@agentvalet/register 0.4.11 → 0.4.13

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { createRequire } from "module";
 import { Command as Command5 } from "commander";
 import chalk12 from "chalk";
 
@@ -191,12 +192,26 @@ async function saveOutput(opts) {
 }
 
 // src/commands/refresh.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync, statSync } from "fs";
-import { createSign, createPrivateKey } from "crypto";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, statSync } from "fs";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 
+// src/lib/jwt.ts
+import { createSign, createPrivateKey } from "crypto";
+function signJwt(agentId, ownerId, privateKeyPem) {
+  const now = Math.floor(Date.now() / 1e3);
+  const b64 = (s) => Buffer.from(s).toString("base64url");
+  const header = b64(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64(
+    JSON.stringify({ agent_id: agentId, owner_id: ownerId, iat: now, exp: now + 300 })
+  );
+  const signingInput = `${header}.${payload}`;
+  const sign = createSign("RSA-SHA256");
+  sign.update(signingInput);
+  return `${signingInput}.${sign.sign(createPrivateKey(privateKeyPem), "base64url")}`;
+}
+
 // src/lib/skill-writer.ts
-import { existsSync, writeFileSync } from "fs";
+import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { execSync } from "child_process";
 import path from "path";
 import chalk2 from "chalk";
@@ -301,6 +316,11 @@ The \`.mcp.json\` in this directory has been configured. Run \`/mcp\` in Claude
     if (detected.openclaw) {
       lines.push(`### OpenClaw
 See \`SKILL.md\` for platform call instructions.`);
+    }
+    if (detected.factoryDroid) {
+      lines.push(`### Factory Droid
+\`~/.factory/mcp.json\` has been updated with the AgentValet MCP server block.
+Type \`@AgentValet\` in Factory Droid to activate governance. Use \`/av-status\` to verify connections.`);
     }
     if (lines.length === 0) {
       lines.push(`Add the MCP server to your IDE manually. See: https://docs.agentvalet.ai/setup`);
@@ -355,6 +375,203 @@ AGENT_PRIVATE_KEY_PATH=${keyPath}
   console.log(chalk2.green("  \u2713 AGENTVALET.md created \u2014 quick reference for this agent"));
   console.log(chalk2.dim("    Add to .gitignore if it contains sensitive paths"));
 }
+function writeFactoryDroidDroid() {
+  const droidsDir = path.join(process.cwd(), ".factory", "droids");
+  if (!existsSync(droidsDir)) mkdirSync(droidsDir, { recursive: true });
+  const dest = path.join(droidsDir, "agentvalet.yaml");
+  if (existsSync(dest)) {
+    console.log(chalk2.dim("  Factory Droid: .factory/droids/agentvalet.yaml already exists"));
+    return;
+  }
+  const content = `# AgentValet Governance Droid
+# Automatically created by @agentvalet/register
+# Commit this file to your repo
+
+name: AgentValet
+description: >
+  Routes all platform API calls through AgentValet's credential
+  proxy. Enforces per-agent permissions, rate limits, and human
+  approval for high-risk operations. Every call is logged.
+
+model: inherit
+
+mcp_servers:
+  - agentvalet
+
+autonomy: Low
+
+instructions: |
+  You are operating under AgentValet credential governance.
+
+  ## Rules \u2014 read before every platform call
+
+  1. NEVER call platform APIs (Slack, Stripe, Gmail, GitHub, etc.) directly.
+     Always use the \`use_platform\` MCP tool.
+
+  2. Call \`list_platforms\` at the start of any session that involves
+     platform calls. Do not assume platforms are available.
+
+  3. Call \`authzen_evaluate\` before any destructive operation
+     (delete, send, charge, publish). Do not proceed if decision=false.
+
+  4. If \`use_platform\` returns \`{ status: "pending_approval" }\`,
+     wait for human approval. Do not retry the call.
+
+  5. If AgentValet MCP tools are unavailable, stop and tell the user:
+     "AgentValet MCP is not connected. Run: npx @agentvalet/register"
+     Do not attempt platform calls without governance.
