+    const verify = await apiPost(ctx, '/api/v1/agent/onboarding/wallet/verify', {
+      challengeId,
+      signature,
+      agentKey,
+      ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
+    });
+    ownerSessionToken = String(verify?.ownerSessionToken || verify?.data?.ownerSessionToken || '').trim();
+    usedWalletFlow = true;
+  }
+
+  const registerFlags = {
+    ...flags,
+    agentKey,
+    name,
+    ...(ownerSessionToken ? { ownerSessionToken } : {}),
+  };
+  const registerResponse = await commandAgentRegister(
+    ctx,
+    { ...registerFlags, __suppressOutput: true },
+    capabilities
+  );
+
+  const config = loadProfileConfig();
+  const next = {
+    ...config,
+    auth: {
+      ...(config.auth && typeof config.auth === 'object' ? config.auth : {}),
+      ...(ownerSessionToken ? { ownerSessionToken } : {}),
+      lastLoginAt: new Date().toISOString(),
+      source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+    },
+    developer: {
+      ...(config.developer && typeof config.developer === 'object' ? config.developer : {}),
+      agentKey,
+      bootstrapCompletedAt: new Date().toISOString(),
+    },
+  };
+  persistProfileConfig(next);
   printEnvelope({
     success: true,
-    code: 'AGENT_REGISTERED',
-    message: 'Agent registered',
-    data: response,
+    code: 'DEVELOPER_BOOTSTRAP_OK',
+    message: 'Developer bootstrap completed',
+    data: {
+      registration: registerResponse,
+      persisted: {
+        ownerSessionTokenSaved: Boolean(ownerSessionToken),
+        source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+        configPath: getProfileConfigPath(),
+      },
+    },
     meta: {
       apiBase: ctx.apiBase,
       capabilitiesVersion: capabilities?.contractVersion || null,
@@ -706,10 +1170,140 @@ async function commandPrompt(ctx, flags, capabilities, promptTokens) {
   });
 }
 
+async function commandSelfExec(ctx, flags, capabilities) {
+  const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
+  enforceChainCompatibility(capabilities, flags, 'self');
+  const selfResult = await executeSelfRun(ctx, flags, resolved, {
+    skipPreflight: Boolean(flags.skipPreflight),
+  });
+
+  if (!selfResult?.success) {
+    const blocked = Boolean(selfResult?.preflightBlocked);
+    printEnvelope({
+      success: false,
+      code: blocked ? 'PREFLIGHT_BLOCKED' : 'SELF_EXECUTION_FAILED',
+      message: blocked ? 'Preflight blocked self execution' : 'Self execution preparation failed',
+      data: selfResult || {},
+      meta: {
+        apiBase: ctx.apiBase,
+        runMode: 'self',
+        resolvedAction: resolved.resolvedAction,
+      },
+    });
+    process.exit(1);
+  }
+
+  const txd = resolveUnsignedTx(selfResult);
+  if (!txd?.to || !txd?.data) {
+    printEnvelope({
+      success: false,
+      code: 'SELF_UNSIGNED_TX_MISSING',
+      message: 'Self execution did not return a valid unsigned transaction',
+      data: selfResult || {},
+      meta: {
+        apiBase: ctx.apiBase,
+        runMode: 'self',
+        resolvedAction: resolved.resolvedAction,
+      },
+    });
+    process.exit(1);
+  }
+
+  const chainId = Number(txd.chainId || flags.chainId || 8453);
+  const walletAddress = String(flags.walletAddress || process.env.MARKET_MAKER_WALLET_ADDRESS || '').trim();
+  const owsWalletName = String(flags.owsWalletName || process.env.OWS_WALLET_NAME || '').trim();
+  const rpcUrl = String(flags.rpcUrl || process.env.BASE_RPC_URL || process.env.BASE_RPC_HTTP_URL || process.env.RPC_URL || 'https://mainnet.base.org').trim();
+  if (!walletAddress) {
+    throw createCliError('SIGNING_FAILED', 'Missing --wallet-address (or MARKET_MAKER_WALLET_ADDRESS) for self-exec signing.');
+  }
+  if (!owsWalletName) {
+    throw createCliError('SIGNING_FAILED', 'Missing --ows-wallet-name (or OWS_WALLET_NAME) for self-exec signing.');
+  }
+
+  const params = getPreparedParams(flags);
+  const effectTokenIn = String(flags.effectTokenIn || params.tokenIn || '').trim();
+  const effectTokenOut = String(flags.effectTokenOut || params.tokenOut || '').trim();
+
+  let balancesBefore = null;
+  if (effectTokenIn && effectTokenOut) {
+    balancesBefore = await readEffectBalances(rpcUrl, walletAddress, effectTokenIn, effectTokenOut);
+  }
+
+  let submission;
+  try {
+    submission = await signAndBroadcastWithOws({
+      txd,
+      chainId,
+      walletAddress,
+      owsWalletName,
+      rpcUrl,
+    });
+  } catch (error) {
+    throw createCliError('SIGNING_FAILED', error?.message || 'OWS signing failed');
