Release: zero-setup onboarding, browser login, agent command

.changeset/oms-browser-login.md

@@ -0,0 +1,12 @@
+---
+"@polygonlabs/agent-cli": minor
+---
+
+Zero-setup onboarding: `agent wallet login` is now the entire setup.
+
+- **`agent` is the primary command.** The CLI ships as `agent` (with `polygon-agent` kept as a long-form alias), so onboarding is `agent wallet login`.
+- **Browser login.** `wallet login` opens a branded login page (agentconnect) where the user chooses Google or email; email one-time codes are entered on the page. It works whether the browser and the CLI are on the same machine or different ones, so there is no separate remote mode. `--local` keeps the previous loopback flow (raw Google URL plus localhost callback); `--remote` is a deprecated no-op.
+- **No keys to obtain.** The CLI ships a default OMS publishable key, and a successful login auto-provisions a Sequence Builder project and access key (the indexer and Trails quota) into `~/.polygon-agent/builder.json`. Provisioning is best-effort: a failure never fails the login and retries on the next `wallet login`. Point at your own project with `OMS_PUBLISHABLE_KEY` (renamed from `SEQUENCE_PUBLISHABLE_KEY`) or `setup --oms-publishable-key`.
+- **Post-login and funding land on the agentconnect dashboard** (wallet prefilled, same app). The `fund` command and the dashboard's Add funds button open the Trails funding widget directly. Relay and login-page URLs default to the production deployments and can be overridden with `POLYGON_AGENT_OIDC_RELAY` and `POLYGON_AGENT_LOGIN_UI`.
+
+Sessions and all downstream commands are unchanged, and existing sessions keep working until they expire.

.changeset/oms-wallet-sdk.md

@@ -0,0 +1,11 @@
+---
+"@polygonlabs/agent-cli": minor
+---
+
+Migrate the embedded wallet to `@polygonlabs/oms-wallet`, the renamed and updated successor to `@0xsequence/typescript-sdk`. Internally `OMSClient` becomes `OMSWallet`, with the same constructor shape and the same `.wallet` / `.indexer` sub-clients.
+
+**Node 22+ is now required** (was Node 20+). Update your runtime before upgrading.
+
+The Google leg of `wallet login` is re-architected onto the SDK's OMS relay: our own OAuth-capture endpoints are gone, and the OMS relay now handles the Google callback directly and returns the browser to the agentconnect login page to finish pairing with the CLI. This is an internal re-architecture with no user-facing behavior change beyond the Node floor: `wallet login` still opens the same login page, still lets you choose Google or email, and sessions still last about a week.
+
+Email login, transactions, and balances are unchanged.

.changeset/x402-services-skill-refresh.md

@@ -0,0 +1,12 @@
+---
+"@polygonlabs/agent-cli": patch
+---
+
+Refresh the x402 discovery skill (polygon-discovery) to the current Agentic Services catalog, and fix x402 payment-option selection.
+
+Skill: replaces the retired x402 bazaar endpoints with the live services on agentic-services.polygon.technology — Exa, SearchApi, Firecrawl, NewsAPI, NVIDIA NIM Llama 3.3/3.2, OpenRouter, Browserbase, Resend, Allium (9 endpoints), AgentMail (6), and QuickNode RPC across 16 chains — each with exact routes/URLs and prices, plus a pointer to the live `/api/discover/routes` catalog. Updates the x402 example lists in the root and CLI skills.
+
+Fixes to `x402-pay`:
+
+- Payment-option selection: no longer blindly pays the first advertised option. When a provider offers multiple options across chains (e.g. QuickNode lists Base Sepolia first), the CLI now selects the cheapest plain-USDC transfer on the preferred chain (default Polygon 137, or `--chain`), so a call settles ~$0.001 on Polygon instead of on a testnet.
+- JSON body handling: the standard x402 flow now sets `Content-Type: application/json` when a `--body` is provided and no content-type was given, so proxied POST services (Exa, Firecrawl, NVIDIA NIM, Resend, Browserbase, OpenRouter) receive a parseable body instead of rejecting it.

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "polygon-agent-cli",
-  "description": "Polygon Agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), DeFi yield (Aave v3, ERC-4626 vaults), x402 micropayments and the Bazaar service catalog, ERC-8004 on-chain identity + reputation, and Polymarket trading. Single CLI entry point (polygon-agent), AES-256-GCM encrypted storage.",
+  "description": "Polygon Agent toolkit. Session-based smart contract wallets (OMS), token ops (send/swap/bridge/deposit via Trails), DeFi yield (Aave v3, ERC-4626 vaults), x402 micropayments and the Bazaar service catalog, ERC-8004 on-chain identity + reputation, and Polymarket trading. Single CLI entry point (polygon-agent), AES-256-GCM encrypted storage.",
   "version": "0.2.0",
   "author": {
     "name": "Polygon Labs"

