@thirdfy/agent-cli 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to `@thirdfy/agent-cli` are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-10-18
+
+`thirdfy-agent track-record` proves an agent's trading track record, the CLI side of thirdfy-mcp's `prove_track_record` (thirdfy-mcp 0.1.47). `track actions` and `track events` now send the agent's key, which the API requires. A minor version for the new command.
+
+### Security
+
+- **`track actions` and `track events` send the agent's credential** (THI-292; MCP THI-148, thirdfy/thirdfy-mcp#292). They called `GET /api/v1/agent/telemetry/{actions,events}` with no credential, and the API used to answer with every agent's rows, user DIDs included. The API now refuses keyless reads (THI-149) and gives an agent key its own rows only. The CLI sends the agent key (`--agent-api-key`, `THIRDFY_AGENT_API_KEY` or config) in `x-agent-api-key`, never in the URL. The API does not let an OAuth sign-in read these routes, so a sign-in is skipped for the key in config. `--agent-key` is now optional (the key names its agent). With no credential the command refuses `AGENT_API_KEY_REQUIRED` (`check_credentials`) before any call. Scripts that passed only `--agent-key` need the agent's key.
+
+### Added
+
+- **`track-record challenge | verify | score | status | public <agentKey>`** (THI-291; thirdfy-api-v2 4.7.0, THI-255/THI-280; MCP thirdfy/thirdfy-mcp#293 and thirdfy/thirdfy-mcp#294). An agent proves it controls a Hyperliquid or Polymarket wallet that Thirdfy never funded and gets a score of the wallet's public venue history, signed by Thirdfy.
+  - **Steps:** `challenge --venue --wallet` returns a one-time message; you sign it with the wallet; `verify --challenge-id --signature` binds the wallet to the agent; `score [--venue --wallet]` scores the proven wallets; `status` lists them with their latest scores; `public <agentKey>` reads any agent's published record (no key).
+  - **Output:** the API's body plus `step`, `nextStep` (the command to run next), and for scores `summary` (venue, wallet, `eligible`, `reasons` and `reasonNotes`, `windowDays`, `pnlUsd`, `maxDrawdownUsd`, `trades`, `signer`, `digest`) and `verifyNote`. Schema: `track-record.response.schema.json`.
+  - **Checking a score:** `verifyNote` gives the 4.7.0 rule: the digest is keccak256 of `thirdfy-track-record/v1`, a newline, then the canonical JSON of `score`; compare the recovered EIP-191 signer with Thirdfy's signer (`GET /api/v1/track-record/signer`), never the `signer` field in the score.
+  - **Refusals:** every API code gets the MCP's `nextAction`, `retryable` and a hint with CLI commands: `AGENT_API_KEY_REQUIRED`, `AGENT_API_KEY_INVALID`, `TRACK_RECORD_UNAVAILABLE`, `TRACK_RECORD_DISABLED`, `SCORE_SIGNER_UNAVAILABLE`, `VENUE_HISTORY_UNAVAILABLE`, `VENUE_UNSUPPORTED`, `WALLET_INVALID`, `SIGNATURE_INVALID`, `SIGNATURE_MISMATCH`, `CHALLENGE_NOT_FOUND`, `CHALLENGE_USED`, `CHALLENGE_EXPIRED`, `WALLET_NOT_PROVEN`, `WALLET_BOUND_TO_OTHER_AGENT`, `TRACK_RECORD_NOT_PUBLISHED`. Also the 4.7.0 codes `AGENT_REGISTRY_UNAVAILABLE`, `RPC_UNAVAILABLE` and `NO_WALLET_SCORED` (503: call again or pass `--wallet`; 502: see each wallet's error in `results`).
+  - New next actions: `start_new_challenge`, `prove_wallet`, `owner_publish`.
+  - A timed-out `challenge` or `score` is sent once more (neither moves anything); `verify` spends its one-use challenge, so a timeout there is `WRITE_OUTCOME_UNKNOWN`: check `track-record status`.
+  - **Credential:** the agent API key (`--agent-api-key`, `THIRDFY_AGENT_API_KEY` or config). The track-record routes take only the agent key (they are not on the API's OAuth allowlist), so an OAuth sign-in is skipped for the key in config, and with no key the command refuses `AGENT_API_KEY_REQUIRED` before any call.
+  - Never asks for a venue key, never holds the wallet key, moves no funds and places no orders. Publishing stays the owner's step, signed in to Thirdfy.
+
+### Changed
+
+- `mcp-tool-map.json` maps `prove_track_record` to `track-record challenge` (68 MCP tools, 66 with a CLI command). `validate:provider-parity` resolves an MCP tool whose `name:` is a string constant in its own file.
+
+## [0.5.1] - 2026-10-16
+
+A patch release: `doctor certify execution` works for agents with a narrow allowlist.
+
+### Fixed
+
+- **`doctor certify execution` no longer fails on venue writes outside the agent's allowlist** (THI-201). With an agent key, the CLI reads the agent's own action list, so bare certification flagged every venue write the agent may not call (for example `place_hyperliquid_tp_sl` or `update_lighter_leverage`) as `CATALOG_SCHEMA_UNAVAILABLE` and failed. It now checks only the venue writes the agent may call and lists the rest in `skippedVenueActions`. An allowed action with a broken schema, a `--required-actions` entry the agent can't call, and a public catalog missing a venue write all still fail.
+
 ## [0.5.0] - 2026-10-15
 
 `thirdfy-agent login` signs in with OAuth in the browser (auth.thirdfy.com, the same sign-in the MCP uses), as one agent with read access, plus trade with `--trade`. A minor version because `login` without a token flag now starts that sign-in instead of failing, and `credits balance` / `pricing quote` drop their credit counts for USD. `login email`, token flags and agent API keys work as before.

package/README.md

@@ -39,11 +39,15 @@ Run without global install:
 npx @thirdfy/agent-cli --help
 ```
 
-## What's new in v0.5.0
-
-- **Sign in with your Thirdfy account:** `thirdfy-agent login` opens your browser at auth.thirdfy.com. You pick one agent and approve read access, and trade access with `thirdfy-agent login --trade`. The CLI then acts as that agent, refreshes the sign-in by itself, and `thirdfy-agent logout` revokes it. Disconnect it any time in Connected apps at auth.thirdfy.com.
