@agentvalet/register 0.2.1 → 0.3.0

package/README.md

@@ -1,91 +1,56 @@
 # @agentvalet/register
 
-Self-register AI agents with [AgentValet](https://agentvalet.ai) — the governance and proxy layer that sits between AI agents and SaaS platforms.
+Register your AI agent with AgentValet in 30 seconds.
 
-## Install
+## Usage
 
 ```bash
-# One-off use (no install):
-npx @agentvalet/register --name "My Agent" --scope slack:chat:write
-
-# Or install globally:
-npm install -g @agentvalet/register
-agentvalet-register --name "My Agent" --scope slack:chat:write
+npx @agentvalet/register
 ```
 
-## Interactive mode
+No installation required. Authenticate with GitHub, and your agent is registered automatically.
 
-Run with no flags for a guided wizard:
+## What it does
 
-```bash
-npx @agentvalet/register
-```
+1. Opens your browser to authenticate with GitHub
+2. Creates your AgentValet account (or finds your existing one)
+3. Registers this machine as an agent
+4. Writes config to `.agentvalet/` in the current directory
+5. Outputs the environment variables you need
 
-## Flags
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--owner <uuid>` | `AGENTVALET_OWNER` env | Owner ID from https://agentvalet.ai/settings |
-| `--name <name>` | prompted | Agent name |
-| `--description <desc>` | — | Agent description |
-| `--scope <platform:scope>` | — | Repeatable, e.g. `--scope slack:chat:write --scope gmail:send` |
-| `--api-url <url>` | `https://api.agentvalet.ai` | AgentValet API base URL |
-| `--output <path>` | `./.env.agentvalet` | Path to write env vars |
-| `--key-path <path>` | `./agentvalet.key` | Path to write private key |
-| `--json` | — | Machine-readable JSON output |
-| `--no-wait` | — | Register only, don't wait for approval |
-| `--timeout <seconds>` | `300` | Approval wait timeout |
-
-## Exit codes
-
-| Code | Meaning |
-|------|---------|
-| `0` | Approved |
-| `1` | Denied |
-| `2` | Timeout |
-| `3` | Network or other error |
-
-## Integration examples
-
-**Claude Code (`CLAUDE.md`):**
-```markdown
-On startup, register with AgentValet:
-  npx @agentvalet/register --owner {uuid} --name "Claude Code Agent" --scope slack:chat:write
-
-Then source ./.env.agentvalet before calling any tool.
-```
+## Requirements
 
-**Python agent:**
-```python
-import subprocess
-subprocess.run([
-    "npx", "@agentvalet/register",
-    "--name", "MyAgent",
-    "--owner", owner_id,
-    "--scope", "slack:chat:write",
-])
-```
+- Node.js 18+
+- A GitHub account
+- An internet connection
 
-**LangChain / CrewAI / bash script:**
+## After registration
 
-Shell out to `npx @agentvalet/register` and parse the output env file:
+Approve your agent in the AgentValet dashboard to activate it:
+https://app.agentvalet.ai/agents
+
+## Commands
 
 ```bash
-npx @agentvalet/register --owner $OWNER_ID --name "BashAgent" --scope slack:chat:write
-source ./.env.agentvalet
+npx @agentvalet/register          # Register a new agent (GitHub onboarding)
+npx @agentvalet/register refresh  # Refresh approved permissions
 ```
 
-## How it works
+## What gets written
+
+- `.agentvalet/config.json` — agent ID, proxy URL, registration timestamp
+- `.agentvalet/agent.key` — private key (mode 0600, never shared)
+
+`.agentvalet/` is automatically added to your `.gitignore`.
 
-1. POSTs to `/v1/register` with your owner ID, agent name, and requested scopes
-2. Prints the approval URL — the owner approves in the dashboard
-3. Waits for approval via SSE (with polling fallback)
-4. On approval, writes the private key to `--key-path` and env vars to `--output`
+## Advanced: existing owner ID
 
-The agent **never holds SaaS credentials** — AgentValet injects them at proxy time.
+If you already have an AgentValet owner ID, pass it directly:
+
+```bash
+AGENTVALET_OWNER=<your-owner-id> npx @agentvalet/register
+```
 
-## Links
+## GitHub OAuth App
 
-- Dashboard: https://agentvalet.ai
-- Docs: https://agentvalet.ai/docs
-- GitHub: https://github.com/MCSEdwin/agentvalet
+The GitHub Device Flow uses AgentValet's OAuth App (client ID is public — the Device Flow does not use or expose the client secret). No secrets are stored on your machine.

