feat(cli): vault withdraw (Aave aTokens & ERC-4626)

packages/connector-ui/public/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: Polygon Agent
-description: "Complete Polygon agent toolkit for on-chain operations on Polygon. Use this skill whenever helping an agent set up a wallet, check balances, send or swap tokens, bridge assets, deposit to earn yield, register on-chain identity, submit or query reputation/feedback, or make x402 micropayments. Covers the full lifecycle: Sequence smart contract wallets, Trails DeFi actions, ERC-8004 identity + reputation, x402 payments. Single CLI entry point (`polygon-agent`), AES-256-GCM encrypted storage."
+description: "Complete Polygon agent toolkit for on-chain operations on Polygon. Use this skill whenever helping an agent set up a wallet, check balances, send or swap tokens, bridge assets, deposit or withdraw from yield (Aave aTokens, ERC-4626 vaults), register on-chain identity, submit or query reputation/feedback, or make x402 micropayments. Covers the full lifecycle: Sequence smart contract wallets, Trails DeFi actions, ERC-8004 identity + reputation, x402 payments. Single CLI entry point (`polygon-agent`), AES-256-GCM encrypted storage."
 ---
 
 # Polygon Agentic CLI
@@ -99,12 +99,13 @@ polygon-agent wallet remove [--name <n>]
 
 ### Operations
 ```bash
-polygon-agent balances [--wallet <n>] [--chain <chain>]
+polygon-agent balances [--wallet <n>] [--chain <chain>] [--chains <csv>]
 polygon-agent send --to <addr> --amount <num> [--symbol <SYM>] [--token <addr>] [--decimals <n>] [--broadcast]
 polygon-agent send-native --to <addr> --amount <num> [--broadcast] [--direct]
 polygon-agent send-token --symbol <SYM> --to <addr> --amount <num> [--token <addr>] [--decimals <n>] [--broadcast]
 polygon-agent swap --from <SYM> --to <SYM> --amount <num> [--to-chain <chain>] [--slippage <num>] [--broadcast]
 polygon-agent deposit --asset <SYM> --amount <num> [--protocol aave|morpho] [--broadcast]
+polygon-agent withdraw --position <addr> --amount <num|max> [--chain <chain>] [--broadcast]
 polygon-agent fund [--wallet <n>] [--token <addr>]
 polygon-agent x402-pay --url <url> --wallet <n> [--method GET] [--body <str>] [--header Key:Value]
 ```
@@ -127,9 +128,11 @@ polygon-agent agent feedback --agent-id <id> --value <score> [--tag1 <t>] [--tag
 
 - **Dry-run by default** — all write commands require `--broadcast` to execute
 - **Smart defaults** — `--wallet main`, `--chain polygon`, auto-wait on `wallet create`
+- **`balances --chains`** — comma-separated chains (max 20); two or more return JSON with `multiChain: true` and a `chains` array (same wallet address on each)
 - **Fee preference** — auto-selects USDC over native POL when both available
 - **`fund`** — reads `walletAddress` from the wallet session and sets it as `toAddress` in the Trails widget URL. Always run `polygon-agent fund` to get the correct URL — never construct it manually or hardcode any address.
 - **`deposit`** — picks highest-TVL pool via Trails `getEarnPools`. If session rejects (contract not whitelisted), re-create wallet with `--contract <depositAddress>`
+- **`withdraw`** — `--position` = aToken or ERC-4626 vault; `--amount` = `max` or underlying units (Aave / vault). Dry-run JSON includes `poolAddress` / `vault`. Broadcast needs session on the **same chain** as `--chain`, with pool/vault + underlying token whitelisted where the relayer touches them
 - **`x402-pay`** — probes endpoint for 402, smart wallet funds builder EOA with exact token amount, EOA signs EIP-3009 payment. Chain auto-detected from 402 response
 - **`send-native --direct`** — bypasses ValueForwarder contract for direct EOA transfer
 - **Session permissions** — without `--usdc-limit` etc., session gets bare-bones defaults and may not transact
@@ -162,6 +165,7 @@ CLI commands output JSON (non-TTY). After running a command, always render the r
 | `send` / `send-token` / `send-native` | One-liner summary: amount, symbol, recipient. If broadcast, show tx hash as a code span and explorer URL as a link. |
 | `swap` | Summary: `X FROM → Y TO` with chain. If broadcast, show deposit tx hash + explorer link. |
 | `deposit` | Summary: amount, asset, protocol, pool address. If broadcast, show tx hash + explorer link. |
+| `withdraw` | Summary: `kind` (aave / erc4626), position, amount, pool or vault. If broadcast, show tx hash + explorer link. |
 | `fund` | Show the `fundingUrl` as a clickable link with a brief instruction to open it. |
 | `wallet create` / `wallet list` | Wallet name, truncated address, chain in a small table or bullet list. |
 | `agent register` | Show agent name and tx hash as a code span with Polygonscan link. Remind user to retrieve `agentId` from the Registered event on the Logs tab. |
@@ -182,7 +186,7 @@ For specific workflows, fetch and load the relevant sub-skill:
 | Use Case | Skill URL |
 |----------|-----------|
 | Polymarket prediction market trading | https://agentconnect.polygon.technology/polygon-polymarket/SKILL.md |
-| DeFi — swap, deposit, yield | https://agentconnect.polygon.technology/polygon-defi/SKILL.md |
+| DeFi — swap, deposit, withdraw, yield | https://agentconnect.polygon.technology/polygon-defi/SKILL.md |
 | x402 discovery & pay-per-call APIs | https://agentconnect.polygon.technology/polygon-discovery/SKILL.md |
 
