Refine x402 CLI and Agent Wallet docs

- Clarify Base catalog scope: mainnet routes only (eip155:8453);
  CLI supports both mainnet and Sepolia
- Agent Wallet CLI: document wallet-type subcommand form for
  non-interactive start/add (local_secure / raw_secret / privy)
- SDK Guide and x402 CLI page touch-ups
- Updated in both en and zh-Hans

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jizhen181-dot

changelog/index.md

@@ -15,7 +15,7 @@ Product updates and announcements for BANK OF AI.
 
 <div className="changelog-tags"><span className="changelog-tag">New Release</span><span className="changelog-tag">x402</span><span className="changelog-tag">Base</span></div>
 
-- **Base is live** — `eip155:8453` and `eip155:84532` with USDC, in both the CLI and the service catalog. Base settles under `exact` using EIP-3009 authorization instead of Permit2.
+- **Base is live in the CLI** — `eip155:8453` and `eip155:84532` both support USDC. The service catalog currently publishes Base Mainnet routes on `eip155:8453` only. Base settles under `exact` using EIP-3009 authorization instead of Permit2.
 - **Agent Wallet is now the CLI's default payer** — `pay` signs with your active wallet, so no private key in an environment variable. With wallets configured but none active, the CLI stops before signing rather than choosing for you. [Details](./x402/)
 - Paid requests no longer follow HTTP redirects, keeping `PAYMENT-SIGNATURE` from reaching another origin.
 

changelog/x402.md

@@ -5,7 +5,7 @@ description: 'Release notes for the x402 payment protocol, SDK, and CLI.'
 
 # x402 Payment Protocol
 
-Release notes for the x402 protocol, SDK, and [CLI](../x402/cli/).
+Release notes for the x402 protocol, SDK, and [CLI](/x402/cli/).
 
 <div className="changelog-entry">
 <div className="changelog-date">Jul 30, 2026</div>
@@ -16,13 +16,13 @@ Release notes for the x402 protocol, SDK, and [CLI](../x402/cli/).
 <div className="changelog-tags"><span className="changelog-tag">New Release</span><span className="changelog-tag">CLI</span><span className="changelog-tag">Base</span></div>
 
 - **Base support** — `eip155:8453` (Mainnet) and `eip155:84532` (Sepolia), both with USDC, plus the `base-mainnet` / `base-sepolia` aliases. Base settles through the standard `exact` scheme using **EIP-3009** authorization rather than Permit2. Supply your own RPC in production via `--rpc-url` or `EVM_RPC_URL_8453` / `EVM_RPC_URL_84532`.
-- **Agent Wallet is now the default payer** — `pay` resolves your active [Agent Wallet](../Agent-Wallet/Intro/) and delegates signing, so no private key sits in an environment variable. If wallets are configured but none is active, the CLI **stops before signing** instead of picking one for you. Select explicitly with `--wallet-id` / `AGENT_WALLET_ID`, or point at another directory with `AGENT_WALLET_DIR`. Private keys are now a development/CI override only.
+- **Agent Wallet is now the default payer** — `pay` resolves your active [Agent Wallet](/Agent-Wallet/Intro/) and delegates signing, so no private key sits in an environment variable. If wallets are configured but none is active, the CLI **stops before signing** instead of picking one for you. Select explicitly with `--wallet-id` / `AGENT_WALLET_ID`, or point at another directory with `AGENT_WALLET_DIR`. Private keys are now a development/CI override only.
 - **Redirects are no longer followed** on paid requests, so `PAYMENT-SIGNATURE` can't be forwarded to another origin.
 - **EVM balance pre-check** — the CLI verifies the payer's token balance before signing and returns the resolved wallet ID, address, and raw balance.
 - New: `pay --asset` / `--decimals`, `serve --valid-for-seconds` (default `300`), and `roundtrip --json` emitting one document with separate `serve` and `pay` results.
 - New wallet error codes: `WALLET_PASSWORD_REQUIRED`, `WALLET_DECRYPTION_FAILED`, `WALLET_CONFIG_CORRUPT`, `WALLET_NETWORK_ERROR`.
 
-👉 [x402 CLI docs](../x402/cli/)
+👉 [x402 CLI docs](/x402/cli/)
 
 </div>
 </div>
@@ -35,10 +35,10 @@ Release notes for the x402 protocol, SDK, and [CLI](../x402/cli/).
 