+
+  ## Making a platform call
+
+  \`\`\`
+  use_platform({
+    platform: "slack",
+    endpoint: "/api/chat.postMessage",
+    method: "POST",
+    scope: "slack:write",
+    data: { channel: "#general", text: "Hello" }
+  })
+  \`\`\`
+
+  ## Scope categories
+
+  - Read scopes (*.read, *.list) \u2014 lower risk, may auto-approve
+  - Write scopes (*.write, *.create) \u2014 check authzen_evaluate first
+  - Destructive scopes (*.delete, stripe:charge, mail:send) \u2014 always
+    call authzen_evaluate, always inform user before proceeding
+
+  Dashboard: https://app.agentvalet.ai
+  Docs: https://docs.agentvalet.ai
+`;
+  writeFileSync(dest, content, "utf8");
+  console.log(chalk2.green("  \u2713 Factory Droid: created .factory/droids/agentvalet.yaml"));
+  console.log(chalk2.dim("    Commit this file to your repo"));
+}
+function writeFactoryDroidCommand() {
+  const commandsDir = path.join(process.cwd(), ".factory", "commands");
+  if (!existsSync(commandsDir)) mkdirSync(commandsDir, { recursive: true });
+  const statusDest = path.join(commandsDir, "av-status.md");
+  if (!existsSync(statusDest)) {
+    const statusContent = `# /av-status
+
+Check your AgentValet agent status and approved platform connections.
+
+## Instructions for the droid
+
+1. Call \`list_platforms\` using the AgentValet MCP server
+2. Display the results in a clean table:
+   - Platform name
+   - Approved scopes
+   - Whether any scope requires human approval
+3. If no platforms are approved yet, tell the user to visit
+   https://app.agentvalet.ai/agents to configure permissions
+4. If AgentValet MCP is not connected, explain how to set it up:
+   Run: npx @agentvalet/register
+`;
+    writeFileSync(statusDest, statusContent, "utf8");
+    console.log(chalk2.green("  \u2713 Factory Droid: created .factory/commands/av-status.md"));
+  } else {
+    console.log(chalk2.dim("  Factory Droid: .factory/commands/av-status.md already exists"));
+  }
+  const registerDest = path.join(commandsDir, "av-register.md");
+  if (!existsSync(registerDest)) {
+    const registerContent = `# /av-register
+
+Register or re-register this project with AgentValet.
+
+## Instructions for the droid
+
+Tell the user to run the following command in their terminal:
+
+\`\`\`bash
+npx @agentvalet/register
+\`\`\`
+
+This will:
+1. Authenticate with GitHub (opens browser)
+2. Create or find their AgentValet account
+3. Register this machine as an agent
+4. Configure Factory Droid MCP integration automatically
+
+After running, approve the agent at: https://app.agentvalet.ai/agents
+`;
+    writeFileSync(registerDest, registerContent, "utf8");
+    console.log(chalk2.green("  \u2713 Factory Droid: created .factory/commands/av-register.md"));
+  }
+}
+function writeFactoryDroidReliabilityDroid() {
+  const droidsDir = path.join(process.cwd(), ".factory", "droids");
+  if (!existsSync(droidsDir)) mkdirSync(droidsDir, { recursive: true });
+  const dest = path.join(droidsDir, "agentvalet-reliability.yaml");
+  if (existsSync(dest)) return;
+  const content = `# AgentValet Reliability Droid
+# Monitors agent call patterns and surfaces governance issues
+# Commit this file to your repo
+
+name: AgentValet Reliability
+description: >
+  Monitors AI agent behaviour against AgentValet governance rules.
+  Surfaces approval-required actions, scope violations, rate limit
+  warnings, and audit anomalies directly in Factory Droid.
+
+type: reliability
+model: inherit
+mcp_servers:
+  - agentvalet
+autonomy: Low
+
+triggers:
+  - on_agent_action: true
+  - on_approval_required: true
+  - on_scope_violation: true
+
+instructions: |
+  You are a governance monitor. You observe what the other droids
+  are doing and flag any actions that require human oversight.
