@thirdfy/agent-cli 0.3.0 → 0.4.0

package/src/lib/creditsUsdSummary.mjs

@@ -1,8 +1,52 @@
-export function formatCreditsBalanceSummary(response) {
-  if (typeof response?.availableUsd === 'number') {
-    return `$${response.availableUsd.toFixed(2)} available (${response.balance ?? 0} credits)`;
+/**
+ * Credits balances and action costs are shown in credits, never as a dollar price per credit or per
+ * request (owner decision 2026-10-14; thirdfy-mcp #252 `stripUsdFields`). Buying credits keeps its USD
+ * amount (`credits buy --usd`): that is a purchase, not a request price.
+ */
+const USD_KEY = /usd/i;
+
+/** The value with every key that names USD (and displayCurrency / pricingCurrency) removed, at any depth. */
+export function stripUsdFields(value) {
+  if (Array.isArray(value)) return value.map(stripUsdFields);
+  if (!value || typeof value !== 'object') return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    if (USD_KEY.test(key) || key === 'displayCurrency' || key === 'pricingCurrency') continue;
+    out[key] = stripUsdFields(inner);
   }
-  return `${response?.balance ?? 0} credits`;
+  return out;
+}
+
+const isCount = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+
+/**
+ * Who pays next for the agent's actions, from the agent credits route's fields (thirdfy-api-v2#884):
+ * `freeRequestsRemainingToday` of `freeDailyLimit` (free requests per UTC day) and
+ * `ownerCreditsFallback` (the owner's credits pay once the agent's credits and free requests are
+ * used). Billing order: agent's credits, free requests, owner's credits, refusal. Same wording as
+ * thirdfy-mcp `creditsFreeQuotaNote` (#253). Undefined when an older API omits the fields.
+ */
+export function creditsFreeQuotaNote(payload) {
+  const fields = payload?.data && typeof payload.data === 'object' && 'freeDailyLimit' in payload.data ? payload.data : payload;
+  if (!fields || typeof fields !== 'object') return undefined;
+  const { freeDailyLimit, freeRequestsRemainingToday, ownerCreditsFallback, balanceCredits } = fields;
+  if (!isCount(freeDailyLimit) || !isCount(freeRequestsRemainingToday)) return undefined;
+  const parts = [];
+  if (isCount(balanceCredits) && balanceCredits > 0) parts.push(`The agent's credits (${balanceCredits}) pay first`);
+  parts.push(`${freeRequestsRemainingToday} of ${freeDailyLimit} free requests left today`);
+  if (ownerCreditsFallback && typeof ownerCreditsFallback === 'object' && ownerCreditsFallback.enabled === true) {
+    const owner = ownerCreditsFallback.balanceCredits;
+    parts.push(isCount(owner) ? `then the owner's credits (${owner}) pay` : "then the owner's credits pay");
+  }
+  parts.push('then buy credits');
+  return `${parts.join('; ')}.`;
+}
+
+/** The balance in credits only, with who pays next when the API says. */
+export function formatCreditsBalanceSummary(response) {
+  const credits = `${response?.balance ?? response?.balanceCredits ?? 0} credits`;
+  const note = creditsFreeQuotaNote(response);
+  return note ? `${credits}. ${note}` : credits;
 }
 
