@thirdfy/agent-cli 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -2,7 +2,69 @@
 
 All notable changes to `@thirdfy/agent-cli` are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## Unreleased
+## [0.5.0] - 2026-10-15
+
+`thirdfy-agent login` signs in with OAuth in the browser (auth.thirdfy.com, the same sign-in the MCP uses), as one agent with read access, plus trade with `--trade`. A minor version because `login` without a token flag now starts that sign-in instead of failing, and `credits balance` / `pricing quote` drop their credit counts for USD. `login email`, token flags and agent API keys work as before.
+
+### Removed
+
+- **The ignored Bitfinex flags of `credentials upsert`** (`--permission-profile`, `--verify-permissions`, `--skip-permissions-probe`, `--bitfinex-base-url`), as 0.4.3's warning announced (THI-86). Passing one is now an unknown-option error. Drop them from scripts.
+
+### Added
+
+- **`thirdfy-agent login` signs in with OAuth** (THI-107, part of THI-104): auth.thirdfy.com, the same sign-in the MCP uses. With no token flag, `login` does this:
+  - opens the browser (`--no-browser` prints the URL);
+  - the owner picks one agent and approves read (plus trade with `--trade`);
+  - the browser returns to a one-time `127.0.0.1` listener;
+  - the CLI is a public client (registered once per server), and uses PKCE S256 and `resource` = the API.
+
+  How the sign-in is used:
+  - **Credential:** it's stored in `auth.oauth` and becomes the agent credential: after `--agent-api-key` and `THIRDFY_AGENT_API_KEY`, before config `agent.apiKey` and before stored owner auth for credits reads.
+  - **Agent:** its agent comes from the API (`GET /api/v1/agent/oauth/session`).
+  - **Requests:** they send `Authorization: Bearer`, refresh before expiry (rotation), and refresh and retry once after a 401.
+  - **Expiry:** a refused refresh is `OAUTH_SESSION_EXPIRED` (`nextAction: reauthenticate`).
+  - **`logout`** revokes the sign-in at the auth server.
+  - **`whoami`** shows `auth.oauth`.
+  - New next actions: `reauthenticate`, `reauthenticate_with_trade`.
+
+  Needs thirdfy/thirdfy-auth#15 (the API as a resource, token introspection) and the API change THI-106. Until both are live, `login` stops at `OAUTH_RESOURCE_NOT_SUPPORTED` and points to `login email`. `login email` and token flags work as before.
+
+### Changed
+
+- **`credits balance` and `pricing quote` show balances in USD, never credits** (THI-123; same rules as thirdfy/thirdfy-mcp#279). Credits are Thirdfy's internal unit, and no price per action or request is stated.
+  - **Kept:** `availableUsd`, the free request counts (`freeDailyLimit`, `freeRequestsRemainingToday`, ...), `wouldBePaidBy` and `displayCurrency`.
+  - **Owner's fallback:** `ownerCreditsFallback` gets `availableUsd`, at the API's own `retailUsdPerCredit` from the same response, rounded to cents.
+  - **Dropped:** every credit count, per-credit rate and per-action price (`balanceCredits`, `balance`, `totalEarned`, `totalSpent`, `creditUsdValue`, `retailUsdPerCredit`, `quote.creditsCost`, `chargedUsd`, ...).
+  - **Text output:** without `--json`, `credits balance` reads `Balance loaded: $4.20 left; 8 of 20 free requests left today; then the owner's balance ($86.22) pays; then top up the balance.` The `note` says the same in USD. `pricing quote` reads `Action checked; would be paid by the owner's balance (owner_credits)`.
+  - **Unchanged:** the owner reports `credits transactions`, `credits usage`, `models list` and `models estimate` (credit ledger lines), as the MCP left its owner-token credits tools.