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
-import chalk2 from "chalk";
+import chalk5 from "chalk";
 
 // src/wizard.ts
 import prompts from "prompts";
@@ -422,7 +422,7 @@ function ensureMcpJson() {
   if (!agentId || !ownerId || !keyPath) return;
   servers["agent-authority"] = {
     command: "npx",
-    args: ["-y", "@agentvalet/register", "mcp-server"],
+    args: ["-y", "@agentvalet/register@0.2.2", "mcp-server"],
     env: {
       AGENT_ID: agentId,
       OWNER_ID: ownerId,
@@ -434,6 +434,346 @@ function ensureMcpJson() {
   writeFileSync(mcpJsonPath, JSON.stringify(mcpConfig, null, 2) + "\n", "utf-8");
 }
 
+// src/commands/onboard.ts
+import chalk4 from "chalk";
+import ora from "ora";
+import prompts2 from "prompts";
+
+// src/auth/github-device-flow.ts
+import { createOAuthDeviceAuth } from "@octokit/auth-oauth-device";
+import open from "open";
+import chalk2 from "chalk";
+var GITHUB_CLIENT_ID = process.env.AGENTVALET_GITHUB_CLIENT_ID ?? "Ov23liXXXXXXXXXXXXXX";
+async function authenticateWithGitHub() {
+  const auth = createOAuthDeviceAuth({
+    clientType: "oauth-app",
+    clientId: GITHUB_CLIENT_ID,
+    scopes: ["user:email", "read:user"],
+    onVerification(verification) {
+      console.log("");
+      console.log(chalk2.bold("  Authenticate with GitHub"));
+      console.log("");
+      console.log(`  1. Open: ${chalk2.cyan.underline(verification.verification_uri)}`);
+      console.log(`  2. Enter code: ${chalk2.bold.yellow(verification.user_code)}`);
+      console.log("");
+      open(verification.verification_uri).catch(() => {
+        console.log(chalk2.dim("  (Could not open browser \u2014 navigate to the URL above manually)"));
+      });
+      console.log(chalk2.dim("  Waiting for authorisation..."));
+    }
+  });
+  const tokenAuth = await auth({ type: "oauth" });
+  return {
+    token: tokenAuth.token,
+    scopes: tokenAuth.scopes ?? []
+  };
+}
+async function getGitHubUser(token) {
+  const response = await fetch("https://api.github.com/user", {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github.v3+json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub API error: ${response.status}`);
+  }
+  const user = await response.json();
+  if (!user.email) {
+    const emailsResponse = await fetch("https://api.github.com/user/emails", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github.v3+json"
+      }
+    });
+    if (emailsResponse.ok) {
+      const emails = await emailsResponse.json();
+      user.email = emails.find((e) => e.primary && e.verified)?.email ?? emails[0]?.email ?? null;
+    }
+  }
+  return user;
+}
+
+// src/api/agentvalet.ts
+var API_BASE = process.env.AGENTVALET_API_URL ?? "https://api.agentvalet.ai";
+async function createOrFindAccount(params) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const response = await fetch(`${API_BASE}/v1/cli/account`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(params),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new Error(`Account creation failed: ${response.status} ${error.message ?? ""}`);
+    }
+    return response.json();
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err?.name === "AbortError") throw new Error("Request timed out \u2014 is the AgentValet API reachable?");
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function registerAgent2(params, apiKey) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const response = await fetch(`${API_BASE}/v1/cli/register-agent`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(params),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new Error(`Agent registration failed: ${response.status} ${error.message ?? ""}`);
