@agentgrant.cash/cli 1.4.2 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentgrant.cash/cli",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Grant Cash — one CLI for your money (gold) and your agent (pay-per-use services). Routes to the Perfolio backend and the Agent-mode backend behind a single, plain-language surface.",
   "type": "module",
   "bin": {

package/skills/grant-cash/SKILL.md

@@ -14,6 +14,24 @@ These are **two sides of the same Grant Cash account**, not two separate apps or
 
 > Note for assistants: do **not** describe this as a "portfolio service" plus an "agent service", and never mention internal system names. It is one product — Grant Cash — with an Investments side and a Spending side. Speak plainly: gold, cash, bitcoin, ethereum, "your worth", "spending money".
 
+## Set up (do this first)
+
+**If Grant Cash isn't connected on this machine yet**, set it up with one command:
+
+```
+npx @agentgrant.cash/cli onboard
+```
+
+This installs the Grant Cash skill and starts sign-in, then prints a **connect link**. Give that link to the user and ask them to open it, **sign in if needed, and approve their spending limits**. (Already signed in to Grant Cash in their browser? They just approve — no new sign-in.)
+
+**Then confirm whose account you're on — always, before moving any money:**
+
+```
+grant status        # shows the connected account (email) + what's enabled
+```
+
+Read the connected account back to the user and confirm it's theirs. A machine may already have an **older or different login cached**, so `status` reporting "connected" is not proof on its own. If the account isn't one the user recognises, run `grant logout` then `grant onboard` again for a fresh sign-in.
+
 ## Install / run
 
 This CLI is published on npm as **`@agentgrant.cash/cli`**. Run it without installing:
@@ -47,7 +65,7 @@ Every **cash** amount is in the user's display currency — a bare `50` means
 
 ## Workflow
 
-1. `grant status` — confirm you're connected (both Investments and Spending).
+1. `grant status` — confirm you're connected **and that the account is the user's** (see *Set up* — re-confirm a cached login before acting).
 2. `grant portfolio` — combined worth: the Investments side (gold, cash, bitcoin, ethereum, leveraged positions, prediction balance, earnings) and the Spending side, in one place.
 3. Invest: `grant prices`, then `grant buy <asset> --amount <cash>` / `grant sell <asset> --for <cash>`.
 4. Spend: `grant search "<q>"` → `grant check <url>` (no charge) → `grant fetch <url> -b '<json>'`.