@thirdfy/agent-cli 0.4.3 → 0.5.1

package/CHANGELOG.md

@@ -2,7 +2,58 @@
 
 All notable changes to `@thirdfy/agent-cli` are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## Unreleased
+## [0.5.1] - 2026-10-16
+
+A patch release: `doctor certify execution` works for agents with a narrow allowlist.
+
+### Fixed
+
+- **`doctor certify execution` no longer fails on venue writes outside the agent's allowlist** (THI-201). With an agent key, the CLI reads the agent's own action list, so bare certification flagged every venue write the agent may not call (for example `place_hyperliquid_tp_sl` or `update_lighter_leverage`) as `CATALOG_SCHEMA_UNAVAILABLE` and failed. It now checks only the venue writes the agent may call and lists the rest in `skippedVenueActions`. An allowed action with a broken schema, a `--required-actions` entry the agent can't call, and a public catalog missing a venue write all still fail.
+
+## [0.5.0] - 2026-10-15
+
+`thirdfy-agent login` signs in with OAuth in the browser (auth.thirdfy.com, the same sign-in the MCP uses), as one agent with read access, plus trade with `--trade`. A minor version because `login` without a token flag now starts that sign-in instead of failing, and `credits balance` / `pricing quote` drop their credit counts for USD. `login email`, token flags and agent API keys work as before.
+
+### Removed
+
+- **The ignored Bitfinex flags of `credentials upsert`** (`--permission-profile`, `--verify-permissions`, `--skip-permissions-probe`, `--bitfinex-base-url`), as 0.4.3's warning announced (THI-86). Passing one is now an unknown-option error. Drop them from scripts.
+
+### Added
+
+- **`thirdfy-agent login` signs in with OAuth** (THI-107, part of THI-104): auth.thirdfy.com, the same sign-in the MCP uses. With no token flag, `login` does this:
+  - opens the browser (`--no-browser` prints the URL);
+  - the owner picks one agent and approves read (plus trade with `--trade`);
+  - the browser returns to a one-time `127.0.0.1` listener;
+  - the CLI is a public client (registered once per server), and uses PKCE S256 and `resource` = the API.
+
+  How the sign-in is used:
+  - **Credential:** it's stored in `auth.oauth` and becomes the agent credential: after `--agent-api-key` and `THIRDFY_AGENT_API_KEY`, before config `agent.apiKey` and before stored owner auth for credits reads.
+  - **Agent:** its agent comes from the API (`GET /api/v1/agent/oauth/session`).
+  - **Requests:** they send `Authorization: Bearer`, refresh before expiry (rotation), and refresh and retry once after a 401.
+  - **Expiry:** a refused refresh is `OAUTH_SESSION_EXPIRED` (`nextAction: reauthenticate`).
+  - **`logout`** revokes the sign-in at the auth server.
+  - **`whoami`** shows `auth.oauth`.
+  - New next actions: `reauthenticate`, `reauthenticate_with_trade`.
+
+  Needs thirdfy/thirdfy-auth#15 (the API as a resource, token introspection) and the API change THI-106. Until both are live, `login` stops at `OAUTH_RESOURCE_NOT_SUPPORTED` and points to `login email`. `login email` and token flags work as before.
+
+### Changed
+
+- **`credits balance` and `pricing quote` show balances in USD, never credits** (THI-123; same rules as thirdfy/thirdfy-mcp#279). Credits are Thirdfy's internal unit, and no price per action or request is stated.
+  - **Kept:** `availableUsd`, the free request counts (`freeDailyLimit`, `freeRequestsRemainingToday`, ...), `wouldBePaidBy` and `displayCurrency`.
+  - **Owner's fallback:** `ownerCreditsFallback` gets `availableUsd`, at the API's own `retailUsdPerCredit` from the same response, rounded to cents.
+  - **Dropped:** every credit count, per-credit rate and per-action price (`balanceCredits`, `balance`, `totalEarned`, `totalSpent`, `creditUsdValue`, `retailUsdPerCredit`, `quote.creditsCost`, `chargedUsd`, ...).
+  - **Text output:** without `--json`, `credits balance` reads `Balance loaded: $4.20 left; 8 of 20 free requests left today; then the owner's balance ($86.22) pays; then top up the balance.` The `note` says the same in USD. `pricing quote` reads `Action checked; would be paid by the owner's balance (owner_credits)`.
+  - **Unchanged:** the owner reports `credits transactions`, `credits usage`, `models list` and `models estimate` (credit ledger lines), as the MCP left its owner-token credits tools.
+  - **Owner ledger:** `totalAvailable` (a credit count) and `currency: 'credits'` are dropped too, and the owner route's free counts (`freeAllowance`, `freeRemainingToday`) are read, so owner auth also prints the free requests left.
+  - Before (0.4.3 and earlier) `credits balance` returned only `balanceCredits` and `ownerCreditsFallback.balanceCredits`, so a model answered in credits.
+- **A proper "signed in" page after `thirdfy-agent login`.** The local listener used to answer the browser with a bare, unbranded page. Like Claude Code, GitHub CLI and Google Cloud CLI, it now:
+  - holds the browser until the CLI has its tokens and knows its agent;
+  - then sends it to the sign-in server's result page, `<issuer>/cli/signed-in`, with the agent, read or trade access, and the API (auth.thirdfy.com 0.5.1+);
+  - on a cancelled or failed sign-in, sends it to `<issuer>/cli/error`.
+
+  A sign-in server without those pages gets a built-in page in the same style.
+- **A sign-in is used only on the API it was issued for**: an api-test sign-in is never sent to production, or the reverse. `whoami` shows `auth.oauth.resource` and `activeForThisApi`.
 
