run402 4.96.0 → 4.98.0

package/README.md

@@ -4,7 +4,7 @@
 
 Command-line interface for [Run402](https://run402.com) — provision Postgres databases, deploy static sites, run Node 22 serverless functions, host content-addressed CDN assets, send email, sign on-chain. Paid autonomously with x402 (USDC on Base) or MPP (pathUSD on Tempo, or sats over Bitcoin Lightning). **Prototype tier is free on testnet.**
 
-The CLI lets an agent act as its own first-class Run402 principal rather than borrowing a human account. Identity records who invoked an action; organization roles, grants, delegates, freshness, and spend policy determine what that principal may do. People remain first-class owners and members without having to run the CLI themselves.
+The CLI lets an agent act as its own first-class Run402 principal rather than borrowing a human account. Identity records who invoked an action; organization roles, grants, grant keys, freshness, and spend policy determine what that principal may do. People remain first-class owners and members without having to run the CLI themselves.
 
 For the full CLI reference (every flag, every subcommand) start at **<https://docs.run402.com/llms-cli.txt>** — the index holds the first-deploy contract and links one fetchable `/llms-cli-<slice>.txt` per topic (deploy, commands, repos, orgs, functions, assets, ops, errors, frontend, platform); <https://docs.run402.com/llms-cli-full.txt> is the whole reference as one document.
 