+
+  ## Your responsibilities
+
+  1. BEFORE any droid makes a platform API call, check if the scope
+     requires approval using \`authzen_evaluate\`:
+     - If decision=false: block the call, explain why, suggest alternatives
+     - If decision=true: allow, but log it
+
+  2. WHEN a droid calls \`use_platform\`, verify:
+     - The platform is in the approved list from \`list_platforms\`
+     - The scope matches what was approved
+     - The call hasn't exceeded rate limits
+
+  3. SURFACE approval-required actions clearly:
+     "\u26A0 This action requires human approval: [action description]
+      Waiting for approval at app.agentvalet.ai/approvals"
+
+  4. MONITOR for unusual patterns:
+     - Multiple calls to the same destructive scope in quick succession
+     - Calls to platforms not in the approved list
+     - Call volume spikes beyond normal operation
+
+  5. REPORT governance status when asked:
+     - Current approved platforms and scopes
+     - Pending approvals
+     - Recent audit log entries (call list_platforms + agent_status)
+
+  ## What you do NOT do
+
+  - You do not make platform API calls yourself
+  - You do not approve actions on behalf of the human
+  - You do not bypass governance even if another droid requests it
+
+  ## Escalation
+
+  If you detect a potential security concern (unexpected scope,
+  unusual call pattern), immediately tell the human:
+  "\u{1F534} Governance alert: [description]. Recommend reviewing at
+  app.agentvalet.ai/audit"
+`;
+  writeFileSync(dest, content, "utf8");
+  console.log(chalk2.green("  \u2713 Factory Droid: created .factory/droids/agentvalet-reliability.yaml"));
+  console.log(chalk2.dim("    Commit this file to your repo"));
+}
 function ensureMcpServer() {
   try {
     execSync("npx --yes @agentvalet/mcp-server --version", {
@@ -500,23 +717,10 @@ var CLAUDE_START = "<!-- agentvalet:start -->";
 var CLAUDE_END = "<!-- agentvalet:end -->";
 var HOOK_COMMAND = "npx @agentvalet/register refresh --if-stale --quiet 2>/dev/null || true";
 var HOOK_MARKER = "agentvalet/register refresh";
-function base64url(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function signJwt(agentId, ownerId, privateKeyPem) {
-  const now = Math.floor(Date.now() / 1e3);
-  const header = base64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
-  const payload = base64url(JSON.stringify({ agent_id: agentId, owner_id: ownerId, iat: now, exp: now + 300 }));
-  const signingInput = `${header}.${payload}`;
-  const sign = createSign("RSA-SHA256");
-  sign.update(signingInput);
-  const signature = sign.sign(createPrivateKey(privateKeyPem), "base64url");
-  return `${signingInput}.${signature}`;
-}
 function writePermissionsFromEvent(agentId, ownerId, platforms, outputPath = "./.claude/agentvalet-permissions.md") {
   const content = generatePermissionsFile(agentId, ownerId, platforms);
   const resolvedPath = resolve3(outputPath);
-  mkdirSync(dirname2(resolvedPath), { recursive: true });
+  mkdirSync2(dirname2(resolvedPath), { recursive: true });
   writeFileSync2(resolvedPath, content, "utf-8");
   embedInClaudeMd(content);
   ensureHook();
@@ -563,7 +767,7 @@ async function runRefresh(options) {
   const json = await res.json();
   const platforms = json.data?.platforms ?? [];
   const content = generatePermissionsFile(agentId, ownerId, platforms);
-  mkdirSync(dirname2(outputPath), { recursive: true });
+  mkdirSync2(dirname2(outputPath), { recursive: true });
   writeFileSync2(outputPath, content, "utf-8");
   embedInClaudeMd(content);
   ensureHook();
@@ -625,7 +829,7 @@ function ensureHook() {
     perms.allow = [...allow, ...missing];
     settings.permissions = perms;
   }
-  mkdirSync(dirname2(settingsPath), { recursive: true });
+  mkdirSync2(dirname2(settingsPath), { recursive: true });
   writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   ensureMcpJson();
 }
@@ -847,7 +1051,7 @@ function formatEnvBlock(vars) {
 }
 
 // src/config/ide.ts
-import { mkdir as mkdir3, writeFile as writeFile4, readFile as readFile2, appendFile as appendFile3 } from "fs/promises";
+import { mkdir as mkdir3, writeFile as writeFile4, readFile as readFile2, appendFile as appendFile3, copyFile } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import path4 from "path";
 import os from "os";
@@ -978,6 +1182,72 @@ async function writeIdeConfigs(params) {
       console.warn(`  Warning: could not write .cursor/mcp.json: ${err.message}`);
     }
   }
+  if (detected.factoryDroid) {
+    const fdResults = await writeFactoryDroidConfig(mcpParams);
+    written.push(...fdResults);
+  }
+  return written;
+}