+  }
+
+  let receipt;
+  try {
+    receipt = await submission.sent.wait();
+  } catch (error) {
+    throw createCliError('BROADCAST_FAILED', error?.message || 'Broadcast wait failed');
+  }
+  const status = Number(receipt?.status ?? 0);
+  if (status !== 1) {
+    throw createCliError('BROADCAST_FAILED', 'Transaction receipt status is not success', {
+      receiptStatus: receipt?.status ?? null,
+      txHash: submission.sent.hash,
+    });
+  }
+
+  let effectCheck = { checked: false, hasEffect: null, inDeltaRaw: null, outDeltaRaw: null };
+  if (balancesBefore) {
+    const balancesAfter = await readEffectBalances(rpcUrl, walletAddress, effectTokenIn, effectTokenOut);
+    const inDeltaRaw = (BigInt(balancesBefore.tokenIn) - BigInt(balancesAfter.tokenIn)).toString();
+    const outDeltaRaw = (BigInt(balancesAfter.tokenOut) - BigInt(balancesBefore.tokenOut)).toString();
+    const hasEffect = BigInt(inDeltaRaw) > 0n || BigInt(outDeltaRaw) > 0n;
+    effectCheck = {
+      checked: true,
+      hasEffect,
+      inDeltaRaw,
+      outDeltaRaw,
+    };
+    if (!hasEffect) {
+      throw createCliError('EFFECT_CHECK_FAILED', 'Transaction mined but did not produce observable token effect.', {
+        txHash: submission.sent.hash,
+        effectCheck,
+      });
+    }
+  }
+
+  printEnvelope({
+    success: true,
+    code: 'SELF_EXECUTED',
+    message: 'Self-custody execution completed',
+    data: {
+      txHash: submission.sent.hash,
+      chainId,
+      blockNumber: receipt?.blockNumber ?? null,
+      status: receipt?.status ?? null,
+      unsignedTx: txd,
+      effectCheck,
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      runMode: 'self',
+      resolvedAction: resolved.resolvedAction,
+      swapInput: flags.__swapInput || null,
+    },
+  });
+}
+
 async function commandProfileInit(ctx, flags) {
+  const current = loadProfileConfig();
   const profile = normalizeProfileName(flags.profile || flags.name || 'personal');
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
   persistProfileConfig({
+    ...current,
     profile,
     runMode,
   });
@@ -734,6 +1328,7 @@ async function commandProfileUse(ctx, flags) {
   // `profile use` intentionally re-applies profile defaults unless caller pins a mode.
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
   persistProfileConfig({
+    ...current,
     profile,
     runMode,
   });
@@ -770,6 +1365,154 @@ async function commandProfileShow(ctx, _flags) {
   });
 }
 
+async function commandConfigSet(ctx, flags) {
+  const key = String(flags.key || '').trim();
+  const value = flags.value;
+  if (!key) {
+    throw new Error('Missing --key for config set');
+  }
+  const canonicalKey = key.toLowerCase();
+  const hasValue = !(value === undefined || String(value).trim() === '');
+  if (canonicalKey === 'profile' && hasValue) {
+    normalizeProfileName(value);
+  }
+  if (canonicalKey === 'runmode' && hasValue) {
+    normalizeRunMode(value);
+  }
+
+  const current = loadProfileConfig();
+  const next = setNestedConfigValue(current, key, value);
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'CONFIG_UPDATED',
+    message: 'Configuration updated',
+    data: {
+      key,
+      value: value === undefined ? null : String(value),
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
+async function commandLogin(ctx, flags) {
+  const current = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
+  let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  let loginSource = 'token';
+
+  if (!authToken && !ownerSessionToken) {
+    const challengeId = String(flags.challengeId || '').trim();
+    const signature = String(flags.signature || '').trim();
+    const agentKey = String(flags.agentKey || '').trim();
+    if (challengeId && signature && agentKey) {
+      const verifyResponse = await requestWithRouteFallback(ctx, {
+        method: 'POST',
+        routes: ['/api/v1/agent/onboarding/wallet/verify'],
+        body: {
+          challengeId,
+          signature,
+          agentKey,
+          ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
+        },
+      });
+      ownerSessionToken = String(
+        verifyResponse?.ownerSessionToken || verifyResponse?.data?.ownerSessionToken || ''
+      ).trim();
+      loginSource = 'wallet-verify';
+    }
+  }
+
+  if (!authToken && !ownerSessionToken) {
+    throw new Error(
+      'Missing login credentials: provide --auth-token, --owner-session-token, or challenge verify inputs (--challenge-id/--signature/--agent-key).'
