@thirdfy/agent-cli 0.4.1 → 0.4.3

package/src/commands/{delegation.mjs → onboarding/delegation.mjs}

@@ -1,11 +1,11 @@
-import { requireFlag, parseJsonFlag } from '../core/args.mjs';
-import { createCliError } from '../core/envelope.mjs';
-import { getEffectiveRunMode } from '../core/runMode.mjs';
-import { apiGet, apiPost, requestWithRouteFallback } from '../core/http.mjs';
+import { requireFlag, parseJsonFlag } from '../../core/args.mjs';
+import { createCliError } from '../../core/envelope.mjs';
+import { getEffectiveRunMode } from '../../core/runMode.mjs';
+import { apiGet, apiPost, requestWithRouteFallback } from '../../core/http.mjs';
 import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
-const { normalizeDelegationStatus } = require('../utils/cli/delegationNormalization.cjs');
+const { normalizeDelegationStatus } = require('../../utils/cli/delegationNormalization.cjs');
 
 export function createDelegationCommands(deps) {
   const {

package/src/commands/{avantis.mjs → venues/avantis.mjs}

@@ -1,4 +1,4 @@
-import { toLegacyVenueActionKey } from '../core/venueBrand.mjs';
+import { toLegacyVenueActionKey } from '../../core/venueBrand.mjs';
 
 /**
  * Veranta (formerly Avantis) helpers. Names keep the Avantis spelling (internal identifiers); every

package/src/commands/{condor.mjs → venues/condor.mjs}

@@ -1,7 +1,7 @@
-import { apiPost } from '../core/http.mjs';
-import { exitAfterOutput } from '../core/envelope.mjs';
-import { parseJsonFlag } from '../core/args.mjs';
-import { negotiateCapabilities } from '../core/http.mjs';
+import { apiPost } from '../../core/http.mjs';
+import { exitAfterOutput } from '../../core/envelope.mjs';
+import { parseJsonFlag } from '../../core/args.mjs';
+import { negotiateCapabilities } from '../../core/http.mjs';
 import { resolveConfigAgentKey } from './polymarket.mjs';
 
 function agentApiKeyFromFlags(flags, ctx) {

package/src/commands/{hummingbot.mjs → venues/hummingbot.mjs}

@@ -1,7 +1,7 @@
-import { apiGet, apiPost } from '../core/http.mjs';
-import { exitAfterOutput } from '../core/envelope.mjs';
-import { parseJsonFlag } from '../core/args.mjs';
-import { negotiateCapabilities } from '../core/http.mjs';
+import { apiGet, apiPost } from '../../core/http.mjs';
+import { exitAfterOutput } from '../../core/envelope.mjs';
+import { parseJsonFlag } from '../../core/args.mjs';
+import { negotiateCapabilities } from '../../core/http.mjs';
 import { resolveConfigAgentKey } from './polymarket.mjs';
 
 function orgIdFromFlags(flags) {

package/src/commands/{hyperliquid.mjs → venues/hyperliquid.mjs}

@@ -1,4 +1,4 @@
-import { parseJsonFlag } from '../core/args.mjs';
+import { parseJsonFlag } from '../../core/args.mjs';
 
 export function createHyperliquidHelpers(deps) {
   const { getPreparedParams, resolveManagedExecutionPreflight } = deps;

package/src/commands/{lighter.mjs → venues/lighter.mjs}

@@ -1,4 +1,4 @@
-import { parseJsonFlag } from '../core/args.mjs';
+import { parseJsonFlag } from '../../core/args.mjs';
 
 export function createLighterHelpers(deps) {
   const { getPreparedParams, resolveManagedExecutionPreflight } = deps;

package/src/commands/{polymarket.mjs → venues/polymarket.mjs}

@@ -1,7 +1,7 @@
-import { loadProfileConfig } from '../core/context.mjs';
-import { negotiateCapabilities } from '../core/http.mjs';
-import { parseBooleanFlag } from '../core/runMode.mjs';
-import { exitAfterOutput } from '../core/envelope.mjs';
+import { loadProfileConfig } from '../../core/context.mjs';
+import { negotiateCapabilities } from '../../core/http.mjs';
+import { parseBooleanFlag } from '../../core/runMode.mjs';
+import { exitAfterOutput } from '../../core/envelope.mjs';
 
 function extractAgentKey(value) {
   if (!value || typeof value !== 'object') return '';

package/src/commands/{venue.mjs → venues/venue.mjs}

@@ -1,6 +1,6 @@
-import { apiGet, apiPost } from '../core/http.mjs';
-import { loadProfileConfig } from '../core/context.mjs';
-import { normalizeVenueProviderId } from '../core/venueBrand.mjs';
+import { apiGet, apiPost } from '../../core/http.mjs';
+import { loadProfileConfig } from '../../core/context.mjs';
+import { normalizeVenueProviderId } from '../../core/venueBrand.mjs';
 