+async function mergeFactoryDroidMcpJson(filePath, key, value) {
+  let existing = {};
+  if (existsSync5(filePath)) {
+    try {
+      const text = await readFile2(filePath, "utf8");
+      existing = JSON.parse(text);
+    } catch {
+      await copyFile(filePath, filePath + ".backup");
+    }
+  }
+  if (existing[key]) return;
+  existing[key] = value;
+  await writeFile4(filePath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+}
+async function updateGitignoreForFactoryDroid() {
+  const gitignorePath = path4.join(process.cwd(), ".gitignore");
+  if (!existsSync5(gitignorePath)) return;
+  const existing = await readFile2(gitignorePath, "utf8");
+  if (existing.includes(".factory/mcp.json")) return;
+  const additions = [
+    "",
+    "# Factory Droid \u2014 private key in MCP config",
+    ".factory/mcp.json",
+    "",
+    "# Factory Droid \u2014 commit these:",
+    "# .factory/droids/",
+    "# .factory/commands/"
+  ].join("\n");
+  await appendFile3(gitignorePath, additions + "\n", "utf8");
+}
+async function writeFactoryDroidConfig(params) {
+  const home = os.homedir();
+  const written = [];
+  const entry = buildMcpEntry(params);
+  const globalDir = path4.join(home, ".factory");
+  const projectDir = path4.join(process.cwd(), ".factory");
+  const globalDirExists = existsSync5(globalDir);
+  const projectDirExists = existsSync5(projectDir);
+  if (globalDirExists) {
+    try {
+      await mergeFactoryDroidMcpJson(path4.join(globalDir, "mcp.json"), "agentvalet", entry);
+      written.push("~/.factory/mcp.json");
+    } catch (err) {
+      console.warn(`  Warning: could not write ~/.factory/mcp.json: ${err.message}`);
+    }
+  }
+  if (projectDirExists && !globalDirExists) {
+    try {
+      await mergeFactoryDroidMcpJson(path4.join(projectDir, "mcp.json"), "agentvalet", entry);
+      written.push(".factory/mcp.json");
+    } catch (err) {
+      console.warn(`  Warning: could not write .factory/mcp.json: ${err.message}`);
+    }
+  }
+  if (written.length > 0) {
+    try {
+      await updateGitignoreForFactoryDroid();
+    } catch {
+    }
+  }
   return written;
 }
 
@@ -1015,7 +1285,8 @@ function detectFrameworks() {
     codex: existsSync6(path5.join(home, ".codex")) || tryBinary("codex"),
     claudeCode: existsSync6(path5.join(home, ".claude")) || tryBinary("claude"),
     cursor: existsSync6(path5.join(process.cwd(), ".cursor")) || cursorInstalled(),
-    openclaw: existsSync6(path5.join(home, ".openclaw"))
+    openclaw: existsSync6(path5.join(home, ".openclaw")),
+    factoryDroid: existsSync6(path5.join(home, ".factory")) || existsSync6(path5.join(process.cwd(), ".factory"))
   };
 }
 async function frameworkSetupConsent(detected) {
@@ -1034,6 +1305,11 @@ async function frameworkSetupConsent(detected) {
   if (detected.openclaw) {
     items.push("OpenClaw     \u2192 SKILL.md (usage rules)");
   }
+  if (detected.factoryDroid) {
+    items.push("Factory Droid \u2192 add MCP server to ~/.factory/mcp.json");
+    items.push("              \u2192 create .factory/droids/agentvalet.yaml");
+    items.push("              \u2192 create .factory/commands/av-status.md");
+  }
   if (items.length === 0) return false;
   console.log("");
   console.log(chalk6.bold("  Detected agent frameworks"));
@@ -1253,6 +1529,16 @@ async function registerAgentFlow(apiKey, ownerId) {
   }
   const detected = detectFrameworks();
   const shouldSetup = await frameworkSetupConsent(detected);
+  let installReliabilityDroid = false;
+  if (detected.factoryDroid && shouldSetup) {
+    const { reliability } = await prompts3({
+      type: "confirm",
+      name: "reliability",
+      message: "Also install AgentValet Reliability Droid for Factory Droid? (monitors agent governance)",
+      initial: false
+    });
+    installReliabilityDroid = reliability ?? false;
+  }
   if (shouldSetup) {
     console.log("");
     console.log(chalk7.bold("  Configuring agent frameworks..."));
@@ -1282,6 +1568,13 @@ async function registerAgentFlow(apiKey, ownerId) {
     if (detected.openclaw) {
       writeSkillMd();
     }
+    if (detected.factoryDroid) {
+      writeFactoryDroidDroid();
+      writeFactoryDroidCommand();
+      if (installReliabilityDroid) {
+        writeFactoryDroidReliabilityDroid();
+      }
+    }
     writeQuickstartDoc({
       agentId: agent.agent_id,
       ownerId,
@@ -1529,20 +1822,9 @@ import chalk11 from "chalk";
 import { existsSync as existsSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync3, rmSync } from "fs";
 import { resolve as resolve4, join as join3 } from "path";
 import { homedir as homedir2 } from "os";
-import { createSign as createSign2, createPrivateKey as createPrivateKey2 } from "crypto";
