@thirdfy/agent-cli 0.2.22 → 0.2.25

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.2.25] - 2026-07-11
+
+### Fixed
+
+- Solo `agent_wallet` still uses `did:wallet:<agentKey>`, but hybrid `agent_wallet` and `--signer-method managed_wallet_server` keep saved Privy delegation identity.
+
+## [0.2.24] - 2026-07-11
+
+### Fixed
+
+- `agent_wallet` execute-intent read-only fallback now passes `runMode: agent_wallet` into identity resolution so solo `did:wallet:<agentKey>` is used consistently.
+
+## [0.2.23] - 2026-07-11
+
+### Fixed
+
+- Solo `agent_wallet` preflight now resolves `did:wallet:<agentKey>` from `--agent-key`, `THIRDFY_AGENT_KEY`, or `config.agent.agentKey` instead of falling back to subscriber Privy `userDid` (fixes `SUBSCRIPTION_NOT_FOUND` on Robinhood and other direct agent lanes).
+
+### Added
+
+- `npm run validate:robinhood-agent-wallet-preflight` for live API solo agent_wallet preflight on chain 4663.
+
 ## [0.2.22] - 2026-07-10
 
 ### Added

package/README.md

@@ -40,12 +40,18 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.2.22
+## What's new in v0.2.25
 
-- **Robinhood Chain (4663):** Provider hints for `trading`, `bridge`, `yield-xyz`, and `market-data`; `robinhood-mainnet` chat alias.
-- Live capabilities validation asserts chain 4663 when `THIRDFY_API_BASE` is set. Pairs with Thirdfy API **v3.10.7+**.
+- Hybrid and `managed_wallet_server` agent_wallet paths keep Privy delegation identity; solo Robinhood lane still uses `did:wallet:<agentKey>`.
 
-Older versions: see [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
+## What's new in v0.2.24
+
+- `agent_wallet` read-only execute-intent fallback keeps solo `did:wallet:<agentKey>` identity (matches preflight and primary execute path).
+
+## What's new in v0.2.23
+
+- Solo `agent_wallet` preflight uses `did:wallet:<agentKey>` so Robinhood and direct agent lanes skip subscriber delegation (`SUBSCRIPTION_NOT_FOUND` fix).
+- `npm run validate:robinhood-agent-wallet-preflight` for live chain 4663 execution-wallet checks.
 
 Older versions: see [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.2.22",
+  "version": "0.2.25",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -47,6 +47,8 @@
     "smoke:cli": "node ./bin/thirdfy-agent.mjs --help && node ./bin/thirdfy-agent.mjs -V && node ./bin/thirdfy-agent.mjs --version --json",
     "validate:release-preflight": "npm run lint && npm run validate:public-docs && npm run validate:cli-contract-schemas && npm run validate:provider-parity && npm run validate:cli-manifest-handlers && npm run validate:runtime-boundaries && npm run test && npm run validate:npm-pack && npm run smoke:cli",
     "validate:live-api-capabilities": "node ./scripts/validate-live-api-capabilities.mjs",
+    "validate:robinhood-agent-wallet-preflight": "node ./scripts/validate-robinhood-agent-wallet-preflight.mjs",
+    "validate:robinhood-agent-wallet-preflight": "node ./scripts/validate-robinhood-agent-wallet-preflight.mjs",
     "prepublishOnly": "npm run validate:release-preflight"
   },
   "keywords": [

package/src/runtime/execution/payloads.mjs

@@ -16,13 +16,57 @@ function buildBuildTxPayload(flags, resolvedAction) {
   return payload;
 }
 
-function resolveEffectiveUserDid(flags) {
+function resolveAgentKey(flags) {
+  const explicit = String(flags.agentKey || '').trim();
+  if (explicit) return explicit.toLowerCase();
+  const envKey = String(process.env.THIRDFY_AGENT_KEY || process.env.AGENT_KEY || '').trim();
+  if (envKey) return envKey.toLowerCase();
+  const config = loadProfileConfig();
+  const configKey = String(config?.agent?.agentKey || '').trim();
+  if (configKey) return configKey.toLowerCase();
+  return '';
+}
+
+function buildSoloAgentWalletUserDid(agentKey) {
+  const normalized = String(agentKey || '').trim().toLowerCase();
+  if (!normalized) return '';
+  return `did:wallet:${normalized}`;
+}
+
+function isWalletScopedUserDid(value) {
+  return String(value || '').trim().toLowerCase().startsWith('did:wallet:');
+}
+
+function preferDelegationAgentWalletIdentity(flags, options = {}) {
+  if (options.preferDelegationIdentity === true) return true;
+  if (String(flags.runMode || '').trim().toLowerCase() === 'hybrid') return true;
+  if (options.hybridWalletMode) return true;
+  const signerMethod = String(flags.signerMethod || '').trim().toLowerCase();
+  if (signerMethod === 'managed_wallet_server') return true;
+  const scope = String(flags.executionScope || '').trim();
+  if (scope && scope !== 'solo_owner_mirror') return true;
+  return false;
+}
+
+function resolveEffectiveUserDid(flags, options = {}) {
   const explicit = String(flags.userDid || '').trim();
   if (explicit) return explicit;
+  const runMode = String(options.runMode || flags.runMode || '').trim().toLowerCase();
   const envUserDid = String(process.env.THIRDFY_USER_DID || '').trim();
-  if (envUserDid) return envUserDid;
   const config = loadProfileConfig();
-  return String(config?.wallets?.userDid || config?.identity?.userDid || '').trim();
+  const configUserDid = String(config?.wallets?.userDid || config?.identity?.userDid || '').trim();
+
+  // Solo agent_wallet uses did:wallet:<agentKey>. Hybrid and managed_wallet_server keep Privy delegation.
+  if (runMode === 'agent_wallet' && !preferDelegationAgentWalletIdentity(flags, options)) {
+    const soloDid = buildSoloAgentWalletUserDid(resolveAgentKey(flags));
+    if (soloDid) return soloDid;
+    if (isWalletScopedUserDid(envUserDid)) return envUserDid;
+    if (isWalletScopedUserDid(configUserDid)) return configUserDid;
+    return '';
+  }
+
+  if (envUserDid) return envUserDid;
+  return configUserDid;
 }
 