+  - **Owner ledger:** `totalAvailable` (a credit count) and `currency: 'credits'` are dropped too, and the owner route's free counts (`freeAllowance`, `freeRemainingToday`) are read, so owner auth also prints the free requests left.
+  - Before (0.4.3 and earlier) `credits balance` returned only `balanceCredits` and `ownerCreditsFallback.balanceCredits`, so a model answered in credits.
+- **A proper "signed in" page after `thirdfy-agent login`.** The local listener used to answer the browser with a bare, unbranded page. Like Claude Code, GitHub CLI and Google Cloud CLI, it now:
+  - holds the browser until the CLI has its tokens and knows its agent;
+  - then sends it to the sign-in server's result page, `<issuer>/cli/signed-in`, with the agent, read or trade access, and the API (auth.thirdfy.com 0.5.1+);
+  - on a cancelled or failed sign-in, sends it to `<issuer>/cli/error`.
+
+  A sign-in server without those pages gets a built-in page in the same style.
+- **A sign-in is used only on the API it was issued for**: an api-test sign-in is never sent to production, or the reverse. `whoami` shows `auth.oauth.resource` and `activeForThisApi`.
+
+## [0.4.3] - 2026-10-14
+
+Bitfinex support is removed, ethers loads again for local signing and RPC checks, and an unreachable RPC no longer floods `--json` output. Older `credentials upsert` scripts keep working: the removed flags are accepted and ignored.
+
+### Removed
+
+- **Bitfinex support.** It was unused and extra code to maintain. Removed:
+  - the Bitfinex static provider hint (`actions --provider bitfinex` no longer carries one; thirdfy-mcp removed its hint too, thirdfy/thirdfy-mcp#270);
+  - the `credentials upsert` permission probe, and the `bitfinex:funding-primary` / `bitfinex:spot-primary` credential-ref defaults (pass `--credential-ref` yourself);
+  - the Bitfinex onboarding hint (`data.onboardingHint` on error envelopes and on `preflight` / `run` results);
+  - `src/runtime/bitfinexProbe.mjs`, `src/runtime/onboardingHints.mjs`, `src/runtime/execution/runners/fallbackHints.mjs`, and the Bitfinex docs.
+
+  `credentials upsert` and `credentials status` stay for the other venues (Hummingbot connectors, Polymarket, Hyperliquid, Lighter, Avantis). The probe's flags (`--permission-profile`, `--verify-permissions`, `--skip-permissions-probe`, `--bitfinex-base-url`) are still accepted, ignored, and named in `meta.warnings`, so older scripts keep working; they go in the next minor version. The API still serves the Bitfinex catalog rows until it removes them.
+
+### Fixed
+
+- **`loadEthers` loads ethers again.** `src/runtime/owsSigning.mjs` called `require` in an ES module, where it is undefined, and the `ReferenceError` was swallowed. So ethers never loaded, and these failed: `doctor self`'s `ethers-runtime` and `rpc-connectivity` checks, OWS sign-and-broadcast, the self lane's effect-check balance reads, and `wallet submit`. It now loads through `createRequire(import.meta.url)`.
+- **RPC calls fail once instead of retrying forever.** Every RPC connection (`doctor self`, OWS broadcast, `wallet submit`, effect-check balance reads) is now pinned to its chain id (`pinnedRpcProvider` in `src/core/chainRegistry.mjs`). An unreachable RPC is one error, not an ethers retry line on stdout every second that breaks `--json` output and keeps the process running. `doctor self`'s `rpc-chain-id` check asks the RPC itself (`eth_chainId`), so a wrong RPC is still reported. Tests: `test/runtime/owsSigning.test.cjs`.
 