+    }
+    return response.json();
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err?.name === "AbortError") throw new Error("Request timed out \u2014 is the AgentValet API reachable?");
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// src/config/store.ts
+import Conf from "conf";
+var store = new Conf({
+  projectName: "agentvalet"
+});
+function getStoredConfig() {
+  return store.store;
+}
+function saveConfig(config) {
+  store.set(config);
+}
+function clearConfig() {
+  store.clear();
+}
+function isAuthenticated() {
+  return !!store.get("apiKey");
+}
+
+// src/config/local.ts
+import { mkdir as mkdir2, writeFile as writeFile2, appendFile, readFile } from "fs/promises";
+import path from "path";
+async function writeLocalConfig(config) {
+  const dir = path.join(process.cwd(), ".agentvalet");
+  await mkdir2(dir, { recursive: true });
+  await writeFile2(
+    path.join(dir, "config.json"),
+    JSON.stringify({
+      agent_id: config.agentId,
+      agent_name: config.agentName,
+      proxy_url: config.proxyUrl,
+      registered_at: (/* @__PURE__ */ new Date()).toISOString()
+    }, null, 2),
+    { encoding: "utf8", mode: 384 }
+  );
+  await writeFile2(
+    path.join(dir, "agent.key"),
+    config.privateKeyPem,
+    { encoding: "utf8", mode: 384 }
+  );
+  if (process.platform === "win32") {
+    console.warn("  Note: file permissions (0o600) are not enforced on Windows. Keep .agentvalet/ in a secure location.");
+  }
+  const gitignorePath = path.join(process.cwd(), ".gitignore");
+  const gitignoreContent = await readFile(gitignorePath, "utf8").catch(() => null);
+  if (gitignoreContent !== null) {
+    const lines = gitignoreContent.split("\n").map((l) => l.trim());
+    if (!lines.includes(".agentvalet/")) {
+      await appendFile(gitignorePath, "\n# AgentValet\n.agentvalet/\n");
+    }
+  }
+}
+
+// src/output/env.ts
+import chalk3 from "chalk";
+import { appendFile as appendFile2, writeFile as writeFile3 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path2 from "path";
+function formatEnvBlock(vars) {
+  return Object.entries(vars).map(([key, value]) => {
+    const truncated = value.length > 60 ? value.substring(0, 40) + "..." + value.substring(value.length - 10) : value;
+    return `  ${chalk3.dim(key + "=")}${chalk3.white(truncated)}`;
+  }).join("\n");
+}
+
+// src/commands/onboard.ts
+import os from "os";
+async function runOnboard() {
+  console.log("");
+  console.log(chalk4.bold("  AgentValet \u2014 Agent Registration"));
+  console.log(chalk4.dim("  agentvalet.ai"));
+  console.log("");
+  if (isAuthenticated()) {
+    const stored = getStoredConfig();
+    console.log(
+      chalk4.green("  \u2713 Already authenticated as") + chalk4.bold(` ${stored.email}`)
+    );
+    const { action } = await prompts2({
+      type: "select",
+      name: "action",
+      message: "What would you like to do?",
+      choices: [
+        { title: "Register a new agent for this directory", value: "register" },
+        { title: "Show my credentials", value: "show" },
+        { title: "Sign out and use a different account", value: "signout" }
+      ]
+    });
+    if (action === void 0) {
+      process.exit(0);
+    }
+    if (action === "show") {
+      showCredentials(stored);
+      return;
+    }
+    if (action === "signout") {
+      clearConfig();
+      console.log(chalk4.dim("  Signed out. Run again to re-authenticate."));
+      return;
+    }