 // `avantis` is the internal venue id the API expects; `veranta` (the venue's new name) maps onto it.
 const VENUES = new Set(['polymarket', 'hyperliquid', 'lighter', 'avantis']);

package/src/core/chainRegistry.mjs

@@ -293,6 +293,17 @@ export function resolveChainRpcUrl({ chainId, rpcUrl, env = process.env } = {})
   return getChainInfo(id)?.rpcUrl || '';
 }
 
+/**
+ * An ethers JsonRpcProvider pinned to `chainId` (`staticNetwork`). Without a pinned network, ethers
+ * probes the RPC for its chain and, when the RPC is down, prints a retry line to stdout every second
+ * and keeps the process alive, which breaks `--json` output. Pinned, a dead RPC is one rejected
+ * call. `getNetwork()` then echoes the pin; read the RPC's real chain with `send('eth_chainId', [])`.
+ */
+export function pinnedRpcProvider(ethers, { rpcUrl, chainId }) {
+  const id = positiveChainId(chainId) || DEFAULT_CHAIN_ID;
+  return new ethers.JsonRpcProvider(rpcUrl, id, { staticNetwork: true });
+}
+
 /**
  * Parse a --chain-id value. Returns null when absent, a positive integer when valid,
  * and NaN when present but not a positive integer (the caller rejects it).

package/src/core/constants.mjs

@@ -1,25 +1,6 @@
 export const DEFAULT_API_BASE = 'https://api.thirdfy.com';
 export const DEFAULT_TIMEOUT_MS = 30000;
 export const DEFAULT_CATALOG_CACHE_TTL_MS = 60_000;
-export const DEFAULT_BITFINEX_BASE_URL = 'https://api.bitfinex.com';
-export const BITFINEX_PERMISSION_PROFILES = {
-  funding: {
-    id: 'funding',
-    credentialRef: 'bitfinex:funding-primary',
-    required: {
-      funding: { read: 1, write: 1 },
-      wallets: { read: 1, write: 0 },
-    },
-  },
-  spot: {
-    id: 'spot',
-    credentialRef: 'bitfinex:spot-primary',
-    required: {
-      orders: { read: 1, write: 1 },
-      wallets: { read: 1, write: 0 },
-    },
-  },
-};
 export const RUN_MODES = ['thirdfy', 'self', 'hybrid', 'agent_wallet'];
 export const HYBRID_WALLET_MODES = ['self', 'agent_wallet'];
 export const CUSTODY_MODES = ['managed', 'external'];

package/src/core/earnclawAttribution.mjs

@@ -4,4 +4,4 @@ export {
   resolveExecutionContextFromInput as resolveEarnClawAttributionFromInput,
   buildExecutionContextHeaders as buildEarnClawAttributionHeaders,
   mergeExecutionContext as mergeEarnClawContext,
-} from './executionContext.mjs';
+} from './execution/executionContext.mjs';

package/src/core/{actionTimeouts.mjs → execution/actionTimeouts.mjs}

@@ -1,6 +1,6 @@
-import { DEFAULT_TIMEOUT_MS } from './constants.mjs';
+import { DEFAULT_TIMEOUT_MS } from '../constants.mjs';
 import { isReadOnlyActionName, isReadOnlyResolvedAction } from './readOnlyActions.mjs';
-import { toLegacyVenueActionKey } from './venueBrand.mjs';
+import { toLegacyVenueActionKey } from '../venueBrand.mjs';
 