 ## [0.4.2] - 2026-10-14
 

package/README.md

@@ -22,7 +22,6 @@ If you want the full developer docs, start here:
 - [Action inventory and compatibility](./docs/action-inventory-and-compatibility.md)
 - [Command reference](./docs/command-reference.md)
 - [DogeOS quickstart (repo)](./docs/dogeos-quickstart.md)
-- [Bitfinex CEX workflow (repo)](./docs/bitfinex-cex-workflow.md)
 - [Action onboarding standard](./docs/action-onboarding-standard.md)
 - [Provider docs governance model](./docs/provider-docs-governance.md)
 - [Skill integration RFC](./docs/skill-integration-rfc.md)
@@ -40,11 +39,11 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.4.2
+## What's new in v0.5.0
 
-- **One spelling per agent:** `wallet profile` and `readiness` report the agent key in lowercase, whether it came from `--agent-key` or from your config.
-- **`pricing quote` on an older API** (no agent quote route) names the agent only from `--agent-key`.
-- **Reorganized source** (no behavior change): source files moved into domain folders. If your code imports files from inside the package, see [CHANGELOG.md](./CHANGELOG.md) for the new paths; the `thirdfy-agent` command is unchanged.
+- **Sign in with your Thirdfy account:** `thirdfy-agent login` opens your browser at auth.thirdfy.com. You pick one agent and approve read access, and trade access with `thirdfy-agent login --trade`. The CLI then acts as that agent, refreshes the sign-in by itself, and `thirdfy-agent logout` revokes it. Disconnect it any time in Connected apps at auth.thirdfy.com.
+- **Same sign-in as the MCP:** the same consent page and the same Connected apps list as Claude, ChatGPT and Cursor.
+- **Nothing else changes:** `login email`, `--auth-token`, `--owner-session-token` and agent API keys work as before, and an explicit `--agent-api-key` always wins over the sign-in.
 - Older versions: see [CHANGELOG.md](./CHANGELOG.md).
 
 ## Quick start
@@ -346,7 +345,6 @@ thirdfy-agent run --agent-api-key "$THIRDFY_AGENT_API_KEY" --action swap \
 Provider and venue guides are kept outside `README` so this page stays stable as integrations grow.
 
 - Provider index: [`docs/providers/index.md`](./docs/providers/index.md)
-- Bitfinex runbook: [`docs/providers/bitfinex.md`](./docs/providers/bitfinex.md)
 - DogeOS runbook: [`docs/providers/dogeos.md`](./docs/providers/dogeos.md)
 
 ## Command groups

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "test": "node --test test/*/*.test.cjs test/*/*/*.test.cjs",
-    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
+    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/core/oauth/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
     "validate:cli-manifest-handlers": "node ./scripts/validate-cli-manifest-handlers.mjs",
     "validate:runtime-boundaries": "node ./scripts/validate-runtime-boundaries.mjs",
     "validate:npm-pack": "node ./scripts/validate-npm-pack.mjs",
@@ -36,6 +36,8 @@
     "e2e:local-api:smoke": "node ./scripts/e2e/local-api-smoke.mjs",
     "e2e:base:simulate": "node ./scripts/e2e/base-simulate.mjs",
     "e2e:base:real": "node ./scripts/e2e/base-realtx.mjs",
+    "e2e:agent-wallet:simulate": "node ./scripts/e2e/agent-wallet/run.mjs",
+    "e2e:agent-wallet:real": "node ./scripts/e2e/agent-wallet/run.mjs --real",
     "e2e:delegation:discovery": "node ./scripts/e2e/delegation-discovery.mjs",
     "e2e:delegation:lifecycle": "node ./scripts/e2e/delegation-lifecycle.mjs",
     "e2e:delegation:commands": "node ./scripts/e2e/delegation-command-parity.mjs",

package/src/cli/help.mjs

@@ -7,6 +7,7 @@ Core commands:
   thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid|agent_wallet] [--custody-mode managed|external] [--json]
   thirdfy-agent profile show [--json]
   thirdfy-agent config set --key <path> --value <value> [--json]
+  thirdfy-agent login [--trade] [--no-browser] [--issuer <url>] [--json]   (OAuth in the browser: one agent)
   thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--agent-key <key>] [--run-mode <mode>] [--custody-mode managed|external] [--wallet-address <addr>] [--json]
   thirdfy-agent login email <address> [--code <otp>] [--accept-terms] [--key-name <name>] [--agent-key <key>] [--not-interactive|--ni] [--json]
   thirdfy-agent logout [--all] [--clear-agent-key] [--json]
@@ -54,7 +55,7 @@ Core commands:
   thirdfy-agent wallet sign --agent-api-key <key> --action <id> --params <json> [--chain-id <id>] [--json]
   thirdfy-agent wallet submit --signed-tx-hex <hex> [--chain-id <id>] [--rpc-url <url>] [--json]
   thirdfy-agent agent run --agent-api-key <key> --action <id> --params <json> [--signer-method managed_wallet_server|byow|fanout_intent] [--strategy-intent single_wallet|fanout] [--run-mode <mode>] [--user-did <did>] [--json]
-  thirdfy-agent credentials upsert --auth-token <token> --venue <id> --api-key <key> --api-secret <secret> [--permission-profile funding|spot] [--credential-ref <ref>] [--verify-permissions] [--skip-permissions-probe] [--bitfinex-base-url <url>] [--json]
+  thirdfy-agent credentials upsert --auth-token <token> --venue <id> --api-key <key> --api-secret <secret> [--credential-ref <ref>] [--json]
   thirdfy-agent credentials status --auth-token <token> [--venue <id>] [--json]
   thirdfy-agent agent auth challenge --agent-key <key> [--wallet-address <addr>] [--chain-id <id>] [--json]
   thirdfy-agent agent auth verify --challenge-id <id> --signature <hex> --agent-key <key> [--wallet-address <addr>] [--json]

