@thirdfy/agent-cli 0.2.33 → 0.2.34

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.2.34] - 2026-07-25
+
+### Fixed
+
+- Read-only actions run under `--run-mode agent_wallet` no longer go through the managed-wallet execute rail. `run`, `preflight`, and pack callers that request `get_*`, `list_*`, or `search_*` actions (or any catalog action with `supportsExecute: false`) are routed to the read rail up front, so the provider payload is returned as-is instead of being reshaped into an execution intent envelope (`intentId`, `blocked`, `executed`).
+- Reads on `agent_wallet` are no longer gated on execution-wallet funding. The execution wallet address is still resolved and reported for response parity, but an unfunded wallet does not block a read. Every other preflight failure (`MISSING_USER_DID`, `EXECUTION_WALLET_MISMATCH`, and other routing checks) still fails closed with `PREFLIGHT_BLOCKED`, exactly as it does for a write.
+
+Operator impact: `get_hyperliquid_perps_meta` and `get_hyperliquid_all_mids` previously returned an envelope with the market universe buried under `data.raw`, which consumers could not parse. Hyperliquid agents fell back to a stale cached universe and reported no trading edge. Upgrade to 0.2.34 on every runtime that executes with `--run-mode agent_wallet`.
+
 ## [0.2.33] - 2026-07-24
 
 ### Fixed

package/README.md

@@ -40,9 +40,10 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.2.33
+## What's new in v0.2.34
 
-- `login email` always surfaces `executionWallets` (and `executionWalletsError` when present) and fails closed for `agent_wallet` when execution wallets are missing. Fund the printed execution address, not the owner login wallet.
+- Read-only actions (`get_*`, `list_*`, `search_*`) requested with `--run-mode agent_wallet` now return the provider payload directly instead of an execution envelope. Market data reads such as `get_hyperliquid_perps_meta` no longer come back wrapped as an intent.
+- Reads are no longer gated on execution-wallet funding. The execution address is still reported, but an unfunded wallet does not block a read. Routing and identity checks still apply.
 
 Older versions: see [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {

package/src/runtime/execution/runners.mjs

@@ -79,15 +79,29 @@ function applyExecutionFallbackHints(normalized, { flags, runMode, resolvedActio
   return next;
 }
 
-function shouldFallbackAgentWalletToExecuteIntent(resolved, response) {
+function isReadOnlyAction(resolved) {
   const meta = resolved?.resolvedActionMeta || {};
   const action = String(resolved?.resolvedAction || '')
     .trim()
     .toLowerCase()
     .replace(/-/g, '_');
-  const readOnlyByName = action.startsWith('get_') || action.startsWith('search_');
+  const readOnlyByName =
+    action.startsWith('get_') || action.startsWith('search_') || action.startsWith('list_');
   const readOnlyByMeta = meta.supportsExecute === false && meta.supportsExecuteIntent !== false;
-  if (!readOnlyByName && !readOnlyByMeta) return false;
+  return readOnlyByName || readOnlyByMeta;
+}
+
+// Reads carry no transaction, so wallet balance never blocks them. Every other preflight failure
+// (identity, routing, wallet mismatch) still fails closed, same as a write.
+const FUNDING_ONLY_PREFLIGHT_BLOCKS = new Set(['INSUFFICIENT_FUNDS', 'INVALID_FUNDING_BALANCE']);
+
+function isFundingOnlyPreflightBlock(preflight) {
+  const reason = String(preflight?.blockedReason || '').trim().toUpperCase();
+  return FUNDING_ONLY_PREFLIGHT_BLOCKS.has(reason);
+}
+
+function shouldFallbackAgentWalletToExecuteIntent(resolved, response) {
+  if (!isReadOnlyAction(resolved)) return false;
   const err = String(response?.error || response?.message || '').toLowerCase();
   return err.includes('does not support execute rail');
 }
@@ -97,7 +111,8 @@ async function runPreflightByMode(runMode, ctx, flags, resolved, options = {}) {
   if (runMode === 'agent_wallet') {
     const preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
       runMode,
-      requireFundingCheck: true,
+      // Reads carry no transaction; keep funding optional so preflight matches run.
+      requireFundingCheck: !isReadOnlyAction(resolved),
       preflightSeed: options.managedPreflight,
     });
     const normalized = normalizeIntentResponse({
@@ -304,7 +319,68 @@ async function executeThirdfyRun(ctx, flags, resolved, options, runMode = 'third
   return normalized;
 }
 