 <div className="changelog-tags"><span className="changelog-tag">Update</span><span className="changelog-tag">Catalog</span><span className="changelog-tag">Base</span></div>
 
-- Published **Base mainnet and Base Sepolia catalog routes**, with payment guides and code examples.
+- Published **Base Mainnet catalog routes** on `eip155:8453`, with payment guides and code examples. Base Sepolia remains available in the CLI but is not published in the service catalog.
 - `assetTransferMethod` now accepts **`eip3009`** alongside `permit2` — Base USDC routes use `eip3009`.
 
-👉 [API Catalog reference](../x402/api-catalog/reference/)
+👉 [API Catalog reference](/x402/api-catalog/reference/)
 
 </div>
 </div>
@@ -56,7 +56,7 @@ Release notes for the x402 protocol, SDK, and [CLI](../x402/cli/).
 - **Settlement reporting** — paid responses distinguish `settled` (payment cleared on-chain) from `delivered` (upstream HTTP response succeeded).
 - Built on x402 SDK 1.0.1.
 
-👉 [x402 CLI docs](../x402/cli/)
+👉 [x402 CLI docs](/x402/cli/)
 
 </div>
 </div>
@@ -73,7 +73,7 @@ Release notes for the x402 protocol, SDK, and [CLI](../x402/cli/).
 - Network IDs must be **canonical CAIP-2**; legacy TRON aliases like `tron:nile` are rejected by schema validation.
 - With x402 SDK 1.0.1, GasFree cost is estimated client-side — routes must no longer publish the legacy `fee` / `feeConfig` fields.
 
-👉 [API Catalog reference](../x402/api-catalog/reference/)
+👉 [API Catalog reference](/x402/api-catalog/reference/)
 
 </div>
 </div>
@@ -95,7 +95,7 @@ First stable release of `@bankofai/x402-cli` — a TypeScript command-line clien
 - Built on the published `@bankofai/x402-core` / `x402-evm` / `x402-tron` SDK 1.0 packages; `scheme=exact` with Permit2
 - Networks: TRON (`tron:mainnet` / `tron:nile` / `tron:shasta`) and BSC (`eip155:56` / `eip155:97`)
 
-👉 Get started: [x402 CLI Quick Start](../x402/cli/quickstart/)
+👉 Get started: [x402 CLI Quick Start](/x402/cli/quickstart/)
 