 export function formatCreditsModelsSummary(response) {

package/src/runtime/actions/actionList.mjs

@@ -0,0 +1,87 @@
+import { usageError } from '../../core/args.mjs';
+
+/**
+ * Search, paging and views for `actions`, as thirdfy-mcp `getActionsCatalog` / `getAgentActions` page
+ * the list (`src/catalog/actionListFilter.ts`, `src/catalog/actionListView.ts`). The catalog is
+ * hundreds of actions with schemas; `--search`, `--limit`, `--offset` and `--view` return one page.
+ * Without any of them, `actions` prints the whole list as before.
+ * `--provider` and `--chain-id` stay the CLI's own filters (src/runtime/actions/selection.mjs).
+ */
+
+export const DEFAULT_PAGE_SIZE = Object.freeze({ concise: 50, detailed: 10 });
+/** The largest page each view returns, whatever `--limit` asks (thirdfy-mcp MAX_PAGE_SIZE). */
+export const MAX_PAGE_SIZE = Object.freeze({ concise: 100, detailed: 25 });
+
+const CONCISE_FIELDS = ['action', 'providerId', 'category', 'description', 'supportedChains', 'requiredParams', 'riskLevel', 'maxAmountUsd', 'enabled', 'aliases'];
+
+const isRecord = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value));
+const isSet = (value) => value !== undefined && value !== null && String(value).trim() !== '';
+
+/**
+ * The paging flags, checked: `{ search, limit, offset, view }`, or null when none is set (the
+ * list stays whole). A bad value is INVALID_ARGUMENTS.
+ */
+export function readActionListPaging(flags = {}) {
+  if (![flags.search, flags.limit, flags.offset, flags.view].some(isSet)) return null;
+  const view = isSet(flags.view) ? String(flags.view).trim().toLowerCase() : 'concise';
+  if (view !== 'concise' && view !== 'detailed') throw usageError('--view must be concise or detailed', 'view');
+  const count = (key, min, max) => {
+    if (!isSet(flags[key])) return undefined;
+    const text = String(flags[key]).trim();
+    const value = Number(text);
+    if (!/^\d+$/.test(text) || value < min || value > max) throw usageError(`--${key} must be an integer from ${min} to ${max}`, key);
+    return value;
+  };
+  return {
+    search: isSet(flags.search) ? String(flags.search).trim() : undefined,
+    limit: count('limit', 1, 500),
+    offset: count('offset', 0, Number.MAX_SAFE_INTEGER),
+    view,
+  };
+}
+
+const lower = (value) => (typeof value === 'string' ? value.toLowerCase() : '');
+
+/** True when the action's name, title, description or aliases contain `search` (case-insensitive). */
+function matchesSearch(entry, search) {
+  if (!search) return true;
+  const record = isRecord(entry) ? entry : {};
+  const aliases = Array.isArray(record.aliases) ? record.aliases : [];
+  return [record.action, record.name, record.title, record.description, ...aliases].map(lower).join(' ').includes(search.toLowerCase());
+}
+
+function conciseEntry(entry) {
+  if (!isRecord(entry)) return entry;
+  const out = {};
+  for (const field of CONCISE_FIELDS) {
+    const value = entry[field];
+    if (value === undefined || value === null || (Array.isArray(value) && value.length === 0)) continue;
+    out[field] = value;
+  }
+  if (typeof entry.behavior?.readOnly === 'boolean') out.readOnly = entry.behavior.readOnly;
+  return out;
+}
+
+/**
+ * One page of `actions` (already filtered by provider and chain): `{ actions, pagination, view, hint }`.
+ * `pagination` is `{ total, matched, offset, limit, returned, hasMore }`, as thirdfy-mcp returns it.
+ */
+export function pageActionList(actions, paging) {
+  const rows = Array.isArray(actions) ? actions : [];
+  const view = paging.view;
+  const limit = Math.min(paging.limit ?? DEFAULT_PAGE_SIZE[view], MAX_PAGE_SIZE[view]);
+  const offset = paging.offset ?? 0;
+  const matched = rows.filter((entry) => matchesSearch(entry, paging.search));
+  const page = matched.slice(offset, offset + limit);
+  const hasMore = offset + page.length < matched.length;
+  return {
+    actions: view === 'concise' ? page.map(conciseEntry) : page,
+    pagination: { total: rows.length, matched: matched.length, offset, limit, returned: page.length, hasMore },
+    view,
+    hint: hasMore
+      ? `More actions match: run again with --offset ${offset + page.length}, or narrow with --provider or --search.`
+      : view === 'concise'
+        ? '--view detailed (with --provider or --search) returns paramsSchema for each action.'
+        : undefined,
+  };
+}

package/src/runtime/actions/selection.mjs

@@ -7,6 +7,15 @@ import {
   toAvantisSpelling,
   toLegacyVenueActionKey,
 } from '../../core/venueBrand.mjs';
+/**
+ * The action name to send to the API: the one the caller asked for, as thirdfy-mcp sends it
+ * (`gateManagedWriteActionParams` `apiAction`). The catalog key is sent instead only when the request
+ * matched through its Veranta/Avantis twin, the name the API in hand does not know.
+ */
+export function actionNameForApi(resolved) {
+  return String(resolved?.apiAction || resolved?.resolvedAction || '').trim();
+}
+
 export function createActionSelection({ getTradingProviderHint, formatProviderAmbiguousActionHint, formatProviderUnknownActionHint }) {
 function getActionKey(action) {
   return String(action?.action || action?.id || action?.key || action?.name || '')
@@ -368,6 +377,9 @@ function getActionProvider(action) {
 
