zk-agent-cli 0.1.0-beta.7 → 0.1.0-beta.8

package/README.md

@@ -11,7 +11,22 @@ Current strengths:
 - workflow orchestration for send, swap, bridge, deposit, and withdraw
 - machine-readable JSON output for agent callers
 
-## Install
+## Public Entry Points
+
+Choose the entrypoint that matches the environment.
+
+If you are installing this repository into a compatible agent harness instead
+of using the CLI directly, prefer the repo skill surface:
+
+```bash
+npx skills add https://github.com/AgiWeb3/zk-agent-cli
+```
+
+This repo currently ships a repository skill bundle for compatible harnesses.
+It does not yet ship a native ChatGPT/Codex plugin bundle such as
+`.codex-plugin/plugin.json`.
+
+For direct terminal use, install the packaged CLI:
 
 One-shot execution:
 
@@ -75,6 +90,15 @@ zk-agent next
 zk-agent workflow pay --wallet main --to <address> --amount <amount>
 ```
 
+If the browser is not colocated with the terminal, keep the same flow but
+replace the wallet-creation step with:
+
+```bash
+zk-agent relay inspect --relay-url <relay-url>
+zk-agent wallet create --relay-url <relay-url> --wait-relay --prompt-code
+zk-agent next
+```
+
 If a wallet already exists, inspect the blocker first. Use `wallet reapprove`
 when approval is missing or expired, then return to `zk-agent next`. Use
 `wallet signer attach` when approval is still present but the local execution
@@ -108,6 +132,58 @@ operator baseline.
 checkpoint, executes immediately when ready, reopens a missing writable session
 through the intent-scoped approval path, and defaults to the validated
 approval-based paymaster mode unless you override it.
+When that approval-based path still needs a fee-token candidate, recover with
+`zk-agent tokens --chain zksync-sepolia --role paymaster-fee-token` and
+`zk-agent resolve-token --chain zksync-sepolia --symbol <symbol> --role paymaster-fee-token`.
+
+## Discovery Path
+
+Use the discovery surfaces in this order when a workflow or direct command
+needs token context:
+
+- `zk-agent assets --wallet main` for the preferred single-chain asset view
+- `zk-agent tokens --wallet main --owned` for the narrower owned ERC-20 subset
+- `zk-agent tokens --chain zksync-sepolia` and
+  `zk-agent resolve-token --chain zksync-sepolia --symbol USDC` for
+  symbol-first discovery before choosing an explicit token address
+- `zk-agent tokens --chain zksync-sepolia --role paymaster-fee-token` and
+  `zk-agent resolve-token --chain zksync-sepolia --symbol <symbol> --role paymaster-fee-token`
+  for approval-based paymaster fee-token discovery on the flagship pay path
+- `zk-agent defaults` for the machine-readable registry/defaults catalog:
+  tracked token roles, paymaster metadata, source order, and validated/fallback
+  route metadata
+
+## Direct Command Escape Hatches
+
+Use the guided workflow layer first, but the lower-level direct commands now
+keep the same symbol/discovery contract:
+
+- `zk-agent send-token --wallet main --symbol USDC --to <address> --amount <amount>`
+- `zk-agent swap --wallet main --token-in-symbol USDC --token-out-symbol ETH --amount-in <amount>`
+- `zk-agent fund --wallet main --symbol USDC --amount <amount>`
+- `zk-agent deposit --wallet main --symbol USDC --amount <amount>`
+- `zk-agent withdraw --wallet main --symbol USDC --amount <amount>`
+
+Current direct-command behavior:
+
+- `send-token`, `fund`, `deposit`, and `withdraw` accept symbol-first token
+  resolution when the local registry can resolve the active chain token
+- `swap` follows the current registry-backed validated route by default when
+  `--protocol` is omitted
+- `bridge` can reuse the tracked default destination route when one is already
+  known for the current wallet chain
+
+## Local Agent Identity
+
+The local operator profile is optional. It helps agent harnesses and operators
+persist stable metadata, but wallet approval and workflow execution do not
+depend on it.
+
+Use:
+
+- `zk-agent agent status`
+- `zk-agent agent set --name "<operator-name>" --wallet main`
+- `zk-agent agent show`
 
 ## Remote Approval
 
@@ -149,7 +225,10 @@ reverse proxy, pass `--public-origin` so the emitted share/status URLs point at
 the externally reachable hosted URL instead of the local bind address. The
 published package now also ships the bundled connector UI build used by
 `relay serve`, so hosted share-link approval no longer depends on a separate
-source checkout just to serve the UI.
+source checkout just to serve the UI. `relay inspect` now also reports
+`stateBackend`, `deploymentScope`, and `sameHostRestartPersists` so the
+single-host local-filesystem constraint is explicit before you rely on a hosted
+URL.
 
 ## Local Storage
 

package/dist/index.js

@@ -7722,6 +7722,10 @@ function formatHumanErrorMessage(error) {
   pushDetailLine(lines, "reason", details.reason);
   pushDetailLine(lines, "note", details.note);
   pushDetailLine(lines, "suggested action", details.suggestedAction);
+  pushDetailLine(lines, "status command", details.statusCommand);
+  pushDetailLine(lines, "approve command", details.approveCommand);
+  pushDetailLine(lines, "relay inspect command", details.relayInspectCommand);
+  pushDetailLine(lines, "reissue remote approval command", details.reissueRemoteApprovalCommand);
   pushDetailLine(lines, "validation domain", details.validationDomain);
   pushDetailLine(lines, "validation stage", details.validationStage);
   const validation = asRecord2(details.validation);
@@ -7758,6 +7762,18 @@ function buildTopLevelNextRecommendedCommand(requestId, paymasterMode) {
 function buildWalletCreateRecommendedCommand() {
   return "zk-agent wallet create --await-local";
 }
+function buildRelayInspectRecommendedCommand(relayUrl = "<url>") {
+  return `zk-agent relay inspect --relay-url ${relayUrl}`;
+}
+function buildWalletCreateRemoteRecommendedCommand(relayUrl = "<url>", paymasterMode, walletName = "main", accountKind = "smart-account") {
+  const command = [
+    "zk-agent wallet create",
+    walletName !== "main" ? `--name ${walletName}` : "",
+    accountKind !== "smart-account" ? `--account-kind ${accountKind}` : "",
+    `--relay-url ${relayUrl} --wait-relay --prompt-code`
+  ].filter(Boolean).join(" ");
+  return appendPaymasterMode(command, paymasterMode);
+}
 function buildWalletListRecommendedCommand() {
   return "zk-agent wallet list";
 }
@@ -7784,6 +7800,12 @@ function buildResolveTokenRecommendedCommand(chain, symbol, role, source) {
   const withRole = role ? `${command} --role ${role}` : command;
   return source ? `${withRole} --source ${source}` : withRole;
 }
+function buildPaymasterFeeTokensRecommendedCommand(chain) {
+  return buildTokensRecommendedCommand(chain, void 0, "paymaster-fee-token");
+}
+function buildPaymasterFeeTokenResolveRecommendedCommand(chain, symbol) {
+  return buildResolveTokenRecommendedCommand(chain, symbol, "paymaster-fee-token");
+}
 function buildDiscoveryRecommendedCommands(input) {
   return {
     inspectDefaults: buildDefaultsRecommendedCommand(),
@@ -7814,6 +7836,9 @@ function buildDiscoveryRecommendedCommands(input) {
 function buildWalletReapproveRecommendedCommand(walletName) {
   return `zk-agent wallet reapprove --name ${walletName} --await-local`;
 }
+function buildWalletReapproveRemoteRecommendedCommand(walletName, relayUrl = "<url>") {
+  return `zk-agent wallet reapprove --name ${walletName} --relay-url ${relayUrl} --wait-relay --prompt-code`;
+}
 function buildWalletNextRecommendedCommand(walletName) {
   return `zk-agent wallet next --name ${walletName}`;
 }
@@ -8507,9 +8532,15 @@ function workflowFollowupLines(recommendedCommands) {
   if (recommendedCommands.discoverOwnedTokens) {
     lines.push(["discover owned tokens", recommendedCommands.discoverOwnedTokens]);
