run402 4.96.0 → 4.98.0

package/lib/buzz-doctor.test.mjs

@@ -5,15 +5,16 @@ import { join } from "node:path";
 import { describe, it } from "node:test";
 import { bech32 } from "@scure/base";
 import {
-  buildBuzzDoctorReport,
+  BUZZ_DOCTOR_CHECK_ORDER,
+  BUZZ_DOCTOR_CONTRACT,
   BUZZ_DOCTOR_MIN_RUN402_VERSION,
   BUZZ_DOCTOR_REPAIR_MATRIX,
   isPublicAddress,
   normalizeNostrSubject,
-  parseBuzzDoctorArgs,
   pinnedLookup,
-} from "./buzz-doctor.mjs";
-import { BUZZ_DOCTOR_CHECK_ORDER, BUZZ_DOCTOR_CONTRACT, validateBuzzDoctorReport } from "./buzz-doctor-contract.mjs";
+  validateBuzzDoctorReport,
+} from "#sdk/node";
+import { buildBuzzDoctorReport, parseBuzzDoctorArgs } from "./buzz-doctor.mjs";
 
 const SUBJECT = "6b6951a5738dfe576d0c44bf7a5f8afe655005a156f9d3e648d81437c3f5ebbf";
 const OTHER_SUBJECT = "a".repeat(64);
@@ -72,7 +73,7 @@ function healthyDependencies(overrides = {}) {
     runCommand,
     lookup: async () => [{ address: "93.184.216.34", family: 4 }],
     pinnedRelayRead: async () => ({ ok: true, status: 200, elapsed_ms: 4 }),
-    originProbe: async () => ({ ok: true, status: 200, elapsed_ms: 3 }),
+    originProbe: async () => ({ reachable: true, classification: "ok", status: 200, elapsed_ms: 3 }),
     updateCheck: async () => ({ name: "cli_update", status: "ok" }),
     getActiveProfile: () => "buzz-fizz",
     profileExistsImpl: () => true,
@@ -154,7 +155,7 @@ describe("Buzz doctor bounded zero-mutation runner", () => {
       }
       return commandError();
     };
-    dependencies.originProbe = async () => ({ ok: false, status: 503, failure: "http_503" });
+    dependencies.originProbe = async () => ({ reachable: false, classification: "http", status: 503, error: "http_503", elapsed_ms: 3 });
     dependencies.lookup = async () => [
       { address: "93.184.216.34", family: 4 },
       { address: "127.0.0.1", family: 4 },

package/lib/buzz.mjs

@@ -67,7 +67,7 @@ Advanced recovery reads:
 Security:
   - JSON stdout only; progress and pending-state advice go to stderr.
   - This command never accepts an nsec, private key, mnemonic, seed, service key,
-    delegate token, recovery code, or payment material.
+    grant key, recovery code, or payment material.
   - Buzz signatures are public evidence. Run402 authority still comes only from
     human/agent principals, org membership, and project grants.
   - Every command in this group has zero spend impact.

package/lib/buzz.test.mjs

@@ -7,11 +7,22 @@ import { afterEach, beforeEach, describe, it, mock } from "node:test";
 let sdk;
 const authModes = [];
 
+// Organization resolution is real (the `--org` flag resolves locally); every
+// other namespace is the test's fake, and `authModes` records the auth mode of
+// each client that reaches one.
+const { run402: realSdk } = await import("../sdk/dist/node/index.js");
 mock.module("./sdk.mjs", {
   namedExports: {
     getSdk: (options = {}) => {
-      authModes.push(options.authMode ?? "default");
-      return sdk;
+      let recorded = false;
+      return new Proxy({}, {
+        get(_target, prop) {
+          if (prop === "orgs") return realSdk({ surface: "cli", disablePaidFetch: true }).orgs;
+          if (!recorded) authModes.push(options.authMode ?? "default");
+          recorded = true;
+          return sdk?.[prop];
+        },
+      });
     },
   },
 });

package/lib/command-manifest.mjs

@@ -235,13 +235,10 @@ export const COMMAND_MANIFEST = [
 
   // ── grants ───────────────────────────────────────────────────────────────
   { path: ["grants", "create"], positionals: [p("wallet")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["0x1111111111111111111111111111111111111111", "--capability", "deploy"] },
+  { path: ["grants", "list"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
   { path: ["grants", "revoke"], positionals: [p("grant_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["grt_gate1"] },
-
-  // ── delegates ────────────────────────────────────────────────────────────
-  { path: ["delegates", "create"], legacyPositionalProject: false, positionals: [], projectScoped: true, minimalArgs: ["--grant", "11111111-1111-1111-1111-111111111111"] },
-  { path: ["delegates", "list"], legacyPositionalProject: false, positionals: [], projectScoped: true, minimalArgs: [] },
-  { path: ["delegates", "revoke"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
-  { path: ["delegates", "rotate"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
+  { path: ["grants", "revoke-key"], positionals: [p("key_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["key_gate1"] },
+  { path: ["grants", "rotate-key"], positionals: [p("key_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["key_gate1"] },
 