 ---
@@ -200,6 +204,8 @@ For specific workflows, fetch and load the relevant sub-skill:
 | `Invalid code: hash mismatch` | Wrong 6-digit code entered — retry (3 attempts allowed) |
 | `Relay request not found` | Session expired or already used — re-run `wallet create` (or `wallet create --print-url`) |
 | Deposit session rejected | Re-create wallet with `--contract <depositAddress>` |
+| `withdraw` / broadcast: wrong chain or session rejects | Use `wallet create --chain <same as --chain>` and `--contract` for pool/vault + underlying ERC-20 on that chain; omit tight `--usdc-limit` if it blocks fee transfers |
+| `Stored explicit session is missing pk` | Re-link: `wallet import --code …` after `wallet create` |
 | Wrong recipient in Trails widget | Run `polygon-agent fund` (do not construct the URL manually) |
 | `x402-pay`: no 402 response | Endpoint doesn't require x402 payment, or URL is wrong |
 | `x402-pay`: payment token mismatch | Chain/token in the 402 response differs from wallet — check `--wallet` points to the right chain |

packages/connector-ui/public/polygon-defi/SKILL.md

@@ -129,6 +129,25 @@ polygon-agent deposit --asset USDC --amount 0.3 --protocol morpho --broadcast
 
 Vault/pool addresses are resolved dynamically from Trails — they are not hardcoded. The dry-run output includes `depositAddress` so you can inspect the exact contract before broadcasting.
 
+## Withdraw (Aave aToken or ERC-4626 vault)
+
+Pass the **position token** you hold: an **Aave aToken** address, or a **Morpho / ERC-4626 vault** (share) address. The CLI resolves the Aave **Pool** via `POOL()` on the aToken, or uses `redeem` on the vault. Dry-run by default.
+
+```bash
+# Full exit from an Aave position (aToken from balances output)
+polygon-agent withdraw --position 0x68215b6533c47ff9f7125ac95adf00fe4a62f79e --amount max --chain mainnet
+
+# Partial Aave withdraw (underlying units, e.g. USDC)
+polygon-agent withdraw --position <aToken> --amount 0.5 --chain mainnet --broadcast
+
+# ERC-4626: max redeems all shares; partial amount is underlying units (convertToShares)
+polygon-agent withdraw --position <vault> --amount max --chain polygon --broadcast
+```
+
+Whitelist the **pool** (Aave) or **vault** contract on the session if the wallet rejects the call (`polygon-agent wallet create --contract <poolOrVault>`).
+
+**Same chain as the transaction:** if you use `withdraw --chain mainnet`, create or refresh the session with **`wallet create --chain mainnet`** (not only Polygon defaults). Include **`--contract`** for the **pool** and for the **underlying ERC-20** on that chain (e.g. mainnet USDC `0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48`) so fee / helper transfers are allowed. Tight **`--usdc-limit`** can block those — omit or relax for yield exits.
+
 ### Session Whitelisting
 
 If the deposit is rejected with a session permission error, the pool's contract address needs to be whitelisted when creating the wallet session:

packages/connector-ui/public/skills/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: Polygon Agent
-description: "Complete Polygon agent toolkit for on-chain operations on Polygon. Use this skill whenever helping an agent set up a wallet, check balances, send or swap tokens, bridge assets, deposit to earn yield, register on-chain identity, submit or query reputation/feedback, or make x402 micropayments. Covers the full lifecycle: Sequence smart contract wallets, Trails DeFi actions, ERC-8004 identity + reputation, x402 payments. Single CLI entry point (`polygon-agent`), AES-256-GCM encrypted storage."
+description: "Complete Polygon agent toolkit for on-chain operations on Polygon. Use this skill whenever helping an agent set up a wallet, check balances, send or swap tokens, bridge assets, deposit or withdraw from yield (Aave aTokens, ERC-4626 vaults), register on-chain identity, submit or query reputation/feedback, or make x402 micropayments. Covers the full lifecycle: Sequence smart contract wallets, Trails DeFi actions, ERC-8004 identity + reputation, x402 payments. Single CLI entry point (`polygon-agent`), AES-256-GCM encrypted storage."
 ---
 