 /**
  * Default HTTP timeout for managed writes. A perps order or TP/SL update signs, broadcasts, and waits

package/src/core/{walletExecuteChainId.mjs → execution/walletExecuteChainId.mjs}

@@ -1,4 +1,4 @@
-import { isSvmChainId } from './chainRegistry.mjs';
+import { isSvmChainId } from '../chainRegistry.mjs';
 
 const DEFAULT_CHAIN_ID = 8453;
 

package/src/core/http.mjs

@@ -2,7 +2,7 @@ import {
   buildExecutionContextHeaders,
   mergeExecutionContext,
   resolveExecutionContextFromInput,
-} from './executionContext.mjs';
+} from './execution/executionContext.mjs';
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));

package/src/runtime/actions/selection.mjs

@@ -222,7 +222,6 @@ function inferActionProvider(action) {
   if (key.includes('lighter')) return 'lighter';
   if (key.includes('avantis') && key.includes('vault')) return 'avantis-vault';
   if (key.includes('avantis')) return 'avantis';
-  if (key.includes('bitfinex')) return 'bitfinex';
   if (key.includes('polymarket') || key.includes('prediction')) return 'polymarket';
   if (key.includes('vaults-fyi')) return 'vaults-fyi';
   if (key.includes('yield-xyz')) return 'yield-xyz';

package/src/runtime/execution/hostedRuntimeWriteGate.mjs

@@ -2,7 +2,7 @@ import { createCliError } from '../../core/envelope.mjs';
 import {
   HOSTED_RUNTIME_IDEMPOTENCY_NAMESPACE,
   readHostedRuntimeUuid,
-} from '../../core/hostedRuntimeIdempotency.mjs';
+} from '../../core/execution/hostedRuntimeIdempotency.mjs';
 
 const POLYMARKET_PLACE_ACTIONS = new Set([
   'place_polymarket_order',

package/src/runtime/execution/payloads.mjs

@@ -1,14 +1,14 @@
 import { randomUUID } from 'crypto';
-import { wrapWriteIdempotencyKeyForHostedRuntime } from '../../core/hostedRuntimeIdempotency.mjs';
-import { resolveExecutionContextFromEnv } from '../../core/executionContext.mjs';
+import { wrapWriteIdempotencyKeyForHostedRuntime } from '../../core/execution/hostedRuntimeIdempotency.mjs';
+import { resolveExecutionContextFromEnv } from '../../core/execution/executionContext.mjs';
 import { requireFlag, parseJsonFlag } from '../../core/args.mjs';
 import { findAgentApiKey, loadProfileConfig } from '../../core/context.mjs';
 import { createCliError } from '../../core/envelope.mjs';
 import { toLegacyVenueActionKey } from '../../core/venueBrand.mjs';
 import { normalizeRunMode, normalizeManagedRunMode, normalizeHybridWalletMode } from '../../core/runMode.mjs';
 import { assertHostedRuntimePolymarketWriteIdempotency } from './hostedRuntimeWriteGate.mjs';
-import { resolveTokenInForFunding } from '../../core/fundingTokenIn.mjs';
-import { resolveWalletExecuteChainId } from '../../core/walletExecuteChainId.mjs';
+import { resolveTokenInForFunding } from '../../core/execution/fundingTokenIn.mjs';
+import { resolveWalletExecuteChainId } from '../../core/execution/walletExecuteChainId.mjs';
 
 function isTruthyFlag(value) {
   return value === true || String(value || '').trim().toLowerCase() === 'true';