   }
+  if (recommendedCommands.discoverPaymasterTokens) {
+    lines.push(["discover paymaster tokens", recommendedCommands.discoverPaymasterTokens]);
+  }
   if (recommendedCommands.discoverTokens) {
     lines.push(["discover tokens", recommendedCommands.discoverTokens]);
   }
+  if (recommendedCommands.inspectPaymasterToken) {
+    lines.push(["inspect paymaster token", recommendedCommands.inspectPaymasterToken]);
+  }
   if (recommendedCommands.inspectToken) {
     lines.push(["inspect token", recommendedCommands.inspectToken]);
   }
@@ -9214,7 +9245,25 @@ function createBalancesCommand(deps) {
 }
 function createAssetsCommand(deps) {
   const resolvedDeps = resolveBalancesCommandDeps(deps);
-  return new Command("assets").description("Fetch the preferred single-chain asset view with native balance plus registry-backed ERC-20 holdings").option("--wallet <name>", "Wallet name", "main").option("--chain <chain>", "Single chain override").action(async (options) => {
+  return new Command("assets").description("Fetch the preferred single-chain asset view with native balance plus registry-backed ERC-20 holdings").addHelpText(
+    "after",
+    [
+      "",
+      "Discovery asset path:",
+      "  Preferred single-chain asset entrypoint:",
+      "    zk-agent assets --wallet main",
+      "",
+      "  Narrower owned ERC-20 registry subset:",
+      "    zk-agent tokens --wallet main --owned",
+      "",
+      "  Symbol-first token lookup before a tokenized command:",
+      "    zk-agent tokens --chain zksync-sepolia --symbol USDC",
+      "    zk-agent resolve-token --chain zksync-sepolia --symbol USDC",
+      "",
+      "  For the machine-readable registry/default catalog:",
+      "    zk-agent defaults"
+    ].join("\n")
+  ).option("--wallet <name>", "Wallet name", "main").option("--chain <chain>", "Single chain override").action(async (options) => {
     const walletName = options.wallet;
     const wallet = await resolvedDeps.loadWallet(walletName);
     if (!wallet) throw new Error(`Wallet not found: ${walletName}`);
@@ -9912,11 +9961,35 @@ function createPlannedCommands() {
 
 // src/commands/setup.ts
 import { Command as Command2 } from "commander";
+function buildSetupHelpText() {
+  return [
+    "",
+    "What setup does:",
+    "  Writes the local default chain and connector URL used by the first-run path.",
+    "",
+    "After setup, stay on the canonical local-first path:",
+    "  zk-agent next",
+    "  zk-agent wallet create --await-local",
+    "  zk-agent next",
+    "",
+    "If the browser is not colocated with this terminal, switch at the wallet step:",
+    "  zk-agent relay inspect --relay-url <url>",
+    "  zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
+    "  zk-agent next",
+    "",
+    "Environment note:",
+    "  No custom .env is required for setup, next, or wallet request creation.",
+    "  Add RPC env vars later, before live reads or broadcasts."
+  ].join("\n");
+}
 function createInitCommand() {
-  return new Command2("init").alias("setup").description("Initialize local zk-agent configuration").option("--default-chain <chain>", "Default chain key", "zksync-era").option("--connector-url <url>", "Connector UI base URL", "http://localhost:4444").option("--force", "Overwrite an existing config", false).action(async (options) => {
+  return new Command2("init").alias("setup").description("Initialize local zk-agent configuration for the default operator path").addHelpText("after", buildSetupHelpText()).option("--default-chain <chain>", "Default chain key", "zksync-era").option("--connector-url <url>", "Connector UI base URL", "http://localhost:4444").option("--force", "Overwrite an existing config", false).action(async (options) => {
     const recommendedCommands = {
+      next: buildTopLevelNextRecommendedCommand(),
       inspectDefaults: buildDefaultsRecommendedCommand(),
       createWallet: buildWalletCreateRecommendedCommand(),
+      relayInspect: buildRelayInspectRecommendedCommand(),
+      createWalletRemote: buildWalletCreateRemoteRecommendedCommand(),
       afterWalletApproval: buildTopLevelNextRecommendedCommand()
     };
     const existing = await loadProjectConfig();
@@ -9926,8 +9999,11 @@ function createInitCommand() {
           ["status", "Config already exists. Re-run with --force to overwrite."],
           ["default chain", existing.defaultChain],
           ["connector", existing.connectorUrl],
+          ["next", recommendedCommands.next],
           ["inspect defaults", recommendedCommands.inspectDefaults],
-          ["create wallet", recommendedCommands.createWallet],
+          ["create wallet (local)", recommendedCommands.createWallet],
+          ["relay inspect", recommendedCommands.relayInspect],
+          ["create wallet (remote)", recommendedCommands.createWalletRemote],
           ["after approval", recommendedCommands.afterWalletApproval]
         ],
         {
@@ -9952,8 +10028,11 @@ function createInitCommand() {
         ["status", "Config saved"],
         ["default chain", config.defaultChain],
         ["connector", config.connectorUrl],
+        ["next", recommendedCommands.next],
         ["inspect defaults", recommendedCommands.inspectDefaults],
-        ["create wallet", recommendedCommands.createWallet],
+        ["create wallet (local)", recommendedCommands.createWallet],
+        ["relay inspect", recommendedCommands.relayInspect],
+        ["create wallet (remote)", recommendedCommands.createWalletRemote],
         ["after approval", recommendedCommands.afterWalletApproval]
       ],
       { ok: true, config, recommendedCommands }
@@ -10383,9 +10462,17 @@ function buildTopLevelWorkflowRecommendedCommands(input) {
       discoverOwnedTokens: buildOwnedTokensRecommendedCommand(input.walletName),
       discoverTokens: buildTokensRecommendedCommand(input.chain),
       inspectToken: buildResolveTokenRecommendedCommand(input.chain)
+    } : {},
+    ...input.paymasterMode === "approval-based" ? {
+      discoverPaymasterTokens: buildPaymasterFeeTokensRecommendedCommand(input.chain),
+      inspectPaymasterToken: buildPaymasterFeeTokenResolveRecommendedCommand(input.chain)
     } : {}
   };
 }
+function extractCheckpointPaymasterMode(checkpoint) {
+  if (!("paymaster" in checkpoint.goal)) return void 0;
+  return checkpoint.goal.paymaster?.mode;
+}
 function resolveNextCommandDeps(deps) {
   return {
     provider: deps?.provider ?? defaultProvider,
@@ -10415,6 +10502,11 @@ function buildNextHelpText() {
     "    zk-agent wallet create --await-local",
     "    zk-agent next",
     "",
+    "  If the browser is remote, switch at the wallet step instead of waiting for a local callback:",
+    "    zk-agent relay inspect --relay-url <url>",
+    "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
+    "    zk-agent next",
+    "",
     "  Continue a stored workflow checkpoint:",
     "    zk-agent next --request-id <id>",
     "",
@@ -10470,7 +10562,8 @@ function createNextCommand(deps) {
         walletName: wallet2.walletName,
         nextAction: nextCommand2,
         chain: result.plan.chain,
-        intent: result.intent
+        intent: result.intent,
+        paymasterMode: extractCheckpointPaymasterMode(updatedCheckpoint)
       });
       const workflowAgentProfile = await loadAgentIdentitySummary(wallet2.walletName);
       const agentFollowup2 = buildAgentFollowup(workflowAgentProfile, {
@@ -10515,6 +10608,7 @@ function createNextCommand(deps) {
     if (!config) {
       const recommendedCommands2 = {
         setup: buildSetupCommand(),
+        afterSetup: buildTopLevelNextRecommendedCommand2(),
         inspectDefaults: buildDefaultsRecommendedCommand()