 # Polygon Agentic CLI
@@ -99,12 +99,13 @@ polygon-agent wallet remove [--name <n>]
 
 ### Operations
 ```bash
-polygon-agent balances [--wallet <n>] [--chain <chain>]
+polygon-agent balances [--wallet <n>] [--chain <chain>] [--chains <csv>]
 polygon-agent send --to <addr> --amount <num> [--symbol <SYM>] [--token <addr>] [--decimals <n>] [--broadcast]
 polygon-agent send-native --to <addr> --amount <num> [--broadcast] [--direct]
 polygon-agent send-token --symbol <SYM> --to <addr> --amount <num> [--token <addr>] [--decimals <n>] [--broadcast]
 polygon-agent swap --from <SYM> --to <SYM> --amount <num> [--to-chain <chain>] [--slippage <num>] [--broadcast]
 polygon-agent deposit --asset <SYM> --amount <num> [--protocol aave|morpho] [--broadcast]
+polygon-agent withdraw --position <addr> --amount <num|max> [--chain <chain>] [--broadcast]
 polygon-agent fund [--wallet <n>] [--token <addr>]
 polygon-agent x402-pay --url <url> --wallet <n> [--method GET] [--body <str>] [--header Key:Value]
 ```
@@ -127,9 +128,11 @@ polygon-agent agent feedback --agent-id <id> --value <score> [--tag1 <t>] [--tag
 
 - **Dry-run by default** — all write commands require `--broadcast` to execute
 - **Smart defaults** — `--wallet main`, `--chain polygon`, auto-wait on `wallet create`
+- **`balances --chains`** — comma-separated chains (max 20); two or more return JSON with `multiChain: true` and a `chains` array (same wallet address on each)
 - **Fee preference** — auto-selects USDC over native POL when both available
 - **`fund`** — reads `walletAddress` from the wallet session and sets it as `toAddress` in the Trails widget URL. Always run `polygon-agent fund` to get the correct URL — never construct it manually or hardcode any address.
 - **`deposit`** — picks highest-TVL pool via Trails `getEarnPools`. If session rejects (contract not whitelisted), re-create wallet with `--contract <depositAddress>`
+- **`withdraw`** — `--position` = aToken or ERC-4626 vault; `--amount` = `max` or underlying units (Aave / vault). Dry-run JSON includes `poolAddress` / `vault`. Broadcast needs session on the **same chain** as `--chain`, with pool/vault + underlying token whitelisted where the relayer touches them
 - **`x402-pay`** — probes endpoint for 402, smart wallet funds builder EOA with exact token amount, EOA signs EIP-3009 payment. Chain auto-detected from 402 response
 - **`send-native --direct`** — bypasses ValueForwarder contract for direct EOA transfer
 - **Session permissions** — without `--usdc-limit` etc., session gets bare-bones defaults and may not transact
@@ -162,6 +165,7 @@ CLI commands output JSON (non-TTY). After running a command, always render the r
 | `send` / `send-token` / `send-native` | One-liner summary: amount, symbol, recipient. If broadcast, show tx hash as a code span and explorer URL as a link. |
 | `swap` | Summary: `X FROM → Y TO` with chain. If broadcast, show deposit tx hash + explorer link. |
 | `deposit` | Summary: amount, asset, protocol, pool address. If broadcast, show tx hash + explorer link. |
+| `withdraw` | Summary: `kind` (aave / erc4626), position, amount, pool or vault. If broadcast, show tx hash + explorer link. |
 | `fund` | Show the `fundingUrl` as a clickable link with a brief instruction to open it. |
 | `wallet create` / `wallet list` | Wallet name, truncated address, chain in a small table or bullet list. |
 | `agent register` | Show agent name and tx hash as a code span with Polygonscan link. Remind user to retrieve `agentId` from the Registered event on the Logs tab. |
@@ -182,7 +186,7 @@ For specific workflows, fetch and load the relevant sub-skill:
 | Use Case | Skill URL |
 |----------|-----------|
 | Polymarket prediction market trading | https://agentconnect.polygon.technology/polygon-polymarket/SKILL.md |
-| DeFi — swap, deposit, yield | https://agentconnect.polygon.technology/polygon-defi/SKILL.md |
+| DeFi — swap, deposit, withdraw, yield | https://agentconnect.polygon.technology/polygon-defi/SKILL.md |
 | x402 discovery & pay-per-call APIs | https://agentconnect.polygon.technology/polygon-discovery/SKILL.md |
 