 ## [0.4.3] - 2026-10-14
 

package/README.md

@@ -39,12 +39,11 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.4.3
+## What's new in v0.5.1
 
-- **Local signing works again:** ethers now loads, so `doctor self`, OWS sign-and-broadcast, `wallet submit` and the self lane's balance checks run as documented.
-- **A dead RPC is one clear error:** every RPC call is pinned to its chain, so an unreachable RPC no longer prints retry lines into `--json` output or keeps the command running.
-- **Bitfinex support removed from the CLI:** no Bitfinex provider hint, credential permission probe or docs any more. The Thirdfy API still serves the Bitfinex actions for now. `credentials upsert` still works for the other venues, and its old Bitfinex flags are accepted and ignored with a warning.
-- Older versions: see [CHANGELOG.md](./CHANGELOG.md).
+- **`doctor certify execution` passes for agents with a narrow allowlist.** It now checks only the venue writes your agent may call, and lists the others under `skippedVenueActions` instead of failing. Runtimes that stop on a failed certify (Hermes, OpenClaw) start again.
+- **Still fails closed:** an allowed action with a broken schema, a `--required-actions` entry the agent can't call, or a missing catalog.
+- Browser sign-in (`thirdfy-agent login`, `--trade` for writes) arrived in 0.5.0. Older versions: see [CHANGELOG.md](./CHANGELOG.md).
 
 ## Quick start
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "test": "node --test test/*/*.test.cjs test/*/*/*.test.cjs",
-    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
+    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/core/oauth/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
     "validate:cli-manifest-handlers": "node ./scripts/validate-cli-manifest-handlers.mjs",
     "validate:runtime-boundaries": "node ./scripts/validate-runtime-boundaries.mjs",
     "validate:npm-pack": "node ./scripts/validate-npm-pack.mjs",

package/src/cli/help.mjs

@@ -7,6 +7,7 @@ Core commands:
   thirdfy-agent profile use --profile <name> [--run-mode thirdfy|self|hybrid|agent_wallet] [--custody-mode managed|external] [--json]
   thirdfy-agent profile show [--json]
   thirdfy-agent config set --key <path> --value <value> [--json]
+  thirdfy-agent login [--trade] [--no-browser] [--issuer <url>] [--json]   (OAuth in the browser: one agent)
   thirdfy-agent login [--auth-token <token> | --owner-session-token <token>] [--agent-api-key <key>] [--agent-key <key>] [--run-mode <mode>] [--custody-mode managed|external] [--wallet-address <addr>] [--json]
   thirdfy-agent login email <address> [--code <otp>] [--accept-terms] [--key-name <name>] [--agent-key <key>] [--not-interactive|--ni] [--json]
   thirdfy-agent logout [--all] [--clear-agent-key] [--json]

