@thirdfy/agent-cli 0.2.38 → 0.2.40

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.2.40] - 2026-07-27
+
+### Added
+
+- EarnClaw runtime Polymarket write gate: when `EARNCLAW_RUNTIME_ID` or `THIRDFY_EXECUTION_RUNTIME_ID` is set, `place_polymarket_order` / `place_prediction_order` require `idempotencyKey` starting with `earnclaw:<runtimeId>`. Blocks bare CLI/dashboard tool buys on managed Hermes machines. MCP parity in `thirdfy-mcp` **0.0.83**.
+
+## [0.2.39] - 2026-07-27
+
+### Changed
+
+- Morpho provider hints: `supportedChains` `[8453, 4663]`; Base MetaMorpho V1 writable, Robinhood Vault V2 read-only until deposit capacity opens. Updated `docs/providers/earn-morpho.md`. Pairs with Thirdfy API develop + `thirdfy-mcp` **0.0.82**.
+
 ## [0.2.38] - 2026-07-25
 
 ### Fixed

package/README.md

@@ -40,13 +40,11 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.2.38
+## What's new in v0.2.40
+- EarnClaw machines: Polymarket place orders require an `earnclaw:<runtimeId>…` idempotency key (blocks ad-hoc CLI/dashboard buys).
+- Pack execute-gate and operator exits already set this key; bare tool writes fail closed.
+- See [CHANGELOG.md](./CHANGELOG.md) for older versions.
 
-- Earn discovery prefers `get_earning_opportunities` / `get-earning-opportunities` (legacy `get_earn_opportunities` aliases remain).
-- Lighter onboarding hints: repeat `complete_lighter_onboarding` on Base (`8453`) until setup is ready.
-- Pairs with MCP **0.0.81** and Thirdfy API **v3.13.26**.
-
-Older versions: see [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
 
 ## Quick start
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.2.38",
+  "version": "0.2.40",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {

package/src/runtime/execution/earnclawRuntimeWriteGate.mjs

@@ -0,0 +1,63 @@
+import { createCliError } from '../../core/envelope.mjs';
+
+function readUuid(value) {
+  const trimmed = String(value || '').trim();
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)
+    ? trimmed
+    : undefined;
+}
+
+const POLYMARKET_PLACE_ACTIONS = new Set([
+  'place_polymarket_order',
+  'place-polymarket-order',
+  'place_prediction_order',
+  'place-prediction-order',
+]);
+
+export function resolveEarnclawRuntimeId(env = process.env) {
+  const runtimeId = readUuid(env.THIRDFY_EXECUTION_RUNTIME_ID)
+    || readUuid(env.EARNCLAW_RUNTIME_ID);
+  return runtimeId ? runtimeId.toLowerCase() : '';
+}
+
+export function normalizePolymarketPlaceAction(action) {
+  return String(action || '')
+    .trim()
+    .toLowerCase()
+    .replace(/_/g, '-');
+}
+
+export function isPolymarketPlaceAction(action) {
+  const key = String(action || '').trim().toLowerCase();
+  if (POLYMARKET_PLACE_ACTIONS.has(key)) return true;
+  return normalizePolymarketPlaceAction(key) === 'place-polymarket-order'
+    || normalizePolymarketPlaceAction(key) === 'place-prediction-order';
+}
+
+/**
+ * On EarnClaw-managed Hermes machines, ad-hoc CLI/MCP/dashboard tool calls can
+ * place Polymarket orders without pack execute-gate. Require an earnclaw-scoped
+ * idempotency key so only adapter/operator keys pass.
+ */
+export function assertEarnclawPolymarketWriteIdempotency({
+  action,
+  idempotencyKey,
+  paramsIdempotencyKey,
+  env = process.env,
+} = {}) {
+  if (!isPolymarketPlaceAction(action)) return null;
+  const runtimeId = resolveEarnclawRuntimeId(env);
+  if (!runtimeId) return null;
+
+  const prefix = `earnclaw:${runtimeId}`;
+  const keys = [idempotencyKey, paramsIdempotencyKey]
+    .map((key) => String(key || '').trim())
+    .filter(Boolean);
+  if (keys.some((key) => key.toLowerCase().startsWith(prefix))) return null;
+
+  throw createCliError(
+    'EARNCLAW_PM_IDEMPOTENCY_REQUIRED',
+    `EarnClaw runtime ${runtimeId} requires Polymarket place orders to use idempotencyKey starting with "${prefix}". ` +
+      'Pack execute-gate and operator exits set this automatically. Bare CLI/dashboard tool writes are blocked.',
+  );
+}