   // ── events / live ────────────────────────────────────────────────────────
   { path: ["events", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },

package/lib/credentials.mjs

@@ -39,7 +39,7 @@ Project credentials (on the gateway — named, revocable, rotatable):
                                 Revoke immediately, freeing the name
   token [--project <project_id>] [--kind <anon|service>]
                                 Mint a SHORT-LIVED token. Works with only a
-                                delegate — the unattended recovery path.
+                                grant key — the unattended recovery path.
 
 Local cache (on this machine):
   project-keys                  Manage the local project-key cache
@@ -49,7 +49,7 @@ Notes:
     plus a fresh step-up, so a scoped agent credential can never escalate
     itself into a permanent root. Authenticate with a wallet (SIWX) or a
     sign-in session ('run402 login').
-  - 'token' is the exception: a delegate can mint one with no human present.
+  - 'token' is the exception: a grant key can mint one with no human present.
   - Secrets are returned EXACTLY ONCE and are never recoverable. Full JSON goes
     to stdout so you can pipe it; the warnings go to stderr.
 
@@ -106,7 +106,7 @@ Usage:
 The secret is printed ONCE, on stdout, inside the JSON. Pipe it:
   run402 credentials issue --kind service --name ci | jq -r .secret
 
-Requires owner membership on the project's org plus a fresh step-up. A delegate
+Requires owner membership on the project's org plus a fresh step-up. A grant key
 can NEVER do this; use 'run402 credentials token' instead.
 `,
   list: `run402 credentials list — list a project's credentials
@@ -157,7 +157,7 @@ Usage:
   run402 credentials token [--project <project_id>] [--kind <anon|service>]
 
 The cold-restart recovery path, and the ONE credential call an agent can make
-with no human present: a delegate is accepted here. There is no step-up because
+with no human present: a grant key is accepted here. There is no step-up because
 there is nobody to prompt, and what you get back expires, so it cannot become a
 durable root. Defaults to --kind service.
 `,

package/lib/deploy-v2.mjs

@@ -44,7 +44,7 @@ import {
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { API, walletAuthHeaders, getActiveProjectId, resolveProjectId, isCoreApiTarget, updateProject } from "./config.mjs";
-import { delegateTokenFromEnv } from "#sdk/node";
+import { grantKeyFromEnv } from "#sdk/node";
 import { flagValue, normalizeArgv } from "./argparse.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 import { withAutoApprove } from "./sign-in.mjs";
@@ -486,10 +486,10 @@ async function rehearseCmd(rawArgs) {
     fail({ code: "BAD_USAGE", message: "--teardown must be one of: on_pass, keep, always", details: { flag: "--teardown", value: teardown } });
   }
   const project = flagValue(args, "--project") ?? undefined;
-  // A delegate is a complete deploy credential and the gateway explicitly
+  // A grant key is a complete deploy credential and the gateway explicitly
   // supports rehearsing with one (the route rejects only CI sessions).
   // Rehearsal is the SAFE path; never make it the harder one.
-  if (!isCoreApiTarget() && !loadLiveControlPlaneSession() && !delegateTokenFromEnv()) {
+  if (!isCoreApiTarget() && !loadLiveControlPlaneSession() && !grantKeyFromEnv()) {
     walletAuthHeaders(`/apply/v1/plans/${givenPlanId ?? "_"}/rehearse`);
   }
   const sdk = getSdk();
@@ -723,9 +723,9 @@ async function promoteCmd(args) {
 