+    );
+  }
+
+  const next = {
+    ...current,
+    auth: {
+      ...(current.auth && typeof current.auth === 'object' ? current.auth : {}),
+      lastLoginAt: new Date().toISOString(),
+      source: loginSource,
+    },
+  };
+  if (authToken) {
+    next.auth.authToken = authToken;
+    delete next.auth.ownerSessionToken;
+  } else if (ownerSessionToken) {
+    next.auth.ownerSessionToken = ownerSessionToken;
+    delete next.auth.authToken;
+  }
+  if (flags.agentApiKey) {
+    next.agent = {
+      ...(current.agent && typeof current.agent === 'object' ? current.agent : {}),
+      apiKey: String(flags.agentApiKey).trim(),
+    };
+  }
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'LOGIN_OK',
+    message: 'Login credentials stored',
+    data: {
+      hasAuthToken: Boolean(authToken),
+      hasOwnerSessionToken: Boolean(ownerSessionToken),
+      hasAgentApiKey: Boolean(flags.agentApiKey),
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
+async function commandLogout(ctx, flags) {
+  const current = loadProfileConfig();
+  const localOnly = flags.all ? false : true;
+  const auth = current.auth && typeof current.auth === 'object' ? current.auth : {};
+  const ownerSessionToken = String(auth.ownerSessionToken || '').trim();
+  let revokeAttempted = false;
+  let revokeSuccess = false;
+  let revokeError = null;
+
+  if (!localOnly && ownerSessionToken) {
+    revokeAttempted = true;
+    try {
+      await requestWithRouteFallback(ctx, {
+        method: 'POST',
+        routes: ['/api/v1/agent/onboarding/wallet/logout', '/api/v1/agent/onboarding/wallet/revoke-session'],
+        body: {},
+        headers: {
+          'x-owner-session-token': ownerSessionToken,
+        },
+      });
+      revokeSuccess = true;
+    } catch (error) {
+      revokeError = error?.message || 'OWNER_SESSION_REVOKE_FAILED';
+    }
+  }
+
+  const next = { ...current };
+  delete next.auth;
+  if (flags.clearAgentKey) {
+    delete next.agent;
+  }
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'LOGOUT_OK',
+    message: 'Local credentials cleared',
+    data: {
+      localOnly,
+      revokeAttempted,
+      revokeSuccess,
+      revokeError,
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
 function resolveProfileState(flags) {
   const persisted = loadProfileConfig();
   const profile = normalizeProfileName(flags.profile || process.env.THIRDFY_PROFILE || persisted.profile || 'personal');
@@ -818,8 +1561,60 @@ function loadProfileConfig() {
 function persistProfileConfig(config) {
   const configPath = getProfileConfigPath();
   const dirPath = path.dirname(configPath);
-  fs.mkdirSync(dirPath, { recursive: true });
-  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+  fs.mkdirSync(dirPath, { recursive: true, mode: 0o700 });
+  const payload = `${JSON.stringify(config, null, 2)}\n`;
+  fs.writeFileSync(configPath, payload, { encoding: 'utf8', mode: 0o600 });
+  try {
+    fs.chmodSync(configPath, 0o600);
+  } catch {
+    /* chmod unsupported or restricted (e.g. some Windows FS) */
+  }
+  try {
+    fs.chmodSync(dirPath, 0o700);
+  } catch {
+    /* ignore */
+  }
+}
+
+function clonePlainConfigTree(input) {
+  const obj = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+  try {
+    return structuredClone(obj);
+  } catch {
+    return JSON.parse(JSON.stringify(obj));
+  }
+}
+
+function setNestedConfigValue(config, keyPath, value) {
+  const next = clonePlainConfigTree(config || {});
+  const parts = String(keyPath || '')
+    .split('.')