-- **Same sign-in as the MCP:** the same consent page and the same Connected apps list as Claude, ChatGPT and Cursor.
-- **Nothing else changes:** `login email`, `--auth-token`, `--owner-session-token` and agent API keys work as before, and an explicit `--agent-api-key` always wins over the sign-in.
+## What's new in v0.6.0
+
+- **Prove a trading track record: `thirdfy-agent track-record`.** Your agent proves it controls a Hyperliquid or Polymarket wallet and gets a score of that wallet's public history (PnL, drawdown, trades, eligibility reasons), signed by Thirdfy. Same steps and answers as the MCP tool `prove_track_record`.
+  - `track-record challenge --venue hyperliquid --wallet 0x…` returns a message; sign it with the wallet yourself.
+  - `track-record verify --challenge-id <id> --signature 0x…` binds the wallet to the agent.
+  - `track-record score`, `track-record status`, and `track-record public <agentKey>` for any agent's published record.
+- **Nothing moves:** no funds, no orders, no venue key, and the CLI never holds the wallet key. Scores stay private until the agent's owner publishes them.
+- **Clear next steps on every refusal:** each one carries `errorCode`, `retryable`, `nextAction` and a `hint`. See [`docs/command-reference.md`](./docs/command-reference.md#track-records-track-record), including how to check a score's signature.
+- **`track actions` and `track events` need the agent's key** (`--agent-api-key`, env or config; an OAuth sign-in cannot read them) and return only that agent's rows. `--agent-key` alone no longer works.
 - Older versions: see [CHANGELOG.md](./CHANGELOG.md).
 
 ## Quick start
@@ -352,6 +356,7 @@ Provider and venue guides are kept outside `README` so this page stays stable as
 - Discovery: `catalogs list`, `signals` (data provider apps and their signals: fields with units, freshness, roles, credits, attribution; `--provider`, `--role`), `actions` (optional `--provider`, `--chain-id`, `--data-category`; see [`docs/command-reference.md`](./docs/command-reference.md) for trading vs earn vs prediction providers and case-insensitive matching)
 - Discovery: `actions`, `chains` (chain ids, CAIP-2 and lanes from the API)
 - Readiness and credits: `readiness` (can the agent act on a chain), `credits balance`, `credits buy --usd <n>`
+- Track records: `track-record challenge`, `track-record verify`, `track-record score`, `track-record status`, `track-record public <agentKey>` (prove a trading wallet, get a Thirdfy-signed score)
 - Execution: `preflight`, `preview`, `run`, `intent-status`
 - Polymarket: `polymarket status`, `polymarket setup`, `polymarket dry-run`
 - Venue tooling: `venue readiness`, `venue setup`, `venue fund` (`polymarket`, `hyperliquid`, `lighter`, `veranta`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdfy/agent-cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Thirdfy Agent CLI for onboarding, governance preflight, execute-intent, and status polling.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "test": "node --test test/*/*.test.cjs test/*/*/*.test.cjs",
-    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/core/oauth/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
+    "lint": "node --check ./bin/thirdfy-agent.mjs && node --check ./src/core/*.mjs && node --check ./src/core/execution/*.mjs && node --check ./src/core/oauth/*.mjs && node --check ./src/commands/*.mjs && node --check ./src/commands/venues/*.mjs && node --check ./src/commands/onboarding/*.mjs && node --check ./src/commands/account/*.mjs && node --check ./src/commands/signals/*.mjs && node --check ./src/commands/trackRecord/*.mjs && node --check ./src/cli/*.mjs && node --check ./src/cli/options/*.mjs && node --check ./src/cli/options/venues/*.mjs && node --check ./src/cli/options/onboarding/*.mjs && node --check ./src/cli/options/account/*.mjs && node --check ./src/runtime/*.mjs && node --check ./src/runtime/execution/*.mjs && node --check ./src/runtime/execution/runners/*.mjs && node --check ./src/runtime/actions/*.mjs && node --check ./src/runtime/validation/*.mjs && node --check ./src/runtime/certification/*.mjs && node --check ./src/runtime/providerHints/*.mjs && node --check ./src/runtime/risk/*.mjs",
     "validate:cli-manifest-handlers": "node ./scripts/validate-cli-manifest-handlers.mjs",
     "validate:runtime-boundaries": "node ./scripts/validate-runtime-boundaries.mjs",
     "validate:npm-pack": "node ./scripts/validate-npm-pack.mjs",

package/scripts/validate-cli-contract-schemas.mjs

@@ -16,6 +16,7 @@ const REQUIRED_FILES = [
   'readiness.response.schema.json',
   'error.response.schema.json',
   'wallet-profile.response.schema.json',
+  'track-record.response.schema.json',
 ];
 
 const REQUIRED_KEYS = ['$schema', 'title', 'type'];

package/src/cli/manifest.mjs

@@ -647,6 +647,43 @@ export const CLI_MANIFEST = [
     options: ['signals'],
     description: 'List data provider apps and the signals they publish (fields, units, freshness, roles, credits)',
   },
+  // track records (thirdfy-mcp prove_track_record): prove a trading wallet, get a Thirdfy-signed score
+  {
+    path: ['track-record', 'challenge'],
+    handler: 'commandTrackRecordChallenge',
+    tier: 'offline',
+    options: ['trackRecord'],
+    description: 'Get a one-time message to sign with a trading wallet: --venue hyperliquid|polymarket --wallet <0x>',
+  },
+  {
+    path: ['track-record', 'verify'],
+    handler: 'commandTrackRecordVerify',
+    tier: 'offline',