       };
       printResult(
@@ -10523,6 +10617,7 @@ function createNextCommand(deps) {
           ...agentProfileLines(agentProfile),
           ...agentFollowupLines(defaultAgentFollowup),
           ["next", recommendedCommands2.setup],
+          ["after setup", recommendedCommands2.afterSetup],
           ["inspect defaults", recommendedCommands2.inspectDefaults]
         ]),
         {
@@ -10544,6 +10639,11 @@ function createNextCommand(deps) {
           buildWalletCreateRecommendedCommand(),
           paymasterMode
         ),
+        relayInspect: buildRelayInspectRecommendedCommand(),
+        createWalletRemote: buildWalletCreateRemoteRecommendedCommand(
+          "<url>",
+          paymasterMode
+        ),
         afterApproval: appendPaymasterMode2(buildTopLevelNextRecommendedCommand2(), paymasterMode),
         inspectDefaults: buildDefaultsRecommendedCommand()
       };
@@ -10555,6 +10655,8 @@ function createNextCommand(deps) {
           ...agentProfileLines(agentProfile),
           ...agentFollowupLines(defaultAgentFollowup),
           ["next", recommendedCommands2.createWallet],
+          ["relay inspect", recommendedCommands2.relayInspect],
+          ["remote fallback", recommendedCommands2.createWalletRemote],
           ["after approval", recommendedCommands2.afterApproval],
           ["inspect defaults", recommendedCommands2.inspectDefaults]
         ]),
@@ -10608,6 +10710,10 @@ function createNextCommand(deps) {
       walletStatus: buildWalletStatusRecommendedCommand(wallet.walletName),
       discoverAssets: buildAssetsRecommendedCommand(wallet.walletName),
       discoverOwnedTokens: buildOwnedTokensRecommendedCommand(wallet.walletName),
+      ...paymasterMode === "approval-based" ? {
+        discoverPaymasterTokens: buildPaymasterFeeTokensRecommendedCommand(wallet.chain),
+        inspectPaymasterToken: buildPaymasterFeeTokenResolveRecommendedCommand(wallet.chain)
+      } : {},
       discoverTokens: buildTokensRecommendedCommand(wallet.chain),
       inspectToken: buildResolveTokenRecommendedCommand(wallet.chain),
       workflowPay,
@@ -10623,7 +10729,9 @@ function createNextCommand(deps) {
         ...summary.recommendedCommand ? [] : [["next", workflowPay]],
         ["discover assets", recommendedCommands.discoverAssets],
         ["discover owned tokens", recommendedCommands.discoverOwnedTokens],
+        ...recommendedCommands.discoverPaymasterTokens ? [["discover paymaster tokens", recommendedCommands.discoverPaymasterTokens]] : [],
         ["discover tokens", recommendedCommands.discoverTokens],
+        ...recommendedCommands.inspectPaymasterToken ? [["inspect paymaster token", recommendedCommands.inspectPaymasterToken]] : [],
         ["inspect token", recommendedCommands.inspectToken],
         ["inspect defaults", recommendedCommands.inspectDefaults]
       ]),
@@ -10740,6 +10848,21 @@ function createAgentCommand() {
   agent.addHelpText(
     "after",
     [
+      "",
+      "  Agent identity path:",
+      "    zk-agent agent status",
+      '    zk-agent agent set --name "SED Operator" --wallet main',
+      "    zk-agent agent show",
+      "",
+      "  Portable local profile management:",
+      "    zk-agent agent export",
+      "    zk-agent agent import --payload @agent-profile.json --overwrite",
+      "",
+      "  Remove the saved local profile:",
+      "    zk-agent agent clear",
+      "",
+      "  This profile is optional. Wallet approval and workflow execution still work",
+      "  without a saved local agent profile.",
       "",
       "Examples:",
       "  zk-agent agent status",
@@ -11386,7 +11509,24 @@ function buildDefaultsLines(input) {
   return lines;
 }
 function createDefaultsCommand() {
-  return new Command5("defaults").description("Show the machine-readable registry of supported, validated, experimental, and manually configured defaults").action(async () => {
+  return new Command5("defaults").description("Show the machine-readable registry of supported, validated, experimental, and manually configured defaults").addHelpText(
+    "after",
+    [
+      "",
+      "Discovery defaults path:",
+      "  Use `defaults` as the machine-readable registry escape hatch for:",
+      "    - validated or fallback swap / bridge paths",
+      "    - tracked token roles and source order",
+      "    - paymaster defaults and supported modes",
+      "",
+      "  For wallet-scoped asset discovery, prefer:",
+      "    zk-agent assets --wallet main",
+      "",
+      "  For symbol-first token discovery, prefer:",
+      "    zk-agent tokens --chain zksync-sepolia",
+      "    zk-agent resolve-token --chain zksync-sepolia --symbol USDC"
+    ].join("\n")
+  ).action(async () => {
     const defaults = loadValidatedDefaults();
     const localTokenRegistry = listLocalTokenRegistryEntries();
     const tokenRegistrySources = describeDefaultTokenRegistrySources();
@@ -11446,7 +11586,27 @@ async function resolveActiveChain(options, deps) {
 }
 function createResolveTokenCommand(deps) {
   const resolvedDeps = resolveResolveTokenCommandDeps(deps);
-  return new Command6("resolve-token").description("Resolve a token symbol or address against the configured local-first token registry").option("--wallet <name>", "Optional stored wallet name to infer the active chain").option("--chain <chain>", "Chain key or chain id override").option("--symbol <symbol>", "Token symbol to resolve on the active chain").option("--address <address>", "Token address to inspect on the active chain").option(
+  return new Command6("resolve-token").description("Resolve a token symbol or address against the configured local-first token registry").addHelpText(
+    "after",
+    [
+      "",
+      "Resolve-token path:",
+      "  Symbol-first resolution on one active chain:",
+      "    zk-agent resolve-token --chain zksync-sepolia --symbol USDC",
+      "",
+      "  Use the stored wallet to infer the active chain:",
+      "    zk-agent resolve-token --wallet main --symbol USDC",
+      "",
+      "  Use broader chain discovery before resolution when you still need the candidate set:",
+      "    zk-agent tokens --chain zksync-sepolia",
+      "",
+      "  Use the wallet asset entrypoint when the real question is balances/holdings:",
+      "    zk-agent assets --wallet main",
+      "",
+      "  Use the registry/default catalog when you need tracked roles or source order:",
+      "    zk-agent defaults"
+    ].join("\n")
+  ).option("--wallet <name>", "Optional stored wallet name to infer the active chain").option("--chain <chain>", "Chain key or chain id override").option("--symbol <symbol>", "Token symbol to resolve on the active chain").option("--address <address>", "Token address to inspect on the active chain").option(
     "--role <role>",
     `Optional defaults-registry role filter: ${REGISTRY_TOKEN_ROLES.join(", ")}`
   ).option(
@@ -11649,7 +11809,29 @@ function ownedTokenSummaryLines2(summary) {
 }
 function createTokensCommand(deps) {
   const resolvedDeps = resolveTokensCommandDeps(deps);
-  return new Command7("tokens").description("List discoverable tokens from the configured local-first token registry, or inspect the owned ERC-20 registry subset for one wallet").option("--wallet <name>", "Optional stored wallet name to infer the active chain").option("--chain <chain>", "Chain key or chain id override").option("--symbol <symbol>", "Optional exact symbol filter").option(
+  return new Command7("tokens").description("List discoverable tokens from the configured local-first token registry, or inspect the owned ERC-20 registry subset for one wallet").addHelpText(
+    "after",
+    [
+      "",
+      "Discovery token path:",