+    .map((v) => v.trim())
+    .filter(Boolean);
+  const blocked = new Set(['__proto__', 'prototype', 'constructor']);
+  if (parts.some((part) => blocked.has(part))) {
+    throw createCliError(
+      'CONFIG_KEY_INVALID',
+      'Invalid config key path: reserved segments (__proto__, prototype, constructor) are not allowed.'
+    );
+  }
+  if (!parts.length) return next;
+  let cursor = next;
+  for (let i = 0; i < parts.length - 1; i += 1) {
+    const key = parts[i];
+    const existing = cursor[key];
+    if (!existing || typeof existing !== 'object' || Array.isArray(existing)) {
+      cursor[key] = {};
+    }
+    cursor = cursor[key];
+  }
+  const finalKey = parts[parts.length - 1];
+  if (value === undefined || String(value).trim() === '') {
+    delete cursor[finalKey];
+  } else {
+    cursor[finalKey] = String(value);
+  }
+  return next;
 }
 
 function getEffectiveRunMode(ctx, flags) {
@@ -1030,10 +1825,11 @@ async function executeHybridRun(ctx, flags, resolved, options) {
 }
 
 function buildBuildTxPayload(flags, resolvedAction) {
+  const runMode = String(flags.runMode || '').trim().toLowerCase() || 'self';
   const payload = {
-    agentApiKey: requireFlag(flags, 'agentApiKey', 'Missing --agent-api-key'),
+    agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
-    params: parseJsonFlag(flags, 'params'),
+    params: getPreparedParams(flags),
   };
   if (flags.chainId) payload.chainId = Number(flags.chainId);
   if (flags.walletAddress) payload.walletAddress = String(flags.walletAddress).trim();
@@ -1041,10 +1837,11 @@ function buildBuildTxPayload(flags, resolvedAction) {
 }
 
 function buildIntentPayload(flags, options) {
+  const runMode = String(options.runMode || flags.runMode || '').trim().toLowerCase() || 'thirdfy';
   const payload = {
-    agentApiKey: requireFlag(flags, 'agentApiKey', 'Missing --agent-api-key'),
+    agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
-    params: parseJsonFlag(flags, 'params'),
+    params: getPreparedParams(flags),
   };
   if (flags.catalog) payload.catalog = String(flags.catalog).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
@@ -1065,6 +1862,22 @@ function buildIntentPayload(flags, options) {
   return payload;
 }
 
+function resolveAgentApiKey(flags, runMode) {
+  const explicit = String(flags.agentApiKey || '').trim();
+  if (explicit) return explicit;
+  const envKey = String(process.env.THIRDFY_AGENT_API_KEY || '').trim();
+  if (envKey) return envKey;
+  const config = loadProfileConfig();
+  const configKey = String(config?.agent?.apiKey || '').trim();
+  if (configKey) return configKey;
+  if (runMode === 'self') {
+    throw new Error(
+      'SELF_OPEN_DISABLED: self mode without agent identity is not enabled on this API yet. Set --agent-api-key, THIRDFY_AGENT_API_KEY, or login/config default.'
+    );
+  }
+  throw new Error('Missing --agent-api-key (or THIRDFY_AGENT_API_KEY / config.agent.apiKey)');
+}
+
 function getActionKey(action) {
   return String(action?.action || action?.id || action?.key || action?.name || '')
     .trim();
@@ -1188,14 +2001,18 @@ async function resolveActionSelection(ctx, flags) {
 }
 
 function getAuthToken(flags, missingMessage) {
-  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
+  const config = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || config?.auth?.authToken || '').trim();
   if (!authToken) throw new Error(missingMessage);
   return authToken;
 }
 
 function buildOwnerAuthHeaders(flags, missingMessage) {
-  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
-  const ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  const config = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || config?.auth?.authToken || '').trim();
+  const ownerSessionToken = String(
+    flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || config?.auth?.ownerSessionToken || ''
+  ).trim();
   if (!authToken && !ownerSessionToken) {
     throw new Error(missingMessage);
   }
@@ -1224,6 +2041,116 @@ async function negotiateCapabilities(ctx) {
   }
 }
 
+function resolveUnsignedTx(result) {
+  if (result?.unsignedTx && typeof result.unsignedTx === 'object') return result.unsignedTx;
+  if (result?.data?.unsignedTx && typeof result.data.unsignedTx === 'object') return result.data.unsignedTx;
+  if (result?.details?.unsignedTx && typeof result.details.unsignedTx === 'object') return result.details.unsignedTx;
