@thirdfy/agent-cli 0.1.6 → 0.1.8

package/bin/thirdfy-agent.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { randomUUID } from 'crypto';
+import { spawnSync } from 'child_process';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -18,6 +19,7 @@ const DEFAULT_API_BASE = 'https://api.thirdfy.com';
 const DEFAULT_TIMEOUT_MS = 30000;
 const DEFAULT_CATALOG_CACHE_TTL_MS = 60_000;
 const RUN_MODES = ['thirdfy', 'self', 'hybrid'];
+const EFFECT_CHECK_MODES = ['strict', 'relaxed', 'off'];
 const PROFILE_DEFAULTS = {
   personal: 'self',
   builder: 'hybrid',
@@ -105,9 +107,21 @@ async function main() {
     case 'config get':
       await commandProfileShow(context, subFlags);
       return;
+    case 'config set':
+      await commandConfigSet(context, subFlags);
+      return;
+    case 'login':
+      await commandLogin(context, subFlags);
+      return;
+    case 'logout':
+      await commandLogout(context, subFlags);
+      return;
     case 'whoami':
       await commandProfileShow(context, subFlags);
       return;
+    case 'doctor self':
+      await commandDoctorSelf(context, subFlags);
+      return;
     default:
       break;
   }
@@ -115,6 +129,9 @@ async function main() {
   const capabilities = await negotiateCapabilities(context);
 
   switch (commandKey) {
+    case 'managed run':
+      await commandManagedRun(context, subFlags, capabilities);
+      return;
     case 'jeff trade':
       await commandRun(context, subFlags, capabilities);
       return;
@@ -133,12 +150,33 @@ async function main() {
     case 'delegation create':
       await commandDelegationCreate(context, subFlags, capabilities);
       return;
+    case 'delegation init-custodial':
+      await commandDelegationInitCustodial(context, subFlags, capabilities);
+      return;
+    case 'delegation custodial-grant':
+      await commandDelegationCustodialGrant(context, subFlags, capabilities);
+      return;
     case 'delegation activate':
       await commandDelegationActivate(context, subFlags, capabilities);
       return;
     case 'delegation status':
       await commandDelegationStatus(context, subFlags, capabilities);
       return;
+    case 'delegation show':
+      await commandDelegationStatus(context, subFlags, capabilities);
+      return;
+    case 'delegation inspect':
+      await commandDelegationInspect(context, subFlags, capabilities);
+      return;
+    case 'delegation balance':
+      await commandDelegationBalance(context, subFlags, capabilities);
+      return;
+    case 'delegation revoke':
+      await commandDelegationRevoke(context, subFlags, capabilities);
+      return;
+    case 'delegation redeem':
+      await commandDelegationRedeem(context, subFlags, capabilities);
+      return;
     case 'credentials upsert':
       await commandCredentialsUpsert(context, subFlags, capabilities);
       return;
@@ -148,6 +186,9 @@ async function main() {
     case 'agent register':
       await commandAgentRegister(context, subFlags, capabilities);
       return;
+    case 'developer bootstrap':
+      await commandDeveloperBootstrap(context, subFlags, capabilities);
+      return;
     default:
       break;
   }
@@ -167,6 +208,14 @@ async function main() {
     await commandAgentAuthVerify(context, subFlags, capabilities);
     return;
   }
+  if (commandKey3 === 'managed wallet init') {
+    await commandDelegationInitCustodial(context, subFlags, capabilities);
+    return;
+  }
+  if (commandKey3 === 'managed wallet grant') {
+    await commandDelegationCustodialGrant(context, subFlags, capabilities);
+    return;
+  }
 
   const rootCommand = parsed.positionals[0];
   switch (rootCommand) {
@@ -182,6 +231,9 @@ async function main() {
     case 'run':
       await commandRun(context, subFlags, capabilities);
       return;
+    case 'self-exec':
+      await commandSelfExec(context, subFlags, capabilities);
+      return;
     case 'intent-status':
       await commandIntentStatus(context, subFlags, capabilities);
       return;
@@ -256,6 +308,162 @@ function parseJsonFlag(flags, key) {
   }
 }
 
+function shouldApplySwapAmountContract(actionName) {
+  const action = String(actionName || '').trim().toLowerCase();
+  return action === 'swap' || /(^|:|-)swap$/.test(action);
+}
+
+function createCliError(code, message, payload = {}) {
+  const error = new Error(message);
+  error.payload = {
+    error: code,
+    blockedReason: code,
+    blockedStage: 'client_validation',
+    ...payload,
+  };
+  return error;
+}
+
+function normalizeIntegerRawAmount(input, code = 'AMOUNT_UNIT_INVALID') {
+  const raw = String(input ?? '').trim();
+  if (!/^\d+$/.test(raw)) {
+    throw createCliError(code, 'amountInRaw must be an integer base-unit string (example: "1000000").');
+  }
+  return raw;
+}
+
+function decimalToRawUnits(amountHuman, decimals) {
+  const s = String(amountHuman ?? '').trim();
+  if (!/^\d+(\.\d+)?$/.test(s)) {
+    throw createCliError('AMOUNT_UNIT_INVALID', 'amountInHuman must be a decimal string (example: "100.5").');
+  }
+  const [whole, frac = ''] = s.split('.');
+  if (decimals === 0) {
+    if (frac && /[1-9]/.test(frac)) {
+      throw createCliError(
+        'AMOUNT_PRECISION_EXCESS',
+        'amountInHuman has fractional digits but tokenInDecimals is 0 (example: use "2" not "2.5").'
+      );
+    }
+  } else if (frac.length > decimals && /[1-9]/.test(frac.slice(decimals))) {
+    throw createCliError(
+      'AMOUNT_PRECISION_EXCESS',
+      `amountInHuman has more than ${decimals} fractional digit(s) for tokenInDecimals; round or use amountInRaw.`
+    );
+  }
+  const fracNorm = (frac + '0'.repeat(decimals)).slice(0, decimals);
+  const wholePart = BigInt(whole || '0') * 10n ** BigInt(decimals);
+  const fracPart = BigInt(fracNorm || '0');
+  return (wholePart + fracPart).toString();
+}
+
+function normalizeSwapAmountContract(params) {
+  const hasRaw = params.amountInRaw !== undefined && params.amountInRaw !== null && String(params.amountInRaw).trim() !== '';
+  const hasHuman = params.amountInHuman !== undefined && params.amountInHuman !== null && String(params.amountInHuman).trim() !== '';
+  const hasLegacy = params.amountIn !== undefined && params.amountIn !== null && String(params.amountIn).trim() !== '';
+  const populated = [hasRaw, hasHuman, hasLegacy].filter(Boolean).length;
+  if (populated === 0) {
+    throw createCliError(
+      'AMOUNT_UNIT_MISSING',
+      'Missing swap amount: provide one of amountInRaw, amountInHuman, or legacy amountIn.'
+    );
+  }
+  if (populated > 1) {
+    throw createCliError(
+      'AMOUNT_UNIT_AMBIGUOUS',
+      'Provide exactly one of amountInRaw, amountInHuman, or legacy amountIn.'
+    );
+  }
+
+  if (hasRaw) {
+    const amountInRaw = normalizeIntegerRawAmount(params.amountInRaw);
+    return {
+      params: {
+        ...params,
+        amountInRaw,
+        amountIn: amountInRaw,
+      },
+      swapInput: {
+        amountInRaw,
+        amountInHuman: null,
+        tokenInDecimals: null,
+        unitSource: 'raw',
+      },
+    };
+  }
+
+  if (hasLegacy) {
+    const amountInRaw = normalizeIntegerRawAmount(params.amountIn, 'AMOUNT_UNIT_INVALID');
+    return {
+      params: {
+        ...params,
+        amountInRaw,
+        amountIn: amountInRaw,
+      },
+      swapInput: {
+        amountInRaw,
+        amountInHuman: null,
+        tokenInDecimals: null,
+        unitSource: 'legacy_raw',
+      },
+    };
+  }
+
+  const hasDecimals =
+    params.tokenInDecimals !== undefined &&
+    params.tokenInDecimals !== null &&
+    String(params.tokenInDecimals).trim() !== '';
+  if (!hasDecimals) {
+    throw createCliError(
+      'AMOUNT_UNIT_DECIMALS_REQUIRED',
+      'amountInHuman requires tokenInDecimals (integer 0-36).'
+    );
+  }
+  const decimals = Number(params.tokenInDecimals);
+  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36) {
+    throw createCliError(
+      'AMOUNT_UNIT_DECIMALS_REQUIRED',
+      'amountInHuman requires tokenInDecimals (integer 0-36).'
+    );
+  }
+  const amountInHuman = String(params.amountInHuman).trim();
+  const amountInRaw = decimalToRawUnits(amountInHuman, decimals);
+  return {
+    params: {
+      ...params,
+      amountInHuman,
+      amountInRaw,
+      amountIn: amountInRaw,
+      tokenInDecimals: decimals,
+    },
+    swapInput: {
+      amountInRaw,
+      amountInHuman,
+      tokenInDecimals: decimals,
+      unitSource: 'human',
+    },
+  };
+}
+
+function prepareActionParamsForFlags(flags, resolvedAction) {
+  const parsedParams = parseJsonFlag(flags, 'params');
+  if (!shouldApplySwapAmountContract(resolvedAction)) {
+    flags.__preparedParams = parsedParams;
+    flags.__swapInput = null;
+    return;
+  }
+  const normalized = normalizeSwapAmountContract(parsedParams);
+  flags.__preparedParams = normalized.params;
+  flags.__swapInput = normalized.swapInput;
+}
+
+function getPreparedParams(flags) {
+  if (flags.__preparedParams && typeof flags.__preparedParams === 'object') {
+    return flags.__preparedParams;
+  }
+  return parseJsonFlag(flags, 'params');
+}
+
 async function commandCatalogsList(ctx, flags, capabilities) {
   const response = await apiGet(ctx, '/api/v1/agent/actions/catalog');
   const actions = extractActions(response);
@@ -306,6 +514,7 @@ async function commandActions(ctx, flags, capabilities) {
 