+      "  Start with the preferred wallet asset view when you need balances plus tracked ERC-20 holdings:",
+      "    zk-agent assets --wallet main",
+      "",
+      "  Use the narrower owned ERC-20 registry subset when you only want held tokens:",
+      "    zk-agent tokens --wallet main --owned",
+      "",
+      "  Use chain-scoped discovery before choosing a token address:",
+      "    zk-agent tokens --chain zksync-sepolia",
+      "    zk-agent tokens --chain zksync-sepolia --symbol USDC",
+      "    zk-agent tokens --chain zksync-sepolia --role paymaster-fee-token",
+      "",
+      "  For one direct token-resolution check:",
+      "    zk-agent resolve-token --chain zksync-sepolia --symbol USDC",
+      "",
+      "  For the full defaults/registry catalog:",
+      "    zk-agent defaults"
+    ].join("\n")
+  ).option("--wallet <name>", "Optional stored wallet name to infer the active chain").option("--chain <chain>", "Chain key or chain id override").option("--symbol <symbol>", "Optional exact symbol filter").option(
     "--role <role>",
     `Optional defaults-registry role filter: ${REGISTRY_TOKEN_ROLES.join(", ")}`
   ).option(
@@ -11975,6 +12157,8 @@ var RELAY_BODY_LIMIT_BYTES = 1024 * 1024;
 var RELAY_SERVICE = "zk-agent-relay";
 var RELAY_PROTOCOL = "zk-agent-session-relay";
 var RELAY_SCHEMA_VERSION = 1;
+var RELAY_STATE_BACKEND = "local-filesystem";
+var RELAY_DEPLOYMENT_SCOPE = "single-host";
 function relayDir() {
   const directory = path7.join(storageDir(), "relay");
   if (!fs7.existsSync(directory)) {
@@ -12010,11 +12194,15 @@ function sanitizeRelayRecord(record) {
 }
 function relayStatusResponse(baseUrl, record) {
   const sanitized = sanitizeRelayRecord(record);
+  const shareUrl = relayShareUrl(baseUrl, sanitized.request_id);
+  const statusUrl = relayStatusUrl(baseUrl, sanitized.request_id);
   return {
     request_id: sanitized.request_id,
     status: relayStatus(record),
     approval_ready: Boolean(record.encrypted_payload),
-    approval_url: `${baseUrl}/r/${sanitized.request_id}`,
+    share_url: shareUrl,
+    status_url: statusUrl,
+    approval_url: shareUrl,
     expires_at: sanitized.expires_at,
     request: sanitized.request,
     approval_submitted_at: sanitized.approval_submitted_at
@@ -12111,6 +12299,9 @@ function relayHealthResponse(bindBaseUrl, publicBaseUrl, connectorUiAvailable, p
     origin: normalizeRelayBaseUrl(bindBaseUrl),
     public_origin: normalizeRelayBaseUrl(publicBaseUrl),
     public_origin_source: publicOriginSource,
+    state_backend: RELAY_STATE_BACKEND,
+    deployment_scope: RELAY_DEPLOYMENT_SCOPE,
+    same_host_restart_persists: true,
     connector_ui_available: connectorUiAvailable,
     capabilities: relayCapabilities(connectorUiAvailable)
   };
@@ -12357,6 +12548,12 @@ function isRelayCapability(value) {
 function isRelayPublicOriginSource(value) {
   return value === "configured" || value === "bind-origin-default";
 }
+function isRelayStateBackend(value) {
+  return value === "local-filesystem";
+}
+function isRelayDeploymentScope(value) {
+  return value === "single-host";
+}
 function asRelayHealthResponse(value) {
   if (!isRecord3(value)) return null;
   if (value.ok !== true) return null;
@@ -12369,6 +12566,15 @@ function asRelayHealthResponse(value) {
   if (typeof value.public_origin_source !== "undefined" && !isRelayPublicOriginSource(value.public_origin_source)) {
     return null;
   }
+  if (typeof value.state_backend !== "undefined" && !isRelayStateBackend(value.state_backend)) {
+    return null;
+  }
+  if (typeof value.deployment_scope !== "undefined" && !isRelayDeploymentScope(value.deployment_scope)) {
+    return null;
+  }
+  if (typeof value.same_host_restart_persists !== "undefined" && typeof value.same_host_restart_persists !== "boolean") {
+    return null;
+  }
   if (typeof value.connector_ui_available !== "boolean") return null;
   if (!Array.isArray(value.capabilities) || !value.capabilities.every(isRelayCapability)) {
     return null;
@@ -12410,6 +12616,15 @@ function inferRelayPublicOriginSource(options) {
   }
   return normalizedOrigin === normalizedPublicOrigin ? "bind-origin-default" : "configured";
 }
+function inferRelayStateBackend(relayMode) {
+  return relayMode === "local-file" ? "local-filesystem" : null;
+}
+function inferRelayDeploymentScope(relayMode) {
+  return relayMode === "local-file" ? "single-host" : null;
+}
+function inferSameHostRestartPersists(relayMode) {
+  return relayMode === "local-file" ? true : null;
+}
 function relayHostedReadinessNotes(options) {
   const notes = [];
   if (!options.compatible) {
@@ -12430,6 +12645,17 @@ function relayHostedReadinessNotes(options) {
   }
   return notes;
 }
+function relayOperationalContractNotes(options) {
+  if (!options.compatible) {
+    return [];
+  }
+  if (options.stateBackend === "local-filesystem" && options.deploymentScope === "single-host" && options.sameHostRestartPersists === true) {
+    return [
+      "Relay state is stored on the relay host local filesystem. Restarts on the same host keep pending approval state, but multi-instance or load-balanced deployments do not share relay state."
+    ];
+  }
+  return [];
+}
 function relayOriginRelationshipNotes(options) {
   const notes = [];
   const relayUrlMatchesOrigin = relayUrlMatches(options.relayUrl, options.origin);
@@ -12454,6 +12680,9 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
     origin: health?.origin || null,
     publicOrigin
   });
+  const stateBackend = health?.state_backend || inferRelayStateBackend(health?.relay_mode || null);
+  const deploymentScope = health?.deployment_scope || inferRelayDeploymentScope(health?.relay_mode || null);
+  const sameHostRestartPersists = typeof health?.same_host_restart_persists === "boolean" ? health.same_host_restart_persists : inferSameHostRestartPersists(health?.relay_mode || null);
   const compatible = Boolean(health && hasCoreRelayCapabilities(health.capabilities));
   const connectorUiAvailable = health?.connector_ui_available ?? null;
   const relayUrlMatchesOrigin = relayUrlMatches(relayUrl, health?.origin || null);
@@ -12468,6 +12697,12 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
       publicOriginSource,
       connectorUiAvailable
     }),
+    ...relayOperationalContractNotes({
+      compatible,
+      stateBackend,
+      deploymentScope,
+      sameHostRestartPersists
+    }),
     ...relayOriginRelationshipNotes({
       relayUrl,
       origin: health?.origin || null,
@@ -12486,6 +12721,9 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
     origin: health?.origin || null,
     publicOrigin,
     publicOriginSource,
+    stateBackend,
+    deploymentScope,
+    sameHostRestartPersists,
     shareLinkBaseUrl,
     statusApiBaseUrl,
     relayUrlMatchesOrigin,
@@ -12500,6 +12738,23 @@ function buildRelayInspectPayload(relayUrl, rawHealth) {
 }
 function createRelayCommand() {
   const relay = new Command8("relay").description("Run the local connector relay prototype server");
+  relay.addHelpText(
+    "after",
+    [
+      "",
+      "  Hosted remote-approval path:",
+      "    zk-agent relay serve --public-origin https://relay.example.com",
+      "    zk-agent relay inspect --relay-url <url>",
+      "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
+      "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code",
+      "",
+      "  Keep `wallet create|reapprove --await-local` as the default baseline when",
+      "  the browser and terminal are colocated.",
+      "",
+      "  Use `relay inspect` before sending operators to a hosted share link so",
+      "  the public origin, connector UI, and hosted-readiness contract are visible."