+    await registerAgentFlow(stored.apiKey, stored.ownerId);
+    return;
+  }
+  let spinner = ora();
+  let githubToken;
+  try {
+    const result = await authenticateWithGitHub();
+    githubToken = result.token;
+  } catch (err) {
+    console.error(chalk4.red(`  \u2717 Authentication failed: ${err.message}`));
+    process.exit(1);
+  }
+  spinner = ora("  Fetching your GitHub profile...").start();
+  let githubUser;
+  try {
+    githubUser = await getGitHubUser(githubToken);
+    spinner.succeed(`  GitHub: ${chalk4.bold("@" + githubUser.login)}`);
+  } catch (err) {
+    spinner.fail(`  Failed to fetch GitHub profile: ${err.message}`);
+    process.exit(1);
+  }
+  if (!githubUser.email) {
+    const { email } = await prompts2({
+      type: "text",
+      name: "email",
+      message: "Your email address (not visible on GitHub):",
+      validate: (v) => v.includes("@") || "Please enter a valid email"
+    });
+    if (email === void 0) {
+      process.exit(0);
+    }
+    githubUser.email = email;
+  }
+  spinner = ora("  Setting up your AgentValet account...").start();
+  let account;
+  try {
+    account = await createOrFindAccount({
+      github_token: githubToken,
+      github_username: githubUser.login,
+      email: githubUser.email,
+      display_name: githubUser.name ?? githubUser.login,
+      avatar_url: githubUser.avatar_url
+    });
+    if (account.is_new_account) {
+      spinner.succeed("  AgentValet account created");
+    } else {
+      spinner.succeed("  Existing AgentValet account found");
+    }
+  } catch (err) {
+    spinner.fail(`  Account setup failed: ${err.message}`);
+    process.exit(1);
+  }
+  saveConfig({
+    apiKey: account.owner_id,
+    ownerId: account.owner_id,
+    orgId: account.org_id,
+    proxyUrl: account.proxy_url,
+    githubUsername: githubUser.login,
+    email: githubUser.email
+  });
+  await registerAgentFlow(account.owner_id, account.owner_id);
+}
+async function registerAgentFlow(apiKey, ownerId) {
+  const hostname = os.hostname().split(".")[0];
+  const dirName = process.cwd().split("/").pop() ?? process.cwd().split("\\").pop() ?? "agent";
+  const { agentName } = await prompts2({
+    type: "text",
+    name: "agentName",
+    message: "Name for this agent:",
+    initial: `${hostname} \u2014 ${dirName}`,
+    validate: (v) => v.trim().length > 0 || "Agent name is required"
+  });
+  if (agentName === void 0) {
+    process.exit(0);
+  }
+  const spinner = ora("  Registering agent...").start();
+  let agent;
+  try {
+    agent = await registerAgent2({
+      owner_id: ownerId,
+      name: agentName.trim(),
+      source: "cli"
+    }, apiKey);
+    spinner.succeed(`  Agent registered: ${chalk4.bold(agent.agent_id)}`);
+  } catch (err) {
+    spinner.fail(`  Registration failed: ${err.message}`);
+    process.exit(1);
+  }
+  try {
+    await writeLocalConfig({
+      agentId: agent.agent_id,
+      agentName: agent.agent_name,
+      proxyUrl: getStoredConfig().proxyUrl,
+      privateKeyPem: agent.private_key_pem
+    });
+  } catch (err) {
+    console.error(chalk4.red(`  \u2717 Failed to write local config: ${err.message}`));
+    console.log(chalk4.dim("  Agent was registered \u2014 run again to save config locally."));
+    process.exit(1);
+  }
+  console.log("");
+  console.log(chalk4.bold.green("  \u2713 All done!"));
+  console.log("");
+  console.log("  Set these in your environment:");
+  console.log("");
+  console.log(formatEnvBlock({
+    AGENTVALET_PROXY_URL: getStoredConfig().proxyUrl,
+    AGENTVALET_AGENT_ID: agent.agent_id,