 async function resolveActionSelection(ctx, flags) {
   const requestedAction = requireFlag(flags, 'action', 'Missing --action');
+  // The agent's own policy list whenever execution will run with an agent key (flag, env or config),
+  // as thirdfy-mcp resolves: an action the agent may not run stops here as UNKNOWN_ACTION with
+  // suggestions, not at the API as ACTION_NOT_ALLOWED.
   const actions = applyActionFilters(await getCachedActionsCatalog(ctx, flags), flags);
   return resolveActionFromRows(requestedAction, actions, flags);
 }
@@ -463,7 +475,6 @@ function matchCatalogEntry(requestedAction, keyed, flags = {}) {
 }
 
 function resolveActionFromRows(requestedAction, actions, flags = {}) {
-  const requestedLower = String(requestedAction || '').toLowerCase();
   const keyed = actions
     .map((action) => ({
       key: getActionKey(action),
@@ -484,34 +495,18 @@ function resolveActionFromRows(requestedAction, actions, flags = {}) {
   }
 
   const direct = matchCatalogEntry(requestedAction, keyed, flags);
-  if (direct) return direct;
+  if (direct) return { ...direct, apiAction: String(requestedAction).trim() };
 
   // Veranta (formerly Avantis): retry with the other spelling so `place_veranta_perps_order` finds the
   // `place_avantis_perps_order` row on an API that has not shipped Veranta names, and the reverse.
   const alternate = alternateVenueActionSpelling(requestedAction);
   if (alternate) {
     const viaAlternate = matchCatalogEntry(alternate, keyed, flags);
-    if (viaAlternate) return { ...viaAlternate, requestedAction };
-  }
-  const alternateLower = alternate ? alternate.toLowerCase() : null;
-
-  const fuzzyNeedles = alternateLower ? [requestedLower, alternateLower] : [requestedLower];
-  const fuzzy = keyed.filter(
-    (entry) =>
-      fuzzyNeedles.some((needle) => entry.key.toLowerCase().includes(needle)) ||
-      entry.aliases.some((a) => fuzzyNeedles.some((needle) => a.toLowerCase().includes(needle)))
-  );
-  if (fuzzy.length === 1) {
-    return { requestedAction, resolvedAction: fuzzy[0].key, resolvedActionMeta: fuzzy[0].action || null };
-  }
-  if (fuzzy.length > 1) {
-    const providerHint = flags.provider ? getTradingProviderHint(flags.provider) : null;
-    throw new Error(
-      `Ambiguous --action "${requestedAction}". Did you mean one of: ${formatActionList(
-        fuzzy.slice(0, 10).map((v) => v.key)
-      )}?${formatProviderAmbiguousActionHint(providerHint)}`
-    );
+    if (viaAlternate) return { ...viaAlternate, requestedAction, apiAction: viaAlternate.resolvedAction };
   }
+  // No substring match: a name that is not an action, alias or Veranta/Avantis twin is unknown, as in
+  // thirdfy-mcp. Picking the one row that contains it ran a different action than the one asked for
+  // (`swap` → `execute_optimal_swap` on a list without `swap`); the near names come back as suggestions.
   return {
     requestedAction,
     resolvedAction: requestedAction,

package/src/runtime/execution/actionPreflight.mjs

@@ -1,5 +1,7 @@
 import { toLegacyVenueActionKey } from '../../core/venueBrand.mjs';
 import { resolveExecuteEstimatedAmountUsd } from './payloads.mjs';
+import { describeCliError } from '../../core/errorEnvelope.mjs';
+import { findRiskRefusal } from '../risk/riskRefusal.mjs';
 
 /**
  * Action-aware `agent_wallet` preflight (Thirdfy API: `GET /agent/execution-wallet?action=…`).
@@ -31,8 +33,12 @@ export function resolveActionVenue(action) {
 
 /**
  * The venue an action executes on, next to the chain the managed wallet was looked up on. The
- * managed wallet is one EVM address on every chain, so a Hyperliquid order still resolves it on the
- * default chain; this says the order itself does not run there.
+ * managed EVM wallet is one address on every EVM chain, so a Hyperliquid order still resolves it on
+ * the default chain; this says the order itself does not run there. Only the four EVM-settled venues
+ * above match. Most Solana actions (Jupiter, Kamino, Meteora, ...) resolve no venue here; the Solana
+ * funding actions `deposit_polymarket_from_solana` and `deposit_hyperliquid_from_solana` name a venue
+ * and so get `executionVenue` in the output. Either way they sign with the separate base58 Solana
+ * agent wallet on chain 101/103, and the API decides venue readiness.
  */
 export function describeExecutionVenue(action, walletLookupChainId) {
   const venue = resolveActionVenue(action);
@@ -41,10 +47,11 @@ export function describeExecutionVenue(action, walletLookupChainId) {
 }
 