+    ].join("\n")
+  );
   relay.command("serve").description("Serve the local relay API and, when available, the built connector UI").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind (0 = choose a free port)", "4445").option(
     "--public-origin <url>",
     "Public base URL to advertise in share/status links when the relay is behind a tunnel or reverse proxy"
@@ -12533,6 +12788,9 @@ function createRelayCommand() {
       origin: server.origin,
       publicOrigin,
       publicOriginSource,
+      stateBackend: "local-filesystem",
+      deploymentScope: "single-host",
+      sameHostRestartPersists: true,
       shareLinkBaseUrl,
       statusApiBaseUrl,
       publicOriginLooksLocal,
@@ -12562,6 +12820,12 @@ function createRelayCommand() {
         humanLine("public origin", publicOrigin);
       }
       humanLine("public origin source", publicOriginSource);
+      humanLine("state backend", payload.stateBackend);
+      humanLine("deployment scope", payload.deploymentScope);
+      humanLine(
+        "same-host restart persists",
+        payload.sameHostRestartPersists ? "yes" : "no"
+      );
       humanLine("share-link base", shareLinkBaseUrl);
       humanLine("status api base", statusApiBaseUrl);
       humanLine("health", `${server.origin}/health`);
@@ -12618,6 +12882,18 @@ function createRelayCommand() {
     if (payload.publicOriginSource) {
       humanLine("public origin source", payload.publicOriginSource);
     }
+    if (payload.stateBackend) {
+      humanLine("state backend", payload.stateBackend);
+    }
+    if (payload.deploymentScope) {
+      humanLine("deployment scope", payload.deploymentScope);
+    }
+    if (payload.sameHostRestartPersists !== null) {
+      humanLine(
+        "same-host restart persists",
+        payload.sameHostRestartPersists ? "yes" : "no"
+      );
+    }
     humanLine("share-link base", payload.shareLinkBaseUrl);
     humanLine("status api base", payload.statusApiBaseUrl);
     if (payload.relayUrlMatchesOrigin !== null) {
@@ -14527,6 +14803,165 @@ function buildPendingRequestRecommendedCommands(walletName, requestId, relayUrl,
 function buildPendingRequestNextAction(recommendedCommands) {
   return recommendedCommands.relayStatus ?? recommendedCommands.awaitLocal;
 }
+function buildRelayWaitGuidanceLines(options) {
+  return [
+    ["status", "Waiting for relay approval"],
+    ["request", options.requestId],
+    ["wallet", options.walletName],
+    ["share url", options.relay.share_url],
+    ["status url", options.relay.status_url],
+    ["approval url", options.relay.approval_url],
+    ["expires", options.expiresAt],
+    ["browser step", "Open the share url in a browser and complete connector approval."],
+    [
+      "terminal step",
+      options.codeEntry === "prompt" ? "After the relay is ready, enter the 6-digit approval code in this terminal." : "The CLI will finalize automatically with the provided 6-digit approval code once the relay is ready."
+    ],
+    ["fallback status", options.statusCommand],
+    ["fallback approve", options.approveCommand]
+  ];
+}
+function printRelayWaitGuidance(options) {
+  if (shouldJsonOutput()) return;
+  for (const [label, value] of buildRelayWaitGuidanceLines(options)) {
+    humanLine(label, value);
+  }
+}
+async function buildRelayStatusFollowUp(options) {
+  if (options.relay.status === "expired") {
+    return await buildRelayExpiredRecoveryCommands({
+      walletName: options.relay.request?.walletName,
+      relayUrl: options.relayUrl,
+      paymasterMode: options.relay.request?.requestedPaymasterMode,
+      accountKind: options.relay.request?.requestedAccountKind
+    });
+  }
+  if (options.relay.approval_ready) {
+    const approve = buildWalletRequestRelayApproveRecommendedCommand(
+      options.relay.request_id,
+      options.relayUrl
+    );
+    return {
+      nextAction: approve,
+      recommendedCommands: {
+        status: buildWalletRequestRelayStatusRecommendedCommand(
+          options.relay.request_id,
+          options.relayUrl
+        ),
+        approve
+      }
+    };
+  }
+  return {
+    nextAction: buildWalletRequestRelayStatusRecommendedCommand(
+      options.relay.request_id,
+      options.relayUrl
+    ),
+    recommendedCommands: {
+      status: buildWalletRequestRelayStatusRecommendedCommand(
+        options.relay.request_id,
+        options.relayUrl
+      )
+    }
+  };
+}
+async function buildRelayExpiredRecoveryCommands(options) {
+  const relayInspect = buildRelayInspectRecommendedCommand(options.relayUrl);
+  const walletName = options.walletName?.trim();
+  if (!walletName) {
+    return {
+      nextAction: relayInspect,
+      recommendedCommands: {
+        relayInspect
+      },
+      note: "Relay approval expired. Inspect the hosted relay, then reissue the wallet request again."
+    };
+  }
+  const existingWallet = await loadWalletSession(walletName);
+  const reissueRemoteApproval = existingWallet ? buildWalletReapproveRemoteRecommendedCommand(walletName, options.relayUrl) : buildWalletCreateRemoteRecommendedCommand(
+    options.relayUrl,
+    options.paymasterMode,
+    walletName,
+    options.accountKind
+  );
+  return {
+    nextAction: reissueRemoteApproval,
+    recommendedCommands: {
+      relayInspect,
+      reissueRemoteApproval
+    },
+    note: "Relay approval expired. Reissue the remote request. If the original request used scoped session flags, add those same policy flags again."
+  };
+}
+function buildRelayApprovalTimeoutError(options) {
+  const statusCommand = buildWalletRequestRelayStatusRecommendedCommand(
+    options.requestId,
+    options.relayUrl
+  );
+  const approveCommand = buildWalletRequestRelayApproveRecommendedCommand(
+    options.requestId,
+    options.relayUrl
+  );
+  return new AgentError(
+    "RELAY_APPROVAL_TIMEOUT",
+    `Timed out waiting for relay approval after ${Math.ceil(options.timeoutMs / 1e3)} seconds.`,
+    {
+      requestId: options.requestId,
+      relayUrl: options.relayUrl,
+      timeoutMs: options.timeoutMs,
+      intervalMs: options.intervalMs,
+      retryable: true,
+      statusCommand,
+      approveCommand,
+      suggestedAction: "Check the current relay status, then finalize the wallet approval once approval_ready=true."
+    }
+  );
+}
+async function buildRelayApprovalExpiredError(options) {
+  const recovery = await buildRelayExpiredRecoveryCommands({
+    walletName: options.walletName,
+    relayUrl: options.relayUrl,
+    paymasterMode: options.paymasterMode,
+    accountKind: options.accountKind
+  });
+  return new AgentError(
+    "RELAY_APPROVAL_EXPIRED",
+    `Relay approval expired before the encrypted payload was ready for request ${options.requestId}.`,
+    {
+      requestId: options.requestId,
+      relayUrl: options.relayUrl,
+      retryable: true,
+      note: recovery.note,
+      relayInspectCommand: recovery.recommendedCommands.relayInspect,
+      reissueRemoteApprovalCommand: recovery.recommendedCommands.reissueRemoteApproval,
+      suggestedAction: "Inspect the hosted relay, then reissue the remote approval request."
+    }
+  );
+}
+function buildRelayApprovalNotReadyError(options) {
+  const statusCommand = buildWalletRequestRelayStatusRecommendedCommand(
+    options.requestId,
+    options.relayUrl
+  );
+  const approveCommand = buildWalletRequestRelayApproveRecommendedCommand(
+    options.requestId,
+    options.relayUrl
+  );
+  return new AgentError(
+    "RELAY_APPROVAL_NOT_READY",
+    `Relay approval is not ready yet for request ${options.requestId}.`,
+    {
+      requestId: options.requestId,
+      relayUrl: options.relayUrl,
+      status: options.status,
+      approvalReady: options.approvalReady,
+      retryable: true,
+      statusCommand,
+      approveCommand,
+      suggestedAction: "Check the current relay status, then retry approval once approval_ready=true."