 ---
@@ -200,6 +204,8 @@ For specific workflows, fetch and load the relevant sub-skill:
 | `Invalid code: hash mismatch` | Wrong 6-digit code entered — retry (3 attempts allowed) |
 | `Relay request not found` | Session expired or already used — re-run `wallet create` (or `wallet create --print-url`) |
 | Deposit session rejected | Re-create wallet with `--contract <depositAddress>` |
+| `withdraw` / broadcast: wrong chain or session rejects | Use `wallet create --chain <same as --chain>` and `--contract` for pool/vault + underlying ERC-20 on that chain; omit tight `--usdc-limit` if it blocks fee transfers |
+| `Stored explicit session is missing pk` | Re-link: `wallet import --code …` after `wallet create` |
 | Wrong recipient in Trails widget | Run `polygon-agent fund` (do not construct the URL manually) |
 | `x402-pay`: no 402 response | Endpoint doesn't require x402 payment, or URL is wrong |
 | `x402-pay`: payment token mismatch | Chain/token in the 402 response differs from wallet — check `--wallet` points to the right chain |

packages/connector-ui/public/skills/polygon-defi/SKILL.md

@@ -108,16 +108,19 @@ interface PoolTokenInfo {
 
 Pool discovery uses `TrailsApi.getEarnPools` — picks the most liquid pool (highest TVL) for the asset on the current chain. No hardcoded addresses — the pool is resolved at runtime.
 
+**Note on Morpho Vaults:**
+Trails categorizes Morpho vaults by their *receipt* token symbol (e.g., `STEAKUSDC` or `gtUSDCp`), rather than the underlying token. To deposit into a Morpho vault, you must provide the vault's exact receipt token symbol as the `--asset`.
+If you try to deposit using `--asset USDC`, it may fail to find the pool. In those cases, you can use the `swap` command to swap `USDC` directly for the vault's receipt token address.
+
 ```bash
 # Dry-run — shows pool name, APY, TVL, and deposit address before committing
-polygon-agent deposit --asset USDC --amount 0.3
+polygon-agent deposit --asset STEAKUSDC --amount 0.3 --protocol morpho
 
 # Execute — deposits into the highest-TVL active pool
-polygon-agent deposit --asset USDC --amount 0.3 --broadcast
+polygon-agent deposit --asset STEAKUSDC --amount 0.3 --protocol morpho --broadcast
 
-# Filter by protocol
+# Filter by protocol (Aave uses the underlying asset name)
 polygon-agent deposit --asset USDC --amount 0.3 --protocol aave --broadcast
-polygon-agent deposit --asset USDC --amount 0.3 --protocol morpho --broadcast
 ```
 
 ### Supported Protocols
@@ -129,6 +132,25 @@ polygon-agent deposit --asset USDC --amount 0.3 --protocol morpho --broadcast
 
 Vault/pool addresses are resolved dynamically from Trails — they are not hardcoded. The dry-run output includes `depositAddress` so you can inspect the exact contract before broadcasting.
 
+## Withdraw (Aave aToken or ERC-4626 vault)
+
+Pass the **position token** you hold: an **Aave aToken** address, or a **Morpho / ERC-4626 vault** (share) address. The CLI resolves the Aave **Pool** via `POOL()` on the aToken, or uses `redeem` on the vault. Dry-run by default.
+
+```bash
+# Full exit from an Aave position (aToken from balances output)
+polygon-agent withdraw --position 0x68215b6533c47ff9f7125ac95adf00fe4a62f79e --amount max --chain mainnet
+
+# Partial Aave withdraw (underlying units, e.g. USDC)
+polygon-agent withdraw --position <aToken> --amount 0.5 --chain mainnet --broadcast
+
+# ERC-4626: max redeems all shares; partial amount is underlying units (convertToShares)
+polygon-agent withdraw --position <vault> --amount max --chain polygon --broadcast
+```
+
+Whitelist the **pool** (Aave) or **vault** contract on the session if the wallet rejects the call (`polygon-agent wallet create --contract <poolOrVault>`).
+
+**Same chain as the transaction:** if you use `withdraw --chain mainnet`, create or refresh the session with **`wallet create --chain mainnet`** (not only Polygon defaults). Include **`--contract`** for the **pool** and for the **underlying ERC-20** on that chain (e.g. mainnet USDC `0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48`) so fee / helper transfers are allowed. Tight **`--usdc-limit`** can block those — omit or relax for yield exits.
+
 ### Session Whitelisting
 
 If the deposit is rejected with a session permission error, the pool's contract address needs to be whitelisted when creating the wallet session:

packages/connector-ui/src/App.tsx

@@ -412,12 +412,12 @@ function App() {
         deadline: BigInt(Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 183),
         permissions: [
           ...basePermissions,
-          ...contractWhitelistPermissions,
           ...oneOffErc20Permissions,
           ...openTokenPermissions,
           ...dynamicTokenPermissions,
           ...nativeFeePermission,
-          ...feePermissions
+          ...feePermissions,
+          ...contractWhitelistPermissions
         ]
       };