package/src/runtime/execution/payloads.mjs

@@ -3,6 +3,7 @@ import { requireFlag, parseJsonFlag } from '../../core/args.mjs';
 import { loadProfileConfig } from '../../core/context.mjs';
 import { createCliError } from '../../core/envelope.mjs';
 import { normalizeRunMode, normalizeManagedRunMode, normalizeHybridWalletMode } from '../../core/runMode.mjs';
+import { assertEarnclawPolymarketWriteIdempotency } from './earnclawRuntimeWriteGate.mjs';
 export function createExecutionPayloads({ getPreparedParams, rawUnitsToDecimalString }) {
 function buildBuildTxPayload(flags, resolvedAction) {
   const runMode = String(flags.runMode || '').trim().toLowerCase() || 'self';
@@ -125,6 +126,11 @@ function buildManagedExecutePayload(flags, options) {
   } else if (flags.idempotencyKey) {
     payload.executionIdempotencyKey = String(flags.idempotencyKey);
   }
+  assertEarnclawPolymarketWriteIdempotency({
+    action: payload.action,
+    idempotencyKey: payload.executionIdempotencyKey,
+    paramsIdempotencyKey: managedParams?.idempotencyKey,
+  });
   return payload;
 }
 
@@ -171,6 +177,13 @@ function buildIntentPayload(flags, options) {
   } else if (flags.idempotencyKey) {
     payload.idempotencyKey = String(flags.idempotencyKey);
   }
+  if (!options.validationOnly) {
+    assertEarnclawPolymarketWriteIdempotency({
+      action: payload.action,
+      idempotencyKey: payload.idempotencyKey,
+      paramsIdempotencyKey: payload.params?.idempotencyKey,
+    });
+  }
   return payload;
 }
 

package/src/runtime/providerHints.mjs

@@ -392,10 +392,11 @@ export function createProviderHints({ getNegotiatedCapabilitiesCache }) {
         canonicalWriteAction: 'deposit_earn_position',
         readActions: ['get_morpho_vaults', 'get_earn_provider', 'get_earn_position'],
         orderManagementActions: ['deposit_earn_position', 'withdraw_earn_position'],
-        supportedChains: [8453, 84532],
-        laneCompatibility: 'Morpho deposits require ERC-20 approvals to the vault/market routes surfaced by the catalog before deposit_earn_position.',
+        supportedChains: [8453, 4663],
+        laneCompatibility:
+          'Base MetaMorpho V1 vaults are writable (use depositPlan from discovery). Robinhood Vault V2 on 4663 is discoverable read-only until maxDeposit > 0. Deposits require ERC-20 approval before deposit_earn_position.',
         example:
-          'thirdfy-agent actions --provider morpho && thirdfy-agent run --action deposit_earn_position --params \'{"providerId":"morpho","vaultAddress":"0x...","tokenAddress":"0x...","amount":"10","chainId":8453}\'',
+          'thirdfy-agent run --action get_earn_opportunities --params \'{"providerId":"morpho","chainId":8453,"asset":"USDC"}\' && thirdfy-agent run --action deposit_earn_position --params \'{"providerId":"morpho","chainId":8453,"vaultAddress":"0x...","tokenAddress":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"0.1","tokenDecimals":6}\'',
       };
     }
     if (provider === 'aegis') {