package/src/cli/manifest.mjs

@@ -47,8 +47,8 @@ export const CLI_MANIFEST = [
   {
     path: ['login'],
     handler: 'commandLogin',
-    options: ['auth', 'bootstrap'],
-    description: 'Login with auth token, owner session, or agent API key',
+    options: ['auth', 'bootstrap', 'oauthLogin'],
+    description: 'Sign in with OAuth in the browser (one agent; --trade for writes), or with an auth token, owner session or agent API key',
   },
   {
     path: ['login', 'email'],
@@ -212,7 +212,7 @@ export const CLI_MANIFEST = [
     handler: 'commandCreditsBalance',
     tier: 'online',
     options: ['auth'],
-    description: 'Credits balance',
+    description: 'Balance in USD, free requests today and who pays next',
   },
   {
     path: ['credits', 'buy'],
@@ -254,7 +254,7 @@ export const CLI_MANIFEST = [
     handler: 'commandPricingQuote',
     tier: 'online',
     options: ['auth', 'execution'],
-    description: 'Quote action-tier credits for a catalog action',
+    description: 'Check who would pay for a catalog action now (never a price)',
   },
   {
     path: ['chat', 'send'],

package/src/cli/options/index.mjs

@@ -6,6 +6,7 @@ import { attachTrackingOptions } from './tracking.mjs';
 import { attachWalletOptions } from './account/wallet.mjs';
 import { attachBootstrapOptions, attachOnboardingHelpOptions } from './onboarding/bootstrap.mjs';
 import { attachCredentialsOptions } from './onboarding/credentials.mjs';
+import { attachOAuthLoginOptions } from './onboarding/oauthLogin.mjs';
 import { attachAnalyticsOptions } from './analytics.mjs';
 import { attachPolymarketOptions } from './venues/polymarket.mjs';
 import { attachHummingbotOptions } from './venues/hummingbot.mjs';
@@ -27,6 +28,7 @@ const BUNDLES = {
   tracking: attachTrackingOptions,
   wallet: attachWalletOptions,
   bootstrap: attachBootstrapOptions,
+  oauthLogin: attachOAuthLoginOptions,
   onboardingHelp: attachOnboardingHelpOptions,
   credentials: attachCredentialsOptions,
   analytics: attachAnalyticsOptions,

package/src/cli/options/onboarding/credentials.mjs

@@ -3,12 +3,8 @@ export function attachCredentialsOptions(cmd) {
     .option('--venue <id>', 'credential venue')
     .option('--api-key <key>', 'exchange API key')
     .option('--api-secret <secret>', 'exchange API secret')
-    .option('--permission-profile <profile>', 'funding|spot')
     .option('--credential-ref <ref>', 'credential reference')
     .option('--credential-type <type>', 'credential type')
-    .option('--verify-permissions', 'verify exchange permissions')
-    .option('--skip-permissions-probe', 'skip permissions probe')
-    .option('--bitfinex-base-url <url>', 'Bitfinex API base URL')
     .option('--passphrase <value>', 'exchange passphrase')
     .option('--metadata <json>', 'credential metadata JSON')
     .option('--policy <json>', 'credential policy JSON');