 async function commandPreflight(ctx, flags, capabilities) {
   const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
   const runMode = getEffectiveRunMode(ctx, flags);
   enforceChainCompatibility(capabilities, flags, runMode);
   const backendResult = await runPreflightByMode(runMode, ctx, flags, resolved.resolvedAction);
@@ -322,6 +531,7 @@ async function commandPreflight(ctx, flags, capabilities) {
       resolvedAction: resolved.resolvedAction,
       runMode,
       profile: ctx.profile || null,
+      swapInput: flags.__swapInput || null,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });
@@ -330,6 +540,7 @@ async function commandPreflight(ctx, flags, capabilities) {
 
 async function commandRun(ctx, flags, capabilities) {
   const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
   const runMode = getEffectiveRunMode(ctx, flags);
   enforceChainCompatibility(capabilities, flags, runMode);
   const skipPreflight = Boolean(flags.skipPreflight);
@@ -337,6 +548,26 @@ async function commandRun(ctx, flags, capabilities) {
     skipPreflight,
   });
   const normalized = backendResult.normalized;
+  if (runMode === 'self' && parseBooleanFlag(flags.broadcast, false) && normalized?.success) {
+    const executed = await performSelfBroadcast(ctx, flags, resolved.resolvedAction, normalized);
+    printEnvelope({
+      success: true,
+      code: 'SELF_EXECUTED',
+      message: 'Self-custody execution completed',
+      data: executed,
+      meta: {
+        apiBase: ctx.apiBase,
+        requestedAction: resolved.requestedAction,
+        resolvedAction: resolved.resolvedAction,
+        runMode,
+        profile: ctx.profile || null,
+        skippedPreflight: skipPreflight,
+        swapInput: flags.__swapInput || null,
+        capabilitiesVersion: capabilities?.contractVersion || null,
+      },
+    });
+    return;
+  }
   printEnvelope({
     success: normalized.success,
     code: backendResult.code,
@@ -350,6 +581,7 @@ async function commandRun(ctx, flags, capabilities) {
       runMode,
       profile: ctx.profile || null,
       skippedPreflight: skipPreflight,
+      swapInput: flags.__swapInput || null,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });
@@ -392,12 +624,15 @@ async function commandCreditsBalance(ctx, flags, capabilities) {
 }
 
 async function commandDelegationCreate(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation create');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation create'
+  );
   let sessionAccountAddress = String(flags.sessionAccountAddress || '').trim();
   if (!sessionAccountAddress) {
     try {
       const executorAddressResponse = await apiGet(ctx, '/api/v1/agent/delegation/executor-address', {
-        Authorization: `Bearer ${authToken}`,
+        ...authHeaders,
       });
       sessionAccountAddress = String(executorAddressResponse?.data?.executorAddress || '').trim();
     } catch (error) {
@@ -419,7 +654,7 @@ async function commandDelegationCreate(ctx, flags, capabilities) {
     expirySeconds: Number(flags.expirySeconds || 86_400),
   };
   const response = await apiPost(ctx, '/api/v1/agent/delegation/create', payload, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const success = Boolean(response?.success !== false);
   printEnvelope({
@@ -434,8 +669,74 @@ async function commandDelegationCreate(ctx, flags, capabilities) {
   });
 }
 
+async function commandDelegationInitCustodial(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation init-custodial'
+  );
+  const payload = {
+    chainId: Number(flags.chainId || 8453),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/init-custodial'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_CUSTODIAL_INITIALIZED' : 'DELEGATION_CUSTODIAL_INIT_FAILED',
+    message: response?.message || (success ? 'Custodial wallet initialized' : 'Custodial wallet init failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationCustodialGrant(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation custodial-grant'
+  );
+  const payload = {
+    chainId: Number(flags.chainId || 8453),
+    agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
+    tokenAddress: requireFlag(flags, 'tokenAddress', 'Missing --token-address'),
+    maxUsdPerDay: Number(requireFlag(flags, 'maxUsdPerDay', 'Missing --max-usd-per-day')),
+    periodDuration: Number(flags.periodDuration || 86_400),
+    expirySeconds: Number(flags.expirySeconds || 86_400),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/custodial-grant'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_CUSTODIAL_GRANTED' : 'DELEGATION_CUSTODIAL_GRANT_FAILED',
+    message: response?.message || (success ? 'Custodial delegation granted' : 'Custodial delegation grant failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
 async function commandDelegationActivate(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation activate');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation activate'
+  );
   const payload = {
     agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
     walletAddress: requireFlag(flags, 'walletAddress', 'Missing --wallet-address'),
@@ -454,7 +755,7 @@ async function commandDelegationActivate(ctx, flags, capabilities) {
   if (flags.permissionData) payload.permissionData = parseJsonFlag(flags, 'permissionData');
   if (flags.modelAConstraints) payload.modelAConstraints = parseJsonFlag(flags, 'modelAConstraints');
   const response = await apiPost(ctx, '/api/v1/agent/delegation/activate', payload, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const success = Boolean(response?.success !== false);
   printEnvelope({
@@ -470,7 +771,10 @@ async function commandDelegationActivate(ctx, flags, capabilities) {
 }
 