+    AGENTVALET_PRIVATE_KEY: agent.private_key_pem.replace(/\n/g, "\\n")
+  }));
+  console.log("");
+  console.log(chalk4.dim("  Private key also saved to: .agentvalet/agent.key"));
+  console.log(chalk4.dim("  Add .agentvalet/ to your .gitignore"));
+  console.log("");
+  console.log(
+    `  Dashboard: ${chalk4.cyan.underline("https://app.agentvalet.ai")}`
+  );
+  console.log(chalk4.dim("  Approve this agent in your dashboard to activate it."));
+  console.log("");
+}
+function showCredentials(config) {
+  console.log("");
+  console.log("  Your AgentValet credentials:");
+  console.log("");
+  console.log(`  Owner ID:  ${chalk4.bold(config.ownerId)}`);
+  console.log(`  Proxy URL: ${chalk4.bold(config.proxyUrl)}`);
+  console.log(`  Email:     ${chalk4.bold(config.email)}`);
+  console.log("");
+}
+
 // src/index.ts
 function collectScope(value, previous) {
   return [...previous, value];
@@ -445,6 +785,10 @@ program.name("agentvalet-register").description("Self-register an AI agent with
   let agentName = opts.name ?? "";
   let description = opts.description ?? "";
   let scopes = opts.scope;
+  if (!ownerId && !isAuthenticated()) {
+    await runOnboard();
+    return;
+  }
   if (!agentName) {
     if (isJson) {
       console.error(JSON.stringify({ error: "--name is required in non-interactive mode" }));
@@ -461,7 +805,7 @@ program.name("agentvalet-register").description("Self-register an AI agent with
       console.error(JSON.stringify({ error: "--owner or AGENTVALET_OWNER is required" }));
       process.exit(3);
     }
-    console.error(chalk2.red("Error: --owner or AGENTVALET_OWNER environment variable is required"));
+    console.error(chalk5.red("Error: --owner or AGENTVALET_OWNER environment variable is required"));
     process.exit(3);
   }
   const scopeMap = /* @__PURE__ */ new Map();
@@ -469,7 +813,7 @@ program.name("agentvalet-register").description("Self-register an AI agent with
     const colon = s.indexOf(":");
     if (colon === -1) {
       console.error(
-        isJson ? JSON.stringify({ error: `Invalid scope format: ${s} (expected platform:scope)` }) : chalk2.red(`Invalid scope format: ${s} (expected platform:scope)`)
+        isJson ? JSON.stringify({ error: `Invalid scope format: ${s} (expected platform:scope)` }) : chalk5.red(`Invalid scope format: ${s} (expected platform:scope)`)
       );
       process.exit(3);
     }
@@ -492,11 +836,11 @@ program.name("agentvalet-register").description("Self-register an AI agent with
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(isJson ? JSON.stringify({ error: msg }) : chalk2.red(`Registration failed: ${msg}`));
+    console.error(isJson ? JSON.stringify({ error: msg }) : chalk5.red(`Registration failed: ${msg}`));
     process.exit(3);
   }
   if (!isJson) {
-    console.log(chalk2.cyan(`
+    console.log(chalk5.cyan(`
 Approve at: https://agentvalet.ai/registrations
 `));
   }
@@ -504,7 +848,7 @@ Approve at: https://agentvalet.ai/registrations
     if (isJson) {
       console.log(JSON.stringify({ status: "pending", token }));
     } else {
-      console.log(chalk2.yellow("Registration submitted (--no-wait). Token:"), token);
+      console.log(chalk5.yellow("Registration submitted (--no-wait). Token:"), token);
     }
     process.exit(0);
   }
@@ -515,14 +859,14 @@ Approve at: https://agentvalet.ai/registrations
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(isJson ? JSON.stringify({ error: msg }) : chalk2.red(`Wait failed: ${msg}`));
+    console.error(isJson ? JSON.stringify({ error: msg }) : chalk5.red(`Wait failed: ${msg}`));
     process.exit(3);