.github/workflows/deploy-connector-ui.yml → .github/workflows/deploy-agentconnect-ui.yml

@@ -1,26 +1,42 @@
-name: Deploy Connector UI to Cloudflare
+name: Deploy agentconnect UI to Cloudflare
+
+# Builds the funding/dashboard SPA and deploys it to the agentconnect domain
+# (replacing the retired connector-ui): merge to `staging` -> staging,
+# merge to `main` -> production. wrangler runs via npx (not a workspace dep, to
+# respect the repo trust policy); the `[assets]` worker serves the built SPA and
+# the wrangler.toml v2 migration drops connector-ui's SessionRelay Durable Object.
+# Reuses the same CF_WORKER_* + VITE_* secrets/environments as connector-ui.
 
 on:
   push:
     branches:
       - main
       - staging
     paths:
-      - 'packages/connector-ui/**'
+      - 'packages/agentconnect-ui/**'
+      - '.github/workflows/deploy-agentconnect-ui.yml'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Environment to deploy
+        type: choice
+        options:
+          - staging
+          - production
+        default: staging
 
 permissions:
   contents: read
 
 jobs:
   deploy-staging:
     name: Deploy (staging)
-    if: github.ref == 'refs/heads/staging'
+    if: github.ref == 'refs/heads/staging' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'staging')
     runs-on: ubuntu-latest
     environment: staging
     defaults:
       run:
-        working-directory: packages/connector-ui
-
+        working-directory: packages/agentconnect-ui
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -38,27 +54,27 @@ jobs:
       - name: Build
         run: pnpm run build
         env:
-          VITE_PROJECT_ACCESS_KEY: ${{ secrets.VITE_PROJECT_ACCESS_KEY }}
-          VITE_WALLET_URL: ${{ secrets.VITE_WALLET_URL }}
-          VITE_DAPP_ORIGIN: ${{ secrets.VITE_DAPP_ORIGIN }}
-          VITE_INDEXER_ACCESS_KEY: ${{ secrets.VITE_INDEXER_ACCESS_KEY }}
           VITE_TRAILS_API_KEY: ${{ secrets.VITE_TRAILS_API_KEY }}
+          VITE_INDEXER_ACCESS_KEY: ${{ secrets.VITE_INDEXER_ACCESS_KEY }}
+          VITE_PROJECT_ACCESS_KEY: ${{ secrets.VITE_PROJECT_ACCESS_KEY }}
+          # Login-page relay base URL (per-environment GitHub variable; empty
+          # falls back to the production default in src/config.ts).
+          VITE_OIDC_RELAY_URL: ${{ vars.VITE_OIDC_RELAY_URL }}
 
       - name: Deploy to staging
-        run: pnpm exec wrangler deploy --env staging
+        run: npx -y wrangler@4 deploy --env staging
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_WORKER_ACCOUNT_ID }}
 
   deploy-production:
     name: Deploy (production)
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'production')
     runs-on: ubuntu-latest
     environment: production
     defaults:
       run:
-        working-directory: packages/connector-ui
-
+        working-directory: packages/agentconnect-ui
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -76,14 +92,15 @@ jobs:
       - name: Build
         run: pnpm run build
         env:
-          VITE_PROJECT_ACCESS_KEY: ${{ secrets.VITE_PROJECT_ACCESS_KEY }}
-          VITE_WALLET_URL: ${{ secrets.VITE_WALLET_URL }}
-          VITE_DAPP_ORIGIN: ${{ secrets.VITE_DAPP_ORIGIN }}
-          VITE_INDEXER_ACCESS_KEY: ${{ secrets.VITE_INDEXER_ACCESS_KEY }}
           VITE_TRAILS_API_KEY: ${{ secrets.VITE_TRAILS_API_KEY }}
+          VITE_INDEXER_ACCESS_KEY: ${{ secrets.VITE_INDEXER_ACCESS_KEY }}
+          VITE_PROJECT_ACCESS_KEY: ${{ secrets.VITE_PROJECT_ACCESS_KEY }}
+          # Login-page relay base URL (per-environment GitHub variable; empty
+          # falls back to the production default in src/config.ts).
+          VITE_OIDC_RELAY_URL: ${{ vars.VITE_OIDC_RELAY_URL }}
 
       - name: Deploy to production
-        run: pnpm exec wrangler deploy --env production
+        run: npx -y wrangler@4 deploy --env production
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_WORKER_ACCOUNT_ID }}