 async function commandDelegationStatus(ctx, flags, capabilities) {
-  const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for delegation status');
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation status'
+  );
   const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
   const chainId = Number(flags.chainId || 8453);
   const verify = Boolean(flags.verify);
@@ -478,7 +782,7 @@ async function commandDelegationStatus(ctx, flags, capabilities) {
     ? `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`
     : `/api/v1/agent/delegation/check?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
   const response = await apiGet(ctx, route, {
-    Authorization: `Bearer ${authToken}`,
+    ...authHeaders,
   });
   const normalized = normalizeDelegationStatus(response);
   printEnvelope({
@@ -495,6 +799,129 @@ async function commandDelegationStatus(ctx, flags, capabilities) {
   });
 }
 
+async function commandDelegationInspect(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation inspect'
+  );
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const chainId = Number(flags.chainId || 8453);
+  const includeOnchain = Boolean(flags.verify || flags.includeOnchain || flags.onchain);
+  const checkRoute = `/api/v1/agent/delegation/check?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+  const checkResponse = await apiGet(ctx, checkRoute, {
+    ...authHeaders,
+  });
+  const checkNormalized = normalizeDelegationStatus(checkResponse);
+
+  let verifyNormalized = null;
+  if (includeOnchain) {
+    const verifyRoute = `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+    const verifyResponse = await apiGet(ctx, verifyRoute, {
+      ...authHeaders,
+    });
+    verifyNormalized = normalizeDelegationStatus(verifyResponse);
+  }
+
+  printEnvelope({
+    success: true,
+    code: 'DELEGATION_INSPECT_OK',
+    message: includeOnchain ? 'Delegation inspect loaded (with onchain verification)' : 'Delegation inspect loaded',
+    data: {
+      check: checkNormalized,
+      verify: verifyNormalized,
+      state: verifyNormalized?.state || checkNormalized.state,
+      rawStatus: verifyNormalized?.rawStatus || checkNormalized.rawStatus,
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      includeOnchain,
+      governanceState: verifyNormalized?.state || checkNormalized.state || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationRevoke(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation revoke'
+  );
+  const payload = {
+    agentKey: requireFlag(flags, 'agentKey', 'Missing --agent-key'),
+    reason: String(flags.reason || 'user_revoked').trim(),
+    chainId: Number(flags.chainId || 8453),
+  };
+  const response = await requestWithRouteFallback(ctx, {
+    method: 'POST',
+    routes: ['/api/v1/agent/delegation/revoke'],
+    body: payload,
+    headers: {
+      ...authHeaders,
+    },
+  });
+  const success = Boolean(response?.success !== false);
+  printEnvelope({
+    success,
+    code: success ? 'DELEGATION_REVOKED' : 'DELEGATION_REVOKE_FAILED',
+    message: response?.message || (success ? 'Delegation revoked' : 'Delegation revoke failed'),
+    data: response,
+    meta: {
+      apiBase: ctx.apiBase,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationBalance(ctx, flags, capabilities) {
+  const authHeaders = buildOwnerAuthHeaders(
+    flags,
+    'Missing --auth-token/--owner-session-token (or THIRDFY_AUTH_TOKEN/THIRDFY_OWNER_SESSION_TOKEN) for delegation balance'
+  );
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const chainId = Number(flags.chainId || 8453);
+  const route = `/api/v1/agent/delegation/verify?agentKey=${encodeURIComponent(agentKey)}&chainId=${encodeURIComponent(String(chainId))}`;
+  const response = await apiGet(ctx, route, {
+    ...authHeaders,
+  });
+  const normalized = normalizeDelegationStatus(response);
+  const verifyData = normalized?.data?.onChainVerification || {};
+  printEnvelope({
+    success: true,
+    code: 'DELEGATION_BALANCE_OK',
+    message: 'Delegation allowance balance loaded',
+    data: {
+      state: normalized.state,
+      rawStatus: normalized.rawStatus,
+      delegatedWalletAddress: normalized?.data?.delegatedWalletAddress || null,
+      periodAvailableUsd: verifyData?.periodAvailableUsd ?? null,
+      periodAvailableBaseUnits: verifyData?.periodAvailableBaseUnits ?? null,
+      verified: verifyData?.verified ?? null,
+      isRevoked: verifyData?.isRevoked ?? null,
+      onChainVerification: verifyData || null,
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      governanceState: normalized.state || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+}
+
+async function commandDelegationRedeem(ctx, flags, capabilities) {
+  const selectedRunMode = getEffectiveRunMode(ctx, flags);
+  if (!['thirdfy', 'hybrid'].includes(selectedRunMode)) {
+    throw createCliError('DELEGATION_REDEEM_MODE_INVALID', 'delegation redeem supports only --run-mode thirdfy|hybrid');
+  }
+  const delegatedFlags = {
+    ...flags,
+    runMode: selectedRunMode,
+  };
+  if (!delegatedFlags.estimatedAmountUsd) {
+    delegatedFlags.estimatedAmountUsd = '5';
+  }
+  await commandRun(ctx, delegatedFlags, capabilities);
+}
+
 async function commandCredentialsUpsert(ctx, flags, capabilities) {
   const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for credentials upsert');
   const payload = {
@@ -587,11 +1014,83 @@ async function commandAgentRegister(ctx, flags, capabilities) {
     ? '/api/v1/agent/onboarding/register-with-wallet'
     : '/api/v1/agent/onboarding/register-with-privy';
   const response = await apiPost(ctx, route, payload, ownerHeaders);
+  if (!flags.__suppressOutput) {
+    printEnvelope({
+      success: true,
+      code: 'AGENT_REGISTERED',
+      message: 'Agent registered',
+      data: response,
+      meta: {
+        apiBase: ctx.apiBase,
+        capabilitiesVersion: capabilities?.contractVersion || null,
+      },
+    });
+  }
+  return response;
+}
+
+async function commandDeveloperBootstrap(ctx, flags, capabilities) {
+  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
+  const name = requireFlag(flags, 'name', 'Missing --name');
+  let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  let usedWalletFlow = false;
+  const challengeId = String(flags.challengeId || '').trim();
+  const signature = String(flags.signature || '').trim();
+
+  if (!ownerSessionToken && signature) {
+    if (!challengeId) {
+      throw new Error('Missing --challenge-id for wallet bootstrap. Run `agent auth challenge` first.');
+    }
+    const verify = await apiPost(ctx, '/api/v1/agent/onboarding/wallet/verify', {
+      challengeId,
+      signature,
+      agentKey,
+      ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
+    });
+    ownerSessionToken = String(verify?.ownerSessionToken || verify?.data?.ownerSessionToken || '').trim();
+    usedWalletFlow = true;
+  }
+
+  const registerFlags = {
+    ...flags,
+    agentKey,
+    name,
+    ...(ownerSessionToken ? { ownerSessionToken } : {}),
+  };
+  const registerResponse = await commandAgentRegister(
+    ctx,
+    { ...registerFlags, __suppressOutput: true },
+    capabilities
+  );
+
+  const config = loadProfileConfig();
+  const next = {
+    ...config,
+    auth: {
+      ...(config.auth && typeof config.auth === 'object' ? config.auth : {}),
+      ...(ownerSessionToken ? { ownerSessionToken } : {}),
+      lastLoginAt: new Date().toISOString(),
+      source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+    },
+    developer: {
+      ...(config.developer && typeof config.developer === 'object' ? config.developer : {}),
+      agentKey,
+      bootstrapCompletedAt: new Date().toISOString(),
+    },
+  };
+  persistProfileConfig(next);
   printEnvelope({
     success: true,
-    code: 'AGENT_REGISTERED',
-    message: 'Agent registered',
-    data: response,
+    code: 'DEVELOPER_BOOTSTRAP_OK',
+    message: 'Developer bootstrap completed',
+    data: {
+      registration: registerResponse,
+      persisted: {
+        ownerSessionTokenSaved: Boolean(ownerSessionToken),
+        source: usedWalletFlow ? 'wallet-verify-bootstrap' : 'bootstrap',
+        configPath: getProfileConfigPath(),
+      },
+    },
     meta: {
       apiBase: ctx.apiBase,
       capabilitiesVersion: capabilities?.contractVersion || null,
@@ -706,10 +1205,156 @@ async function commandPrompt(ctx, flags, capabilities, promptTokens) {
   });
 }
 