package/src/cli/options/onboarding/oauthLogin.mjs

@@ -0,0 +1,8 @@
+/** `thirdfy-agent login` with OAuth (auth.thirdfy.com), the default when no token flag is passed. */
+export function attachOAuthLoginOptions(cmd) {
+  return cmd
+    .option('--trade', 'also ask for trade access (writes that move funds); read-only otherwise')
+    .option('--no-browser', 'print the sign-in URL instead of opening the browser')
+    .option('--issuer <url>', 'sign-in server (default: paired with --api-base, https://auth.thirdfy.com)')
+    .option('--login-timeout <seconds>', 'how long to wait for the browser sign-in (default 300)');
+}

package/src/commands/account/credits.mjs

@@ -6,7 +6,8 @@ import { toAvantisSpelling } from '../../core/venueBrand.mjs';
 import {
   formatCreditsEstimateSummary,
   formatCreditsModelsSummary,
-  stripUsdFields,
+  describeWouldBePaidBy,
+  toUsdFirst,
 } from '../../lib/creditsUsdSummary.mjs';
 
 function resolveToolCallsEstimate(flags) {
@@ -146,12 +147,13 @@ export function createCreditsCommands({ printEnvelope, getAuthToken, buildOwnerA
   }
 
   /**
-   * `pricing quote --action <id>`: the credits one catalog action costs, and `wouldBePaidBy`
-   * (agent_credits | free_request | owner_credits | none) when the API can read the balances
+   * `pricing quote --action <id>`: whether one catalog action can run now and who pays for it:
+   * `wouldBePaidBy` (agent_credits | free_request | owner_credits | none) when the API can read the balances
    * (thirdfy-api-v2#887). The ledger follows `resolveCreditsLedger`. Agent: `POST /agent/credits/quote`
    * with the agent's key. Owner (session token or auth token): `/credits/pricing/quote`, for one of the
    * owner's agents with --agent-key. An API without the agent route (404, before #887) is quoted
-   * through the owner route when owner auth is set and --agent-key names the key's agent. Credits only.
+   * through the owner route when owner auth is set and --agent-key names the key's agent. Never a price:
+   * the quote's credit cost and USD figures are dropped (thirdfy-mcp quoteActionPricing, thirdfy-mcp#279).
    */
   async function commandPricingQuote(ctx, flags) {
     const action = requireFlag(flags, 'action', 'Missing --action for pricing quote');
@@ -210,9 +212,9 @@ export function createCreditsCommands({ printEnvelope, getAuthToken, buildOwnerA
       success: true,
       code: 'OK',
       // wouldBePaidBy (agent_credits | free_request | owner_credits | none), when the API sends it.
-      message: response?.wouldBePaidBy ? `Action pricing quote generated; would be paid by ${response.wouldBePaidBy}` : 'Action pricing quote generated',
-      // An action's cost is in credits only, never dollars (thirdfy-mcp quoteActionPricing).
-      data: stripUsdFields(response),
+      message: response?.wouldBePaidBy ? `Action checked; would be paid by ${describeWouldBePaidBy(response.wouldBePaidBy)}` : 'Action checked',
+      // No price per action or request: no credit cost, rate or USD figure (thirdfy-mcp quoteActionPricing).
+      data: toUsdFirst(response),
       meta: {
         apiBase: ctx.apiBase,
         action,

