@thirdfy/agent-cli 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.2.8] - 2026-06-13
+
+### Added
+
+- EarnClaw runtime attribution on all API POSTs: reads `THIRDFY_EXECUTION_RUNTIME_ID` / `THIRDFY_EXECUTION_ORG_ID` (with `EARNCLAW_*` fallback) and sends `executionContext` plus `x-thirdfy-execution-*` headers on execute paths. Pairs with Thirdfy API v3.4.55+ for per-runtime credit debits.
+
+### Fixed
+
+- `apiPost` resolves execution context headers from the request body, not env only.
+
+## [0.2.7] - 2026-06-08
+
+### Added
+
+- Hyperliquid `update_hyperliquid_leverage` action parity: listed in provider hints `orderManagementActions`, classified under the `hyperliquid` provider, and treated as an offchain venue write (rejects `self`/BYOW with `OFFCHAIN_VENUE_ORDER_SELF_UNSUPPORTED`; use `thirdfy`/`hybrid`/`agent_wallet`). Sets per-coin leverage (cross by default), bounded by the venue per-coin maxLeverage. Matches Thirdfy API v3.4.52+ and thirdfy-mcp v0.0.56+.
+
 ## [0.2.6] - 2026-06-05
 
 ### Changed

package/README.md

@@ -40,11 +40,11 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.2.6
+## What's new in v0.2.8
 
-- Hyperliquid provider hints include `complete_hyperliquid_onboarding` and `setupWarnings` for unfunded builder treasury (`HYPERLIQUID_BUILDER_WALLET_UNFUNDED`).
-- Builder fee approval is documented only when builder monetization is active (builder treasury funded on Hyperliquid).
-- Command reference matches Thirdfy API setup/execute parity for Hyperliquid perps.
+- Hosted runtimes can set `THIRDFY_EXECUTION_RUNTIME_ID` and `THIRDFY_EXECUTION_ORG_ID` in machine env (EarnClaw also sets legacy `EARNCLAW_*` aliases). The CLI forwards neutral `executionContext` on Thirdfy API POSTs.
+- Attribution uses `x-thirdfy-execution-runtime-id`, `x-thirdfy-execution-org-id`, and `executionContext` on execute payloads.
+- Pairs with Thirdfy API v3.4.55+ and EarnClaw cost sync `attribution=strict`.
 
 Older versions: [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {

package/src/core/earnclawAttribution.mjs

@@ -0,0 +1,7 @@
+/** @deprecated Import from executionContext.mjs instead. */
+export {
+  resolveExecutionContextFromEnv as resolveEarnClawAttributionFromEnv,
+  resolveExecutionContextFromInput as resolveEarnClawAttributionFromInput,
+  buildExecutionContextHeaders as buildEarnClawAttributionHeaders,
+  mergeExecutionContext as mergeEarnClawContext,
+} from './executionContext.mjs';

package/src/core/executionContext.mjs

@@ -0,0 +1,50 @@
+function readUuid(value) {
+  const trimmed = String(value || '').trim();
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)
+    ? trimmed
+    : undefined;
+}
+
+export function resolveExecutionContextFromEnv() {
+  const runtimeId = readUuid(process.env.THIRDFY_EXECUTION_RUNTIME_ID)
+    || readUuid(process.env.EARNCLAW_RUNTIME_ID);
+  const orgId = readUuid(process.env.THIRDFY_EXECUTION_ORG_ID)
+    || readUuid(process.env.EARNCLAW_ORG_ID);
+  return { runtimeId, orgId };
+}
+
+export function resolveExecutionContextFromInput(input = {}) {
+  const env = resolveExecutionContextFromEnv();
+  const executionContext = input.executionContext && typeof input.executionContext === 'object'
+    ? input.executionContext
+    : {};
+  const context = input.context && typeof input.context === 'object' ? input.context : {};
+  const runtimeId = readUuid(input.runtimeId)
+    || readUuid(executionContext.runtimeId)
+    || readUuid(context.runtimeId)
+    || env.runtimeId;
+  const orgId = readUuid(input.orgId)
+    || readUuid(executionContext.orgId)
+    || readUuid(context.orgId)
+    || env.orgId;
+  return { runtimeId, orgId };
+}
+
+export function buildExecutionContextHeaders(attribution) {
+  const headers = {};
+  if (attribution.runtimeId) headers['x-thirdfy-execution-runtime-id'] = attribution.runtimeId;
+  if (attribution.orgId) headers['x-thirdfy-execution-org-id'] = attribution.orgId;
+  return headers;
+}
+
+export function mergeExecutionContext(body) {
+  const attribution = resolveExecutionContextFromInput(body);
+  if (!attribution.runtimeId && !attribution.orgId) return body;
+  const executionContext = body.executionContext && typeof body.executionContext === 'object'
+    ? { ...body.executionContext }
+    : {};
+  if (attribution.runtimeId && !executionContext.runtimeId) executionContext.runtimeId = attribution.runtimeId;
+  if (attribution.orgId && !executionContext.orgId) executionContext.orgId = attribution.orgId;
+  if (!executionContext.source) executionContext.source = 'hosted_runtime';
+  return { ...body, executionContext };
+}

package/src/core/http.mjs

@@ -1,15 +1,30 @@
+import {
+  buildExecutionContextHeaders,
+  mergeExecutionContext,
+  resolveExecutionContextFromInput,
+} from './executionContext.mjs';
+
 export async function apiGet(ctx, route, headers = {}) {
-  return requestJson(ctx, route, { method: 'GET', headers });
+  return requestJson(ctx, route, { method: 'GET', headers: mergeExecutionContextHeaders(headers) });
+}
+
+function mergeExecutionContextHeaders(headers = {}, body = {}) {
+  return {
+    ...buildExecutionContextHeaders(resolveExecutionContextFromInput(body)),
+    ...headers,
+  };
 }
 
 export async function apiPost(ctx, route, body, headers = {}) {
+  const normalizedBody = body && typeof body === 'object' ? body : {};
+  const mergedBody = mergeExecutionContext(normalizedBody);
   return requestJson(ctx, route, {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
-      ...headers,
+      ...mergeExecutionContextHeaders(headers, normalizedBody),
     },
-    body: JSON.stringify(body),
+    body: JSON.stringify(mergedBody),
   });
 }
 

package/src/runtime/actions/selection.mjs

@@ -87,6 +87,7 @@ function inferActionProvider(action) {
     'deposit-hyperliquid-bridge': 'hyperliquid',
     'place-hyperliquid-perps-order': 'hyperliquid',
     'cancel-hyperliquid-perps-order': 'hyperliquid',
+    'update-hyperliquid-leverage': 'hyperliquid',
     'get-perps-markets': 'hyperliquid',
     'get-perps-account': 'hyperliquid',
     'get-perps-position': 'hyperliquid',

package/src/runtime/execution/lanes.mjs

@@ -5,6 +5,8 @@ const OFFCHAIN_VENUE_ORDER_ACTIONS = new Set([
   'place-hyperliquid-perps-order',
   'cancel_hyperliquid_perps_order',
   'cancel-hyperliquid-perps-order',
+  'update_hyperliquid_leverage',
+  'update-hyperliquid-leverage',
   'place_polymarket_order',
   'place-polymarket-order',
 ]);

package/src/runtime/providerHints.mjs

@@ -38,6 +38,7 @@ export function createProviderHints({ getNegotiatedCapabilitiesCache }) {
         orderManagementActions: [
           'place_hyperliquid_perps_order',
           'cancel_hyperliquid_perps_order',
+          'update_hyperliquid_leverage',
           'get_hyperliquid_open_orders',
         ],
         setupActions: [