 </div>
 </div>

docs/Agent-Wallet/Developer/CLI-Reference.md

@@ -58,6 +58,33 @@ agent-wallet start -p Abc12345! -k your-private-key-hex
 agent-wallet start -p Abc12345! -m "word1 word2 word3 ..."
 ```
 
+#### Skip the prompts: name the wallet type directly
+
+`start` and `add` also take the wallet type as a subcommand. That form asks nothing, which is what you want in CI or any background service:
+
+```bash
+agent-wallet start local_secure -p Abc12345! -g      # encrypted, generate a new key
+agent-wallet start raw_secret -k your-private-key    # plaintext, dev only
+agent-wallet start privy --app-id <id> --app-secret <secret> --privy-wallet-id <wallet>
+```
+
+`add` works the same way (`add local_secure` / `add raw_secret` / `add privy`) for a second wallet.
+
+| Option | Applies to | Description |
+| :--- | :--- | :--- |
+| `-w, --wallet-id <id>` | all | Wallet ID to create |
+| `-g, --generate` | `local_secure` | Generate a new random key |
+| `-k, --private-key <hex>` | `local_secure`, `raw_secret` | Import a private key |
+| `-m, --mnemonic <words>` | `local_secure`, `raw_secret` | Import a mnemonic |
+| `--mnemonic-index <n>` | `local_secure`, `raw_secret` | Account index when deriving from the mnemonic |
+| `-p, --password <pass>` | `local_secure` | Master password |
+| `--app-id` / `--app-secret` / `--privy-wallet-id` | `privy` | Privy app credentials and wallet ID |
+| `-d, --dir <path>` | all | Secrets directory (default `~/.agent-wallet`) |
+| `--save-runtime-secrets` | all | Persist the password to `runtime_secrets.json` |
+| `--override` | `start` only | Overwrite an existing setup |
+
+Run `agent-wallet start local_secure --help` or `agent-wallet add privy --help` for the exact options of one mode.
+
 ### `agent-wallet sign` (Core Signing Operations)
 
 Every `sign` subcommand requires `--network` / `-n` to specify the chain.

docs/Agent-Wallet/Developer/SDK-Guide.md

@@ -195,6 +195,10 @@ If both a password and a private key exist in your environment variables, the SD
 | `AGENT_WALLET_MNEMONIC` | Plaintext mnemonic phrase | ⚠️ Static Injection | Choose one (with private key) |
 | `AGENT_WALLET_MNEMONIC_ACCOUNT_INDEX` | BIP-44 derivation index (default `0`) | ⚠️ Static Injection | Optional |
 
+:::note Legacy variable names
+The SDK still accepts the older `TRON_PRIVATE_KEY`, `TRON_MNEMONIC`, and `TRON_ACCOUNT_INDEX` variables, which map to `AGENT_WALLET_PRIVATE_KEY`, `AGENT_WALLET_MNEMONIC`, and `AGENT_WALLET_MNEMONIC_ACCOUNT_INDEX`. They work on EVM networks too, despite the name. Prefer the `AGENT_WALLET_*` names in new setups.
+:::
+
 ---
 
 ## Usage Examples

docs/x402/api-catalog/reference.md

@@ -122,7 +122,6 @@ security   shopping    storage     translation
 | BNB Chain (BSC) | `eip155:56` |
 | BNB Smart Chain testnet | `eip155:97` |
 | Base mainnet | `eip155:8453` |
-| Base Sepolia testnet | `eip155:84532` |
 
 The build resolves each chain ID into display metadata (`kind` / `label` / `label_zh`) so the frontend doesn't have to parse CAIP-2 itself — see [Frontend display fields](#frontend-display-fields).
 

docs/x402/cli/index.md

@@ -35,7 +35,7 @@ The CLI groups its capabilities into five commands.
 | **`gateway`** | Manage local gateway provider files: validate, scaffold, start, and build catalog assets. | `x402-cli gateway check ./providers` |
 | **`catalog`** | Search, cache, inspect, and export the hosted provider catalog. | `x402-cli catalog search "weather"` |
 
-Read-only commands (`pay --dry-run`, `catalog search`, `gateway check`) need no wallet. Only an actual payment requires a payer private key.
+Read-only commands (`pay --dry-run`, `catalog search`, `gateway check`) need no wallet. An actual payment requires a configured signing wallet; raw private keys are only a development/CI override.
 
 ---
 
@@ -44,17 +44,34 @@ Read-only commands (`pay --dry-run`, `catalog search`, `gateway check`) need no
 Output is human-friendly text by default. Add `--json` to any command for a stable, machine-readable envelope — ideal for scripts and AI agents:
 
 ```bash
-x402-cli pay https://api.example.com/paid --dry-run --json
+x402-cli pay 'https://x402-gateway.bankofai.io/providers/defillama-tvl-tron/protocols' \
+  --network tron:0x2b6653dc \
+  --token USDT \
+  --dry-run \
+  --json
 ```
 
 ```json
 {
   "ok": true,
-  "command": "client",
-  "network": "tron:0xcd8690dc",
+  "command": "pay",
+  "component": "client",
+  "network": "tron:0x2b6653dc",
   "scheme": "exact",
   "result": {
-    "url": "https://api.example.com/paid",
+    "url": "https://x402-gateway.bankofai.io/providers/defillama-tvl-tron/protocols",
+    "resource": "https://x402-gateway.bankofai.io/providers/defillama-tvl-tron/protocols",
+    "selected": {
+      "scheme": "exact",
+      "network": "tron:0x2b6653dc",
+      "amount": "1",
+      "asset": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t",
+      "payTo": "TLXPgJVJFgL97gc49j8w8kC22mDTpH9EGa",
+      "maxTimeoutSeconds": 300,
+      "extra": {
+        "assetTransferMethod": "permit2"
+      }
+    },
     "message": "Dry run - no payment submitted"
   }
 }
@@ -117,7 +134,7 @@ Use the CLI to explore, test, and script against x402 endpoints, or to give an A
 :::warning
 Payments move real on-chain assets and cannot be reversed. Keep these principles in mind:
 