+  return null;
+}
+
+async function loadEthers() {
+  const candidates = ['ethers', path.join(process.cwd(), 'node_modules', 'ethers')];
+  for (const candidate of candidates) {
+    try {
+      return require(candidate);
+    } catch {
+      // continue
+    }
+  }
+  throw new Error('Could not load ethers dependency for self-exec');
+}
+
+function resolveOwsBinary() {
+  const explicit = String(process.env.OWS_CLI_PATH || '').trim();
+  if (explicit && fs.existsSync(explicit)) return explicit;
+  const localBin = path.join(process.cwd(), 'node_modules', '.bin', 'ows');
+  if (fs.existsSync(localBin)) return localBin;
+  const which = spawnSync('which', ['ows'], { encoding: 'utf-8' });
+  const discovered = String(which.stdout || '').trim();
+  if (discovered) return discovered;
+  throw new Error('ows CLI not found. Install it or set OWS_CLI_PATH.');
+}
+
+function signUnsignedTxWithOws(unsignedHex, walletName, chainId) {
+  const passphrase = String(process.env.OWS_PASSPHRASE || process.env.OWS_API_KEY || '').trim();
+  if (!passphrase) {
+    throw new Error('Set OWS_PASSPHRASE (or OWS_API_KEY) for self-exec signing.');
+  }
+  const ows = resolveOwsBinary();
+  const txHex = String(unsignedHex).startsWith('0x') ? String(unsignedHex).slice(2) : String(unsignedHex);
+  const res = spawnSync(
+    ows,
+    ['sign', 'tx', '--wallet', walletName, '--chain', `eip155:${chainId}`, '--tx', txHex, '--json'],
+    { env: { ...process.env, OWS_PASSPHRASE: passphrase }, encoding: 'utf-8' }
+  );
+  const out = String(res.stdout || '').trim();
+  if (res.status !== 0 || !out) {
+    throw new Error(`ows sign tx failed: ${String(res.stderr || out || res.status).slice(0, 300)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch {
+    throw new Error(`ows sign tx returned non-json payload: ${out.slice(0, 200)}`);
+  }
+  const signature = String(parsed.signature || '').replace(/^0x/i, '');
+  if (signature.length < 128) {
+    throw new Error('Invalid OWS signature payload');
+  }
+  return {
+    recoveryId: Number(parsed.recovery_id),
+    r: `0x${signature.slice(0, 64)}`,
+    s: `0x${signature.slice(64, 128)}`,
+  };
+}
+
+async function signAndBroadcastWithOws({ txd, chainId, walletAddress, owsWalletName, rpcUrl }) {
+  const ethers = await loadEthers();
+  const { JsonRpcProvider, Transaction, Signature } = ethers;
+  const provider = new JsonRpcProvider(rpcUrl, chainId);
+  const nonce = await provider.getTransactionCount(walletAddress, 'pending');
+  const fee = await provider.getFeeData();
+  const txFields = {
+    type: 2,
+    chainId,
+    nonce,
+    to: String(txd.to).toLowerCase(),
+    data: txd.data,
+    value: txd.value ? BigInt(txd.value) : 0n,
+    gasLimit: txd.gas ? BigInt(txd.gas) : txd.gasLimit ? BigInt(txd.gasLimit) : 500000n,
+    maxFeePerGas: fee.maxFeePerGas ?? fee.gasPrice ?? 2_000_000_000n,
+    maxPriorityFeePerGas: fee.maxPriorityFeePerGas ?? 1_000_000_000n,
+  };
+  const unsigned = Transaction.from(txFields);
+  const sigParts = signUnsignedTxWithOws(unsigned.unsignedSerialized, owsWalletName, chainId);
+  const sig = Signature.from({ r: sigParts.r, s: sigParts.s, yParity: sigParts.recoveryId });
+  const tx = Transaction.from(unsigned.unsignedSerialized);
+  tx.signature = sig;
+  const sent = await provider.broadcastTransaction(tx.serialized);
+  return { sent };
+}
+
+async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress) {
+  const ethers = await loadEthers();
+  const { JsonRpcProvider, Interface } = ethers;
+  const provider = new JsonRpcProvider(rpcUrl);
+  const erc20 = new Interface(['function balanceOf(address owner) view returns (uint256)']);
+  const response = await provider.call({
+    to: tokenAddress,
+    data: erc20.encodeFunctionData('balanceOf', [walletAddress]),
+  });
+  const decoded = erc20.decodeFunctionResult('balanceOf', response);
+  return BigInt(decoded[0].toString()).toString();
+}
+
+async function readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut) {
+  const [inBal, outBal] = await Promise.all([
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenIn),
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenOut),
+  ]);
+  return { tokenIn: inBal, tokenOut: outBal };
+}
+
 async function apiGet(ctx, route, headers = {}) {
   return requestJson(ctx, route, { method: 'GET', headers });