+async function commandSelfExec(ctx, flags, capabilities) {
+  const resolved = await resolveActionSelection(ctx, flags);
+  prepareActionParamsForFlags(flags, resolved.resolvedAction);
+  enforceChainCompatibility(capabilities, flags, 'self');
+  const selfResult = await executeSelfRun(ctx, flags, resolved, {
+    skipPreflight: Boolean(flags.skipPreflight),
+  });
+
+  if (!selfResult?.success) {
+    const blocked = Boolean(selfResult?.preflightBlocked);
+    printEnvelope({
+      success: false,
+      code: blocked ? 'PREFLIGHT_BLOCKED' : 'SELF_EXECUTION_FAILED',
+      message: blocked ? 'Preflight blocked self execution' : 'Self execution preparation failed',
+      data: selfResult || {},
+      meta: {
+        apiBase: ctx.apiBase,
+        runMode: 'self',
+        resolvedAction: resolved.resolvedAction,
+      },
+    });
+    process.exit(1);
+  }
+
+  const executed = await performSelfBroadcast(ctx, flags, resolved.resolvedAction, selfResult);
+
+  printEnvelope({
+    success: true,
+    code: 'SELF_EXECUTED',
+    message: 'Self-custody execution completed',
+    data: executed,
+    meta: {
+      apiBase: ctx.apiBase,
+      runMode: 'self',
+      resolvedAction: resolved.resolvedAction,
+      swapInput: flags.__swapInput || null,
+    },
+  });
+}
+
+async function commandDoctorSelf(ctx, flags) {
+  const walletAddress = String(flags.walletAddress || process.env.MARKET_MAKER_WALLET_ADDRESS || '').trim();
+  const owsWalletName = String(flags.owsWalletName || process.env.OWS_WALLET_NAME || '').trim();
+  const rpcUrl = String(
+    flags.rpcUrl || process.env.BASE_RPC_URL || process.env.BASE_RPC_HTTP_URL || process.env.RPC_URL || 'https://mainnet.base.org'
+  ).trim();
+  const passphrasePresent = Boolean(String(process.env.OWS_PASSPHRASE || process.env.OWS_API_KEY || '').trim());
+  const checks = [];
+
+  checks.push({
+    name: 'wallet-address',
+    ok: Boolean(walletAddress),
+    detail: walletAddress || 'missing --wallet-address / MARKET_MAKER_WALLET_ADDRESS',
+  });
+  checks.push({
+    name: 'ows-wallet-name',
+    ok: Boolean(owsWalletName),
+    detail: owsWalletName || 'missing --ows-wallet-name / OWS_WALLET_NAME',
+  });
+  checks.push({
+    name: 'ows-passphrase',
+    ok: passphrasePresent,
+    detail: passphrasePresent ? 'present' : 'missing OWS_PASSPHRASE (or OWS_API_KEY fallback)',
+  });
+
+  try {
+    resolveOwsBinary();
+    checks.push({ name: 'ows-binary', ok: true, detail: 'found' });
+  } catch (error) {
+    checks.push({ name: 'ows-binary', ok: false, detail: error?.message || 'not found' });
+  }
+
+  try {
+    await loadEthers();
+    checks.push({ name: 'ethers-runtime', ok: true, detail: 'loaded' });
+  } catch (error) {
+    checks.push({ name: 'ethers-runtime', ok: false, detail: error?.message || 'missing ethers dependency' });
+  }
+
+  try {
+    const ethers = await loadEthers();
+    const provider = new ethers.JsonRpcProvider(rpcUrl);
+    const block = await provider.getBlockNumber();
+    checks.push({ name: 'rpc-connectivity', ok: Number.isFinite(block), detail: `latestBlock=${block}` });
+  } catch (error) {
+    checks.push({ name: 'rpc-connectivity', ok: false, detail: error?.message || 'rpc check failed' });
+  }
+
+  const ok = checks.every((entry) => entry.ok);
+  printEnvelope({
+    success: ok,
+    code: ok ? 'DOCTOR_SELF_OK' : 'DOCTOR_SELF_FAILED',
+    message: ok ? 'Self lane signer diagnostics passed' : 'Self lane signer diagnostics found blocking issues',
+    data: {
+      checks,
+      hints: [
+        'For one-command self execution use: thirdfy-agent run --run-mode self --broadcast ...',
+        'Set --effect-check strict|relaxed|off to control post-trade effect validation behavior.',
+      ],
+    },
+    meta: {
+      apiBase: ctx.apiBase,
+      runMode: 'self',
+      rpcUrl,
+    },
+  });
+  if (!ok) process.exit(1);
+}
+
+async function commandManagedRun(ctx, flags, capabilities) {
+  const mode = normalizeManagedRunMode(flags.runMode || 'thirdfy');
+  const managedFlags = { ...flags, runMode: mode };
+  const resolved = await resolveActionSelection(ctx, managedFlags);
+  prepareActionParamsForFlags(managedFlags, resolved.resolvedAction);
+  enforceChainCompatibility(capabilities, managedFlags, mode);
+  const skipPreflight = Boolean(managedFlags.skipPreflight);
+  const backendResult = await runExecutionByMode(mode, ctx, managedFlags, resolved, {
+    skipPreflight,
+  });
+  const normalized = backendResult.normalized;
+  printEnvelope({
+    success: normalized.success,
+    code: normalized.success ? 'MANAGED_RUN_QUEUED' : backendResult.code,
+    message: normalized.success
+      ? mode === 'hybrid'
+        ? 'Managed easy-wallet hybrid execution prepared'
+        : 'Managed easy-wallet execution queued'
+      : backendResult.message,
+    data: normalized,
+    meta: {
+      apiBase: ctx.apiBase,
+      requestedAction: resolved.requestedAction,
+      resolvedAction: resolved.resolvedAction,
+      lane: 'managed_easy_wallet',
+      runMode: mode,
+      skippedPreflight: skipPreflight,
+      profile: ctx.profile || null,
+      swapInput: managedFlags.__swapInput || null,
+      capabilitiesVersion: capabilities?.contractVersion || null,
+    },
+  });
+  if (!normalized.success) process.exit(1);
+}
+
 async function commandProfileInit(ctx, flags) {
+  const current = loadProfileConfig();
   const profile = normalizeProfileName(flags.profile || flags.name || 'personal');
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
   persistProfileConfig({
+    ...current,
     profile,
     runMode,
   });
@@ -734,6 +1379,7 @@ async function commandProfileUse(ctx, flags) {
   // `profile use` intentionally re-applies profile defaults unless caller pins a mode.
   const runMode = normalizeRunMode(flags.runMode || PROFILE_DEFAULTS[profile]);
   persistProfileConfig({
+    ...current,
     profile,
     runMode,
   });
@@ -770,6 +1416,154 @@ async function commandProfileShow(ctx, _flags) {
   });
 }
 