package/src/cli/manifest.mjs

@@ -47,8 +47,8 @@ export const CLI_MANIFEST = [
   {
     path: ['login'],
     handler: 'commandLogin',
-    options: ['auth', 'bootstrap'],
-    description: 'Login with auth token, owner session, or agent API key',
+    options: ['auth', 'bootstrap', 'oauthLogin'],
+    description: 'Sign in with OAuth in the browser (one agent; --trade for writes), or with an auth token, owner session or agent API key',
   },
   {
     path: ['login', 'email'],
@@ -212,7 +212,7 @@ export const CLI_MANIFEST = [
     handler: 'commandCreditsBalance',
     tier: 'online',
     options: ['auth'],
-    description: 'Credits balance',
+    description: 'Balance in USD, free requests today and who pays next',
   },
   {
     path: ['credits', 'buy'],
@@ -254,7 +254,7 @@ export const CLI_MANIFEST = [
     handler: 'commandPricingQuote',
     tier: 'online',
     options: ['auth', 'execution'],
-    description: 'Quote action-tier credits for a catalog action',
+    description: 'Check who would pay for a catalog action now (never a price)',
   },
   {
     path: ['chat', 'send'],

package/src/cli/options/index.mjs

@@ -6,6 +6,7 @@ import { attachTrackingOptions } from './tracking.mjs';
 import { attachWalletOptions } from './account/wallet.mjs';
 import { attachBootstrapOptions, attachOnboardingHelpOptions } from './onboarding/bootstrap.mjs';
 import { attachCredentialsOptions } from './onboarding/credentials.mjs';
+import { attachOAuthLoginOptions } from './onboarding/oauthLogin.mjs';
 import { attachAnalyticsOptions } from './analytics.mjs';
 import { attachPolymarketOptions } from './venues/polymarket.mjs';
 import { attachHummingbotOptions } from './venues/hummingbot.mjs';
@@ -27,6 +28,7 @@ const BUNDLES = {
   tracking: attachTrackingOptions,
   wallet: attachWalletOptions,
   bootstrap: attachBootstrapOptions,
+  oauthLogin: attachOAuthLoginOptions,
   onboardingHelp: attachOnboardingHelpOptions,
   credentials: attachCredentialsOptions,
   analytics: attachAnalyticsOptions,

package/src/cli/options/onboarding/credentials.mjs

@@ -7,11 +7,5 @@ export function attachCredentialsOptions(cmd) {
     .option('--credential-type <type>', 'credential type')
     .option('--passphrase <value>', 'exchange passphrase')
     .option('--metadata <json>', 'credential metadata JSON')
-    .option('--policy <json>', 'credential policy JSON')
-    // Accepted and ignored since Bitfinex support was removed, so older scripts keep working; the
-    // command says so in meta.warnings. Drop them in the next minor version.
-    .option('--permission-profile <profile>', 'ignored (Bitfinex support was removed)')
-    .option('--verify-permissions', 'ignored (Bitfinex support was removed)')
-    .option('--skip-permissions-probe', 'ignored (Bitfinex support was removed)')
-    .option('--bitfinex-base-url <url>', 'ignored (Bitfinex support was removed)');
+    .option('--policy <json>', 'credential policy JSON');
 }

package/src/cli/options/onboarding/oauthLogin.mjs

@@ -0,0 +1,8 @@
+/** `thirdfy-agent login` with OAuth (auth.thirdfy.com), the default when no token flag is passed. */
+export function attachOAuthLoginOptions(cmd) {
+  return cmd
+    .option('--trade', 'also ask for trade access (writes that move funds); read-only otherwise')
+    .option('--no-browser', 'print the sign-in URL instead of opening the browser')
+    .option('--issuer <url>', 'sign-in server (default: paired with --api-base, https://auth.thirdfy.com)')
+    .option('--login-timeout <seconds>', 'how long to wait for the browser sign-in (default 300)');
+}

package/src/commands/account/credits.mjs

@@ -6,7 +6,8 @@ import { toAvantisSpelling } from '../../core/venueBrand.mjs';
 import {
   formatCreditsEstimateSummary,
   formatCreditsModelsSummary,
-  stripUsdFields,
+  describeWouldBePaidBy,
+  toUsdFirst,
 } from '../../lib/creditsUsdSummary.mjs';
 
 function resolveToolCallsEstimate(flags) {
@@ -146,12 +147,13 @@ export function createCreditsCommands({ printEnvelope, getAuthToken, buildOwnerA
   }
 