 /** Adds `action`, `params` and `estimatedAmountUsd` to an `/execution-wallet` query. */
-export function appendActionPreflightQuery(query, { action, params, flags }) {
+export function appendActionPreflightQuery(query, { action, apiAction, params, flags }) {
   const actionId = String(action || '').trim();
   if (!actionId) return query;
-  query.set('action', actionId);
+  // The API gets the requested name (as thirdfy-mcp sends it); the catalog key sizes the estimate.
+  query.set('action', String(apiAction || actionId).trim());
   if (params && typeof params === 'object' && !Array.isArray(params) && Object.keys(params).length) {
     query.set('params', JSON.stringify(params));
   }
@@ -53,11 +60,22 @@ export function appendActionPreflightQuery(query, { action, params, flags }) {
   return query;
 }
 
-/** Venue fields an action preflight carries onto the CLI envelope. */
-export const ACTION_PREFLIGHT_VENUE_FIELDS = Object.freeze(['venue', 'venueReadiness', 'blockingReasons']);
+/**
+ * Venue and order fields an action preflight carries onto the CLI envelope: venue readiness, the
+ * order preview (`orderPreview`), a risk-policy refusal (`riskRefusal`) and a venue setup that runs
+ * with the first order (`venueSetup`), as thirdfy-mcp `previewOrder` reads them.
+ */
+export const ACTION_PREFLIGHT_VENUE_FIELDS = Object.freeze([
+  'venue',
+  'venueReadiness',
+  'blockingReasons',
+  'orderPreview',
+  'riskRefusal',
+  'venueSetup',
+]);
 
 /** Stages at which the API refused the action itself (as opposed to a CLI-local check). */
-const API_BLOCK_STAGES = new Set(['catalog', 'policy', 'venue_readiness']);
+const API_BLOCK_STAGES = new Set(['catalog', 'policy', 'venue_readiness', 'venue_rules', 'risk_policy']);
 
 /** True when the API blocked the action (policy, catalog, venue readiness). */
 export function isApiActionBlock(preflight) {
@@ -70,24 +88,42 @@ export function pickActionPreflightFields(response) {
   for (const key of [...ACTION_PREFLIGHT_VENUE_FIELDS, 'actionPreflight']) {
     if (response?.[key] != null) out[key] = response[key];
   }
+  // A risk-policy refusal may sit under `data`; carry it at the top level.
+  const riskRefusal = out.riskRefusal || findRiskRefusal(response);
+  if (riskRefusal) out.riskRefusal = riskRefusal;
   return out;
 }
 
 /**
- * A blocked action preflight arrives as a non-2xx answer (409 `VENUE_NOT_READY`, 403 policy, 429
- * limits) with `preflightBlocked: true`. Turn it into a blocked preflight result; null otherwise.
+ * The API answered the action preflight but refused the action (`success: false`, from a non-2xx
+ * `preflightBlocked` answer or a 2xx one). `preflightBlocked: true` tells it from a CLI-local check.
  */
-export function blockedActionPreflightFromError(error) {
-  const payload = error?.payload;
-  if (!payload || typeof payload !== 'object' || payload.preflightBlocked !== true) return null;
+export function blockedActionPreflight(payload, { statusCode = null, fallbackError = 'Preflight blocked', errorFields = {} } = {}) {
   return {
     success: false,
+    preflightBlocked: true,
     blockedReason: String(payload.blockedReason || 'PREFLIGHT_BLOCKED'),
     blockedStage: String(payload.blockedStage || 'policy'),
-    error: String(payload.error || payload.message || error?.message || 'Preflight blocked'),
-    statusCode: Number(error?.statusCode) || null,
+    error: String(payload.error || payload.message || fallbackError),
+    statusCode,
     signerMethod: payload.signerMethod || 'managed_wallet_server',
     ...pickActionPreflightFields(payload),
     ...(payload.data ? { data: payload.data } : {}),
+    ...errorFields,
   };
 }
+
+/**
+ * A blocked action preflight arrives as a non-2xx answer (409 `VENUE_NOT_READY`, 403 policy, 429
+ * limits) with `preflightBlocked: true`. Turn it into a blocked preflight result; null otherwise.
+ */
+export function blockedActionPreflightFromError(error) {
+  const payload = error?.payload;
+  if (!payload || typeof payload !== 'object' || payload.preflightBlocked !== true) return null;
+  return blockedActionPreflight(payload, {
+    statusCode: Number(error?.statusCode) || null,
+    fallbackError: error?.message || 'Preflight blocked',
+    // errorCode, retryable, retryAfterSeconds, nextAction, hint: as thirdfy-mcp's error envelope.
+    errorFields: describeCliError(error),
+  });
+}