+async function commandConfigSet(ctx, flags) {
+  const key = String(flags.key || '').trim();
+  const value = flags.value;
+  if (!key) {
+    throw new Error('Missing --key for config set');
+  }
+  const canonicalKey = key.toLowerCase();
+  const hasValue = !(value === undefined || String(value).trim() === '');
+  if (canonicalKey === 'profile' && hasValue) {
+    normalizeProfileName(value);
+  }
+  if (canonicalKey === 'runmode' && hasValue) {
+    normalizeRunMode(value);
+  }
+
+  const current = loadProfileConfig();
+  const next = setNestedConfigValue(current, key, value);
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'CONFIG_UPDATED',
+    message: 'Configuration updated',
+    data: {
+      key,
+      value: value === undefined ? null : String(value),
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
+async function commandLogin(ctx, flags) {
+  const current = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
+  let ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  let loginSource = 'token';
+
+  if (!authToken && !ownerSessionToken) {
+    const challengeId = String(flags.challengeId || '').trim();
+    const signature = String(flags.signature || '').trim();
+    const agentKey = String(flags.agentKey || '').trim();
+    if (challengeId && signature && agentKey) {
+      const verifyResponse = await requestWithRouteFallback(ctx, {
+        method: 'POST',
+        routes: ['/api/v1/agent/onboarding/wallet/verify'],
+        body: {
+          challengeId,
+          signature,
+          agentKey,
+          ...(flags.walletAddress ? { walletAddress: String(flags.walletAddress).trim() } : {}),
+        },
+      });
+      ownerSessionToken = String(
+        verifyResponse?.ownerSessionToken || verifyResponse?.data?.ownerSessionToken || ''
+      ).trim();
+      loginSource = 'wallet-verify';
+    }
+  }
+
+  if (!authToken && !ownerSessionToken) {
+    throw new Error(
+      'Missing login credentials: provide --auth-token, --owner-session-token, or challenge verify inputs (--challenge-id/--signature/--agent-key).'
+    );
+  }
+
+  const next = {
+    ...current,
+    auth: {
+      ...(current.auth && typeof current.auth === 'object' ? current.auth : {}),
+      lastLoginAt: new Date().toISOString(),
+      source: loginSource,
+    },
+  };
+  if (authToken) {
+    next.auth.authToken = authToken;
+    delete next.auth.ownerSessionToken;
+  } else if (ownerSessionToken) {
+    next.auth.ownerSessionToken = ownerSessionToken;
+    delete next.auth.authToken;
+  }
+  if (flags.agentApiKey) {
+    next.agent = {
+      ...(current.agent && typeof current.agent === 'object' ? current.agent : {}),
+      apiKey: String(flags.agentApiKey).trim(),
+    };
+  }
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'LOGIN_OK',
+    message: 'Login credentials stored',
+    data: {
+      hasAuthToken: Boolean(authToken),
+      hasOwnerSessionToken: Boolean(ownerSessionToken),
+      hasAgentApiKey: Boolean(flags.agentApiKey),
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
+async function commandLogout(ctx, flags) {
+  const current = loadProfileConfig();
+  const localOnly = flags.all ? false : true;
+  const auth = current.auth && typeof current.auth === 'object' ? current.auth : {};
+  const ownerSessionToken = String(auth.ownerSessionToken || '').trim();
+  let revokeAttempted = false;
+  let revokeSuccess = false;
+  let revokeError = null;
+
+  if (!localOnly && ownerSessionToken) {
+    revokeAttempted = true;
+    try {
+      await requestWithRouteFallback(ctx, {
+        method: 'POST',
+        routes: ['/api/v1/agent/onboarding/wallet/logout', '/api/v1/agent/onboarding/wallet/revoke-session'],
+        body: {},
+        headers: {
+          'x-owner-session-token': ownerSessionToken,
+        },
+      });
+      revokeSuccess = true;
+    } catch (error) {
+      revokeError = error?.message || 'OWNER_SESSION_REVOKE_FAILED';
+    }
+  }
+
+  const next = { ...current };
+  delete next.auth;
+  if (flags.clearAgentKey) {
+    delete next.agent;
+  }
+  persistProfileConfig(next);
+  printEnvelope({
+    success: true,
+    code: 'LOGOUT_OK',
+    message: 'Local credentials cleared',
+    data: {
+      localOnly,
+      revokeAttempted,
+      revokeSuccess,
+      revokeError,
+      configPath: getProfileConfigPath(),
+    },
+    meta: { apiBase: ctx.apiBase },
+  });
+}
+
 function resolveProfileState(flags) {
   const persisted = loadProfileConfig();
   const profile = normalizeProfileName(flags.profile || process.env.THIRDFY_PROFILE || persisted.profile || 'personal');
@@ -800,6 +1594,14 @@ function normalizeRunMode(value) {
   throw new Error(`Unsupported --run-mode "${value}". Supported: ${RUN_MODES.join(', ')}`);
 }
 