+async function runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, preflight) {
+  const userDid = resolveEffectiveUserDid(flags, {
+    runMode: 'agent_wallet',
+    hybridWalletMode: options?.hybridWalletMode,
+    preferDelegationIdentity: options?.preferDelegationIdentity,
+  });
+  const intentResult = await executeThirdfyRun(
+    ctx,
+    {
+      ...flags,
+      chainId: Number(flags.chainId || 8453),
+      runMode: 'thirdfy',
+      userDid: userDid || flags.userDid,
+      executionScope: flags.executionScope || 'solo_owner_mirror',
+    },
+    resolved,
+    { ...options, skipPreflight: true },
+    'thirdfy'
+  );
+  intentResult.mode = 'agent_wallet';
+  intentResult.routeFallback = 'execute_intent_read_only';
+  if (preflight) {
+    intentResult.executionWalletPreflight = preflight;
+    intentResult.executionWalletAddress = preflight.executionWalletAddress || null;
+  }
+  intentResult.signerMethod = 'managed_wallet_server';
+  return intentResult;
+}
+
 async function executeManagedWalletRun(ctx, flags, resolved, options) {
+  // Read-only actions carry no transaction. Routing them through the managed-wallet execute rail
+  // returns an execution envelope instead of the queried data, which silently starves callers that
+  // asked for market state (see earnclaw-api HL universe probe regression, 2026-07-25).
+  // The wallet address is still resolved for response parity, but a read is never gated on funding.
+  if (isReadOnlyAction(resolved)) {
+    // Do not swallow lookup/routing errors: writes let them propagate, and reads must fail closed
+    // the same way (wallet mismatch, missing identity, failed /execution-wallet).
+    const readPreflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
+      runMode: 'agent_wallet',
+      requireFundingCheck: false,
+      preflightSeed: options?.managedPreflight,
+    });
+    // Funding is intentionally skipped for reads (`requireFundingCheck: false`), but routing
+    // failures (wallet mismatch, missing identity, failed address seed) must still fail closed.
+    if (readPreflight && readPreflight.success === false && !isFundingOnlyPreflightBlock(readPreflight)) {
+      const normalized = normalizeIntentResponse({
+        success: false,
+        status: 'failed',
+        mode: 'agent_wallet',
+        blockedReason: readPreflight.blockedReason || 'PRECHECK_FAILED',
+        blockedStage: readPreflight.blockedStage || 'routing',
+        error: readPreflight.error || 'Managed wallet preflight failed',
+        preflightBlocked: true,
+        executionWalletAddress: readPreflight.executionWalletAddress || null,
+        executionWalletPreflight: readPreflight,
+      });
+      normalized.executionWalletAddress = readPreflight.executionWalletAddress || null;
+      normalized.executionWalletPreflight = readPreflight;
+      return normalized;
+    }
+    return runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, readPreflight);
+  }
   const skipPreflight = Boolean(options?.skipPreflight);
   let preflight = null;
   if (!skipPreflight) {
@@ -338,34 +414,12 @@ async function executeManagedWalletRun(ctx, flags, resolved, options) {
   const actionCtx = withActionTimeout(ctx, resolved.resolvedAction);
   const response = await apiPost(actionCtx, '/api/v1/agent/execute', payload);
   if (shouldFallbackAgentWalletToExecuteIntent(resolved, response)) {
-    const userDid = resolveEffectiveUserDid(flags, {
-      runMode: 'agent_wallet',
-      hybridWalletMode: options.hybridWalletMode,
-      preferDelegationIdentity: options.preferDelegationIdentity,
-    });
-    const chainId = Number(flags.chainId || 8453);
-    const intentResult = await executeThirdfyRun(
-      ctx,
-      {
-        ...flags,
-        chainId,
-        runMode: 'thirdfy',
-        userDid: userDid || flags.userDid,
-        executionScope: flags.executionScope || 'solo_owner_mirror',
-      },
-      resolved,
-      { ...options, skipPreflight: true },
-      'thirdfy'
-    );
-    intentResult.mode = 'agent_wallet';
-    intentResult.routeFallback = 'execute_intent_read_only';
-    intentResult.executionWalletPreflight = preflight;
+    const intentResult = await runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, preflight);
     intentResult.executionWalletAddress =
       preflight?.executionWalletAddress ||
       response?.executionWalletAddress ||
       response?.data?.executionWalletAddress ||
       null;
-    intentResult.signerMethod = 'managed_wallet_server';
     return intentResult;
   }
   const normalized = normalizeIntentResponse({