+    }
+  );
+}
 function buildRequestListEntryRecommendedCommands(walletName, requestId, paymasterMode) {
   return {
     show: buildWalletRequestShowRecommendedCommand(requestId),
@@ -14669,25 +15104,55 @@ async function fetchEncryptedRelayApprovalPayload(relayUrl, requestId, options)
       intervalMs: options.intervalMs ?? 2e3
     });
     if (!relay.approval_ready) {
-      throw new Error(`Relay approval expired before the encrypted payload was ready for request ${requestId}.`);
+      throw await buildRelayApprovalExpiredError({
+        requestId,
+        relayUrl
+      });
     }
   }
   const approval = await fetchRelayApproval(relayUrl, requestId);
   if (!approval.approval_ready || !approval.encrypted_payload) {
-    throw new Error(`Relay approval is not ready yet for request ${requestId}.`);
+    throw buildRelayApprovalNotReadyError({
+      requestId,
+      relayUrl,
+      status: approval.status,
+      approvalReady: approval.approval_ready
+    });
   }
   return approval.encrypted_payload;
 }
 async function finalizePublishedRelayWalletRequest(options) {
-  const encryptedPayload = await fetchEncryptedRelayApprovalPayload(
-    options.relayUrl,
-    options.walletRequest.requestId,
-    {
-      wait: true,
-      timeoutMs: options.timeoutMs,
-      intervalMs: options.intervalMs
+  let encryptedPayload;
+  try {
+    encryptedPayload = await fetchEncryptedRelayApprovalPayload(
+      options.relayUrl,
+      options.walletRequest.requestId,
+      {
+        wait: true,
+        timeoutMs: options.timeoutMs,
+        intervalMs: options.intervalMs
+      }
+    );
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Timed out waiting for relay approval after ")) {
+      throw buildRelayApprovalTimeoutError({
+        requestId: options.walletRequest.requestId,
+        relayUrl: options.relayUrl,
+        timeoutMs: options.timeoutMs,
+        intervalMs: options.intervalMs
+      });
     }
-  );
+    if (error instanceof AgentError && error.code === "RELAY_APPROVAL_EXPIRED") {
+      throw await buildRelayApprovalExpiredError({
+        requestId: options.walletRequest.requestId,
+        walletName: options.walletRequest.walletName,
+        relayUrl: options.relayUrl,
+        paymasterMode: options.walletRequest.requestedPaymasterMode,
+        accountKind: options.walletRequest.requestedAccountKind
+      });
+    }
+    throw error;
+  }
   const code = options.code || (options.promptCode ? await readApprovalCodeFromStdin() : void 0);
   if (!code) {
     throw new Error("Missing relay approval code.");
@@ -15054,7 +15519,9 @@ async function printBuiltinSmartAccountProfiles() {
 }
 function createWalletCommand(deps) {
   const resolvedDeps = resolveWalletCommandDeps(deps);
-  const wallet = new Command9("wallet").description("Manage wallet sessions");
+  const wallet = new Command9("wallet").description(
+    "Create, inspect, and recover local-first wallet sessions"
+  );
   const request = new Command9("request").description("Inspect and finalize pending wallet requests");
   const signer = new Command9("signer").description(
     "Inspect and manage the stored local execution signer for a wallet"
@@ -15104,7 +15571,8 @@ function createWalletCommand(deps) {
       "  Hosted remote approval path:",
       "    zk-agent relay inspect --relay-url <url>",
       "    zk-agent wallet create --relay-url <url> --wait-relay --prompt-code",
-      "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code"
+      "    zk-agent wallet reapprove --name main --relay-url <url> --wait-relay --prompt-code",
+      "    zk-agent next"
     ].join("\n")
   );
   request.addHelpText(
@@ -15118,7 +15586,11 @@ function createWalletCommand(deps) {
       "  Remote relay completion:",
       "    zk-agent wallet request relay-publish --request-id <id> --relay-url <url>",
       "    zk-agent wallet request relay-status --request-id <id> --relay-url <url> --wait",
-      "    zk-agent wallet request approve --request-id <id> --relay-url <url> --code <code> --wait"
+      "    zk-agent wallet request approve --request-id <id> --relay-url <url> --code <code> --wait",
+      "",
+      "  If relay-status returns status = expired:",
+      "    zk-agent relay inspect --relay-url <url>",
+      "    zk-agent wallet create|reapprove --relay-url <url> --wait-relay --prompt-code"
     ].join("\n")
   );
   signer.addHelpText(
@@ -15217,6 +15689,23 @@ function createWalletCommand(deps) {
       }
       const relay = options.relayUrl ? await publishWalletRequestToRelay(request2, options.relayUrl) : void 0;
       if (relayWaitOptions) {
+        if (relay) {
+          printRelayWaitGuidance({
+            requestId: request2.requestId,
+            walletName: request2.walletName,
+            relay,
+            expiresAt: request2.expiresAt,
+            codeEntry: relayWaitOptions.promptCode ? "prompt" : "provided",
+            statusCommand: buildWalletRequestRelayStatusRecommendedCommand(
+              request2.requestId,
+              relayWaitOptions.relayUrl
+            ),
+            approveCommand: buildWalletRequestRelayApproveRecommendedCommand(
+              request2.requestId,
+              relayWaitOptions.relayUrl
+            )
+          });
+        }
         const { payload, walletRecord } = await finalizePublishedRelayWalletRequest({
           walletRequest: request2,
           ...relayWaitOptions
@@ -15365,6 +15854,23 @@ function createWalletCommand(deps) {
       }
       const relay = options.relayUrl ? await publishWalletRequestToRelay(request2, options.relayUrl) : void 0;
       if (relayWaitOptions) {
+        if (relay) {
+          printRelayWaitGuidance({
+            requestId: request2.requestId,
+            walletName: request2.walletName,
+            relay,
+            expiresAt: request2.expiresAt,
+            codeEntry: relayWaitOptions.promptCode ? "prompt" : "provided",
+            statusCommand: buildWalletRequestRelayStatusRecommendedCommand(
+              request2.requestId,
+              relayWaitOptions.relayUrl
+            ),
+            approveCommand: buildWalletRequestRelayApproveRecommendedCommand(
+              request2.requestId,
+              relayWaitOptions.relayUrl
+            )
+          });
+        }
         const { payload, walletRecord: approvedWallet } = await finalizePublishedRelayWalletRequest({
           walletRequest: request2,
           ...relayWaitOptions
@@ -15784,40 +16290,53 @@ function createWalletCommand(deps) {
     );
   });
   request.command("relay-status").description("Inspect the relay status of a published wallet request, optionally waiting until approval is ready").requiredOption("--request-id <id>", "Wallet request id").requiredOption("--relay-url <url>", "Relay server base URL").option("--wait", "Poll until the encrypted relay approval is ready or the request expires").option("--timeout-seconds <seconds>", "How long to wait while polling relay status", "600").option("--interval-ms <milliseconds>", "How often to poll relay status while waiting", "2000").action(async (options) => {
-    const relay = options.wait ? await waitForRelayApprovalReady(options.relayUrl, options.requestId, {
-      timeoutMs: parsePositiveIntegerOption(options.timeoutSeconds, "--timeout-seconds", 600) * 1e3,
-      intervalMs: parsePositiveIntegerOption(options.intervalMs, "--interval-ms", 2e3)
-    }) : await fetchRelayStatus(options.relayUrl, options.requestId);
+    const timeoutMs = parsePositiveIntegerOption(options.timeoutSeconds, "--timeout-seconds", 600) * 1e3;
+    const intervalMs = parsePositiveIntegerOption(options.intervalMs, "--interval-ms", 2e3);
+    let relay;
+    try {
+      relay = options.wait ? await waitForRelayApprovalReady(options.relayUrl, options.requestId, {
+        timeoutMs,
+        intervalMs
+      }) : await fetchRelayStatus(options.relayUrl, options.requestId);
+    } catch (error) {
+      if (options.wait && error instanceof Error && error.message.startsWith("Timed out waiting for relay approval after ")) {
+        throw buildRelayApprovalTimeoutError({
+          requestId: options.requestId,
+          relayUrl: options.relayUrl,
+          timeoutMs,
+          intervalMs
+        });
+      }
+      throw error;