package/src/runtime/execution/payloads.mjs

@@ -2,7 +2,7 @@ import { randomUUID } from 'crypto';
 import { wrapWriteIdempotencyKeyForHostedRuntime } from '../../core/hostedRuntimeIdempotency.mjs';
 import { resolveExecutionContextFromEnv } from '../../core/executionContext.mjs';
 import { requireFlag, parseJsonFlag } from '../../core/args.mjs';
-import { loadProfileConfig } from '../../core/context.mjs';
+import { findAgentApiKey, loadProfileConfig } from '../../core/context.mjs';
 import { createCliError } from '../../core/envelope.mjs';
 import { toLegacyVenueActionKey } from '../../core/venueBrand.mjs';
 import { normalizeRunMode, normalizeManagedRunMode, normalizeHybridWalletMode } from '../../core/runMode.mjs';
@@ -14,15 +14,25 @@ function isTruthyFlag(value) {
   return value === true || String(value || '').trim().toLowerCase() === 'true';
 }
 
-export function mergeConfirmWritesIntoParams(params, flags) {
+const SCHEMA_CONFIRMATION_KEYS = ['confirmWrites', 'confirm'];
+
+/**
+ * `--confirm-writes` (or `--confirm`) copied into each confirmation key the action's catalog
+ * `paramsSchema` lists, and only those, as thirdfy-mcp `injectSchemaConfirmationIntoParams`
+ * (`src/catalog/actionParamsGate.ts`): `params.confirmWrites` on Veranta writes, `params.confirm` on
+ * the Hyperliquid and Polymarket bridge and capital hops. A schema with `additionalProperties: false`
+ * refuses any other key, so a key it does not list is never added. A value already in params wins.
+ * The schema defaults to the one the catalog params gate kept on `flags`.
+ */
+export function mergeConfirmWritesIntoParams(params, flags, schema = flags?.__actionParamsSchema) {
   const next = { ...(params && typeof params === 'object' ? params : {}) };
-  if (
-    isTruthyFlag(flags?.confirmWrites) ||
-    isTruthyFlag(flags?.confirm) ||
-    next.confirmWrites === true ||
-    next.confirm === true
-  ) {
-    next.confirmWrites = true;
+  if (!isTruthyFlag(flags?.confirmWrites) && !isTruthyFlag(flags?.confirm)) return next;
+  const properties = schema && typeof schema === 'object' ? schema.properties : null;
+  if (!properties || typeof properties !== 'object') return next;
+  for (const key of SCHEMA_CONFIRMATION_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(properties, key)) continue;
+    if (next[key] !== undefined) continue;
+    next[key] = true;
   }
   return next;
 }
@@ -37,11 +47,11 @@ export function resolveExecuteEstimatedAmountUsd(action, flags) {
 }
 