package/src/runtime/execution/runners/agentWalletLane.mjs

@@ -0,0 +1,109 @@
+import { apiPost } from '../../../core/http.mjs';
+import { withActionTimeout } from '../../../core/execution/actionTimeouts.mjs';
+import { actionNameForApi } from '../../actions/selection.mjs';
+import { isEmptyQueuedExecuteIntent } from '../managedReadExecuteRail.mjs';
+import {
+  isReadOnlyAction,
+  shouldFallbackAgentWalletToExecuteIntent,
+  normalizeManagedExecuteResponse,
+  READ_FAST_PATH_PREFLIGHT,
+  fastPathWalletMismatch,
+} from './managedResponse.mjs';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { normalizeIntentResponse } = require('../../../utils/cli/intentNormalization.cjs');
+
+/** The agent_wallet lane: the API signs with the agent's execution wallet. */
+export function createAgentWalletLane(deps, lanes) {
+  const {
+    buildManagedExecutePayload,
+  } = deps;
+  const { shouldUseManagedReadFastPath, runReadOnlyActionViaIntentRail, resolveManagedExecutionPreflight } = lanes;
+
+async function executeManagedWalletRun(ctx, flags, resolved, options) {
+  // Market-data reads under agent_wallet must use /execute and keep the provider payload on the
+  // envelope (raw + parsed data.result). Routing them only through /execute-intent was the 0.2.34
+  // attempt to avoid a burial bug, but solo Hermes agent_wallet intents come back as an empty
+  // queued envelope with no universe. Live /execute still returns the Hyperliquid meta payload
+  // (often as a JSON string under data.result). Reads skip funding gates; routing still fails closed.
+  const isRead = isReadOnlyAction(resolved);
+  const skipPreflight = Boolean(options?.skipPreflight);
+  // A seeded preflight (Hyperliquid/Lighter/Veranta address defaults) already ran; reuse it.
+  const readFastPath =
+    !skipPreflight && !options?.managedPreflight && shouldUseManagedReadFastPath(flags, resolved, options);
+  let preflight = readFastPath ? READ_FAST_PATH_PREFLIGHT : null;
+  if (!skipPreflight && !readFastPath) {
+    preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
+      runMode: 'agent_wallet',
+      requireFundingCheck: !isRead,
+      preflightSeed: options?.managedPreflight,
+    });
+    if (!preflight.success) {
+      const normalized = normalizeIntentResponse({
+        success: false,
+        status: 'failed',
+        mode: 'agent_wallet',
+        blockedReason: preflight.blockedReason || 'PRECHECK_FAILED',
+        blockedStage: preflight.blockedStage || 'routing',
+        error: preflight.error || 'Managed wallet preflight failed',
+        preflightBlocked: true,
+        executionWalletAddress: preflight.executionWalletAddress || null,
+        executionWalletPreflight: preflight,
+      });
+      normalized.executionWalletAddress = preflight.executionWalletAddress || null;
+      normalized.executionWalletPreflight = preflight;
+      return normalized;
+    }
+  }
+  const payload = buildManagedExecutePayload(flags, {
+    resolvedAction: resolved.resolvedAction,
+    apiAction: actionNameForApi(resolved),
+    runMode: 'agent_wallet',
+    forceIdempotency: true,
+  });
+  const actionCtx = withActionTimeout(ctx, resolved);
+  const response = await apiPost(actionCtx, '/api/v1/agent/execute', payload);
+  if (readFastPath) {
+    const mismatch = fastPathWalletMismatch(flags, response);
+    if (mismatch) return mismatch;
+  }
+  if (shouldFallbackAgentWalletToExecuteIntent(resolved, response)) {
+    // On the fast path the wallet comes from the /execute answer, not a preflight.
+    const fallbackPreflight = readFastPath
+      ? {
+          ...READ_FAST_PATH_PREFLIGHT,
+          executionWalletAddress: response?.executionWalletAddress || response?.data?.executionWalletAddress || null,
+        }
+      : preflight;
+    const intentResult = await runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, fallbackPreflight);
+    if (isEmptyQueuedExecuteIntent(intentResult.raw || intentResult)) {
+      // A read that did not answer in time (often a cold provider cache): nothing changed, and the
+      // same read usually answers on the next try. Same fields as thirdfy-mcp walletExecute.
+      intentResult.success = false;
+      intentResult.status = 'failed';
+      intentResult.error = intentResult.error || 'MANAGED_READ_EMPTY_EXECUTE_INTENT';
+      Object.assign(intentResult, {
+        errorCode: 'MANAGED_READ_EMPTY_EXECUTE_INTENT',
+        retryable: true,
+        retryAfterSeconds: 3,
+        nextAction: 'retry_later',
+        hint:
+          intentResult.hint ||
+          'The read did not answer in time; nothing was changed. Repeat the same read in a few seconds. Do not treat the empty queued result as data.',
+      });
+    }
+    intentResult.executionWalletAddress =
+      preflight?.executionWalletAddress ||
+      response?.executionWalletAddress ||
+      response?.data?.executionWalletAddress ||
+      null;
+    return intentResult;
+  }
+  return normalizeManagedExecuteResponse(response, { preflight, payload, isRead });
+}
+
+  return {
+    executeManagedWalletRun,
+  };
+}