+    options: ['trackRecord'],
+    description: "Prove the wallet: --challenge-id <id> --signature <the wallet's signature of the message>",
+  },
+  {
+    path: ['track-record', 'score'],
+    handler: 'commandTrackRecordScore',
+    tier: 'offline',
+    options: ['trackRecord'],
+    description: 'Score the proven wallets from public venue history, signed by Thirdfy (optional --venue, --wallet)',
+  },
+  {
+    path: ['track-record', 'status'],
+    handler: 'commandTrackRecordStatus',
+    tier: 'offline',
+    options: ['trackRecord'],
+    description: "This agent's proven wallets and latest scores, published or not",
+  },
+  {
+    path: ['track-record', 'public'],
+    handler: 'commandTrackRecordPublic',
+    tier: 'offline',
+    options: ['trackRecord'],
+    description: "An agent's published track record (no key needed)",
+    args: { query: '<agentKey>' },
+  },
   {
     path: ['readiness'],
     handler: 'commandReadiness',

package/src/cli/options/index.mjs

@@ -20,6 +20,7 @@ import { attachBrainOptions } from './brain.mjs';
 import { attachCertificationOptions } from './certification.mjs';
 import { attachActionListOptions, attachDataCategoryOptions, attachSignalsOptions } from './data.mjs';
 import { attachWalletControlOptions } from './account/walletControl.mjs';
+import { attachTrackRecordOptions } from './trackRecord.mjs';
 
 const BUNDLES = {
   auth: attachAuthOptions,
@@ -48,6 +49,7 @@ const BUNDLES = {
   dataCategory: attachDataCategoryOptions,
   actionList: attachActionListOptions,
   walletControl: attachWalletControlOptions,
+  trackRecord: attachTrackRecordOptions,
 };
 
 /** @param {import('commander').Command} cmd */

package/src/cli/options/trackRecord.mjs

@@ -0,0 +1,9 @@
+/** `track-record` steps: the agent API key, and the step's own fields. No venue key and no wallet key. */
+export function attachTrackRecordOptions(cmd) {
+  return cmd
+    .option('--agent-api-key <key>', 'agent API key (every step but public)')
+    .option('--venue <venue>', 'challenge (required) and score (optional filter): the venue the wallet trades on, for example hyperliquid or polymarket')
+    .option('--wallet <address>', 'challenge (required) and score (optional filter): the 0x wallet; for Polymarket, the proxy wallet trades settle to')
+    .option('--challenge-id <id>', 'verify (required): the challengeId the challenge step returned')
+    .option('--signature <hex>', "verify (required): the wallet's signature of the challenge message, exactly as returned");
+}

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from 'module';
 import { requireFlag } from '../core/args.mjs';
 import { apiGet, requestWithRouteFallback } from '../core/http.mjs';
-import { loadProfileConfig, getProfileConfigPath, getCachedActionsCatalog } from '../core/context.mjs';
+import { loadProfileConfig, getProfileConfigPath, getCachedActionsCatalogSnapshot } from '../core/context.mjs';
 import { DEFAULT_API_BASE, PROFILE_DEFAULTS } from '../core/constants.mjs';
 import { DEFAULT_CHAIN_ID, describeChainGas, parseChainIdFlag, pinnedRpcProvider, resolveChainRpcUrl } from '../core/chainRegistry.mjs';
 import { exitAfterOutput } from '../core/envelope.mjs';
@@ -333,9 +333,12 @@ async function commandManagedSetup(ctx, flags, capabilities) {
 
 async function commandDoctorCertifyExecution(ctx, flags) {
   let liveActions = null;
+  let catalogPolicyScoped = false;
   let catalogError = null;
   try {
-    liveActions = await getCachedActionsCatalog(ctx, flags);
+    const snapshot = await getCachedActionsCatalogSnapshot(ctx, flags);
+    liveActions = snapshot.actions;
+    catalogPolicyScoped = snapshot.policyScoped === true;
   } catch (error) {
     catalogError = {
       message: error?.message || 'Actions catalog fetch failed',
@@ -356,6 +359,7 @@ async function commandDoctorCertifyExecution(ctx, flags) {
     runMode,
     expectedSchemaDigest,
     requiredActions,
+    catalogPolicyScoped,
   });
 
   printEnvelope({
@@ -369,6 +373,7 @@ async function commandDoctorCertifyExecution(ctx, flags) {
       catalog: {
         fetched: Array.isArray(liveActions),
         actionCount: Array.isArray(liveActions) ? liveActions.length : 0,
+        policyScoped: catalogPolicyScoped,
         error: catalogError,
       },
     },

package/src/commands/telemetry.mjs

@@ -1,5 +1,7 @@
 import { requireFlag, parseJsonFlag } from '../core/args.mjs';
 import { apiGet, apiPost } from '../core/http.mjs';
+import { findAgentApiKeyWithoutOAuth } from '../core/context.mjs';
+import { createCliError } from '../core/envelope.mjs';
 import { hasVerantaToken, normalizeVenueProviderId } from '../core/venueBrand.mjs';
 export function createTelemetryCommands({ printEnvelope, resolveAgentApiKey }) {
 function applySharedPortfolioListingFiltersToQuery(query, flags) {
@@ -80,11 +82,35 @@ async function commandAnalyticsLeaderboard(ctx, flags, capabilities) {
   });
 }
 
+/**
+ * `track actions` / `track events`: the agent's own tracked rows. The API answers only an agent
+ * key (that agent's rows, without user DIDs) or an operator key (THI-149), so the agent key goes in
+ * `x-agent-api-key`, never the URL, as thirdfy-mcp getAgentTrackActions / getAgentTrackEvents
+ * (THI-148). The API's OAuth allowlist does not open these routes, so an OAuth sign-in is skipped
+ * for the key in config (`findAgentApiKeyWithoutOAuth`). The key names its agent;
+ * `--agent-key` is optional and must be that agent. No credential: refused before any call.