   }
   if (result.status === "rejected") {
     if (isJson) {
       console.log(JSON.stringify({ status: "rejected" }));
     } else {
-      console.log(chalk2.red("\nRegistration denied by owner."));
+      console.log(chalk5.red("\nRegistration denied by owner."));
     }
     process.exit(1);
   }
@@ -530,7 +874,7 @@ Approve at: https://agentvalet.ai/registrations
     if (isJson) {
       console.log(JSON.stringify({ status: "timeout" }));
     } else {
-      console.log(chalk2.yellow("\nTimed out waiting for approval."));
+      console.log(chalk5.yellow("\nTimed out waiting for approval."));
     }
     process.exit(2);
   }
@@ -549,30 +893,30 @@ Approve at: https://agentvalet.ai/registrations
     }));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(isJson ? JSON.stringify({ error: msg }) : chalk2.red(`Failed to save output: ${msg}`));
+    console.error(isJson ? JSON.stringify({ error: msg }) : chalk5.red(`Failed to save output: ${msg}`));
     process.exit(3);
   }
   const keyWritten = !!privateKey;
   if (isJson) {
     console.log(JSON.stringify({ status: "approved", agentId, keyPath: keyWritten ? keyPath : null, envPath }));
   } else {
-    console.log(chalk2.green(`
+    console.log(chalk5.green(`
 Approved! Agent ID: ${agentId}`));
     if (keyWritten) {
-      console.log(chalk2.gray(`Key:        ${keyPath}`));
+      console.log(chalk5.gray(`Key:        ${keyPath}`));
     } else {
-      console.log(chalk2.yellow(`Key:        not written \u2014 copy it from the dashboard and paste into ${keyPath}`));
+      console.log(chalk5.yellow(`Key:        not written \u2014 copy it from the dashboard and paste into ${keyPath}`));
     }
-    console.log(chalk2.gray(`Env file:   ${envPath}`));
+    console.log(chalk5.gray(`Env file:   ${envPath}`));
     console.log(`
 Source the env file before calling any tool:`);
-    console.log(chalk2.cyan(`  source ${envPath}`));
+    console.log(chalk5.cyan(`  source ${envPath}`));
   }
   if (keyWritten) {
     try {
       if (grantedPlatforms && grantedPlatforms.length > 0) {
         writePermissionsFromEvent(agentId, resolvedOwnerId, grantedPlatforms);
-        if (!isJson) console.log(chalk2.gray(`Permissions: .claude/agentvalet-permissions.md`));
+        if (!isJson) console.log(chalk5.gray(`Permissions: .claude/agentvalet-permissions.md`));
       } else {
         await runRefresh({
           envFile: opts.output,
@@ -580,10 +924,10 @@ Source the env file before calling any tool:`);
           ifStale: false,
           quiet: isJson
         });
-        if (!isJson) console.log(chalk2.gray(`Permissions: .claude/agentvalet-permissions.md`));
+        if (!isJson) console.log(chalk5.gray(`Permissions: .claude/agentvalet-permissions.md`));
       }
     } catch {
-      if (!isJson) console.log(chalk2.yellow(`Permissions: run 'agentvalet-register refresh' to generate`));
+      if (!isJson) console.log(chalk5.yellow(`Permissions: run 'agentvalet-register refresh' to generate`));
     }
   }
   process.exit(0);
@@ -598,12 +942,12 @@ program.command("refresh").description("Refresh approved permissions and update
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk2.red(`Refresh failed: ${msg}`));
+    console.error(chalk5.red(`Refresh failed: ${msg}`));
     process.exit(3);
   }
 });
 program.command("mcp-server").description("Start the AgentValet MCP server (stdio transport)").action(async () => {
-  await import("./mcp-server-AM5ZYWTB.js");
+  await import("./mcp-server-LUNOQPUO.js");
 });
 program.parseAsync().catch((err) => {
   console.error(err);