+function normalizeManagedRunMode(value) {
+  const mode = normalizeRunMode(value || 'thirdfy');
+  if (mode === 'self') {
+    throw new Error('Managed lane does not support run-mode=self. Use thirdfy or hybrid.');
+  }
+  return mode;
+}
+
 function getProfileConfigPath() {
   return path.join(os.homedir(), '.thirdfy', 'config.json');
 }
@@ -818,8 +1620,60 @@ function loadProfileConfig() {
 function persistProfileConfig(config) {
   const configPath = getProfileConfigPath();
   const dirPath = path.dirname(configPath);
-  fs.mkdirSync(dirPath, { recursive: true });
-  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+  fs.mkdirSync(dirPath, { recursive: true, mode: 0o700 });
+  const payload = `${JSON.stringify(config, null, 2)}\n`;
+  fs.writeFileSync(configPath, payload, { encoding: 'utf8', mode: 0o600 });
+  try {
+    fs.chmodSync(configPath, 0o600);
+  } catch {
+    /* chmod unsupported or restricted (e.g. some Windows FS) */
+  }
+  try {
+    fs.chmodSync(dirPath, 0o700);
+  } catch {
+    /* ignore */
+  }
+}
+
+function clonePlainConfigTree(input) {
+  const obj = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+  try {
+    return structuredClone(obj);
+  } catch {
+    return JSON.parse(JSON.stringify(obj));
+  }
+}
+
+function setNestedConfigValue(config, keyPath, value) {
+  const next = clonePlainConfigTree(config || {});
+  const parts = String(keyPath || '')
+    .split('.')
+    .map((v) => v.trim())
+    .filter(Boolean);
+  const blocked = new Set(['__proto__', 'prototype', 'constructor']);
+  if (parts.some((part) => blocked.has(part))) {
+    throw createCliError(
+      'CONFIG_KEY_INVALID',
+      'Invalid config key path: reserved segments (__proto__, prototype, constructor) are not allowed.'
+    );
+  }
+  if (!parts.length) return next;
+  let cursor = next;
+  for (let i = 0; i < parts.length - 1; i += 1) {
+    const key = parts[i];
+    const existing = cursor[key];
+    if (!existing || typeof existing !== 'object' || Array.isArray(existing)) {
+      cursor[key] = {};
+    }
+    cursor = cursor[key];
+  }
+  const finalKey = parts[parts.length - 1];
+  if (value === undefined || String(value).trim() === '') {
+    delete cursor[finalKey];
+  } else {
+    cursor[finalKey] = String(value);
+  }
+  return next;
 }
 
 function getEffectiveRunMode(ctx, flags) {
@@ -1030,10 +1884,11 @@ async function executeHybridRun(ctx, flags, resolved, options) {
 }
 
 function buildBuildTxPayload(flags, resolvedAction) {
+  const runMode = String(flags.runMode || '').trim().toLowerCase() || 'self';
   const payload = {
-    agentApiKey: requireFlag(flags, 'agentApiKey', 'Missing --agent-api-key'),
+    agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
-    params: parseJsonFlag(flags, 'params'),
+    params: getPreparedParams(flags),
   };
   if (flags.chainId) payload.chainId = Number(flags.chainId);
   if (flags.walletAddress) payload.walletAddress = String(flags.walletAddress).trim();
@@ -1041,10 +1896,11 @@ function buildBuildTxPayload(flags, resolvedAction) {
 }
 
 function buildIntentPayload(flags, options) {
+  const runMode = String(options.runMode || flags.runMode || '').trim().toLowerCase() || 'thirdfy';
   const payload = {
-    agentApiKey: requireFlag(flags, 'agentApiKey', 'Missing --agent-api-key'),
+    agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
-    params: parseJsonFlag(flags, 'params'),
+    params: getPreparedParams(flags),
   };
   if (flags.catalog) payload.catalog = String(flags.catalog).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
@@ -1065,6 +1921,22 @@ function buildIntentPayload(flags, options) {
   return payload;
 }
 
+function resolveAgentApiKey(flags, runMode) {
+  const explicit = String(flags.agentApiKey || '').trim();
+  if (explicit) return explicit;
+  const envKey = String(process.env.THIRDFY_AGENT_API_KEY || '').trim();
+  if (envKey) return envKey;
+  const config = loadProfileConfig();
+  const configKey = String(config?.agent?.apiKey || '').trim();
+  if (configKey) return configKey;
+  if (runMode === 'self') {
+    throw new Error(
+      'SELF_OPEN_DISABLED: self mode without agent identity is not enabled on this API yet. Set --agent-api-key, THIRDFY_AGENT_API_KEY, or login/config default.'
+    );
+  }
+  throw new Error('Missing --agent-api-key (or THIRDFY_AGENT_API_KEY / config.agent.apiKey)');
+}
+
 function getActionKey(action) {
   return String(action?.action || action?.id || action?.key || action?.name || '')
     .trim();
@@ -1188,14 +2060,18 @@ async function resolveActionSelection(ctx, flags) {
 }
 
 function getAuthToken(flags, missingMessage) {
-  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
+  const config = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || config?.auth?.authToken || '').trim();
   if (!authToken) throw new Error(missingMessage);
   return authToken;
 }
 
 function buildOwnerAuthHeaders(flags, missingMessage) {
-  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || '').trim();
-  const ownerSessionToken = String(flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || '').trim();
+  const config = loadProfileConfig();
+  const authToken = String(flags.authToken || process.env.THIRDFY_AUTH_TOKEN || config?.auth?.authToken || '').trim();
+  const ownerSessionToken = String(
+    flags.ownerSessionToken || process.env.THIRDFY_OWNER_SESSION_TOKEN || config?.auth?.ownerSessionToken || ''
+  ).trim();
   if (!authToken && !ownerSessionToken) {
     throw new Error(missingMessage);
   }
@@ -1224,6 +2100,281 @@ async function negotiateCapabilities(ctx) {
   }
 }
 