+ */
 async function commandTrackList(ctx, flags, capabilities, kind) {
-  const agentKey = requireFlag(flags, 'agentKey', 'Missing --agent-key');
-  const query = new URLSearchParams({ agentKey });
+  const agentApiKey = findAgentApiKeyWithoutOAuth(flags);
+  if (!agentApiKey) {
+    const error = createCliError(
+      'AGENT_API_KEY_REQUIRED',
+      `track ${kind} reads the agent's own rows and needs its API key (--agent-api-key, THIRDFY_AGENT_API_KEY or config; an OAuth sign-in cannot read them).`,
+      { blockedStage: 'auth' },
+    );
+    error.errorFields = {
+      nextAction: 'check_credentials',
+      retryable: false,
+      hint: "Tracked actions and events belong to an agent: pass --agent-api-key, set THIRDFY_AGENT_API_KEY, or save the key with `thirdfy-agent login --agent-api-key <key>`. An OAuth sign-in cannot read them.",
+    };
+    throw error;
+  }
+  const agentKey = String(flags.agentKey || '').trim();
+  const query = new URLSearchParams();
+  if (agentKey) query.set('agentKey', agentKey);
   if (flags.limit) query.set('limit', String(flags.limit));
-  const response = await apiGet(ctx, `/api/v1/agent/telemetry/${kind}?${query.toString()}`);
+  const search = query.toString();
+  const response = await apiGet(ctx, `/api/v1/agent/telemetry/${kind}${search ? `?${search}` : ''}`, { 'x-agent-api-key': agentApiKey });
   printEnvelope({
     success: true,
     code: kind === 'events' ? 'TRACK_EVENTS_OK' : 'TRACK_ACTIONS_OK',
@@ -92,7 +118,7 @@ async function commandTrackList(ctx, flags, capabilities, kind) {
     data: response,
     meta: {
       apiBase: ctx.apiBase,
-      agentKey,
+      agentKey: agentKey || null,
       kind,
     },
   });

package/src/commands/trackRecord/command.mjs

@@ -0,0 +1,187 @@
+import { usageError } from '../../core/args.mjs';
+import { findAgentApiKeyWithoutOAuth } from '../../core/context.mjs';
+import { createCliError } from '../../core/envelope.mjs';
+import { apiGet, apiPost } from '../../core/http.mjs';
+import { TRACK_RECORD_REFUSALS, trackRecordRefusal } from './refusals.mjs';
+import { VERIFY_NOTE, formatScoreLines, scoreSummaries } from './scoreSummary.mjs';
+
+/**
+ * `thirdfy-agent track-record <step>`: the CLI side of thirdfy-mcp's prove_track_record (THI-256,
+ * THI-291). An agent proves it controls a trading wallet and gets a score of that wallet's public
+ * venue history, signed by Thirdfy. It calls the Thirdfy API's track-record routes (THI-255,
+ * thirdfy-api-v2 `docs-dev/agents/track-record.md`):
+ *
+ * - `challenge --venue --wallet` -> `POST /api/v1/track-record/challenge`: a one-time message. The
+ *   agent signs it with the wallet itself; the CLI never holds or asks for the wallet key.
+ * - `verify --challenge-id --signature` -> `POST /verify`: the wallet is bound to the agent.
+ * - `score [--venue] [--wallet]` -> `POST /score`: signed scores of the proven wallets.
+ * - `status` -> `GET /me`: the agent's proven wallets and latest scores, published or not.
+ * - `public <agentKey>` -> `GET /public/:agentKey`: what anyone sees once the owner has published.
+ *
+ * Every step but `public` sends the agent API key (`x-agent-api-key`); the API takes the agent from
+ * the key, never from the body. These routes read only that header, so an OAuth sign-in (sent as
+ * `Authorization: Bearer`, which the API's OAuth allowlist does not open here) is skipped for the
+ * agent key saved in config (`findAgentApiKeyWithoutOAuth`), or the CLI refuses with
+ * AGENT_API_KEY_REQUIRED before any call. Publishing is the owner's step (signed in to
+ * Thirdfy) and is not offered. Nothing moves funds, places orders or asks for a venue key.
+ */
+
+const BASE = '/api/v1/track-record';
+
+function agentApiKeyRequired() {
+  const error = createCliError('AGENT_API_KEY_REQUIRED', 'track-record needs the agent API key (every step but public).', {
+    blockedStage: 'auth',
+  });
+  error.errorFields = TRACK_RECORD_REFUSALS.AGENT_API_KEY_REQUIRED;
+  return error;
+}
+
+function missingArguments(step, names) {
+  return usageError(`track-record ${step} needs ${names.map((name) => `--${name}`).join(' and ')}.`, names[0]);
+}
+
+/** A track-record refusal gets its next step (`errorFields`); anything else is left as thrown. */
+function withRefusalFields(error) {
+  const code = String(error?.payload?.error || '').trim();
+  const refusal = error?.statusCode ? trackRecordRefusal(code, Number(error.statusCode)) : undefined;
+  if (refusal) error.errorFields = refusal;
+  return error;
+}
+
+/** What the agent does after a successful step. */
+function nextStepOf(step, data) {
+  if (step === 'challenge') {
+    const challenge = data.challenge && typeof data.challenge === 'object' ? data.challenge : {};
+    return {
+      step: 'verify',
+      instruction:
+        'Sign `challenge.message` exactly as returned with the wallet (personal_sign) before `expiresAt`, then run `thirdfy-agent track-record verify --challenge-id <challengeId> --signature <signature>`. Thirdfy never sees the wallet key.',
+      challengeId: challenge.challengeId,
+      expiresAt: challenge.expiresAt,
+    };
+  }
+  if (step === 'verify') {
+    return { step: 'score', instruction: 'Run `thirdfy-agent track-record score` to score the proven wallet.' };
+  }
+  if (step === 'score' || step === 'status') {
+    return {
+      step: 'owner_publish',
+      instruction:
+        "Scores stay private until the agent's owner publishes them, signed in to Thirdfy. After that, `thirdfy-agent track-record public <agentKey>` shows them to anyone.",
+    };
+  }
+  return undefined;
+}
+
+const MESSAGES = {
+  challenge: 'Challenge created: sign the message with the wallet',
+  verify: 'Wallet proven',
+  score: 'Scores signed',
+  status: 'Track record loaded',
+  public: 'Published track record loaded',
+};
+
+export function createTrackRecordCommands({ printEnvelope }) {
+  async function runStep(ctx, step, request) {
+    let data;
+    try {
+      // challenge and score move nothing and are safe to send again, so a timeout there is retried
+      // and never WRITE_OUTCOME_UNKNOWN; verify spends its one-use challenge and stays a write.