-- **Let Agent Wallet hold the key.** It is the default payer and signs locally — you never put a private key in a config file or environment variable. `--private-key` and the `*_PRIVATE_KEY` variables exist for development and CI only.
+- **Let Agent Wallet hold the key.** It is the default payer and delegates signing to the configured wallet backend, which may be local or remote. You never need to put a private key in the CLI configuration or environment. `--private-key` and the `*_PRIVATE_KEY` variables exist for development and CI only.
 - **Test on testnet first.** Use `tron:0xcd8690dc`, `eip155:97`, or `eip155:84532` before running any payment on mainnet.
 - **Preview before you pay.** Run `pay --dry-run` to inspect the exact requirement before signing.
 - **Cap the amount.** Use `--max-amount` or `--max-raw-amount` so a mispriced endpoint can't overcharge you.

docs/x402/cli/quickstart.md

@@ -49,17 +49,17 @@ You should see the version number and the list of commands (`pay`, `serve`, `rou
 
 ## Step 2: Try it without spending anything
 
-The fastest way to see a real `402` challenge is a **dry run**. This probes an endpoint, reads its payment requirement, and prints exactly what you'd be asked to pay — without signing or spending:
+The fastest way to see a real `402` challenge is a **dry run**. This probes a live TRON Mainnet endpoint, reads its payment requirement, and prints exactly what you'd be asked to pay — without signing or spending:
 
 ```bash
-x402-cli pay https://api.example.com/paid \
-  --network tron:0xcd8690dc \
+x402-cli pay 'https://x402-gateway.bankofai.io/providers/defillama-tvl-tron/protocols' \
+  --network tron:0x2b6653dc \
   --token USDT \
   --dry-run \
   --json
 ```
 
-The `--dry-run` output includes the selected requirement (network, asset, amount, recipient). This is your safety net: always dry-run an unfamiliar endpoint before paying it.
+This step reads a TRON Mainnet requirement, but `--dry-run` never signs or submits a payment. Its output includes the selected requirement (network, asset, amount, recipient). This is your safety net: always dry-run an unfamiliar endpoint before paying it.
 
 ---
 
@@ -85,12 +85,12 @@ The CLI signs with your active [Agent Wallet](../../Agent-Wallet/QuickStart.md),
 
 ## Step 4: Pay a real x402 endpoint
 
-Once the roundtrip works, paying any x402-protected URL is the same `pay` command pointed at a real resource:
+Once the roundtrip works, paying any x402-protected URL uses the same command. Replace the placeholders below with the URL, network, and token advertised by the provider:
 
 ```bash
-x402-cli pay https://api.example.com/paid \
-  --network tron:0xcd8690dc \
-  --token USDT \
+x402-cli pay '<x402-url>' \
+  --network <network> \
+  --token <token> \
   --max-amount 0.01
 ```
 

i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/index.md

@@ -15,7 +15,7 @@ BANK OF AI 各产品的更新与公告。
 
 <div className="changelog-tags"><span className="changelog-tag">新版本</span><span className="changelog-tag">x402</span><span className="changelog-tag">Base</span></div>
 
-- **Base 上线**——`eip155:8453` 与 `eip155:84532`，均支持 USDC，CLI 与服务目录同步支持。Base 在 `exact` 方案下使用 EIP-3009 授权，而非 Permit2。
+- **CLI 已支持 Base**——`eip155:8453` 与 `eip155:84532` 均支持 USDC；服务目录目前只发布 `eip155:8453` Base 主网路由。Base 在 `exact` 方案下使用 EIP-3009 授权，而非 Permit2。
 - **Agent Wallet 成为 CLI 默认付款方**——`pay` 用你当前激活的钱包签名，私钥不再进环境变量。若配置了钱包但没有激活项，CLI 会在签名前停下而不是替你选。[详情](./x402/)
 - 付费请求不再跟随 HTTP 重定向，避免 `PAYMENT-SIGNATURE` 流向其他源。
 

i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/x402.md

@@ -5,7 +5,7 @@ description: 'x402 支付协议、SDK 与 CLI 的版本发布记录。'
 
 # x402支付协议
 
-x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
+x402 协议、SDK 与 [CLI](/x402/cli/) 的版本发布记录。
 
 <div className="changelog-entry">
 <div className="changelog-date">2026-07-30</div>
@@ -16,13 +16,13 @@ x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
 <div className="changelog-tags"><span className="changelog-tag">新版本</span><span className="changelog-tag">CLI</span><span className="changelog-tag">Base</span></div>
 
