Awal 2.12.1 no-auth Bazaar search fails by requiring wallet bridge

[epistemedeus]

Awal 2.12.1 no-auth Bazaar search fails by requiring the wallet bridge

Context

Coinbase's current Agentic Wallet CLI documentation says Bazaar search requires
no authentication or balance. I tested the documented current command on a
clean headless Linux worker. Search never reached the public catalog because
the CLI required its Electron wallet bridge and that bridge did not start.

The npm package points to coinbase/awal, which currently resolves as a
non-public repository. I am filing here as a routing path, following the same
precedent as issue 947. Please transfer or route this to the Awal owner if a
different tracker is authoritative.

Environment

• awal 2.12.1
• Linux 6.12.94+ x86_64
• Node.js 20.19.2
• npm 9.2.0
• no Awal login, wallet, balance, credential, signature, or payment

Reproduction

npx -y awal@latest x402 bazaar search "morpho position" \
  --network base \
  --max-price 0.02 \
  -k 10 \
  --json

Observed after the search spinner:

{
  "success": false,
  "error": {
    "code": "BAZAAR_SEARCH_FAILED",
    "message": "Bridge communication error: Failed to start wallet. Please start it manually.\n\nThis may indicate a configuration issue. Try restarting the wallet."
  }
}

The process exits 1.

Expected behavior

x402 bazaar search should complete on a supported headless Linux host without
requiring an authenticated or running wallet, consistent with the documented
no-auth search boundary. The smallest fix appears to be either:

1. route read-only Bazaar search and listing directly to the public catalog
   client without starting the wallet bridge; or
2. make the wallet server start reliably without a display and document the
   exact headless runtime dependency.

No paid request was attempted. This report is about the credential-free
discovery path before authorization.

[epistemedeus]

I inspected the exact public npm artifact to narrow this down.

• Package: awal@2.12.1
• npm tarball SHA-256:
  0b570230cf0e590691393e96ee0745fc9a25abf1970e91cad49dadd4125dab2c
• npm integrity:
  sha512-z4whchSMbUhDuhwoI/+7vZ1ArwG9e8C9yIX9Y3W+JXJkR3E95iIZ1vIBZ6nPWSzakCw21YuZhFvOpGKEXtN6kQ==

The direct cause is visible in the packaged code:

1. dist/commands/bazaar.js implements both bazaar list and bazaar search
   through sendIpcRequest('bazaar-list', ...) and
   sendIpcRequest('bazaar-search', ...).
2. dist/ipcClient.js makes every sendIpcRequest call run
   ensureServerRunning(...) when no primary wallet process exists.
3. dist/utils/serverManager.js installs and spawns Electron, then waits up to
   30 seconds for the primary-process lock. On this headless worker, that lock
   never appears and the documented read-only search fails before any catalog
   request.

So this is not an authentication or balance failure. In 2.12.1 the read-only
Bazaar commands are architecturally coupled to the Electron wallet process.
Separating bazaar-list and bazaar-search into a direct public-catalog client
would enforce the documented no-auth boundary and remove the display/runtime
dependency from agent discovery. If that separation is intentionally deferred,
the CLI should at least expose a specific HEADLESS_WALLET_START_FAILED-style
diagnostic rather than suggesting login or manual wallet startup for a
credential-free search.