@@ -76,7 +76,7 @@ run402 repos list --org org_1a2b3c
 run402 repos delete --project prj_xyz --force # refuses without --force while the vault holds generations
 ```
 
-A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. Every mutating `repos` verb (`create`, `rename`, `delete`, `capture`, `policy`, `mirror`, `gc`, `handoff`, `resume`, `invite`, `join`) is CLI/OpenClaw-only by design — no MCP tool exists or will exist for them (one-shot recovery receipts, immutable generations, irreversible delete, single-use bearer keys). Three READ-ONLY tools do exist — `repos_view`, `repos_list_heads`, `repos_fsck` — teaching only `repos` spellings. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `capture`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
+A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. From MCP, the vault is reached through a `run` snippet against `r.repos`; the verbs that mint or redeem a one-time secret (`handoff`/`invite` keys, `resume`/`join`) refuse there with `SECRET_REQUIRES_CLI`, naming the `run402 repos` command to hand the person. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `capture`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
 
 **Handoff / resume.** `run402 repos handoff [--note-file <path>]` captures the actual working tree (staged/unstaged/untracked, like `git stash push -u`) into the vault and mints a single-use bearer key (`kgh1_…`, printed to stdout exactly once); `run402 repos resume <kgh1_…>` claims it on another machine, clones fresh, and reapplies the exact dirty state with `git stash apply --index`. No shared keystore, no shared wallet — the key is the whole handoff. On a wallet with no active tier, `resume` first folds the same cold-start chain `create` does (wallet → faucet → one x402 prototype payment); `--no-init` opts out, and the claim itself never waits on it. Sensitive untracked files (`.env`, `*.pem`, SSH/AWS/GPG dirs, …) are excluded from capture by default (`--include-sensitive <glob>` re-admits one). See the reference `run402.com/llms-cli.txt` for the full note-schema and flag reference.
 
@@ -121,7 +121,7 @@ This links two separately held public identities through fresh signatures; it ne
 
 ### Buzz community control plane
 
-`run402 buzz status` reports skill installation, human-adoption offers/adoptions, community installation, and this agent's enrollment independently, and safely reports `supported: false` against an older gateway. The canonical ownership workflow is `buzz adopt offer --org … --identity-link …`: it capability-checks before mutation and returns a normal durable HTTPS handoff. Poll with `buzz adopt offer show <buzzhao_id>` and cancel with `buzz adopt offer cancel <buzzhao_id>`. The raw challenge command is explicitly advanced as `buzz adopt direct …`; direct completion/cancellation remain `buzz adopt complete|cancel`. Other goal workflows are `buzz install` and `buzz enroll`; decisions are `buzz install activate|update|revoke` and `buzz approve|deny|revoke`. `buzz install discover --community <buzz:community:host>` lists Run402-owned active descriptors without authentication. MCP intentionally has no signing/passkey mutation and only renders exact HTTPS/CLI handoffs. All commands print JSON to stdout, advice to stderr, have zero spend impact, and never accept Nostr/wallet secrets, session material, service keys, delegates, or payment credentials. Failure JSON preserves the gateway's code-specific `next_actions`, exact repair `field`, and retry safety; never replace it with a generic edit-and-retry. See the [Fizz/Honey examples](../buzz/references/community-control-plane.md).
+`run402 buzz status` reports skill installation, human-adoption offers/adoptions, community installation, and this agent's enrollment independently, and safely reports `supported: false` against an older gateway. The canonical ownership workflow is `buzz adopt offer --org … --identity-link …`: it capability-checks before mutation and returns a normal durable HTTPS handoff. Poll with `buzz adopt offer show <buzzhao_id>` and cancel with `buzz adopt offer cancel <buzzhao_id>`. The raw challenge command is explicitly advanced as `buzz adopt direct …`; direct completion/cancellation remain `buzz adopt complete|cancel`. Other goal workflows are `buzz install` and `buzz enroll`; decisions are `buzz install activate|update|revoke` and `buzz approve|deny|revoke`. `buzz install discover --community <buzz:community:host>` lists Run402-owned active descriptors without authentication. MCP intentionally has no signing/passkey mutation and only renders exact HTTPS/CLI handoffs. All commands print JSON to stdout, advice to stderr, have zero spend impact, and never accept Nostr/wallet secrets, session material, service keys, grant keys, or payment credentials. Failure JSON preserves the gateway's code-specific `next_actions`, exact repair `field`, and retry safety; never replace it with a generic edit-and-retry. See the [Fizz/Honey examples](../buzz/references/community-control-plane.md).
 
 ### Buy from an x402 URL
 

package/cli.mjs

@@ -70,8 +70,7 @@ COORDINATE — work alongside other agents and humans
 
 AUTHORITY — who may act, and with what credential
   credentials Manage local credential material (project-keys)
-  delegates   Scoped deploy credentials for agents (create, list, revoke, rotate)
-  grants      Per-project capability grants for agent/CI principals (create, revoke)
+  grants      Project grants and grant keys for agents (create, list, revoke, revoke-key, rotate-key)
   orgs        Organizations, members, invites & audit (list, get, members, invite, audit)
   identity    Public proof-backed external agent identity links
   auth        Manage project user authentication (magic link, passwords, settings)
@@ -285,11 +284,6 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "delegates": {
-    const { run } = await import("./lib/delegates.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "events": {
     const { run } = await import("./lib/events.mjs");
     await run(sub, rest);

package/core-dist/binding-file.js

@@ -22,7 +22,7 @@
  * Unknown keys are ignored on purpose: that is what makes an older client
  * forward-compatible with a binding file written by a newer one.
  */
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 /** The committed binding file. Safe to check in — it names, never authorizes. */
 export const BINDING_FILE = ".run402.json";
@@ -80,4 +80,31 @@ export function readBindingFile(dir = process.cwd()) {
         return {};
     }
 }
+/**
+ * MERGE keys into a directory's committed binding file. A `null` (or
+ * `undefined`) value removes its key; a file left with no keys is deleted
+ * rather than committed empty.
+ *
+ * The file is shared by tiers (`wallet` from `wallets bind`, `org`/`room` from
+ * `orgs bind`) and unknown keys are preserved, so one tier can never clobber
+ * another's binding.
+ */
+export function updateBindingFile(dir, patch) {
+    const file = bindingFilePath(dir);
+    const next = { ...readBindingFile(dir) };
+    for (const [k, v] of Object.entries(patch)) {
+        if (v === null || v === undefined)
+            delete next[k];
+        else
+            next[k] = v;
+    }
+    if (Object.keys(next).length === 0) {
+        const existed = existsSync(file);
+        if (existed)
+            rmSync(file, { force: true });
+        return { file, contents: null, removed: existed };
+    }
+    writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
+    return { file, contents: next, removed: false };
+}
 //# sourceMappingURL=binding-file.js.map

package/core-dist/wallet.js

@@ -22,9 +22,9 @@ const PRIVATE_KEY_RE = /^0x[a-fA-F0-9]{64}$/;
  *   - `core/src/wallet-auth.ts` passes a malformed `privateKey` to
  *     `@noble/curves` which throws "expected 32 bytes, got N".
  *
- * The CLI's `cli/lib/config.mjs:readWallet()` wrapper and the MCP
- * `src/tools/{status,init}.ts` callers translate the throw into their own
- * structured envelopes (`code: BAD_WALLET_FILE`).
+ * The CLI's `cli/lib/config.mjs:readWallet()` wrapper and the Node SDK's
+ * `readLocalWallet()` (`sdk/src/node/wallets.ts`) translate the throw into
+ * their own structured envelopes (`code: BAD_WALLET_FILE`).
  */
 /**
  * If a wallet file is readable by group or other (any of the low 0o077

package/lib/auth.mjs

@@ -710,8 +710,7 @@ function scaffoldIdent(args, flag, def) {
 
 // Pure, offline generator — no SDK / network / project. Emits the conventional
 // role-table migration, the matching requireRole gate snippet, and a
-// first-operator bootstrap. (Keep in sync with the MCP `scaffold_roles` tool in
-// src/tools/scaffold-roles.ts — same artifacts, different presentation.)
+// first-operator bootstrap.
 function scaffoldRoles(args) {
   const table = scaffoldIdent(args, "--table", "app_roles");
   const userCol = scaffoldIdent(args, "--user-col", "user_id");