+      const callCtx = request.resendable ? { ...ctx, writeAction: false } : ctx;
+      const response =
+        request.method === 'GET'
+          ? await apiGet(callCtx, request.route, request.headers)
+          : await apiPost(callCtx, request.route, request.body, request.headers);
+      data = response && typeof response === 'object' && !Array.isArray(response) ? response : {};
+    } catch (error) {
+      throw withRefusalFields(error);
+    }
+    const scored = step === 'score' || step === 'status' || step === 'public';
+    const summary = scored ? scoreSummaries(data.scores) : [];
+    const nextStep = nextStepOf(step, data);
+    const lead = [
+      scored ? formatScoreLines(summary) : '',
+      step === 'challenge' && data.challenge?.message ? `Message to sign:\n${data.challenge.message}` : '',
+      nextStep ? `Next: ${nextStep.instruction}` : '',
+    ]
+      .filter(Boolean)
+      .join('\n');
+    printEnvelope(
+      {
+        success: true,
+        code: 'OK',
+        message: MESSAGES[step],
+        data: {
+          ...data,
+          step,
+          ...(scored ? { summary, verifyNote: VERIFY_NOTE } : {}),
+          ...(nextStep ? { nextStep } : {}),
+        },
+        meta: { apiBase: ctx.apiBase, step },
+      },
+      { humanLead: lead },
+    );
+  }
+
+  function agentHeaders(flags) {
+    const agentApiKey = findAgentApiKeyWithoutOAuth(flags);
+    if (!agentApiKey) throw agentApiKeyRequired();
+    return { 'x-agent-api-key': agentApiKey };
+  }
+
+  async function commandTrackRecordChallenge(ctx, flags) {
+    const venue = String(flags.venue || '').trim();
+    const wallet = String(flags.wallet || '').trim();
+    if (!venue || !wallet) throw missingArguments('challenge', ['venue', 'wallet']);
+    await runStep(ctx, 'challenge', {
+      method: 'POST',
+      route: `${BASE}/challenge`,
+      resendable: true,
+      body: { venue, wallet },
+      headers: agentHeaders(flags),
+    });
+  }
+
+  async function commandTrackRecordVerify(ctx, flags) {
+    const challengeId = String(flags.challengeId || '').trim();
+    const signature = String(flags.signature || '').trim();
+    if (!challengeId || !signature) throw missingArguments('verify', ['challenge-id', 'signature']);
+    await runStep(ctx, 'verify', {
+      method: 'POST',
+      route: `${BASE}/verify`,
+      body: { challengeId, signature },
+      headers: agentHeaders(flags),
+    });
+  }
+
+  async function commandTrackRecordScore(ctx, flags) {
+    const venue = String(flags.venue || '').trim();
+    const wallet = String(flags.wallet || '').trim();
+    await runStep(ctx, 'score', {
+      method: 'POST',
+      route: `${BASE}/score`,
+      resendable: true,
+      body: { ...(venue ? { venue } : {}), ...(wallet ? { wallet } : {}) },
+      headers: agentHeaders(flags),
+    });
+  }
+
+  async function commandTrackRecordStatus(ctx, flags) {
+    await runStep(ctx, 'status', { method: 'GET', route: `${BASE}/me`, headers: agentHeaders(flags) });
+  }
+
+  async function commandTrackRecordPublic(ctx, flags) {
+    // Commander requires <agentKey>; it arrives as the positional `query`.
+    const positional = Array.isArray(flags.query) ? flags.query[0] : flags.query;
+    const agentKey = String(positional || '').trim().toLowerCase();
+    await runStep(ctx, 'public', { method: 'GET', route: `${BASE}/public/${encodeURIComponent(agentKey)}`, headers: {} });
+  }
+
+  return {
+    commandTrackRecordChallenge,
+    commandTrackRecordVerify,
+    commandTrackRecordScore,
+    commandTrackRecordStatus,
+    commandTrackRecordPublic,
+  };
+}

package/src/commands/trackRecord/refusals.mjs

@@ -0,0 +1,128 @@
+/**
+ * What an agent does after each refusal of the Thirdfy API's track-record routes (THI-255,
+ * `/api/v1/track-record/*`). The API sends only `{ success: false, error, message }`; the CLI adds
+ * `nextAction`, `retryable` and a `hint` (as `error.errorFields`, read by `describeCliError`), the
+ * same as thirdfy-mcp's prove_track_record (`src/tools/trackRecord/trackRecordRefusals.ts`), with
+ * CLI commands in the hints instead of the MCP tool's steps.
+ * Codes: thirdfy-api-v2 `docs-dev/agents/track-record.md`.