 - **支持 Base**——`eip155:8453`（主网）与 `eip155:84532`（Sepolia），均支持 USDC，并提供 `base-mainnet` / `base-sepolia` 别名。Base 走标准 `exact` 方案，但使用 **EIP-3009** 授权而非 Permit2。生产环境请通过 `--rpc-url` 或 `EVM_RPC_URL_8453` / `EVM_RPC_URL_84532` 自备 RPC。
-- **Agent Wallet 成为默认付款方**——`pay` 会解析你当前激活的 [Agent Wallet](../Agent-Wallet/Intro/) 并交由它签名，私钥不再需要放进环境变量。如果配置了钱包但没有激活项，CLI 会**在签名前停下**而不是替你选一个。可用 `--wallet-id` / `AGENT_WALLET_ID` 显式指定，或用 `AGENT_WALLET_DIR` 指向其他目录。私钥现在只作为开发/CI 的覆盖手段。
+- **Agent Wallet 成为默认付款方**——`pay` 会解析你当前激活的 [Agent Wallet](/Agent-Wallet/Intro/) 并交由它签名，私钥不再需要放进环境变量。如果配置了钱包但没有激活项，CLI 会**在签名前停下**而不是替你选一个。可用 `--wallet-id` / `AGENT_WALLET_ID` 显式指定，或用 `AGENT_WALLET_DIR` 指向其他目录。私钥现在只作为开发/CI 的覆盖手段。
 - **付费请求不再跟随重定向**，确保 `PAYMENT-SIGNATURE` 不会被转发到其他源。
 - **EVM 余额预检**——签名前校验付款方代币余额，并返回解析出的钱包 ID、地址与原始余额。
 - 新增：`pay --asset` / `--decimals`、`serve --valid-for-seconds`（默认 `300`），以及 `roundtrip --json` 输出单个文档、内含独立的 `serve` 与 `pay` 结果。
 - 新增钱包类错误码：`WALLET_PASSWORD_REQUIRED`、`WALLET_DECRYPTION_FAILED`、`WALLET_CONFIG_CORRUPT`、`WALLET_NETWORK_ERROR`。
 
-👉 [x402 CLI 文档](../x402/cli/)
+👉 [x402 CLI 文档](/x402/cli/)
 
 </div>
 </div>
@@ -35,10 +35,10 @@ x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
 
 <div className="changelog-tags"><span className="changelog-tag">更新</span><span className="changelog-tag">Catalog</span><span className="changelog-tag">Base</span></div>
 
-- 发布 **Base 主网与 Base Sepolia 目录路由**，配套支付指引与代码示例。
+- 发布 `eip155:8453` **Base 主网目录路由**，配套支付指引与代码示例。CLI 仍支持 Base Sepolia，但服务目录未发布 Base Sepolia 路由。
 - `assetTransferMethod` 现在除 `permit2` 外还接受 **`eip3009`**——Base USDC 路由使用 `eip3009`。
 
-👉 [API Catalog 参考](../x402/api-catalog/reference/)
+👉 [API Catalog 参考](/x402/api-catalog/reference/)
 
 </div>
 </div>
@@ -56,7 +56,7 @@ x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
 - **结算状态**——已付款响应区分 `settled`（支付已在链上结算）与 `delivered`（上游 HTTP 响应成功）。
 - 基于 x402 SDK 1.0.1 构建。
 
-👉 [x402 CLI 文档](../x402/cli/)
+👉 [x402 CLI 文档](/x402/cli/)
 
 </div>
 </div>
@@ -73,7 +73,7 @@ x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
 - 网络标识必须使用**标准 CAIP-2**；旧的 TRON 别名如 `tron:nile` 会被 schema 校验拒绝。
 - 在 x402 SDK 1.0.1 下，GasFree 费用由客户端估算——目录路由不再发布旧的 `fee` / `feeConfig` 字段。
 
-👉 [API Catalog 参考](../x402/api-catalog/reference/)
+👉 [API Catalog 参考](/x402/api-catalog/reference/)
 
 </div>
 </div>
@@ -95,7 +95,7 @@ x402 协议、SDK 与 [CLI](../x402/cli/) 的版本发布记录。
 - 基于已发布的 `@bankofai/x402-core` / `x402-evm` / `x402-tron` SDK 1.0 包构建；`scheme=exact` 配合 Permit2
 - 支持网络：TRON（`tron:mainnet` / `tron:nile` / `tron:shasta`）与 BSC（`eip155:56` / `eip155:97`）
 
-👉 立即上手：[x402 CLI 快速开始](../x402/cli/quickstart/)
+👉 立即上手：[x402 CLI 快速开始](/x402/cli/quickstart/)
 
 </div>
 </div>