package/dist/{mcp-server-AM5ZYWTB.js → mcp-server-LUNOQPUO.js}

@@ -7,8 +7,8 @@ import { SignJWT, importPKCS8 } from "jose";
 if (!process.env.AGENT_PRIVATE_KEY && process.env.AGENT_PRIVATE_KEY_PATH) {
   try {
     process.env.AGENT_PRIVATE_KEY = readFileSync(process.env.AGENT_PRIVATE_KEY_PATH, "utf-8").trim();
-  } catch (err2) {
-    process.stderr.write(`[agent-authority] Cannot read AGENT_PRIVATE_KEY_PATH: ${err2 instanceof Error ? err2.message : err2}
+  } catch (err) {
+    process.stderr.write(`[agent-authority] Cannot read AGENT_PRIVATE_KEY_PATH: ${err instanceof Error ? err.message : err}
 `);
     process.exit(1);
   }
@@ -25,23 +25,28 @@ var AGENT_PRIVATE_KEY_RAW = process.env.AGENT_PRIVATE_KEY;
 var AGENT_ID = process.env.AGENT_ID;
 var OWNER_ID = process.env.OWNER_ID;
 var PROXY_URL = process.env.PROXY_URL.replace(/\/$/, "");
-var privateKey = null;
-if (AGENT_PRIVATE_KEY_RAW !== "PENDING_FIRST_CALL") {
+var _privateKey = null;
+var _keyError = null;
+async function getPrivateKey() {
+  if (_keyError) throw new Error(_keyError);
+  if (_privateKey) return _privateKey;
+  if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") return null;
   const raw = AGENT_PRIVATE_KEY_RAW.trim();
   const pem = raw.startsWith("-----") ? raw.replace(/\\n/g, "\n") : `-----BEGIN PRIVATE KEY-----
 ${raw}
 -----END PRIVATE KEY-----`;
   try {
-    privateKey = await importPKCS8(pem, "RS256");
-  } catch (err2) {
-    process.stderr.write(`[agent-authority] Invalid private key: ${err2 instanceof Error ? err2.message : err2}
-`);
-    process.exit(1);
+    _privateKey = await importPKCS8(pem, "RS256");
+    return _privateKey;
+  } catch (err) {
+    _keyError = `Invalid private key: ${err instanceof Error ? err.message : err}`;
+    throw new Error(_keyError);
   }
 }
 async function signJWT() {
-  if (!privateKey) throw new Error("Private key not loaded");
-  return new SignJWT({ agent_id: AGENT_ID, owner_id: OWNER_ID }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setExpirationTime("60s").sign(privateKey);
+  const key = await getPrivateKey();
+  if (!key) throw new Error("Private key not loaded");
+  return new SignJWT({ agent_id: AGENT_ID, owner_id: OWNER_ID }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setExpirationTime("60s").sign(key);
 }
 function fetchWithTimeout(url, init, ms = 15e3) {
   const ac = new AbortController();
@@ -55,12 +60,9 @@ async function bearerFetch(url, init) {
     headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init.headers }
   });
 }
-function err(msg) {
+function errResult(msg) {
   return { content: [{ type: "text", text: msg }], isError: true };
 }
-function pendingResponse() {
-  return err("Agent not yet activated \u2014 owner confirmation pending. Retry in 60 seconds.");
-}
 var ALLOWED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var server = new Server(
   { name: "agent-authority", version: "1.0.0" },
@@ -93,22 +95,26 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params;
   if (name === "list_platforms") {
-    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") return pendingResponse();
+    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
+      return errResult("Agent not yet activated \u2014 owner confirmation pending. Retry in 60 seconds.");
+    }
     try {
       const res = await bearerFetch(`${PROXY_URL}/v1/agent/permissions`, { method: "GET", headers: {} });
       const body = await res.text();
-      if (!res.ok) return err(`Proxy error ${res.status}: ${body}`);
+      if (!res.ok) return errResult(`Proxy error ${res.status}: ${body}`);
       return { content: [{ type: "text", text: body }] };
     } catch (e) {
-      return err(`Network error: ${e instanceof Error ? e.message : e}`);
+      return errResult(`Error: ${e instanceof Error ? e.message : e}`);
     }
   }
   if (name === "use_platform") {
-    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") return pendingResponse();
+    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
+      return errResult("Agent not yet activated \u2014 owner confirmation pending. Retry in 60 seconds.");
+    }
     if (!args || typeof args.platform !== "string" || typeof args.endpoint !== "string" || typeof args.method !== "string" || typeof args.scope !== "string") {
-      return err("Missing required args: platform, endpoint, method, scope");
+      return errResult("Missing required args: platform, endpoint, method, scope");
     }
-    if (!ALLOWED_METHODS.includes(args.method)) return err(`Invalid method: ${args.method}`);
+    if (!ALLOWED_METHODS.includes(args.method)) return errResult(`Invalid method: ${args.method}`);
     try {
       const res = await bearerFetch(`${PROXY_URL}/v1/actions`, {
         method: "POST",
@@ -121,13 +127,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         })
       });
       const body = await res.text();
-      if (!res.ok) return err(`Proxy error ${res.status}: ${body}`);
+      if (!res.ok) return errResult(`Proxy error ${res.status}: ${body}`);
       return { content: [{ type: "text", text: body }] };
     } catch (e) {
-      return err(`Network error: ${e instanceof Error ? e.message : e}`);
+      return errResult(`Error: ${e instanceof Error ? e.message : e}`);
     }
   }
-  return err(`Unknown tool: ${name}`);
+  return errResult(`Unknown tool: ${name}`);
 });
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/register",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Self-register AI agents with AgentValet",
   "type": "module",
   "bin": {
@@ -11,7 +11,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
+    "build": "tsup src/index.ts --format esm --dts --clean --shims",
     "dev": "tsx src/index.ts",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
@@ -19,9 +19,12 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@octokit/auth-oauth-device": "^7.0.0",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
+    "conf": "^13.0.0",
     "jose": "^6.2.2",
+    "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
     "undici": "^6.0.0"