+function resolveUnsignedTx(result) {
+  if (result?.unsignedTx && typeof result.unsignedTx === 'object') return result.unsignedTx;
+  if (result?.data?.unsignedTx && typeof result.data.unsignedTx === 'object') return result.data.unsignedTx;
+  if (result?.details?.unsignedTx && typeof result.details.unsignedTx === 'object') return result.details.unsignedTx;
+  return null;
+}
+
+function parseBooleanFlag(value, defaultValue = false) {
+  if (value === undefined || value === null) return defaultValue;
+  if (typeof value === 'boolean') return value;
+  const normalized = String(value).trim().toLowerCase();
+  if (!normalized) return defaultValue;
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+  return defaultValue;
+}
+
+function normalizeEffectCheckMode(value) {
+  const normalized = String(value || '').trim().toLowerCase();
+  if (!normalized) return 'relaxed';
+  if (EFFECT_CHECK_MODES.includes(normalized)) return normalized;
+  throw createCliError(
+    'EFFECT_CHECK_MODE_INVALID',
+    `Unsupported --effect-check "${value}". Supported: ${EFFECT_CHECK_MODES.join(', ')}.`
+  );
+}
+
+async function sleepMs(ms) {
+  const delay = Number(ms || 0);
+  if (!Number.isFinite(delay) || delay <= 0) return;
+  await new Promise((resolve) => setTimeout(resolve, delay));
+}
+
+async function resolveEffectCheckResult({
+  mode,
+  rpcUrl,
+  walletAddress,
+  tokenIn,
+  tokenOut,
+  balancesBefore,
+  retries,
+  waitMs,
+}) {
+  const baseResult = {
+    checked: true,
+    mode,
+    hasEffect: false,
+    inDeltaRaw: '0',
+    outDeltaRaw: '0',
+    attempts: 0,
+    retries: Math.max(0, Number(retries || 0)),
+  };
+  if (mode === 'off') {
+    return { checked: false, mode, hasEffect: null, inDeltaRaw: null, outDeltaRaw: null, reason: 'disabled' };
+  }
+  if (!tokenIn || !tokenOut || !balancesBefore) {
+    return { checked: false, mode, hasEffect: null, inDeltaRaw: null, outDeltaRaw: null, reason: 'token_pair_missing' };
+  }
+  const maxAttempts = Math.max(1, Number(retries || 0) + 1);
+  let last = null;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const balancesAfter = await readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut);
+    const inDeltaRaw = (BigInt(balancesBefore.tokenIn) - BigInt(balancesAfter.tokenIn)).toString();
+    const outDeltaRaw = (BigInt(balancesAfter.tokenOut) - BigInt(balancesBefore.tokenOut)).toString();
+    const hasEffect = BigInt(inDeltaRaw) > 0n || BigInt(outDeltaRaw) > 0n;
+    last = {
+      checked: true,
+      mode,
+      hasEffect,
+      inDeltaRaw,
+      outDeltaRaw,
+      attempts: attempt,
+      retries: maxAttempts - 1,
+    };
+    if (hasEffect) return last;
+    if (attempt < maxAttempts) await sleepMs(waitMs);
+  }
+  return {
+    ...(last || baseResult),
+    warning: 'No balance delta observed after retries; treating as non-fatal in relaxed mode.',
+  };
+}
+
+async function performSelfBroadcast(ctx, flags, resolvedAction, selfResult) {
+  const txd = resolveUnsignedTx(selfResult);
+  if (!txd?.to || !txd?.data) {
+    throw createCliError('SELF_UNSIGNED_TX_MISSING', 'Self execution did not return a valid unsigned transaction');
+  }
+  const chainId = Number(txd.chainId || flags.chainId || 8453);
+  const walletAddress = String(flags.walletAddress || process.env.MARKET_MAKER_WALLET_ADDRESS || '').trim();
+  const owsWalletName = String(flags.owsWalletName || process.env.OWS_WALLET_NAME || '').trim();
+  const rpcUrl = String(
+    flags.rpcUrl || process.env.BASE_RPC_URL || process.env.BASE_RPC_HTTP_URL || process.env.RPC_URL || 'https://mainnet.base.org'
+  ).trim();
+  if (!walletAddress) {
+    throw createCliError('SIGNING_FAILED', 'Missing --wallet-address (or MARKET_MAKER_WALLET_ADDRESS) for self-exec signing.');
+  }
+  if (!owsWalletName) {
+    throw createCliError('SIGNING_FAILED', 'Missing --ows-wallet-name (or OWS_WALLET_NAME) for self-exec signing.');
+  }
+
+  const params = getPreparedParams(flags);
+  const effectTokenIn = String(flags.effectTokenIn || params.tokenIn || '').trim();
+  const effectTokenOut = String(flags.effectTokenOut || params.tokenOut || '').trim();
+  const effectMode = normalizeEffectCheckMode(flags.effectCheck || process.env.THIRDFY_EFFECT_CHECK || 'relaxed');
+  const effectRetries = Number(flags.effectCheckRetries || process.env.THIRDFY_EFFECT_CHECK_RETRIES || 2);
+  const effectWaitMs = Number(flags.effectCheckWaitMs || process.env.THIRDFY_EFFECT_CHECK_WAIT_MS || 1200);
+
+  let balancesBefore = null;
+  if (effectMode !== 'off' && effectTokenIn && effectTokenOut) {
+    balancesBefore = await readEffectBalances(rpcUrl, walletAddress, effectTokenIn, effectTokenOut);
+  }
+
+  let submission;
+  try {
+    submission = await signAndBroadcastWithOws({
+      txd,
+      chainId,
+      walletAddress,
+      owsWalletName,
+      rpcUrl,
+    });
+  } catch (error) {
+    throw createCliError('SIGNING_FAILED', error?.message || 'OWS signing failed');
+  }
+
+  let receipt;
+  try {
+    receipt = await submission.sent.wait();
+  } catch (error) {
+    throw createCliError('BROADCAST_FAILED', error?.message || 'Broadcast wait failed');
+  }
+  const status = Number(receipt?.status ?? 0);
+  if (status !== 1) {
+    throw createCliError('BROADCAST_FAILED', 'Transaction receipt status is not success', {
+      receiptStatus: receipt?.status ?? null,
+      txHash: submission.sent.hash,
+    });
+  }
+
+  const effectCheck = await resolveEffectCheckResult({
+    mode: effectMode,
+    rpcUrl,
+    walletAddress,
+    tokenIn: effectTokenIn,
+    tokenOut: effectTokenOut,
+    balancesBefore,
+    retries: effectRetries,
+    waitMs: effectWaitMs,
+  });
+  if (effectCheck.checked && !effectCheck.hasEffect && effectMode === 'strict') {
+    throw createCliError('EFFECT_CHECK_FAILED', 'Transaction mined but did not produce observable token effect.', {
+      txHash: submission.sent.hash,
+      effectCheck,
+      mode: effectMode,
+    });
+  }
+
+  return {
+    txHash: submission.sent.hash,
+    chainId,
+    blockNumber: receipt?.blockNumber ?? null,
+    status: receipt?.status ?? null,
+    unsignedTx: txd,
+    effectCheck,
+    lane: 'self',
+    signer: 'ows',
+    resolvedAction,
+    apiBase: ctx.apiBase,
+  };
+}
+
+async function loadEthers() {
+  const candidates = ['ethers', path.join(process.cwd(), 'node_modules', 'ethers')];
+  for (const candidate of candidates) {
+    try {
+      return require(candidate);
+    } catch {
+      // continue
+    }
+  }
+  throw new Error('Could not load ethers dependency for self-exec');
+}
+
+function resolveOwsBinary() {
+  const explicit = String(process.env.OWS_CLI_PATH || '').trim();
+  if (explicit && fs.existsSync(explicit)) return explicit;
+  const localBin = path.join(process.cwd(), 'node_modules', '.bin', 'ows');
+  if (fs.existsSync(localBin)) return localBin;
+  const which = spawnSync('which', ['ows'], { encoding: 'utf-8' });
+  const discovered = String(which.stdout || '').trim();
+  if (discovered) return discovered;
+  throw new Error('ows CLI not found. Install it or set OWS_CLI_PATH.');
+}
+
+function signUnsignedTxWithOws(unsignedHex, walletName, chainId) {
+  const passphrase = String(process.env.OWS_PASSPHRASE || process.env.OWS_API_KEY || '').trim();
+  if (!passphrase) {
+    throw new Error('Set OWS_PASSPHRASE (or OWS_API_KEY) for self-exec signing.');
+  }
+  const ows = resolveOwsBinary();
+  const txHex = String(unsignedHex).startsWith('0x') ? String(unsignedHex).slice(2) : String(unsignedHex);
+  const res = spawnSync(
+    ows,
+    ['sign', 'tx', '--wallet', walletName, '--chain', `eip155:${chainId}`, '--tx', txHex, '--json'],