package/src/commands/discovery.mjs

@@ -2,7 +2,7 @@ import { requireFlag, parseJsonFlag } from '../core/args.mjs';
 import { apiGet, apiPost } from '../core/http.mjs';
 import { extractActions, getCachedActionsCatalogSnapshot, resolveCreditsLedger } from '../core/context.mjs';
 import { getEffectiveRunMode } from '../core/runMode.mjs';
-import { creditsFreeQuotaNote, formatCreditsBalanceSummary, stripUsdFields } from '../lib/creditsUsdSummary.mjs';
+import { creditsFreeQuotaNote, formatCreditsBalanceSummary, toUsdFirst } from '../lib/creditsUsdSummary.mjs';
 import { filterActionsByChain } from '../runtime/actions/chainFilter.mjs';
 import { pageActionList, readActionListPaging } from '../runtime/actions/actionList.mjs';
 import {
@@ -186,7 +186,8 @@ async function commandChains(ctx, flags, capabilities) {
  * `credits balance`. Owner auth reads the owner's balance (`/credits/balance`). An explicit
  * --agent-api-key, or no owner auth but an agent key in env or config, reads the agent's own ledger
  * (`/agent/credits/balance`: its credits, free requests today and the owner-credits fallback), as
- * thirdfy-mcp getCreditsBalance. Credits only, never dollars.
+ * thirdfy-mcp getCreditsBalance. In USD, never credits: `availableUsd` (the owner's fallback too, at the
+ * API's `retailUsdPerCredit`), free requests and who pays; no credit count, rate or price (thirdfy-mcp#279).
  */
 async function commandCreditsBalance(ctx, flags, capabilities) {
   const { ledger, agentApiKey } = resolveCreditsLedger(flags);
@@ -203,9 +204,9 @@ async function commandCreditsBalance(ctx, flags, capabilities) {
   printEnvelope({
     success: true,
     code: 'OK',
-    message: flags.json ? 'Credits balance loaded' : `Credits balance loaded: ${summary}`,
-    // Credits only: no USD price per credit (thirdfy-mcp getCreditsBalance).
-    data: { ...stripUsdFields(response), ...(note ? { note } : {}) },
+    message: flags.json ? 'Balance loaded' : `Balance loaded: ${summary}`,
+    // USD-first: balances in USD, no credit count, per-credit rate or price (thirdfy-mcp getCreditsBalance).
+    data: { ...toUsdFirst(response), ...(note ? { note } : {}) },
     meta: {
       apiBase: ctx.apiBase,
       ledger: agentLedger ? 'agent' : 'owner',

package/src/commands/doctor.mjs

@@ -3,7 +3,7 @@ import { requireFlag } from '../core/args.mjs';
 import { apiGet, requestWithRouteFallback } from '../core/http.mjs';
 import { loadProfileConfig, getProfileConfigPath, getCachedActionsCatalog } from '../core/context.mjs';
 import { DEFAULT_API_BASE, PROFILE_DEFAULTS } from '../core/constants.mjs';
-import { describeChainGas, parseChainIdFlag, resolveChainRpcUrl } from '../core/chainRegistry.mjs';
+import { DEFAULT_CHAIN_ID, describeChainGas, parseChainIdFlag, pinnedRpcProvider, resolveChainRpcUrl } from '../core/chainRegistry.mjs';
 import { exitAfterOutput } from '../core/envelope.mjs';
 import { normalizeRunMode, normalizeManagedRunMode } from '../core/runMode.mjs';
 import { buildExecutionCertificationReport } from '../runtime/certification/executionCertify.mjs';
@@ -63,13 +63,13 @@ async function commandDoctorSelf(ctx, flags) {
   try {
     if (!rpcUrl) throw new Error(`no known RPC for chain ${flags.chainId}; pass --rpc-url <url>`);
     const ethers = await loadEthers();
-    const provider = new ethers.JsonRpcProvider(rpcUrl);
+    const expectedChainId = parseChainIdFlag(flags.chainId);
+    const provider = pinnedRpcProvider(ethers, { rpcUrl, chainId: expectedChainId || DEFAULT_CHAIN_ID });
     const block = await provider.getBlockNumber();
     checks.push({ name: 'rpc-connectivity', ok: Number.isFinite(block), detail: `latestBlock=${block}` });
-    const expectedChainId = parseChainIdFlag(flags.chainId);
     if (expectedChainId) {
-      const network = await provider.getNetwork();
-      const rpcChainId = Number(network.chainId);
+      // The provider's network is pinned, so ask the RPC itself which chain it serves.
+      const rpcChainId = Number(await provider.send('eth_chainId', []));
       checks.push({
         name: 'rpc-chain-id',
         ok: rpcChainId === expectedChainId,