 }
@@ -1308,21 +2235,33 @@ Core commands:
   thirdfy-agent profile init [--profile personal|builder|network] [--run-mode thirdfy|self|hybrid] [--json]
   thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid] [--json]
   thirdfy-agent profile show [--json]
+  thirdfy-agent config set --key <path> --value <value> [--json]
+  thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--json]
+  thirdfy-agent logout [--all] [--clear-agent-key] [--json]
   thirdfy-agent whoami [--json]
   thirdfy-agent catalogs list [--json]
   thirdfy-agent actions [--catalog <id>] [--provider <id>] [--agent-api-key <key>] [--chain-id <id>] [--run-mode <mode>] [--json]
   thirdfy-agent delegation create --auth-token <token> --agent-key <key> --owner-address <addr> --token-address <addr> --max-usd-per-day <usd> [--session-account-address <addr>] [--json]
+  thirdfy-agent delegation init-custodial --auth-token <token> [--chain-id <id>] [--json]
+  thirdfy-agent delegation custodial-grant --auth-token <token> --agent-key <key> --token-address <addr> --max-usd-per-day <usd> [--chain-id <id>] [--period-duration <sec>] [--expiry-seconds <sec>] [--json]
   thirdfy-agent delegation activate --auth-token <token> --agent-key <key> --wallet-address <addr> --session-account-address <addr> --delegation-manager <addr> --delegation <json> --signature <hex> [--json]
   thirdfy-agent delegation status --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation show --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation inspect --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation balance --auth-token <token> --agent-key <key> [--chain-id <id>] [--json]
+  thirdfy-agent delegation revoke --auth-token <token> --agent-key <key> [--reason <text>] [--chain-id <id>] [--json]
+  thirdfy-agent delegation redeem --agent-api-key <key> --action <id> --params <json> [--run-mode thirdfy|hybrid] [--estimated-amount-usd <usd>] [--json]
   thirdfy-agent credentials upsert --auth-token <token> --venue <id> --api-key <key> --api-secret <secret> [--json]
   thirdfy-agent credentials status --auth-token <token> [--venue <id>] [--json]
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]
+  thirdfy-agent developer bootstrap --agent-key <key> --name <name> [--owner-session-token <token> | --challenge-id <id> --signature <hex>] [--json]
   thirdfy-agent agent register --agent-key <key> --name <name> [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent agent key rotate [--agent-key <key>] [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent agent key revoke [--agent-key <key>] [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent preflight --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
   thirdfy-agent run --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--idempotency-key <key>] [--json]
+  thirdfy-agent self-exec --agent-api-key <key> --action <id> --params <json> --wallet-address <addr> --ows-wallet-name <name> [--rpc-url <url>] [--json]
   thirdfy-agent jeff preflight --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
   thirdfy-agent jeff trade --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
   thirdfy-agent jeff status --intent-id <id> [--json]
@@ -1336,6 +2275,7 @@ Global flags:
   --profile <name>   personal | builder | network
   --env <file>       load env vars from file
   --timeout <ms>     request timeout
+  --params <json>    for swap: exactly one of {amountInRaw} or {amountInHuman + tokenInDecimals}
   --owner-session-token <token>  owner session token (or THIRDFY_OWNER_SESSION_TOKEN)
   --json             stable machine-readable output
   --verbose          print adapter diagnostics

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -23,6 +23,8 @@
     "e2e:base:real": "node ./scripts/e2e/base-realtx.mjs",
     "e2e:delegation:discovery": "node ./scripts/e2e/delegation-discovery.mjs",
     "e2e:delegation:lifecycle": "node ./scripts/e2e/delegation-lifecycle.mjs",
+    "e2e:delegation:commands": "node ./scripts/e2e/delegation-command-parity.mjs",
+    "e2e:self:delegation:parity": "node ./scripts/e2e/self-delegation-parity.mjs",
     "e2e:delegation:prod:certify": "node ./scripts/e2e/prod-delegation-certify.mjs",
     "e2e:report:last": "node ./scripts/e2e/report-last.mjs",
     "smoke:cli": "node ./bin/thirdfy-agent.mjs --help && node ./bin/thirdfy-agent.mjs --version --json",