package/src/runtime/execution/runners/createExecutionRunners.mjs

@@ -0,0 +1,312 @@
+import { ACTION_PREFLIGHT_VENUE_FIELDS, isApiActionBlock } from '../actionPreflight.mjs';
+import { normalizeHybridWalletMode } from '../../../core/runMode.mjs';
+import { apiPost } from '../../../core/http.mjs';
+import { actionNameForApi } from '../../actions/selection.mjs';
+import { isReadOnlyAction } from './managedResponse.mjs';
+import { createManagedPreflight } from './managedPreflight.mjs';
+import { createThirdfyLane } from './thirdfyLane.mjs';
+import { createSelfLane } from './selfLane.mjs';
+import { createAgentWalletLane } from './agentWalletLane.mjs';
+import { createHybridLane } from './hybridLane.mjs';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { normalizeIntentResponse } = require('../../../utils/cli/intentNormalization.cjs');
+
+/** Execution runners: the preflight and the run for each run mode, wired from the lane files. */
+export function createExecutionRunners(deps) {
+  const {
+    buildIntentPayload,
+    shouldUseBuildTxPreflight,
+  } = deps;
+  const { shouldUseManagedReadFastPath, resolveManagedExecutionPreflight } = createManagedPreflight(deps);
+  const { executeThirdfyRun, runReadOnlyActionViaIntentRail } = createThirdfyLane(deps);
+  const { executeSelfRun, performSelfBroadcast, resolveEffectCheckResult, submitSignedTx } = createSelfLane(deps, { runReadOnlyActionViaIntentRail });
+  const { executeManagedWalletRun } = createAgentWalletLane(deps, { shouldUseManagedReadFastPath, resolveManagedExecutionPreflight, runReadOnlyActionViaIntentRail });
+  const { executeHybridRun } = createHybridLane(deps, { runReadOnlyActionViaIntentRail, executeManagedWalletRun, executeSelfRun });
+
+async function runPreflightByMode(runMode, ctx, flags, resolved, options = {}) {
+  const resolvedAction = resolved.resolvedAction;
+  if (runMode === 'agent_wallet') {
+    const preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
+      runMode,
+      // Reads carry no transaction; keep funding optional so preflight matches run.
+      requireFundingCheck: !isReadOnlyAction(resolved),
+      preflightSeed: options.managedPreflight,
+      // Ask the API to check policy and venue readiness for this action, not just the wallet.
+      evaluateAction: true,
+    });
+    const normalized = normalizeIntentResponse({
+      success: preflight.success,
+      status: preflight.success ? 'ready' : 'failed',
+      mode: 'agent_wallet',
+      executionWalletAddress: preflight.executionWalletAddress || null,
+      signerMethod: preflight.signerMethod || 'managed_wallet_server',
+      blockedReason: preflight.blockedReason || null,
+      blockedStage: preflight.blockedStage || null,
+      error: preflight.success ? null : preflight.error || 'Managed wallet preflight failed',
+      preflightBlocked: !preflight.success,
+      fundingTokenBalance: preflight.fundingTokenBalance || null,
+      executionWalletPreflight: preflight,
+    });
+    normalized.executionWalletAddress = preflight.executionWalletAddress || null;
+    normalized.signerMethod = preflight.signerMethod || 'managed_wallet_server';
+    normalized.executionWalletPreflight = preflight;
+    normalized.fundingTokenBalance = preflight.fundingTokenBalance || null;
+    normalized.policyEvaluated = preflight.policyEvaluated === true;
+    for (const key of [...ACTION_PREFLIGHT_VENUE_FIELDS, 'executionVenue']) {
+      if (preflight[key] != null) normalized[key] = preflight[key];
+    }
+    // Only an API refusal of the action is `blocked`; CLI-local checks keep `failed`.
+    const apiBlocked = isApiActionBlock(preflight);
+    if (apiBlocked) normalized.status = 'blocked';
+    return {
+      message: preflight.success
+        ? 'Managed wallet preflight completed'
+        : preflight.blockedStage === 'venue_readiness'
+          ? 'Managed wallet preflight blocked: venue not ready'
+          : apiBlocked
+            ? 'Managed wallet preflight blocked by policy'
+            : 'Managed wallet preflight failed',
+      route: 'execution_wallet_preflight',
+      normalized,
+    };
+  }
+  if (runMode === 'self') {
+    // Reads have no unsigned tx to prepare. Keep preflight on validation-only execute-intent so
+    // operators dry-running self mode do not trigger a real catalog read (run still uses the read rail).
+    if (isReadOnlyAction(resolved)) {
+      const payload = buildIntentPayload(flags, {