+ */
+
+const startOver = (why) => ({
+  nextAction: 'start_new_challenge',
+  retryable: false,
+  hint: `${why} Run \`thirdfy-agent track-record challenge\` again and sign the new message.`,
+});
+
+export const TRACK_RECORD_REFUSALS = Object.freeze({
+  AGENT_API_KEY_REQUIRED: {
+    nextAction: 'check_credentials',
+    retryable: false,
+    hint: "Track records belong to an agent: pass --agent-api-key, set THIRDFY_AGENT_API_KEY, or save the key with `thirdfy-agent login --agent-api-key <key>`. An OAuth sign-in cannot prove a track record from the CLI; use the agent's API key.",
+  },
+  AGENT_API_KEY_INVALID: {
+    nextAction: 'check_credentials',
+    retryable: false,
+    hint: 'Thirdfy did not accept this agent API key. Use the key of the agent that trades the wallet.',
+  },
+  AGENT_REGISTRY_UNAVAILABLE: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: 'Thirdfy could not check the agent key right now. This is an outage, not a bad key: retry shortly.',
+  },
+  TRACK_RECORD_UNAVAILABLE: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: 'Thirdfy could not check the key or reach its store. This is an outage, not a bad key: retry shortly.',
+  },
+  TRACK_RECORD_DISABLED: {
+    nextAction: 'contact_support',
+    retryable: false,
+    hint: 'Track records are switched off on this Thirdfy environment.',
+  },
+  SCORE_SIGNER_UNAVAILABLE: {
+    nextAction: 'contact_support',
+    retryable: false,
+    hint: 'This Thirdfy environment has no score signing key, so it stores no score. The wallet proof is kept.',
+  },
+  RPC_UNAVAILABLE: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: "Thirdfy could not reach the venue chain to check a contract wallet's signature. Nothing was refused: retry the verify shortly with the same challenge, before it expires.",
+  },
+  VENUE_HISTORY_UNAVAILABLE: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: "The venue's public history API did not answer. Retry the score shortly.",
+  },
+  VENUE_UNSUPPORTED: {
+    nextAction: 'fix_request',
+    retryable: false,
+    hint: 'Thirdfy does not score this venue yet. Use a venue the API supports (the refusal message says which).',
+  },
+  WALLET_INVALID: {
+    nextAction: 'fix_request',
+    retryable: false,
+    hint: '--wallet must be a 0x EVM address: the Hyperliquid account, or the Polymarket proxy wallet trades settle to.',
+  },
+  SIGNATURE_INVALID: {
+    nextAction: 'fix_request',
+    retryable: false,
+    hint: '--signature must be the 0x hex signature of the challenge message, signed with the wallet (personal_sign / EIP-191, or EIP-1271 for a contract wallet).',
+  },
+  SIGNATURE_MISMATCH: {
+    nextAction: 'fix_request',
+    retryable: false,
+    hint: 'The signature is not from the challenged wallet. Sign the exact challenge message, unchanged, with that wallet.',
+  },
+  CHALLENGE_NOT_FOUND: startOver('This challenge does not exist for this agent.'),
+  CHALLENGE_USED: startOver('This challenge was already used.'),
+  CHALLENGE_EXPIRED: startOver('The challenge expired (past its expiresAt).'),
+  WALLET_NOT_PROVEN: {
+    nextAction: 'prove_wallet',
+    retryable: false,
+    hint: 'This agent has not proven that wallet. Run `thirdfy-agent track-record challenge`, sign the message with the wallet, then `thirdfy-agent track-record verify`.',
+  },
+  WALLET_BOUND_TO_OTHER_AGENT: {
+    nextAction: 'contact_support',
+    retryable: false,
+    hint: 'Another agent already proved this wallet. A wallet belongs to one agent.',
+  },
+  TRACK_RECORD_NOT_PUBLISHED: {
+    nextAction: 'owner_publish',
+    retryable: false,
+    hint: "The agent's owner has not published its track record. The owner opts in, signed in to Thirdfy; an agent key cannot publish.",
+  },
+});
+
+/**
+ * `/score` when no wallet scored (thirdfy-api-v2 4.7.0, THI-280): 503 when every wallet only ran out
+ * of time or hit the per-call cap, else 502. Both carry the per-wallet `results`.
+ */
+const NO_WALLET_SCORED = Object.freeze({
+  503: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: 'No wallet scored in this call: each one ran out of time or passed the per-call cap. Call `thirdfy-agent track-record score` again, or pass --venue and --wallet to score one.',
+  },
+  502: {
+    nextAction: 'retry_later',
+    retryable: true,
+    hint: "No wallet could be scored; each wallet's error is in `results` (VENUE_HISTORY_UNAVAILABLE: the venue's public API did not answer). Retry the score shortly.",
+  },
+});
+
+/** The next step for a track-record refusal, or undefined for a code this table does not know. */
+export function trackRecordRefusal(code, status) {
+  if (code === 'NO_WALLET_SCORED') return NO_WALLET_SCORED[status === 503 ? 503 : 502];
+  return TRACK_RECORD_REFUSALS[code];
+}
+
+/** The line a score adds for each reason it is not eligible. */
+export const INELIGIBLE_REASON_NOTES = Object.freeze({
+  SHORT_HISTORY: "SHORT_HISTORY: the account history is shorter than the policy's minimum days.",
+  FEW_TRADES: "FEW_TRADES: fewer trades in the window than the policy's minimum.",
+  SHORT_HOLDS: "SHORT_HOLDS: too many round trips were held for less than the policy's minimum time.",
+  SELF_TRADES: 'SELF_TRADES: too many trades were self-trades.',
+  HISTORY_TRUNCATED:
+    'HISTORY_TRUNCATED: the venue had more history pages than Thirdfy reads, so trade counts and PnL are lower bounds. The score is signed but not eligible.',
+});

package/src/commands/trackRecord/scoreSummary.mjs

@@ -0,0 +1,57 @@
+import { INELIGIBLE_REASON_NOTES } from './refusals.mjs';
+
+const isRecord = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value));
+
+const stringList = (value) => (Array.isArray(value) ? value.filter((item) => typeof item === 'string') : []);
+
+/**
+ * One line per signed score: venue, wallet, eligible or why not, and the signer and digest. The
+ * same fields as thirdfy-mcp prove_track_record's `summary`.
+ */
+export function scoreSummaries(scores) {
+  return (Array.isArray(scores) ? scores : []).filter(isRecord).map((signed) => {
+    const score = isRecord(signed.score) ? signed.score : {};
+    const metrics = isRecord(score.metrics) ? score.metrics : {};
+    const reasons = stringList(score.reasons);
+    return {
+      venue: score.venue,
+      wallet: score.wallet,
+      eligible: score.eligible,
+      reasons,
+      ...(reasons.length ? { reasonNotes: reasons.map((reason) => INELIGIBLE_REASON_NOTES[reason] ?? reason) } : {}),
+      ...(isRecord(score.window) ? { windowDays: score.window.days } : {}),
+      pnlUsd: metrics.pnlUsd,
+      maxDrawdownUsd: metrics.maxDrawdownUsd,
+      trades: metrics.trades,
+      signer: signed.signer,
+      digest: signed.digest,
+    };
+  });
+}
+
+/**
+ * How anyone checks a score. Since thirdfy-api-v2 4.7.0 (THI-280) the digest carries a domain tag,
+ * and the signer to trust is Thirdfy's (`GET /api/v1/track-record/signer`), never the `signer`
+ * field inside the score, which anyone can set.