   /**
-   * `pricing quote --action <id>`: the credits one catalog action costs, and `wouldBePaidBy`
-   * (agent_credits | free_request | owner_credits | none) when the API can read the balances
+   * `pricing quote --action <id>`: whether one catalog action can run now and who pays for it:
+   * `wouldBePaidBy` (agent_credits | free_request | owner_credits | none) when the API can read the balances
    * (thirdfy-api-v2#887). The ledger follows `resolveCreditsLedger`. Agent: `POST /agent/credits/quote`
    * with the agent's key. Owner (session token or auth token): `/credits/pricing/quote`, for one of the
    * owner's agents with --agent-key. An API without the agent route (404, before #887) is quoted
-   * through the owner route when owner auth is set and --agent-key names the key's agent. Credits only.
+   * through the owner route when owner auth is set and --agent-key names the key's agent. Never a price:
+   * the quote's credit cost and USD figures are dropped (thirdfy-mcp quoteActionPricing, thirdfy-mcp#279).
    */
   async function commandPricingQuote(ctx, flags) {
     const action = requireFlag(flags, 'action', 'Missing --action for pricing quote');
@@ -210,9 +212,9 @@ export function createCreditsCommands({ printEnvelope, getAuthToken, buildOwnerA
       success: true,
       code: 'OK',
       // wouldBePaidBy (agent_credits | free_request | owner_credits | none), when the API sends it.
-      message: response?.wouldBePaidBy ? `Action pricing quote generated; would be paid by ${response.wouldBePaidBy}` : 'Action pricing quote generated',
-      // An action's cost is in credits only, never dollars (thirdfy-mcp quoteActionPricing).
-      data: stripUsdFields(response),
+      message: response?.wouldBePaidBy ? `Action checked; would be paid by ${describeWouldBePaidBy(response.wouldBePaidBy)}` : 'Action checked',
+      // No price per action or request: no credit cost, rate or USD figure (thirdfy-mcp quoteActionPricing).
+      data: toUsdFirst(response),
       meta: {
         apiBase: ctx.apiBase,
         action,

package/src/commands/discovery.mjs

@@ -2,7 +2,7 @@ import { requireFlag, parseJsonFlag } from '../core/args.mjs';
 import { apiGet, apiPost } from '../core/http.mjs';
 import { extractActions, getCachedActionsCatalogSnapshot, resolveCreditsLedger } from '../core/context.mjs';
 import { getEffectiveRunMode } from '../core/runMode.mjs';
-import { creditsFreeQuotaNote, formatCreditsBalanceSummary, stripUsdFields } from '../lib/creditsUsdSummary.mjs';
+import { creditsFreeQuotaNote, formatCreditsBalanceSummary, toUsdFirst } from '../lib/creditsUsdSummary.mjs';
 import { filterActionsByChain } from '../runtime/actions/chainFilter.mjs';
 import { pageActionList, readActionListPaging } from '../runtime/actions/actionList.mjs';
 import {
@@ -186,7 +186,8 @@ async function commandChains(ctx, flags, capabilities) {
  * `credits balance`. Owner auth reads the owner's balance (`/credits/balance`). An explicit
  * --agent-api-key, or no owner auth but an agent key in env or config, reads the agent's own ledger
  * (`/agent/credits/balance`: its credits, free requests today and the owner-credits fallback), as
- * thirdfy-mcp getCreditsBalance. Credits only, never dollars.
+ * thirdfy-mcp getCreditsBalance. In USD, never credits: `availableUsd` (the owner's fallback too, at the
+ * API's `retailUsdPerCredit`), free requests and who pays; no credit count, rate or price (thirdfy-mcp#279).
  */
 async function commandCreditsBalance(ctx, flags, capabilities) {
   const { ledger, agentApiKey } = resolveCreditsLedger(flags);
@@ -203,9 +204,9 @@ async function commandCreditsBalance(ctx, flags, capabilities) {
   printEnvelope({
     success: true,
     code: 'OK',
-    message: flags.json ? 'Credits balance loaded' : `Credits balance loaded: ${summary}`,
-    // Credits only: no USD price per credit (thirdfy-mcp getCreditsBalance).
-    data: { ...stripUsdFields(response), ...(note ? { note } : {}) },
+    message: flags.json ? 'Balance loaded' : `Balance loaded: ${summary}`,
+    // USD-first: balances in USD, no credit count, per-credit rate or price (thirdfy-mcp getCreditsBalance).
+    data: { ...toUsdFirst(response), ...(note ? { note } : {}) },
     meta: {
       apiBase: ctx.apiBase,
       ledger: agentLedger ? 'agent' : 'owner',