+        validationOnly: true,
+        forceIdempotency: false,
+        resolvedAction,
+        apiAction: actionNameForApi(resolved),
+        runMode: 'self',
+        mirrorOnly: false,
+      });
+      const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
+      const normalized = normalizeIntentResponse(response);
+      const blockedCount = normalized.blocked || 0;
+      if (!normalized.success || blockedCount > 0) {
+        normalized.success = false;
+        normalized.error = normalized.error || 'Preflight blocked self execution';
+        normalized.preflightBlocked = true;
+      }
+      return {
+        message: normalized.success
+          ? 'Self preflight completed'
+          : normalized.preflightBlocked
+            ? 'Self preflight blocked by governance'
+            : 'Self preflight failed',
+        route: 'execute_intent_validation',
+        normalized,
+      };
+    }
+    const route = shouldUseBuildTxPreflight(runMode, resolved) ? 'build_tx' : 'execute_intent_validation';
+    const normalized = await executeSelfRun(
+      ctx,
+      flags,
+      resolved,
+      { skipPreflight: route === 'build_tx' }
+    );
+    const blockedByGovernance = !normalized.success && Boolean(normalized.preflightBlocked);
+    return {
+      message: blockedByGovernance
+        ? 'Self preflight blocked by governance'
+        : normalized.success
+          ? 'Self preflight completed (unsigned transaction ready)'
+          : 'Self preflight failed',
+      route,
+      normalized,
+    };
+  }
+  if (runMode === 'hybrid') {
+    // Reads have nothing to mirror and need no wallet. Keep preflight on validation-only
+    // execute-intent so dry-runs do not trigger a real catalog read (run still uses the read rail).
+    if (isReadOnlyAction(resolved)) {
+      const payload = buildIntentPayload(flags, {
+        validationOnly: true,
+        forceIdempotency: false,
+        resolvedAction,
+        apiAction: actionNameForApi(resolved),
+        runMode: 'hybrid',
+        mirrorOnly: false,
+        hybridWalletMode: options.hybridWalletMode,
+      });
+      const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
+      const normalized = normalizeIntentResponse(response);
+      const blockedCount = normalized.blocked || 0;
+      if (!normalized.success || blockedCount > 0) {
+        normalized.success = false;
+        normalized.error = normalized.error || 'Preflight blocked hybrid execution';
+        normalized.preflightBlocked = true;
+      }
+      return {
+        message: normalized.success
+          ? 'Hybrid preflight completed'
+          : normalized.preflightBlocked
+            ? 'Hybrid preflight blocked by governance'
+            : 'Hybrid preflight failed',
+        route: 'execute_intent_validation',
+        normalized,
+      };
+    }
+    if (options.hybridWalletMode === 'agent_wallet') {
+      const managedPayload = buildIntentPayload(flags, {
+        validationOnly: true,
+        forceIdempotency: false,
+        resolvedAction,
+        apiAction: actionNameForApi(resolved),
+        runMode: 'agent_wallet',
+        mirrorOnly: false,
+        hybridWalletMode: 'agent_wallet',
+      });
+      const managedResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', managedPayload);
+      const managedNormalized = normalizeIntentResponse(managedResponse);
+      const mirrorPayload = buildIntentPayload(flags, {
+        validationOnly: true,
+        forceIdempotency: false,
+        resolvedAction,
+        apiAction: actionNameForApi(resolved),
+        runMode: 'hybrid',
+        mirrorOnly: true,
+        hybridWalletMode: 'agent_wallet',
+      });
+      const mirrorResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', mirrorPayload);
+      const mirrorNormalized = normalizeIntentResponse(mirrorResponse);
+      return {
+        message:
+          managedNormalized.success && mirrorNormalized.success
+            ? 'Hybrid preflight completed (agent_wallet + thirdfy mirror)'
+            : 'Hybrid preflight failed (agent_wallet + thirdfy mirror)',
+        route: 'execute_intent_validation_dual',
+        normalized: normalizeIntentResponse({
+          success: Boolean(managedNormalized.success && mirrorNormalized.success),
+          status: mirrorNormalized.status || managedNormalized.status || 'failed',
+          mode: 'hybrid',
+          hybridWalletMode: 'agent_wallet',