.github/workflows/deploy-oidc-relay.yml

@@ -0,0 +1,72 @@
+name: Deploy OIDC Relay to Cloudflare
+
+# Mirrors the connector-ui deploy: merge to `staging` -> deploy the staging
+# worker; merge to `main` -> deploy production. The relay has no build step and
+# no runtime deps, so we deploy it straight with wrangler (run via npx because
+# wrangler is intentionally NOT a workspace dependency — see packages/oidc-relay).
+# Reuses the same Cloudflare credentials as connector-ui (CF_WORKER_* org/env
+# secrets) and the same staging/production GitHub environments.
+
+on:
+  push:
+    branches:
+      - main
+      - staging
+    paths:
+      - 'packages/oidc-relay/**'
+      - '.github/workflows/deploy-oidc-relay.yml'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Environment to deploy
+        type: choice
+        options:
+          - staging
+          - production
+        default: staging
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-staging:
+    name: Deploy (staging)
+    if: github.ref == 'refs/heads/staging' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'staging')
+    runs-on: ubuntu-latest
+    environment: staging
+    defaults:
+      run:
+        working-directory: packages/oidc-relay
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Deploy to staging
+        run: npx -y wrangler@3 deploy --env staging
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_WORKER_ACCOUNT_ID }}
+
+  deploy-production:
+    name: Deploy (production)
+    if: github.ref == 'refs/heads/main' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'production')
+    runs-on: ubuntu-latest
+    environment: production
+    defaults:
+      run:
+        working-directory: packages/oidc-relay
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Deploy to production
+        run: npx -y wrangler@3 deploy --env production
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_WORKER_ACCOUNT_ID }}

.gitignore

@@ -8,3 +8,11 @@ dist/
 .nx/
 */**/.nx
 .gstack/
+
+# Build and dev artifacts
+.wrangler/
+*.tsbuildinfo
+
+# Superpowers scratch (plans/specs live in docs/superpowers, not here)
+.superpowers/
+.entire/

CLAUDE.md

@@ -8,23 +8,32 @@ Fetch and apply the Polygon Apps Team standards:
 
 ## Repository Structure
 
-This is a pnpm workspace monorepo with two packages:
+This is a pnpm workspace monorepo. The primary package is:
 
 - `packages/polygon-agent-cli/` — CLI tool for on-chain agent operations on Polygon
-- `packages/connector-ui/` — Wallet connector UI (Vite + React frontend)
+
+Wallets use the OMS (Open Money Stack) V3 embedded-wallet model (`@polygonlabs/oms-wallet`,
+`OMSWallet`): the CLI authenticates via browser login with Google or email (`wallet login`) and
+holds the credential on disk.
 
 Static assets (ABI JSON in `contracts/`, Claude skills in `skills/`) are
 published with the CLI package but are not source code.
 
 ## Development
 
-- Dev environment requires Node 24+ (`.nvmrc`). The published CLI supports Node 20+.
+- Dev environment requires Node 24+ (`.nvmrc`). The published CLI supports Node 22+.
 - `tsx packages/polygon-agent-cli/src/index.ts` runs the CLI directly from source (tsx handles `.js`→`.ts` remapping for workspace packages).
-- `pnpm run build` compiles TypeScript to `dist/` (targeting es2023 for Node 20 compat).
+- `pnpm run build` compiles TypeScript to `dist/` (targeting es2023 for Node 22 compat).
 - The CLI uses yargs with the `CommandModule` builder/handler pattern.
 
 ## Key Directories
 
 - `packages/polygon-agent-cli/src/commands/` — yargs command modules
-- `packages/polygon-agent-cli/src/lib/` — shared utilities (storage, dapp-client, token-directory, ethauth)
+- `packages/polygon-agent-cli/src/lib/` — shared utilities (storage, oms-client, oms-tx, oms-storage, tx-dispatch, token-directory, ethauth)
 - `packages/polygon-agent-cli/src/types.d.ts` — ambient declarations for untyped dependencies
+
+## Wallet auth (OMS V3)
+
+- `agent wallet login`: by default opens the agentconnect login page (`POLYGON_AGENT_LOGIN_UI`, default `https://agentconnect.polygon.technology`), where the user chooses Google or email; works whether the browser is local or remote. `--local` falls back to the older loopback flow (raw Google URL + localhost callback; browser must be on this machine). `--remote` is deprecated now that the default flow already works remotely. Relay base URL is `POLYGON_AGENT_OIDC_RELAY` or `--relay-url` (default `https://oidc-relay.polygon.technology`). Other flags: `--name <n>` (default "main"), `--no-fund`, `--force`. Session persists ~1 week under `~/.polygon-agent/oms/<name>/`.
+- No setup step is required: the CLI ships a default `OMS_PUBLISHABLE_KEY`, and `wallet login` auto-provisions a Builder project + access key on first login, saving it to `~/.polygon-agent/builder.json`. `OMS_PUBLISHABLE_KEY` (env) and `setup --oms-publishable-key` remain as advanced overrides for developers pointing at their own OMS project; plain `setup` remains for manual or `--force` re-provisioning.
+- `lib/tx-dispatch.ts` `runTx` is the single tx primitive (wraps `runOmsTx`). All commands submit through it.