@thirdfy/agent-cli 0.2.7 → 0.2.8

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@thirdfy/agent-cli` are documented here. The format is b
 
 ## [Unreleased]
 
+## [0.2.8] - 2026-06-13
+
+### Added
+
+- EarnClaw runtime attribution on all API POSTs: reads `THIRDFY_EXECUTION_RUNTIME_ID` / `THIRDFY_EXECUTION_ORG_ID` (with `EARNCLAW_*` fallback) and sends `executionContext` plus `x-thirdfy-execution-*` headers on execute paths. Pairs with Thirdfy API v3.4.55+ for per-runtime credit debits.
+
+### Fixed
+
+- `apiPost` resolves execution context headers from the request body, not env only.
+
 ## [0.2.7] - 2026-06-08
 
 ### Added

package/README.md

@@ -40,11 +40,11 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.2.7
+## What's new in v0.2.8
 
-- Hyperliquid `update_hyperliquid_leverage` sets per-coin leverage (cross by default) before placing an order; bounded by the venue per-coin maxLeverage.
-- The leverage update is an offchain venue write: run it with `--run-mode thirdfy`, `--run-mode hybrid`, or `--run-mode agent_wallet` (not `self`/BYOW).
-- Provider hints list `update_hyperliquid_leverage` in Hyperliquid order management actions.
+- Hosted runtimes can set `THIRDFY_EXECUTION_RUNTIME_ID` and `THIRDFY_EXECUTION_ORG_ID` in machine env (EarnClaw also sets legacy `EARNCLAW_*` aliases). The CLI forwards neutral `executionContext` on Thirdfy API POSTs.
+- Attribution uses `x-thirdfy-execution-runtime-id`, `x-thirdfy-execution-org-id`, and `executionContext` on execute payloads.
+- Pairs with Thirdfy API v3.4.55+ and EarnClaw cost sync `attribution=strict`.
 
 Older versions: [CHANGELOG.md](./CHANGELOG.md) and [GitHub Releases](https://github.com/thirdfy/agent-cli/releases).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {

package/src/core/earnclawAttribution.mjs

@@ -0,0 +1,7 @@
+/** @deprecated Import from executionContext.mjs instead. */
+export {
+  resolveExecutionContextFromEnv as resolveEarnClawAttributionFromEnv,
+  resolveExecutionContextFromInput as resolveEarnClawAttributionFromInput,
+  buildExecutionContextHeaders as buildEarnClawAttributionHeaders,
+  mergeExecutionContext as mergeEarnClawContext,
+} from './executionContext.mjs';

package/src/core/executionContext.mjs

@@ -0,0 +1,50 @@
+function readUuid(value) {
+  const trimmed = String(value || '').trim();
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)
+    ? trimmed
+    : undefined;
+}
+
+export function resolveExecutionContextFromEnv() {
+  const runtimeId = readUuid(process.env.THIRDFY_EXECUTION_RUNTIME_ID)
+    || readUuid(process.env.EARNCLAW_RUNTIME_ID);
+  const orgId = readUuid(process.env.THIRDFY_EXECUTION_ORG_ID)
+    || readUuid(process.env.EARNCLAW_ORG_ID);
+  return { runtimeId, orgId };
+}
+
+export function resolveExecutionContextFromInput(input = {}) {
+  const env = resolveExecutionContextFromEnv();
+  const executionContext = input.executionContext && typeof input.executionContext === 'object'
+    ? input.executionContext
+    : {};
+  const context = input.context && typeof input.context === 'object' ? input.context : {};
+  const runtimeId = readUuid(input.runtimeId)
+    || readUuid(executionContext.runtimeId)
+    || readUuid(context.runtimeId)
+    || env.runtimeId;
+  const orgId = readUuid(input.orgId)
+    || readUuid(executionContext.orgId)
+    || readUuid(context.orgId)
+    || env.orgId;
+  return { runtimeId, orgId };
+}
+
+export function buildExecutionContextHeaders(attribution) {
+  const headers = {};
+  if (attribution.runtimeId) headers['x-thirdfy-execution-runtime-id'] = attribution.runtimeId;
+  if (attribution.orgId) headers['x-thirdfy-execution-org-id'] = attribution.orgId;
+  return headers;
+}
+
+export function mergeExecutionContext(body) {
+  const attribution = resolveExecutionContextFromInput(body);
+  if (!attribution.runtimeId && !attribution.orgId) return body;
+  const executionContext = body.executionContext && typeof body.executionContext === 'object'
+    ? { ...body.executionContext }
+    : {};
+  if (attribution.runtimeId && !executionContext.runtimeId) executionContext.runtimeId = attribution.runtimeId;
+  if (attribution.orgId && !executionContext.orgId) executionContext.orgId = attribution.orgId;
+  if (!executionContext.source) executionContext.source = 'hosted_runtime';
+  return { ...body, executionContext };
+}

package/src/core/http.mjs

@@ -1,15 +1,30 @@
+import {
+  buildExecutionContextHeaders,
+  mergeExecutionContext,
+  resolveExecutionContextFromInput,
+} from './executionContext.mjs';
+
 export async function apiGet(ctx, route, headers = {}) {
-  return requestJson(ctx, route, { method: 'GET', headers });
+  return requestJson(ctx, route, { method: 'GET', headers: mergeExecutionContextHeaders(headers) });
+}
+
+function mergeExecutionContextHeaders(headers = {}, body = {}) {
+  return {
+    ...buildExecutionContextHeaders(resolveExecutionContextFromInput(body)),
+    ...headers,
+  };
 }
 
 export async function apiPost(ctx, route, body, headers = {}) {
+  const normalizedBody = body && typeof body === 'object' ? body : {};
+  const mergedBody = mergeExecutionContext(normalizedBody);
   return requestJson(ctx, route, {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
-      ...headers,
+      ...mergeExecutionContextHeaders(headers, normalizedBody),
     },
-    body: JSON.stringify(body),
+    body: JSON.stringify(mergedBody),
   });
 }