package/src/commands/execute.mjs

@@ -33,7 +33,6 @@ export function createExecuteCommands(deps) {
     runPreflightByMode,
     runExecutionByMode,
     resolveManagedExecutionPreflight,
-    applyExecutionFallbackHints,
     performSelfBroadcast,
     executeManagedWalletRun,
     executeSelfRun,
@@ -57,11 +56,7 @@ async function commandPreflight(ctx, flags, capabilities) {
     || (await applyLighterAgentWalletAddressDefault(ctx, flags, resolved, runMode))
     || (await applyAvantisAgentWalletAddressDefault(ctx, flags, resolved, runMode));
   const backendResult = await runPreflightByMode(runMode, ctx, flags, resolved, { hybridWalletMode, managedPreflight });
-  const normalized = applyExecutionFallbackHints(backendResult.normalized, {
-    flags,
-    runMode,
-    resolvedAction: resolved.resolvedAction,
-  });
+  const normalized = backendResult.normalized;
   const data = flags.__polymarketSetupGuide
     ? {
         ...normalized,
@@ -195,11 +190,7 @@ async function commandRun(ctx, flags, capabilities) {
     hybridWalletMode,
     managedPreflight,
   });
-  const normalized = applyExecutionFallbackHints(backendResult.normalized, {
-    flags,
-    runMode,
-    resolvedAction: resolved.resolvedAction,
-  });
+  const normalized = backendResult.normalized;
   if (runMode === 'self' && parseBooleanFlag(flags.broadcast, false) && normalized?.success) {
     const executed = await performSelfBroadcast(ctx, flags, resolved.resolvedAction, normalized);
     printEnvelope({

package/src/commands/onboarding/bootstrap.mjs

@@ -17,6 +17,9 @@ import {
 } from '../../core/context.mjs';
 import { apiGet, apiPost, requestWithRouteFallback } from '../../core/http.mjs';
 import { isEvmAddress, isSolanaAddress } from '../../core/chainRegistry.mjs';
+import { commandOAuthLogin } from './oauthLogin.mjs';
+import { readOAuthSession } from '../../core/oauth/session.mjs';
+import { revokeToken } from '../../core/oauth/authServer.mjs';
 import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
@@ -35,6 +38,7 @@ export function createBootstrapCommands(deps) {
     verifyOwnerWalletChallenge,
     resolveEffectiveUserDid,
     negotiateCapabilities,
+    CLI_VERSION,
     commandAgentRegister,
   } = deps;
 
@@ -232,6 +236,19 @@ async function commandWhoami(ctx, flags) {
         hasOwnerSessionToken: Boolean(auth.ownerSessionToken),
         ownerSessionToken: maskSecret(auth.ownerSessionToken),
         ownerSessionExpiresAt: auth.ownerSessionExpiresAt || null,
+        oauth: readOAuthSession(config)
+          ? {
+              issuer: auth.oauth.issuer || null,
+              // The API this sign-in is for; commands use it only on that API (--api-base).
+              resource: auth.oauth.resource || null,
+              activeForThisApi: String(auth.oauth.resource || '').replace(/\/+$/, '') === String(ctx.apiBase || '').replace(/\/+$/, ''),
+              agentKey: auth.oauth.agentKey || null,
+              scope: auth.oauth.scope || '',
+              canTrade: auth.oauth.canTrade === true,
+              expiresAt: auth.oauth.expiresAt || null,
+              accessToken: maskSecret(auth.oauth.accessToken),
+            }
+          : null,
       },
       agent: {
         hasAgentApiKey: Boolean(agent.apiKey),
@@ -272,6 +289,12 @@ async function commandLogin(ctx, flags) {
   );
   let loginSource = 'token';
 
+  // No token and no wallet-signature inputs: sign in with OAuth in the browser (THI-104).
+  const hasChallengeInputs = Boolean(String(flags.challengeId || '').trim() && String(flags.signature || '').trim());
+  if (!authToken && !ownerSessionToken && !hasChallengeInputs) {
+    return commandOAuthLogin(ctx, flags, { printEnvelope, version: CLI_VERSION });
+  }
+
   if (!authToken && !ownerSessionToken) {
     const challengeId = String(flags.challengeId || '').trim();
     const signature = String(flags.signature || '').trim();
@@ -611,6 +634,17 @@ async function commandLogout(ctx, flags) {
     }
   }
 