+          managed: managedNormalized,
+          mirror: mirrorNormalized,
+          error: managedNormalized.error || mirrorNormalized.error || null,
+        }),
+      };
+    }
+  }
+  const payload = buildIntentPayload(flags, {
+    validationOnly: true,
+    forceIdempotency: false,
+    resolvedAction,
+    apiAction: actionNameForApi(resolved),
+    runMode,
+    mirrorOnly: runMode === 'hybrid',
+  });
+  const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
+  const normalized = normalizeIntentResponse(response);
+  return {
+    message: normalized.success
+      ? runMode === 'hybrid'
+        ? 'Hybrid mirror preflight completed'
+        : 'Preflight completed'
+      : runMode === 'hybrid'
+        ? 'Hybrid mirror preflight failed'
+        : 'Preflight failed',
+    route: 'execute_intent_validation',
+    normalized,
+  };
+}
+
+async function runExecutionByMode(runMode, ctx, flags, resolved, options) {
+  if (runMode === 'thirdfy') {
+    const normalized = await executeThirdfyRun(ctx, flags, resolved, options, runMode);
+    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
+    return {
+      code: normalized.success ? 'RUN_QUEUED' : preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
+      message: normalized.success
+        ? 'Execution intent queued'
+        : preflightBlocked
+          ? 'Preflight blocked execution'
+          : 'Execution failed',
+      idempotencyKey: normalized.idempotencyKey || null,
+      normalized,
+    };
+  }
+  if (runMode === 'agent_wallet') {
+    const normalized = await executeManagedWalletRun(ctx, flags, resolved, options);
+    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
+    return {
+      code: normalized.success ? 'WALLET_EXECUTED' : preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
+      message: normalized.success
+        ? 'Managed wallet execution completed'
+        : preflightBlocked
+          ? 'Managed wallet preflight blocked execution'
+          : 'Managed wallet execution failed',
+      idempotencyKey: normalized.idempotencyKey || null,
+      normalized,
+    };
+  }
+  if (runMode === 'self') {
+    const normalized = await executeSelfRun(ctx, flags, resolved, options);
+    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
+    const readOnlySuccess =
+      normalized.success && normalized.routeFallback === 'execute_intent_read_only';
+    return {
+      code: normalized.success
+        ? readOnlySuccess
+          ? 'SELF_READ_COMPLETED'
+          : 'SELF_UNSIGNED_TX_READY'
+        : preflightBlocked
+          ? 'PREFLIGHT_BLOCKED'
+          : 'SELF_EXECUTION_FAILED',
+      message: normalized.success
+        ? readOnlySuccess
+          ? 'Read-only action completed via delegated execute-intent'
+          : 'Unsigned transaction prepared for self-custody execution'
+        : preflightBlocked
+          ? 'Preflight blocked self execution'
+          : 'Self-custody execution failed',
+      idempotencyKey: null,
+      normalized,
+    };
+  }
+  const normalized = await executeHybridRun(ctx, flags, resolved, options);
+  const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
+  const hybridWalletMode = normalizeHybridWalletMode(
+    normalized.hybridWalletMode || options?.hybridWalletMode || flags.hybridWalletMode || 'self',
+  );
+  const readOnlySuccess =
+    normalized.success && normalized.routeFallback === 'execute_intent_read_only';
+  return {
+    code: normalized.success
+      ? readOnlySuccess
+        ? 'HYBRID_READ_COMPLETED'
+        : 'HYBRID_READY'
+      : preflightBlocked
+        ? 'PREFLIGHT_BLOCKED'
+        : 'HYBRID_FAILED',
+    message: normalized.success
+      ? readOnlySuccess
+        ? 'Read-only action completed via delegated execute-intent'
+        : hybridWalletMode === 'agent_wallet'
+          ? 'Hybrid execution prepared (agent wallet + mirror preflight)'
+          : 'Hybrid execution prepared (self tx + mirror preflight)'
+      : preflightBlocked
+        ? 'Preflight blocked hybrid execution'
+        : 'Hybrid execution failed',
+    idempotencyKey: normalized.idempotencyKey || null,
+    normalized,
+  };
+}
+
+  return {
+    runPreflightByMode,
+    runExecutionByMode,
+    executeThirdfyRun,
+    executeManagedWalletRun,
+    executeSelfRun,
+    executeHybridRun,
+    resolveManagedExecutionPreflight,
+    performSelfBroadcast,
+    resolveEffectCheckResult,
+    submitSignedTx,
+  };
+}