 export function createExecutionPayloads({ getPreparedParams, rawUnitsToDecimalString }) {
-function buildBuildTxPayload(flags, resolvedAction) {
+function buildBuildTxPayload(flags, resolvedAction, apiAction) {
   const runMode = String(flags.runMode || '').trim().toLowerCase() || 'self';
   const payload = {
     agentApiKey: resolveAgentApiKey(flags, runMode),
-    action: String(resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
+    action: String(apiAction || resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
     params: getPreparedParams(flags),
   };
   if (flags.chainId) payload.chainId = Number(flags.chainId);
@@ -129,10 +139,11 @@ function buildManagedExecutePayload(flags, options) {
     delete managedParams.tokenInDecimals;
     managedParams.amountIn = flags.__swapInput.amountInHuman;
   }
+  // `action` (the catalog key) drives the CLI's own rules; the API gets the requested name.
   const action = String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim();
   const payload = {
     agentApiKey: resolveAgentApiKey(flags, runMode),
-    action,
+    action: String(options.apiAction || action).trim(),
     userDid: resolveEffectiveUserDid(flags, {
       runMode,
       hybridWalletMode: options.hybridWalletMode,
@@ -155,11 +166,11 @@ function buildManagedExecutePayload(flags, options) {
       'Managed wallet execution requires --user-did, --agent-key (solo did:wallet identity), THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.'
     );
   }
-  const estimatedAmountUsd = resolveExecuteEstimatedAmountUsd(payload.action, flags);
+  const estimatedAmountUsd = resolveExecuteEstimatedAmountUsd(action, flags);
   if (estimatedAmountUsd != null) payload.estimatedAmountUsd = estimatedAmountUsd;
   if (options.forceIdempotency) {
     payload.executionIdempotencyKey = String(
-      flags.idempotencyKey || `cli:walletExecute:${payload.action}:${Date.now()}:${randomUUID()}`
+      flags.idempotencyKey || `cli:walletExecute:${action}:${Date.now()}:${randomUUID()}`
     );
   } else if (flags.idempotencyKey) {
     payload.executionIdempotencyKey = String(flags.idempotencyKey);
@@ -168,11 +179,11 @@ function buildManagedExecutePayload(flags, options) {
     payload.executionIdempotencyKey = wrapWriteIdempotencyKeyForHostedRuntime(
       payload.executionIdempotencyKey,
       resolveExecutionContextFromEnv().runtimeId,
-      payload.action,
+      action,
     );
   }
   assertHostedRuntimePolymarketWriteIdempotency({
-    action: payload.action,
+    action,
     idempotencyKey: payload.executionIdempotencyKey,
     paramsIdempotencyKey: managedParams?.idempotencyKey,
   });
@@ -181,14 +192,16 @@ function buildManagedExecutePayload(flags, options) {
 
 function buildIntentPayload(flags, options) {
   const runMode = String(options.runMode || flags.runMode || '').trim().toLowerCase() || 'thirdfy';
+  // `action` (the catalog key) drives the CLI's own rules; the API gets the requested name.
+  const action = String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim();
   const payload = {
     agentApiKey: resolveAgentApiKey(flags, runMode),
-    action: String(options.resolvedAction || requireFlag(flags, 'action', 'Missing --action')).trim(),
+    action: String(options.apiAction || action).trim(),
     params: mergeConfirmWritesIntoParams(getPreparedParams(flags), flags),
   };
   if (flags.catalog) payload.catalog = String(flags.catalog).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
-  const estimatedAmountUsd = resolveExecuteEstimatedAmountUsd(payload.action, flags);
+  const estimatedAmountUsd = resolveExecuteEstimatedAmountUsd(action, flags);
   if (estimatedAmountUsd != null) payload.estimatedAmountUsd = estimatedAmountUsd;
   const intentRunMode = String(options.runMode || flags.runMode || '').trim().toLowerCase();
   const userDid = resolveEffectiveUserDid(flags, {
@@ -213,7 +226,7 @@ function buildIntentPayload(flags, options) {
     };
   }
   if (options.forceIdempotency) {
-    payload.idempotencyKey = String(flags.idempotencyKey || `cli:${payload.action}:${Date.now()}:${randomUUID()}`);
+    payload.idempotencyKey = String(flags.idempotencyKey || `cli:${action}:${Date.now()}:${randomUUID()}`);
   } else if (flags.idempotencyKey) {
     payload.idempotencyKey = String(flags.idempotencyKey);
   }
@@ -221,12 +234,12 @@ function buildIntentPayload(flags, options) {
     payload.idempotencyKey = wrapWriteIdempotencyKeyForHostedRuntime(
       payload.idempotencyKey,
       resolveExecutionContextFromEnv().runtimeId,
-      payload.action,
+      action,
     );
   }
   if (!options.validationOnly) {
     assertHostedRuntimePolymarketWriteIdempotency({
-      action: payload.action,
+      action,
       idempotencyKey: payload.idempotencyKey,
       paramsIdempotencyKey: payload.params?.idempotencyKey,
     });
@@ -235,13 +248,8 @@ function buildIntentPayload(flags, options) {
 }
 
 function resolveAgentApiKey(flags, runMode) {
-  const explicit = String(flags.agentApiKey || '').trim();
-  if (explicit) return explicit;
-  const envKey = String(process.env.THIRDFY_AGENT_API_KEY || '').trim();
-  if (envKey) return envKey;
-  const config = loadProfileConfig();
-  const configKey = String(config?.agent?.apiKey || '').trim();
-  if (configKey) return configKey;
+  const key = findAgentApiKey(flags);
+  if (key) return key;
   if (runMode === 'self') {
     throw new Error(
       'SELF_OPEN_DISABLED: self mode without agent identity is not enabled on this API yet. Set --agent-api-key, THIRDFY_AGENT_API_KEY, or login/config default.'