 function buildManagedExecutePayload(flags, options) {
@@ -55,7 +99,11 @@ function buildManagedExecutePayload(flags, options) {
   const payload = {
     agentApiKey: resolveAgentApiKey(flags, runMode),
     action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
-    userDid: resolveEffectiveUserDid(flags),
+    userDid: resolveEffectiveUserDid(flags, {
+      runMode,
+      hybridWalletMode: options.hybridWalletMode,
+      preferDelegationIdentity: options.preferDelegationIdentity,
+    }),
     params: managedParams,
     chainId: Number(flags.chainId || 8453),
     executionStrategy: {
@@ -66,7 +114,7 @@ function buildManagedExecutePayload(flags, options) {
   if (!payload.userDid) {
     throw createCliError(
       'MISSING_USER_DID',
-      'Managed wallet execution requires --user-did, THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.'
+      'Managed wallet execution requires --user-did, --agent-key (solo did:wallet identity), THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.'
     );
   }
   if (flags.estimatedAmountUsd) payload.estimatedAmountUsd = Number(flags.estimatedAmountUsd);
@@ -96,7 +144,12 @@ function buildIntentPayload(flags, options) {
   if (flags.catalog) payload.catalog = String(flags.catalog).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
   if (flags.estimatedAmountUsd) payload.estimatedAmountUsd = Number(flags.estimatedAmountUsd);
-  const userDid = resolveEffectiveUserDid(flags);
+  const intentRunMode = String(options.runMode || flags.runMode || '').trim().toLowerCase();
+  const userDid = resolveEffectiveUserDid(flags, {
+    runMode: intentRunMode,
+    hybridWalletMode: options.hybridWalletMode,
+    preferDelegationIdentity: options.preferDelegationIdentity,
+  });
   if (flags.userDid || (options.validationOnly && (runMode === 'agent_wallet' || (runMode === 'hybrid' && options.mirrorOnly)))) {
     if (userDid) payload.userDid = userDid;
   }
@@ -139,6 +192,8 @@ function resolveAgentApiKey(flags, runMode) {
 
   return {
     buildBuildTxPayload,
+    resolveAgentKey,
+    buildSoloAgentWalletUserDid,
     resolveEffectiveUserDid,
     buildManagedExecutePayload,
     resolveTokenInForFunding,

package/src/runtime/execution/runners.mjs

@@ -338,7 +338,11 @@ async function executeManagedWalletRun(ctx, flags, resolved, options) {
   const actionCtx = withActionTimeout(ctx, resolved.resolvedAction);
   const response = await apiPost(actionCtx, '/api/v1/agent/execute', payload);
   if (shouldFallbackAgentWalletToExecuteIntent(resolved, response)) {
-    const userDid = resolveEffectiveUserDid(flags);
+    const userDid = resolveEffectiveUserDid(flags, {
+      runMode: 'agent_wallet',
+      hybridWalletMode: options.hybridWalletMode,
+      preferDelegationIdentity: options.preferDelegationIdentity,
+    });
     const chainId = Number(flags.chainId || 8453);
     const intentResult = await executeThirdfyRun(
       ctx,
@@ -493,13 +497,20 @@ async function resolveManagedExecutionPreflight(ctx, flags, resolved, options =
   const chainId = Number(flags.chainId || 8453);
   const runMode = String(options.runMode || 'agent_wallet').trim().toLowerCase();
   const agentApiKey = resolveAgentApiKey(flags, runMode);
-  const userDid = resolveEffectiveUserDid(flags);
+  const userDid = resolveEffectiveUserDid(flags, {
+    runMode,
+    hybridWalletMode: options.hybridWalletMode,
+    preferDelegationIdentity: options.preferDelegationIdentity,
+  });
   if (!userDid) {
     return {
       success: false,
       blockedReason: 'MISSING_USER_DID',
       blockedStage: 'routing',
-      error: 'Managed wallet execution requires --user-did, THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.',
+      error:
+        runMode === 'agent_wallet'
+          ? 'Solo agent_wallet requires --agent-key, THIRDFY_AGENT_KEY, config.agent.agentKey, or --user-did did:wallet:<agentKey>. Subscriber Privy DIDs require delegation; use did:wallet for direct agent execution.'
+          : 'Managed wallet execution requires --user-did, THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.',
       signerMethod: 'managed_wallet_server',
     };
   }