+  // An OAuth sign-in is revoked at the auth server (RFC 7009), so its tokens stop working
+  // everywhere, not only on this machine. Best effort: local credentials are cleared either way.
+  const oauthSession = readOAuthSession(current);
+  let oauthRevoked = null;
+  if (oauthSession) {
+    const revoke = (token) =>
+      revokeToken({ revocationEndpoint: oauthSession.revocationEndpoint, clientId: oauthSession.clientId, token }, ctx.timeoutMs || 30_000);
+    const [refresh, access] = await Promise.all([revoke(oauthSession.refreshToken), revoke(oauthSession.accessToken)]);
+    oauthRevoked = Boolean(refresh || access);
+  }
+
   const next = { ...current };
   delete next.auth;
   if (flags.clearAgentKey) {
@@ -626,6 +660,7 @@ async function commandLogout(ctx, flags) {
       revokeAttempted,
       revokeSuccess,
       revokeError,
+      ...(oauthSession ? { oauthRevoked, oauthAgentKey: oauthSession.agentKey || null } : {}),
       configPath: getProfileConfigPath(),
     },
     meta: { apiBase: ctx.apiBase },

package/src/commands/onboarding/credentials.mjs

@@ -2,47 +2,25 @@ import { createRequire } from 'module';
 import { requireFlag, parseJsonFlag } from '../../core/args.mjs';
 import { requestWithRouteFallback } from '../../core/http.mjs';
 import { createCliError } from '../../core/envelope.mjs';
-import { BITFINEX_PERMISSION_PROFILES, DEFAULT_BITFINEX_BASE_URL } from '../../core/constants.mjs';
-import { parseBooleanFlag } from '../../core/runMode.mjs';
 
 const require = createRequire(import.meta.url);
 const { normalizeCredentialStatus } = require('../../utils/cli/delegationNormalization.cjs');
-export function createCredentialsCommands({ printEnvelope, getAuthToken, buildOwnerAuthHeaders, probeBitfinexPermissions }) {
+export function createCredentialsCommands({ printEnvelope, getAuthToken, buildOwnerAuthHeaders }) {
 async function commandCredentialsUpsert(ctx, flags, capabilities) {
   const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for credentials upsert');
   const venue = requireFlag(flags, 'venue', 'Missing --venue');
-  const permissionProfile = String(flags.permissionProfile || 'funding').trim().toLowerCase();
-  const bitfinexProfile =
-    String(venue).trim().toLowerCase() === 'bitfinex'
-      ? BITFINEX_PERMISSION_PROFILES[permissionProfile] || BITFINEX_PERMISSION_PROFILES.funding
-      : null;
   const payload = {
     venue,
     apiKey: requireFlag(flags, 'apiKey', 'Missing --api-key'),
     apiSecret: requireFlag(flags, 'apiSecret', 'Missing --api-secret'),
     credentialType: String(flags.credentialType || 'api_key'),
-    credentialRef: String(flags.credentialRef || bitfinexProfile?.credentialRef || ''),
+    credentialRef: String(flags.credentialRef || ''),
   };
   if (flags.passphrase) payload.passphrase = String(flags.passphrase);
   if (flags.metadata) payload.metadata = parseJsonFlag(flags, 'metadata');
   if (flags.policy) payload.policy = parseJsonFlag(flags, 'policy');
   if (flags.agentKey) payload.agentKey = String(flags.agentKey).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
-  const probeEnabled =
-    String(venue).trim().toLowerCase() === 'bitfinex' &&
-    !parseBooleanFlag(flags.skipPermissionsProbe, false) &&
-    parseBooleanFlag(flags.verifyPermissions, true);
-  let permissionProbe = null;
-  if (probeEnabled) {
-    permissionProbe = await probeBitfinexPermissions({
-      apiKey: payload.apiKey,
-      apiSecret: payload.apiSecret,
-      permissionProfile: bitfinexProfile?.id || 'funding',
-      timeoutMs: ctx.timeoutMs,
-      baseUrl: String(flags.bitfinexBaseUrl || process.env.BITFINEX_BASE_URL || DEFAULT_BITFINEX_BASE_URL),
-    });
-  }
-
   const response = await requestWithRouteFallback(ctx, {
     method: 'POST',
     routes: ['/api/v1/agent/delegation/credentials/upsert', '/api/v1/agent/agent/delegation/credentials/upsert'],
@@ -58,7 +36,6 @@ async function commandCredentialsUpsert(ctx, flags, capabilities) {
     data: response,
     meta: {
       apiBase: ctx.apiBase,
-      permissionProbe,
       capabilitiesVersion: capabilities?.contractVersion || null,
     },
   });