   // Preserve the aggressive early-exit when no local wallet is configured
   // — same as apply.
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/releases");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/releases");
 
   try {
     // Call the engine directly (matches the pattern used by apply / resume
@@ -1295,20 +1295,20 @@ async function deployCmd(args) {
 
 
   let sdkOpts;
-  const delegateToken = delegateTokenFromEnv();
+  const grantKey = grantKeyFromEnv();
   if (useGithubActionsOidc) {
     sdkOpts = {
       credentials: githubActionsCredentials({ projectId: releaseSpec.project_id, apiBase: API }),
       disablePaidFetch: true,
     };
-  } else if (delegateToken) {
-    // A delegate is a complete, self-contained deploy credential: the owner
+  } else if (grantKey) {
+    // A grant key is a complete, self-contained deploy credential: the owner
     // minted it with their wallet and handed it over, so this process needs no
     // wallet of its own. Skipping the guard is the point — an agent that
     // lost its local state (or never had a wallet) can still deploy. Paid fetch
-    // is disabled for the same reason it is under CI: a delegate authorizes
+    // is disabled for the same reason it is under CI: a grant key authorizes
     // deploys, not spending.
-    sdkOpts = { delegateToken, disablePaidFetch: true };
+    sdkOpts = { grantKey, disablePaidFetch: true };
   } else if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) {
     // Aggressive early exit when no local wallet is configured — unless a
     // wallet-less person is deploying via their sign-in session
@@ -1766,9 +1766,9 @@ async function resumeCmd(args) {
   emitDeployUpdateNotice("resume", args, { quiet: opts.quiet });
   const project = resolveProjectId(opts.project);
 
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk({ disablePaidFetch: true })._applyEngine.resume(opts.operationId, {
@@ -1794,9 +1794,9 @@ async function statusCmd(args) {
     missing: "Missing <operation_id>.",
   });
   const project = resolveProjectId(parsed.flags["--project"] ?? null);
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk()._applyEngine.status(operationId, { project });
@@ -1822,24 +1822,24 @@ async function listCmd(args) {
   };
 
   const project = resolveProjectId(opts.project);
-  // NOT ungated for delegates, deliberately: /apply/v1/operations (list) is
+  // NOT ungated for grant keys, deliberately: /apply/v1/operations (list) is
   // `apikeyAuth` only — unlike get/events/resume/promote, which accept a
-  // delegate bearer. Listing every operation on a project is broader than
+  // grant-key bearer. Listing every operation on a project is broader than
   // the per-operation reads a deploy credential is scoped to. If this is
   // ever widened, widen the ROUTE first, then this guard.
   //
   // The refusal is correct; the REMEDY must still be honest. Falling through
-  // to NO_WALLET would tell a delegate holder to run `run402 init`, which
+  // to NO_WALLET would tell a grant-key holder to run `run402 init`, which
   // is wrong for a credential that is wallet-less by design — the same
   // misleading-remedy shape removed from the payment path in 4.11.2.
-  if (delegateTokenFromEnv()) {
+  if (grantKeyFromEnv()) {
     fail({
-      code: "DELEGATE_SCOPE_INSUFFICIENT",
-      message: "Listing deploy operations is not available to a delegate.",
-      hint: "Use `run402 deploy status <operation_id>`, `deploy events <operation_id>` or `deploy verify <operation_id>` for a specific operation, which a delegate CAN read. A full listing needs the project apikey or the owner wallet.",
-      details: { command: "deploy list", credential: "delegate", route: "GET /apply/v1/operations" },
+      code: "GRANT_KEY_SCOPE_INSUFFICIENT",
+      message: "Listing deploy operations is not available to a grant key.",
+      hint: "Use `run402 deploy status <operation_id>`, `deploy events <operation_id>` or `deploy verify <operation_id>` for a specific operation, which a grant key CAN read. A full listing needs the project apikey or the owner wallet.",
+      details: { command: "deploy list", credential: "grant_key", route: "GET /apply/v1/operations" },
       next_actions: [
-        { type: "run_command", command: "run402 deploy status <operation_id>", why: "Per-operation reads are within a delegate's deploy scope." },
+        { type: "run_command", command: "run402 deploy status <operation_id>", why: "Per-operation reads are within a grant key's deploy scope." },
       ],
     });
   }
@@ -1870,9 +1870,9 @@ async function eventsCmd(args) {
   const opts = { operationId, project: parsed.flags["--project"] ?? null };
 
   const project = resolveProjectId(opts.project);
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk()._applyEngine.events(opts.operationId, { project });
@@ -1916,9 +1916,9 @@ async function verifyCmd(args) {
     ? 60
     : parsePositiveInt(parsed.flags["--timeout"], "--timeout");
 
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     let result;