+    }
+    const followUp = await buildRelayStatusFollowUp({
+      relay,
+      relayUrl: options.relayUrl
+    });
     printResult(
       [
         ["status", relay.status],
         ["request", relay.request_id],
         ["approval ready", relay.approval_ready ? "yes" : "no"],
-        ["share url", relay.approval_url],
-        ["share-link base", relay.approval_url.replace(/\/[^/]+$/, "")],
-        ["status api base", `${relay.approval_url.replace(/\/r\/[^/]+$/, "")}/api/requests`],
+        ["share url", relay.share_url],
+        ["status url", relay.status_url],
+        ["approval url", relay.approval_url],
+        ["share-link base", relay.share_url.replace(/\/[^/]+$/, "")],
+        ["status api base", relay.status_url.replace(/\/[^/]+$/, "")],
         ["expires", relay.expires_at],
-        ["next status", buildWalletRequestRelayStatusRecommendedCommand(relay.request_id, options.relayUrl)],
-        ...relay.approval_ready ? [[
-          "next approve",
-          buildWalletRequestRelayApproveRecommendedCommand(relay.request_id, options.relayUrl)
-        ]] : []
+        ...followUp.note ? [["note", followUp.note]] : [],
+        ...Object.entries(followUp.recommendedCommands).map(
+          ([label, command]) => [label, command]
+        )
       ],
       {
         ok: true,
         walletRequestId: relay.request_id,
         relay,
         ...relayOutputAliases(relay),
-        nextAction: relay.approval_ready ? buildWalletRequestRelayApproveRecommendedCommand(relay.request_id, options.relayUrl) : buildWalletRequestRelayStatusRecommendedCommand(relay.request_id, options.relayUrl),
-        recommendedCommands: {
-          status: buildWalletRequestRelayStatusRecommendedCommand(relay.request_id, options.relayUrl),
-          ...relay.approval_ready ? {
-            approve: buildWalletRequestRelayApproveRecommendedCommand(
-              relay.request_id,
-              options.relayUrl
-            )
-          } : {}
-        }
+        nextAction: followUp.nextAction,
+        recommendedCommands: followUp.recommendedCommands,
+        ...followUp.note ? { note: followUp.note } : {}
       }
     );
   });
@@ -15830,6 +16349,24 @@ function createWalletCommand(deps) {
     if (options.wait && !options.relayUrl) {
       throw new Error("--wait is only supported together with --relay-url.");
     }
+    if (options.wait && options.relayUrl && !shouldJsonOutput()) {
+      const relayStatus2 = await fetchRelayStatus(options.relayUrl, walletRequest.requestId);
+      printRelayWaitGuidance({
+        requestId: walletRequest.requestId,
+        walletName: walletRequest.walletName,
+        relay: relayStatus2,
+        expiresAt: walletRequest.expiresAt,
+        codeEntry: "provided",
+        statusCommand: buildWalletRequestRelayStatusRecommendedCommand(
+          walletRequest.requestId,
+          options.relayUrl
+        ),
+        approveCommand: buildWalletRequestRelayApproveRecommendedCommand(
+          walletRequest.requestId,
+          options.relayUrl
+        )
+      });
+    }
     const payload = options.payload ? parseJsonInput(options.payload) : decryptApprovedPayloadForWalletRequest(
       walletRequest,
       options.encryptedPayload ? parseJsonInput(options.encryptedPayload) : await fetchEncryptedRelayApprovalPayload(options.relayUrl, walletRequest.requestId, {
@@ -18137,7 +18674,8 @@ async function printWorkflowRunCommandResult(execution) {
       walletName: execution.result.walletName,
       nextAction: execution.result.nextCommand,
       chain: execution.result.plan.chain,
-      intent: execution.result.intent
+      intent: execution.result.intent,
+      paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.goal)
     });
     printResult(
       prependWorkflowRequestId(
@@ -18178,7 +18716,8 @@ async function printWorkflowRunCommandResult(execution) {
     walletName: execution.status.walletName,
     nextAction: execution.status.recommendedCommand,
     chain: execution.status.plan.chain,
-    intent: execution.status.intent
+    intent: execution.status.intent,
+    paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal)
   });
   printResult(
     prependWorkflowRequestId(
@@ -18450,6 +18989,7 @@ async function executeWorkflowAutoCommand(options, deps = resolveWorkflowCommand
     action: result ? result.stage : walletApproval?.stage ?? status.status,
     requestId: context.requestId,
     checkpointPersisted: Boolean(checkpoint),
+    goal: context.goal,
     checkpoint,
     status,
     result,
@@ -18468,7 +19008,8 @@ async function printWorkflowAutoCommandResult(execution) {
     walletName: execution.status.walletName,
     nextAction,
     chain: execution.status.plan.chain,
-    intent: execution.status.intent
+    intent: execution.status.intent,
+    paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.goal) ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal)
   });
   const summaryLines = [
     ["source", execution.source],
@@ -18530,7 +19071,21 @@ function buildWorkflowCheckpointRecommendedCommands(checkpoint) {
     walletStatus: buildWalletStatusRecommendedCommand(checkpoint.walletName)
   };
 }
+function extractWorkflowGoalPaymasterMode(goal) {
+  if (!goal || !("paymaster" in goal)) {
+    return void 0;
+  }
+  return goal.paymaster?.mode;
+}
+function extractPaymasterModeFromCommand(command) {
+  if (!command) {
+    return void 0;
+  }
+  const match = command.match(/--paymaster-mode (none|sponsored|approval-based)\b/);
+  return match?.[1];
+}
 function buildWorkflowRuntimeRecommendedCommands(input) {
+  const paymasterMode = extractPaymasterModeFromCommand(input.nextAction) ?? input.paymasterMode;
   return {
     inspectDefaults: "zk-agent defaults",
     list: buildWorkflowListRecommendedCommand(),
@@ -18554,6 +19109,10 @@ function buildWorkflowRuntimeRecommendedCommands(input) {
       } : {},
       discoverTokens: `zk-agent tokens --chain ${input.chain}`,
       inspectToken: `zk-agent resolve-token --chain ${input.chain} --symbol <symbol>`
+    } : {},
+    ...input.chain && paymasterMode === "approval-based" ? {
+      discoverPaymasterTokens: buildPaymasterFeeTokensRecommendedCommand(input.chain),
+      inspectPaymasterToken: buildPaymasterFeeTokenResolveRecommendedCommand(input.chain)
     } : {}
   };
 }
@@ -18571,6 +19130,10 @@ function buildWorkflowPlanRecommendedCommands(plan) {
       discoverOwnedTokens: buildOwnedTokensRecommendedCommand(plan.walletName),
       discoverTokens: buildTokensRecommendedCommand(plan.chain),
       inspectToken: buildResolveTokenRecommendedCommand(plan.chain)
+    } : {},
+    ...plan.paymasterMode === "approval-based" ? {
+      discoverPaymasterTokens: buildPaymasterFeeTokensRecommendedCommand(plan.chain),
+      inspectPaymasterToken: buildPaymasterFeeTokenResolveRecommendedCommand(plan.chain)
     } : {}
   };
 }
@@ -18818,6 +19381,7 @@ async function executeWorkflowRunCommand(options, deps = resolveWorkflowCommandD
     if (inspection.walletApproval?.stage === "request-created" || inspection.result.status === "blocked") {
       return {
         requestId: inspection.requestId,
+        goal: context.goal,
         status: inspection.result,
         walletApproval: inspection.walletApproval,
         checkpoint: inspection.checkpoint
@@ -18855,6 +19419,7 @@ async function executeWorkflowRunCommand(options, deps = resolveWorkflowCommandD
   );
   return {
     requestId: context.requestId,
+    goal: context.goal,
     result,
     walletApproval
   };
@@ -18931,14 +19496,13 @@ function assertWorkflowResumeReady(result) {
 }
 function buildWorkflowHelpText() {
   return [
-    "",
-    "Default workflow path:",
-    "  Guided default:",
-    "    zk-agent workflow auto --wallet main --intent <intent> [goal flags] --create-checkpoint --execute-when-ready",
     "",
     "  Flagship native pay path:",
     "    zk-agent workflow pay --wallet main --to <address> --amount <amount>",
     "",
+    "  Broader multi-intent guided path:",
+    "    zk-agent workflow auto --wallet main --intent <intent> [goal flags] --create-checkpoint --execute-when-ready",
+    "",
     "  Checkpointed execution:",
     "    zk-agent workflow start --wallet main --intent <intent> [goal flags]",