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from 'module';
 import { requireFlag } from '../core/args.mjs';
 import { apiGet, requestWithRouteFallback } from '../core/http.mjs';
-import { loadProfileConfig, getProfileConfigPath, getCachedActionsCatalog } from '../core/context.mjs';
+import { loadProfileConfig, getProfileConfigPath, getCachedActionsCatalogSnapshot } from '../core/context.mjs';
 import { DEFAULT_API_BASE, PROFILE_DEFAULTS } from '../core/constants.mjs';
 import { DEFAULT_CHAIN_ID, describeChainGas, parseChainIdFlag, pinnedRpcProvider, resolveChainRpcUrl } from '../core/chainRegistry.mjs';
 import { exitAfterOutput } from '../core/envelope.mjs';
@@ -333,9 +333,12 @@ async function commandManagedSetup(ctx, flags, capabilities) {
 
 async function commandDoctorCertifyExecution(ctx, flags) {
   let liveActions = null;
+  let catalogPolicyScoped = false;
   let catalogError = null;
   try {
-    liveActions = await getCachedActionsCatalog(ctx, flags);
+    const snapshot = await getCachedActionsCatalogSnapshot(ctx, flags);
+    liveActions = snapshot.actions;
+    catalogPolicyScoped = snapshot.policyScoped === true;
   } catch (error) {
     catalogError = {
       message: error?.message || 'Actions catalog fetch failed',
@@ -356,6 +359,7 @@ async function commandDoctorCertifyExecution(ctx, flags) {
     runMode,
     expectedSchemaDigest,
     requiredActions,
+    catalogPolicyScoped,
   });
 
   printEnvelope({
@@ -369,6 +373,7 @@ async function commandDoctorCertifyExecution(ctx, flags) {
       catalog: {
         fetched: Array.isArray(liveActions),
         actionCount: Array.isArray(liveActions) ? liveActions.length : 0,
+        policyScoped: catalogPolicyScoped,
         error: catalogError,
       },
     },

package/src/commands/onboarding/bootstrap.mjs

@@ -17,6 +17,9 @@ import {
 } from '../../core/context.mjs';
 import { apiGet, apiPost, requestWithRouteFallback } from '../../core/http.mjs';
 import { isEvmAddress, isSolanaAddress } from '../../core/chainRegistry.mjs';
+import { commandOAuthLogin } from './oauthLogin.mjs';
+import { readOAuthSession } from '../../core/oauth/session.mjs';
+import { revokeToken } from '../../core/oauth/authServer.mjs';
 import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
@@ -35,6 +38,7 @@ export function createBootstrapCommands(deps) {
     verifyOwnerWalletChallenge,
     resolveEffectiveUserDid,
     negotiateCapabilities,
+    CLI_VERSION,
     commandAgentRegister,
   } = deps;
 
@@ -232,6 +236,19 @@ async function commandWhoami(ctx, flags) {
         hasOwnerSessionToken: Boolean(auth.ownerSessionToken),
         ownerSessionToken: maskSecret(auth.ownerSessionToken),
         ownerSessionExpiresAt: auth.ownerSessionExpiresAt || null,
+        oauth: readOAuthSession(config)
+          ? {
+              issuer: auth.oauth.issuer || null,
+              // The API this sign-in is for; commands use it only on that API (--api-base).
+              resource: auth.oauth.resource || null,
+              activeForThisApi: String(auth.oauth.resource || '').replace(/\/+$/, '') === String(ctx.apiBase || '').replace(/\/+$/, ''),
+              agentKey: auth.oauth.agentKey || null,
+              scope: auth.oauth.scope || '',
+              canTrade: auth.oauth.canTrade === true,
+              expiresAt: auth.oauth.expiresAt || null,
+              accessToken: maskSecret(auth.oauth.accessToken),
+            }
+          : null,
       },
       agent: {
         hasAgentApiKey: Boolean(agent.apiKey),
@@ -272,6 +289,12 @@ async function commandLogin(ctx, flags) {
   );
   let loginSource = 'token';
 