+ */
+export const VERIFY_NOTE =
+  'Anyone can check a score: the digest is keccak256 of `thirdfy-track-record/v1`, a newline, then the canonical JSON of `score` (keys sorted). Recover the EIP-191 signer from `digest` and `signature` and compare it with Thirdfy\'s signer from `GET /api/v1/track-record/signer`, not with the `signer` field in the score. `score.evidence` lists the public venue requests it read.';
+
+const usd = (value) => {
+  const n = Number(value);
+  if (value === null || value === undefined || !Number.isFinite(n)) return 'n/a';
+  const sign = n < 0 ? '-' : '';
+  return `${sign}$${Math.abs(n).toLocaleString('en-US', { maximumFractionDigits: 2 })}`;
+};
+
+/** Human mode: one line per score, then the next step. */
+export function formatScoreLines(summaries) {
+  if (!summaries.length) return 'No scores yet.';
+  return summaries
+    .map((row) => {
+      const status = row.eligible ? 'eligible' : `not eligible (${row.reasons.join(', ') || 'no reason given'})`;
+      const window = row.windowDays ? ` over ${row.windowDays}d` : '';
+      return `${row.venue} ${row.wallet}: ${status}; PnL ${usd(row.pnlUsd)}${window}, max drawdown ${usd(row.maxDrawdownUsd)}, ${row.trades ?? 'n/a'} trades`;
+    })
+    .join('\n');
+}

package/src/contracts/cli/schemas/track-record.response.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "CLI Endpoint: track-record (challenge, verify, score, status, public)",
+  "description": "The API's track-record body (thirdfy-api-v2 /api/v1/track-record/*) plus the fields thirdfy-mcp prove_track_record adds: step, summary and verifyNote (score, status, public), nextStep (all but public).",
+  "type": "object",
+  "required": ["step"],
+  "properties": {
+    "step": { "enum": ["challenge", "verify", "score", "status", "public"] },
+    "challenge": {
+      "type": "object",
+      "required": ["challengeId", "message", "expiresAt"],
+      "properties": {
+        "challengeId": { "type": "string" },
+        "venue": { "type": "string" },
+        "wallet": { "type": "string" },
+        "message": { "type": "string" },
+        "expiresAt": { "type": "string" }
+      }
+    },
+    "wallet": { "type": "object" },
+    "wallets": { "type": "array" },
+    "scores": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["score", "digest", "signature"],
+        "properties": {
+          "score": { "type": "object" },
+          "digest": { "type": "string" },
+          "signature": { "type": "string" },
+          "signer": { "type": "string" }
+        }
+      }
+    },
+    "results": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["venue", "wallet", "ok"],
+        "properties": {
+          "venue": { "type": "string" },
+          "wallet": { "type": "string" },
+          "ok": { "type": "boolean" },
+          "reused": { "type": "boolean" },
+          "score": { "type": "object" },
+          "error": { "type": "string" },
+          "message": { "type": "string" }
+        }
+      }
+    },
+    "summary": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["reasons"],
+        "properties": {
+          "venue": { "type": ["string", "null"] },
+          "wallet": { "type": ["string", "null"] },
+          "eligible": { "type": ["boolean", "null"] },
+          "reasons": { "type": "array", "items": { "type": "string" } },
+          "reasonNotes": { "type": "array", "items": { "type": "string" } },
+          "windowDays": { "type": ["number", "null"] },
+          "pnlUsd": { "type": ["number", "null"] },
+          "maxDrawdownUsd": { "type": ["number", "null"] },
+          "trades": { "type": ["number", "null"] },
+          "signer": { "type": ["string", "null"] },
+          "digest": { "type": ["string", "null"] }
+        }
+      }
+    },
+    "verifyNote": { "type": "string" },
+    "nextStep": {
+      "type": "object",
+      "required": ["step", "instruction"],
+      "properties": {
+        "step": { "enum": ["verify", "score", "owner_publish"] },
+        "instruction": { "type": "string" },
+        "challengeId": { "type": "string" },
+        "expiresAt": { "type": "string" }
+      }
+    }
+  }
+}

package/src/core/context.mjs

@@ -4,7 +4,7 @@ import path from 'path';
 import { DEFAULT_CATALOG_CACHE_TTL_MS, PROFILE_DEFAULTS } from './constants.mjs';
 import { createCliError } from './envelope.mjs';
 import { apiGet } from './http.mjs';
-import { apiBaseFor, oauthSessionForApi, oauthSessionIsAgentCredential } from './oauth/session.mjs';
+import { apiBaseFor, isOAuthAccessToken, oauthSessionForApi, oauthSessionIsAgentCredential } from './oauth/session.mjs';
 import {
   normalizeCustodyMode,
   normalizeProfileName,
@@ -139,6 +139,19 @@ export function findAgentApiKey(flags = {}) {
   return String(config?.agent?.apiKey || '').trim();
 }
 
+/**
+ * The agent API key for a route an OAuth sign-in may not call. The API lets an OAuth bearer reach
+ * only the routes in its allowlist (thirdfy-api-v2 `auth/oauth/oauthRouteAllowlist.ts`): not
+ * `/track-record/*` or `/telemetry/{actions,events}`. So an OAuth access token from
+ * `findAgentApiKey` is skipped for config `agent.apiKey`; empty when there is no real agent key.