     "    zk-agent workflow status --request-id <id>",
@@ -18948,13 +19512,24 @@ function buildWorkflowHelpText() {
     "  Funding-only step:",
     "    zk-agent workflow fund --wallet main --amount <amount> --execute",
     "",
+    "  Token/discovery recovery path:",
+    "    zk-agent assets --wallet main",
+    "    zk-agent tokens --wallet main --owned",
+    "    zk-agent tokens --chain zksync-sepolia",
+    "    zk-agent resolve-token --chain zksync-sepolia --symbol USDC",
+    "",
+    "  Approval-based paymaster fee-token recovery:",
+    "    zk-agent tokens --chain zksync-sepolia --role paymaster-fee-token",
+    "    zk-agent resolve-token --chain zksync-sepolia --symbol <symbol> --role paymaster-fee-token",
+    "    zk-agent defaults",
+    "",
     "  Lower-level one-shot escape hatch:",
     "    zk-agent workflow run --wallet main --intent <intent> [goal flags]"
   ].join("\n");
 }
 var WORKFLOW_HELP_COMMAND_ORDER = [
-  "auto",
   "pay",
+  "auto",
   "start",
   "status",
   "next",
@@ -18983,7 +19558,7 @@ function applyWorkflowHelpCommandOrder(workflow) {
 function createWorkflowCommand(deps) {
   const resolvedDeps = resolveWorkflowCommandDeps(deps);
   const workflow = new Command10("workflow").description(
-    "Build a higher-level CLI workflow for a stored wallet and a concrete action intent"
+    "Plan, persist, and execute higher-level wallet workflows"
   );
   workflow.addHelpText("after", buildWorkflowHelpText());
   workflow.command("plan").description("Plan the prerequisite and execution steps for one concrete wallet workflow").requiredOption(
@@ -18995,15 +19570,19 @@ function createWorkflowCommand(deps) {
   ).option("--to-chain <chain>", "Optional destination chain override for bridge workflows").option("--paymaster-mode <mode>", "none, sponsored, or approval-based").option("--paymaster-address <address>", "Explicit paymaster contract address override").option("--paymaster-token <address>", "ERC-20 token address for approval-based paymaster mode").action(
     async (options) => {
       const intent = parseWorkflowIntent(options.intent);
+      const paymasterInput = resolveWorkflowPaymasterInput(options);
       const { inspection, plan } = await loadWorkflowPlanState(
         options.wallet,
         intent,
         parseWorkflowSwapProtocol(options.protocol),
         options.toChain,
-        resolveWorkflowPaymasterInput(options),
+        paymasterInput,
         resolvedDeps
       );
-      const recommendedCommands = buildWorkflowPlanRecommendedCommands(plan);
+      const recommendedCommands = buildWorkflowPlanRecommendedCommands({
+        ...plan,
+        paymasterMode: paymasterInput?.mode
+      });
       const agentProfile = await loadWorkflowAgentProfile(plan.walletName);
       const agentFollowup = buildAgentFollowup(agentProfile, {
         walletName: plan.walletName,
@@ -19221,7 +19800,8 @@ function createWorkflowCommand(deps) {
       walletName: inspection.result.walletName,
       nextAction: inspection.result.recommendedCommand,
       chain: inspection.result.plan.chain,
-      intent: inspection.result.intent
+      intent: inspection.result.intent,
+      paymasterMode: inspection.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(inspection.checkpoint?.goal)
     });
     const agentProfile = await loadWorkflowAgentProfile(inspection.result.walletName);
     const agentFollowup = buildAgentFollowup(agentProfile, {
@@ -19272,7 +19852,8 @@ function createWorkflowCommand(deps) {
       walletName: inspection.result.walletName,
       nextAction: nextCommand,
       chain: inspection.result.plan.chain,
-      intent: inspection.result.intent
+      intent: inspection.result.intent,
+      paymasterMode: inspection.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(inspection.checkpoint?.goal)
     });
     const agentProfile = await loadWorkflowAgentProfile(inspection.result.walletName);
     const agentFollowup = buildAgentFollowup(agentProfile, {
@@ -19337,7 +19918,8 @@ function createWorkflowCommand(deps) {
         walletName: inspection.result.walletName,
         nextAction: inspection.result.recommendedCommand,
         chain: inspection.result.plan.chain,
-        intent: inspection.result.intent
+        intent: inspection.result.intent,
+        paymasterMode: inspection.walletApproval.request.requestedPaymasterMode
       });
       const agentProfile2 = await loadWorkflowAgentProfile(inspection.result.walletName);
       const agentFollowup2 = buildAgentFollowup(agentProfile2, {
@@ -19388,7 +19970,8 @@ function createWorkflowCommand(deps) {
         walletName: execution.status.walletName,
         nextAction: execution.status.recommendedCommand,
         chain: execution.status.plan.chain,
-        intent: execution.status.intent
+        intent: execution.status.intent,
+        paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.checkpoint?.goal)
       });
       const agentProfile2 = await loadWorkflowAgentProfile(execution.status.walletName);
       const agentFollowup2 = buildAgentFollowup(agentProfile2, {
@@ -19430,7 +20013,8 @@ function createWorkflowCommand(deps) {
       walletName: execution.result.walletName,
       nextAction: execution.result.nextCommand,
       chain: execution.result.plan.chain,
-      intent: execution.result.intent
+      intent: execution.result.intent,
+      paymasterMode: execution.walletApproval?.request.requestedPaymasterMode ?? extractWorkflowGoalPaymasterMode(execution.goal)
     });
     const agentProfile = await loadWorkflowAgentProfile(execution.result.walletName);
     const agentFollowup = buildAgentFollowup(agentProfile, {
@@ -19497,16 +20081,24 @@ function createWorkflowCommand(deps) {
 function buildDefaultOperatorPathHelpText() {
   return [
     "",
-    "Default local-first operator path:",
+    "Public entrypoints:",
+    "  Agent harness: npx skills add https://github.com/AgiWeb3/zk-agent-cli",
+    "  One-shot CLI:  npx zk-agent-cli --help",
+    "  Global CLI:    npm install -g zk-agent-cli",
+    "",
+    "Canonical terminal path:",
     "  zk-agent setup",
     "  zk-agent next",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
     `  ${buildWorkflowPayRecommendedCommand("main")}`,
     "",
+    "No custom .env is required for setup, next, or wallet create/reapprove request generation.",
+    "Add RPC env vars later, before live reads or broadcasts.",
+    "",
     "Use `zk-agent next --request-id <id>` to continue a stored workflow checkpoint.",
-    "Use `zk-agent relay inspect --relay-url <url>` and `zk-agent wallet --help` for the hosted remote-approval path.",
-    "Use `zk-agent wallet --help` for bootstrap/reapproval details and `zk-agent workflow --help` once the intent is known."
+    "Use `zk-agent relay inspect --relay-url <url>` plus `zk-agent wallet create|reapprove --relay-url <url> --wait-relay --prompt-code` when the browser is not colocated.",
+    "Use `zk-agent wallet --help` for wallet recovery details and `zk-agent workflow --help` when the intent is broader than the flagship native-send path."
   ].join("\n");
 }
 var ROOT_HELP_COMMAND_ORDER = [
@@ -19547,7 +20139,9 @@ function applyRootHelpCommandOrder(program) {
   program.commands = sortedCommands;
 }
 function createProgram() {
-  const program = new Command11().name("zk-agent").description("zkSync and ZK Stack CLI scaffold for agent workflows").showHelpAfterError().option("--json", "Force JSON output for agent harnesses", false).hook("preAction", (thisCommand) => {
+  const program = new Command11().name("zk-agent").description(
+    "Local-first zkSync Era CLI for wallet approval, workflow execution, and hosted relay recovery"
+  ).showHelpAfterError().option("--json", "Force JSON output for agent harnesses", false).hook("preAction", (thisCommand) => {
     if (thisCommand.optsWithGlobals().json) process.env.ZK_AGENT_OUTPUT = "json";
   });
   program.addCommand(createInitCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zk-agent-cli",
-  "version": "0.1.0-beta.7",
+  "version": "0.1.0-beta.8",
   "description": "Local-first zkSync Era and ZK Stack agent CLI with wallet session recovery, workflow orchestration, relay-backed approval, and SED smart-account support.",
   "license": "MIT",
   "type": "module",