+  // No token and no wallet-signature inputs: sign in with OAuth in the browser (THI-104).
+  const hasChallengeInputs = Boolean(String(flags.challengeId || '').trim() && String(flags.signature || '').trim());
+  if (!authToken && !ownerSessionToken && !hasChallengeInputs) {
+    return commandOAuthLogin(ctx, flags, { printEnvelope, version: CLI_VERSION });
+  }
+
   if (!authToken && !ownerSessionToken) {
     const challengeId = String(flags.challengeId || '').trim();
     const signature = String(flags.signature || '').trim();
@@ -611,6 +634,17 @@ async function commandLogout(ctx, flags) {
     }
   }
 
+  // An OAuth sign-in is revoked at the auth server (RFC 7009), so its tokens stop working
+  // everywhere, not only on this machine. Best effort: local credentials are cleared either way.
+  const oauthSession = readOAuthSession(current);
+  let oauthRevoked = null;
+  if (oauthSession) {
+    const revoke = (token) =>
+      revokeToken({ revocationEndpoint: oauthSession.revocationEndpoint, clientId: oauthSession.clientId, token }, ctx.timeoutMs || 30_000);
+    const [refresh, access] = await Promise.all([revoke(oauthSession.refreshToken), revoke(oauthSession.accessToken)]);
+    oauthRevoked = Boolean(refresh || access);
+  }
+
   const next = { ...current };
   delete next.auth;
   if (flags.clearAgentKey) {
@@ -626,6 +660,7 @@ async function commandLogout(ctx, flags) {
       revokeAttempted,
       revokeSuccess,
       revokeError,
+      ...(oauthSession ? { oauthRevoked, oauthAgentKey: oauthSession.agentKey || null } : {}),
       configPath: getProfileConfigPath(),
     },
     meta: { apiBase: ctx.apiBase },

package/src/commands/onboarding/credentials.mjs

@@ -5,14 +5,6 @@ import { createCliError } from '../../core/envelope.mjs';
 
 const require = createRequire(import.meta.url);
 const { normalizeCredentialStatus } = require('../../utils/cli/delegationNormalization.cjs');
-/** `credentials upsert` flags of the removed Bitfinex permission probe: accepted, ignored, and named in a warning. */
-const REMOVED_BITFINEX_FLAGS = [
-  ['permissionProfile', '--permission-profile'],
-  ['verifyPermissions', '--verify-permissions'],
-  ['skipPermissionsProbe', '--skip-permissions-probe'],
-  ['bitfinexBaseUrl', '--bitfinex-base-url'],
-];
-
 export function createCredentialsCommands({ printEnvelope, getAuthToken, buildOwnerAuthHeaders }) {
 async function commandCredentialsUpsert(ctx, flags, capabilities) {
   const authToken = getAuthToken(flags, 'Missing --auth-token (or THIRDFY_AUTH_TOKEN) for credentials upsert');
@@ -29,7 +21,6 @@ async function commandCredentialsUpsert(ctx, flags, capabilities) {
   if (flags.policy) payload.policy = parseJsonFlag(flags, 'policy');
   if (flags.agentKey) payload.agentKey = String(flags.agentKey).trim();
   if (flags.chainId) payload.chainId = Number(flags.chainId);
-  const ignoredFlags = REMOVED_BITFINEX_FLAGS.filter(([key]) => flags[key] !== undefined).map(([, flag]) => flag);
   const response = await requestWithRouteFallback(ctx, {
     method: 'POST',
     routes: ['/api/v1/agent/delegation/credentials/upsert', '/api/v1/agent/agent/delegation/credentials/upsert'],
@@ -46,7 +37,6 @@ async function commandCredentialsUpsert(ctx, flags, capabilities) {
     meta: {
       apiBase: ctx.apiBase,
       capabilitiesVersion: capabilities?.contractVersion || null,
-      ...(ignoredFlags.length ? { warnings: [`Ignored ${ignoredFlags.join(', ')}: Bitfinex support was removed. Drop these flags; they will stop being accepted in the next minor version.`] } : {}),
     },
   });
 }