+    { env: { ...process.env, OWS_PASSPHRASE: passphrase }, encoding: 'utf-8' }
+  );
+  const out = String(res.stdout || '').trim();
+  if (res.status !== 0 || !out) {
+    throw new Error(`ows sign tx failed: ${String(res.stderr || out || res.status).slice(0, 300)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch {
+    throw new Error(`ows sign tx returned non-json payload: ${out.slice(0, 200)}`);
+  }
+  const signature = String(parsed.signature || '').replace(/^0x/i, '');
+  if (signature.length < 128) {
+    throw new Error('Invalid OWS signature payload');
+  }
+  return {
+    recoveryId: Number(parsed.recovery_id),
+    r: `0x${signature.slice(0, 64)}`,
+    s: `0x${signature.slice(64, 128)}`,
+  };
+}
+
+async function signAndBroadcastWithOws({ txd, chainId, walletAddress, owsWalletName, rpcUrl }) {
+  const ethers = await loadEthers();
+  const { JsonRpcProvider, Transaction, Signature } = ethers;
+  const provider = new JsonRpcProvider(rpcUrl, chainId);
+  const nonce = await provider.getTransactionCount(walletAddress, 'pending');
+  const fee = await provider.getFeeData();
+  const txFields = {
+    type: 2,
+    chainId,
+    nonce,
+    to: String(txd.to).toLowerCase(),
+    data: txd.data,
+    value: txd.value ? BigInt(txd.value) : 0n,
+    gasLimit: txd.gas ? BigInt(txd.gas) : txd.gasLimit ? BigInt(txd.gasLimit) : 500000n,
+    maxFeePerGas: fee.maxFeePerGas ?? fee.gasPrice ?? 2_000_000_000n,
+    maxPriorityFeePerGas: fee.maxPriorityFeePerGas ?? 1_000_000_000n,
+  };
+  const unsigned = Transaction.from(txFields);
+  const sigParts = signUnsignedTxWithOws(unsigned.unsignedSerialized, owsWalletName, chainId);
+  const sig = Signature.from({ r: sigParts.r, s: sigParts.s, yParity: sigParts.recoveryId });
+  const tx = Transaction.from(unsigned.unsignedSerialized);
+  tx.signature = sig;
+  const sent = await provider.broadcastTransaction(tx.serialized);
+  return { sent };
+}
+
+async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress) {
+  const ethers = await loadEthers();
+  const { JsonRpcProvider, Interface } = ethers;
+  const provider = new JsonRpcProvider(rpcUrl);
+  const erc20 = new Interface(['function balanceOf(address owner) view returns (uint256)']);
+  const response = await provider.call({
+    to: tokenAddress,
+    data: erc20.encodeFunctionData('balanceOf', [walletAddress]),
+  });
+  const decoded = erc20.decodeFunctionResult('balanceOf', response);
+  return BigInt(decoded[0].toString()).toString();
+}
+
+async function readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut) {
+  const [inBal, outBal] = await Promise.all([
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenIn),
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenOut),
+  ]);
+  return { tokenIn: inBal, tokenOut: outBal };
+}
+
 async function apiGet(ctx, route, headers = {}) {
   return requestJson(ctx, route, { method: 'GET', headers });
 }
@@ -1308,21 +2459,37 @@ Core commands:
   thirdfy-agent profile init [--profile personal|builder|network] [--run-mode thirdfy|self|hybrid] [--json]
   thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid] [--json]
   thirdfy-agent profile show [--json]
+  thirdfy-agent config set --key <path> --value <value> [--json]
+  thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--json]
+  thirdfy-agent logout [--all] [--clear-agent-key] [--json]
   thirdfy-agent whoami [--json]
   thirdfy-agent catalogs list [--json]
   thirdfy-agent actions [--catalog <id>] [--provider <id>] [--agent-api-key <key>] [--chain-id <id>] [--run-mode <mode>] [--json]
   thirdfy-agent delegation create --auth-token <token> --agent-key <key> --owner-address <addr> --token-address <addr> --max-usd-per-day <usd> [--session-account-address <addr>] [--json]
+  thirdfy-agent delegation init-custodial [--auth-token <token> | --owner-session-token <token>] [--chain-id <id>] [--json]
+  thirdfy-agent delegation custodial-grant [--auth-token <token> | --owner-session-token <token>] --agent-key <key> --token-address <addr> --max-usd-per-day <usd> [--chain-id <id>] [--period-duration <sec>] [--expiry-seconds <sec>] [--json]
   thirdfy-agent delegation activate --auth-token <token> --agent-key <key> --wallet-address <addr> --session-account-address <addr> --delegation-manager <addr> --delegation <json> --signature <hex> [--json]
   thirdfy-agent delegation status --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation show --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation inspect --auth-token <token> --agent-key <key> [--verify] [--json]
+  thirdfy-agent delegation balance --auth-token <token> --agent-key <key> [--chain-id <id>] [--json]
+  thirdfy-agent delegation revoke --auth-token <token> --agent-key <key> [--reason <text>] [--chain-id <id>] [--json]
+  thirdfy-agent delegation redeem --agent-api-key <key> --action <id> --params <json> [--run-mode thirdfy|hybrid] [--estimated-amount-usd <usd>] [--json]
+  thirdfy-agent managed wallet init [--auth-token <token> | --owner-session-token <token>] [--chain-id <id>] [--json]
+  thirdfy-agent managed wallet grant [--auth-token <token> | --owner-session-token <token>] --agent-key <key> --token-address <addr> --max-usd-per-day <usd> [--chain-id <id>] [--period-duration <sec>] [--expiry-seconds <sec>] [--json]
+  thirdfy-agent managed run --agent-api-key <key> --action <id> --params <json> [--run-mode thirdfy|hybrid] [--idempotency-key <key>] [--json]
   thirdfy-agent credentials upsert --auth-token <token> --venue <id> --api-key <key> --api-secret <secret> [--json]
   thirdfy-agent credentials status --auth-token <token> [--venue <id>] [--json]
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]
+  thirdfy-agent developer bootstrap --agent-key <key> --name <name> [--owner-session-token <token> | --challenge-id <id> --signature <hex>] [--json]
   thirdfy-agent agent register --agent-key <key> --name <name> [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent agent key rotate [--agent-key <key>] [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent agent key revoke [--agent-key <key>] [--auth-token <token> | --owner-session-token <token>] [--json]
   thirdfy-agent preflight --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
-  thirdfy-agent run --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--idempotency-key <key>] [--json]
+  thirdfy-agent run --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--broadcast] [--idempotency-key <key>] [--json]
+  thirdfy-agent self-exec --agent-api-key <key> --action <id> --params <json> --wallet-address <addr> --ows-wallet-name <name> [--rpc-url <url>] [--effect-check strict|relaxed|off] [--json]
+  thirdfy-agent doctor self [--wallet-address <addr>] [--ows-wallet-name <name>] [--rpc-url <url>] [--json]
   thirdfy-agent jeff preflight --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
   thirdfy-agent jeff trade --agent-api-key <key> --action <id> --params <json> [--run-mode <mode>] [--json]
   thirdfy-agent jeff status --intent-id <id> [--json]
@@ -1336,6 +2503,9 @@ Global flags:
   --profile <name>   personal | builder | network
   --env <file>       load env vars from file
   --timeout <ms>     request timeout
+  --params <json>    for swap: exactly one of {amountInRaw} or {amountInHuman + tokenInDecimals}
+  --broadcast        with run --run-mode self, sign and broadcast using OWS
+  --effect-check <mode>  self-exec check mode: strict | relaxed | off (default: relaxed)
   --owner-session-token <token>  owner session token (or THIRDFY_OWNER_SESSION_TOKEN)
   --json             stable machine-readable output
   --verbose          print adapter diagnostics