+ */
+export function findAgentApiKeyWithoutOAuth(flags = {}) {
+  const key = findAgentApiKey(flags);
+  if (key && !isOAuthAccessToken(key)) return key;
+  const saved = String(loadProfileConfig()?.agent?.apiKey || '').trim();
+  return saved && !isOAuthAccessToken(saved) ? saved : '';
+}
+
 /**
  * Whose credits a credits read is about. Same precedence as `wallet profile`: an owner credential
  * passed as a flag (--owner-session-token or --auth-token), then an explicit --agent-api-key or an

package/src/core/errorEnvelope.mjs

@@ -22,6 +22,9 @@ export const NEXT_ACTIONS = Object.freeze({
   use_evm_chain: 'This Thirdfy API does not run that chain family (Solana). Use an EVM chain the API lists in `chains`.',
   reauthenticate: 'The sign-in expired or was revoked. Sign in again: `thirdfy-agent login`.',
   reauthenticate_with_trade: 'This sign-in is read-only. Sign in again with trade access: `thirdfy-agent login --trade`.',
+  start_new_challenge: 'The wallet challenge cannot be used. Run `thirdfy-agent track-record challenge` again and sign the new message.',
+  prove_wallet: 'The agent has not proven this wallet. Run `thirdfy-agent track-record challenge`, sign it with the wallet, then `track-record verify`.',
+  owner_publish: "The agent's owner has not published its track record. The owner publishes it, signed in to Thirdfy.",
 });
 
 /** Credits refusal codes the API sends (HTTP 402). */
@@ -138,9 +141,20 @@ function withoutUndefined(fields) {
 /**
  * `{ errorCode, retryable, retryAfterSeconds?, nextAction, hint? }` for a thrown CLI error.
  * It reads what `src/core/http.mjs` attaches (`statusCode`, `payload`, `write`, `retryAfterSeconds`)
- * and what `createCliError` attaches (`payload.error`, `payload.blockedStage`).
+ * and what `createCliError` attaches (`payload.error`, `payload.blockedStage`). A command that knows
+ * the next step for a refusal sets `error.errorFields` (`{ retryable, nextAction, hint }`), and those
+ * win: `track-record` does, as thirdfy-mcp's prove_track_record does for the same codes.
  */
 export function describeCliError(error) {
+  const fields = describeCliErrorFromResponse(error);
+  if (!isRecord(error?.errorFields)) return fields;
+  const merged = { ...fields, ...withoutUndefined(error.errorFields) };
+  // retryAfterSeconds goes with a retryable answer only.
+  if (merged.retryable === false) delete merged.retryAfterSeconds;
+  return merged;
+}
+
+function describeCliErrorFromResponse(error) {
   const payload = isRecord(error?.payload) ? error.payload : {};
   const status = Number(error?.statusCode || 0);
   const data = isRecord(payload.data) ? payload.data : {};

package/src/runtime/certification/executionCertify.mjs

@@ -227,6 +227,7 @@ export function buildExecutionCertificationReport({
   runMode = null,
   expectedSchemaDigest = null,
   requiredActions = [],
+  catalogPolicyScoped = false,
 } = {}) {
   const version = String(cliVersion || PACKAGE_VERSION).trim();
   const normalizedRequiredActions = parseRequiredActions(requiredActions);
@@ -259,10 +260,25 @@ export function buildExecutionCertificationReport({
     }
   }
 
+  // A keyed catalog lists only the agent's allowlist. Bare certification then checks the venue
+  // writes this agent may call; the rest are reported as skipped, not as missing schemas.
+  // An unscoped (public) catalog that lacks a venue action still fails closed.
+  const scopeToAllowlist = bareCertification && catalogFetched && catalogPolicyScoped === true;
+  const liveActionKeys = new Set();
+  for (const row of liveActions || []) {
+    for (const name of [row?.action, ...(Array.isArray(row?.aliases) ? row.aliases : [])]) {
+      if (name) liveActionKeys.add(normalizeActionKey(String(name)));
+    }
+  }
+  const skippedVenueActions = [];
   const venueActionNames =
     normalizedRequiredActions.length > 0
       ? normalizedRequiredActions.filter((action) => isWriteAction(action))
-      : VENUE_WRITE_ACTION_FIXTURES.map((fixture) => fixture.action);
+      : VENUE_WRITE_ACTION_FIXTURES.map((fixture) => fixture.action).filter((action) => {
+          if (!scopeToAllowlist || liveActionKeys.has(normalizeActionKey(action))) return true;
+          skippedVenueActions.push({ action, reason: 'NOT_ON_AGENT_ALLOWLIST' });
+          return false;
+        });
 
   const venueActions = runSchemaCompatibilityChecks(catalogByAction, venueActionNames, {
     requireLiveCatalog: bareCertification,
@@ -380,6 +396,7 @@ export function buildExecutionCertificationReport({
     commandAvailability,
     authorityInputs,
     venueActions,
+    skippedVenueActions,
     checks,
   };
 }

package/src/runtime/handlers.mjs

@@ -12,6 +12,7 @@ import { createConsoleMandateCommands } from '../commands/onboarding/consoleMand
 import { createBootstrapCommands } from '../commands/onboarding/bootstrap.mjs';
 import { createDiscoveryCommands } from '../commands/discovery.mjs';
 import { createSignalsCommands } from '../commands/signals/command.mjs';
+import { createTrackRecordCommands } from '../commands/trackRecord/command.mjs';
 import { createCreditsCommands } from '../commands/account/credits.mjs';
 import { createChatCommands } from '../commands/chat.mjs';
 import { createBrainCommands } from '../commands/brain.mjs';
@@ -70,6 +71,8 @@ export function createRuntimeHandlers(deps) {
 
   const __signals = createSignalsCommands({ printEnvelope });
 
+  const __trackRecord = createTrackRecordCommands({ printEnvelope });
+
   const __credits = createCreditsCommands({
     printEnvelope,
     getAuthToken,
@@ -244,6 +247,11 @@ export function createRuntimeHandlers(deps) {
     commandCatalogsList: __discovery.commandCatalogsList,
     commandActions: __discovery.commandActions,
     commandSignals: __signals.commandSignals,
+    commandTrackRecordChallenge: __trackRecord.commandTrackRecordChallenge,
+    commandTrackRecordVerify: __trackRecord.commandTrackRecordVerify,
+    commandTrackRecordScore: __trackRecord.commandTrackRecordScore,
+    commandTrackRecordStatus: __trackRecord.commandTrackRecordStatus,
+    commandTrackRecordPublic: __trackRecord.commandTrackRecordPublic,
     commandCreditsBalance: __discovery.commandCreditsBalance,
     commandCreditsBuy: __credits.commandCreditsBuy,
     commandCreditsTransactions: __credits.commandCreditsTransactions,