 var CLAUDE_START2 = "<!-- agentvalet:start -->";
 var CLAUDE_END2 = "<!-- agentvalet:end -->";
 var HOOK_MARKER2 = "agentvalet/register refresh";
-function signJwt2(agentId, ownerId, privateKeyPem) {
-  const now = Math.floor(Date.now() / 1e3);
-  const b64 = (s) => Buffer.from(s).toString("base64url");
-  const header = b64(JSON.stringify({ alg: "RS256", typ: "JWT" }));
-  const payload = b64(JSON.stringify({ agent_id: agentId, owner_id: ownerId, iat: now, exp: now + 300 }));
-  const signingInput = `${header}.${payload}`;
-  const sign = createSign2("RSA-SHA256");
-  sign.update(signingInput);
-  return `${signingInput}.${sign.sign(createPrivateKey2(privateKeyPem), "base64url")}`;
-}
 function stripClaudeMd() {
   const path7 = resolve4("CLAUDE.md");
   if (!existsSync7(path7)) return;
@@ -1718,7 +2000,7 @@ function uninstallCommand() {
     }
     console.log(chalk11.dim(`
   Submitting revocation request for ${creds.agentId}...`));
-    const jwt = signJwt2(creds.agentId, creds.ownerId, privateKeyPem);
+    const jwt = signJwt(creds.agentId, creds.ownerId, privateKeyPem);
     let revocationToken;
     try {
       const res = await fetch(`${creds.apiUrl}/v1/revoke-request`, {
@@ -1765,11 +2047,13 @@ function uninstallCommand() {
 }
 
 // src/index.ts
+var require2 = createRequire(import.meta.url);
+var { version } = require2("../package.json");
 function collectScope(value, previous) {
   return [...previous, value];
 }
 var program = new Command5();
-program.name("agentvalet-register").description("Self-register an AI agent with AgentValet").version("0.4.8").option("--owner <uuid>", "Owner ID (or set AGENTVALET_OWNER env var)").option("--name <name>", "Agent name").option("--description <desc>", "Agent description").option("--scope <platform:scope>", "Requested scope, repeatable", collectScope, []).option("--api-url <url>", "AgentValet API base URL", "https://api.agentvalet.ai").option("--output <path>", "Path to write .env file", "./.env.agentvalet").option("--key-path <path>", "Path to write private key", "./agentvalet.key").option("--json", "Machine-readable JSON output").option("--no-wait", "Register only, do not wait for approval").option("--timeout <seconds>", "Approval wait timeout in seconds", "300").action(async (opts) => {
+program.name("agentvalet-register").description("Self-register an AI agent with AgentValet").version(version).option("--owner <uuid>", "Owner ID (or set AGENTVALET_OWNER env var)").option("--name <name>", "Agent name").option("--description <desc>", "Agent description").option("--scope <platform:scope>", "Requested scope, repeatable", collectScope, []).option("--api-url <url>", "AgentValet API base URL", "https://api.agentvalet.ai").option("--output <path>", "Path to write .env file", "./.env.agentvalet").option("--key-path <path>", "Path to write private key", "./agentvalet.key").option("--json", "Machine-readable JSON output").option("--no-wait", "Register only, do not wait for approval").option("--timeout <seconds>", "Approval wait timeout in seconds", "300").action(async (opts) => {
   const isJson = !!opts.json;
   let ownerId = opts.owner ?? process.env.AGENTVALET_OWNER ?? "";
   let agentName = opts.name ?? "";
@@ -1940,7 +2224,8 @@ program.command("refresh").description("Refresh approved permissions and update
   }
 });
 program.command("mcp-server").description("Start the AgentValet MCP server (stdio transport)").action(async () => {
-  await import("./mcp-server-SBGWYBP7.js");
+  const { mcpServerCommand } = await import("./mcp-server-R3LG4PNM.js");
+  await mcpServerCommand();
 });
 program.addCommand(listCommand());
 program.addCommand(revokeCommand());

package/dist/mcp-server-R3LG4PNM.js

@@ -0,0 +1,46 @@
+// src/commands/mcp-server.ts
+import { spawn } from "child_process";
+import { createRequire } from "module";
+function resolveMcpServerBin() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    return require2.resolve("@agentvalet/mcp-server/dist/index.js");
+  } catch {
+    try {
+      const require2 = createRequire(import.meta.url);
+      const pkgRoot = require2.resolve("@agentvalet/mcp-server/package.json");
+      return pkgRoot.replace("package.json", "dist/index.js");
+    } catch {
+      throw new Error(
+        "@agentvalet/mcp-server is not installed. Run: npx @agentvalet/register"
+      );
+    }
+  }
+}
+async function mcpServerCommand() {
+  let binPath;
+  try {
+    binPath = resolveMcpServerBin();
+  } catch (err) {
+    process.stderr.write(
+      `[agentvalet] ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exit(1);
+  }
+  const child = spawn(process.execPath, [binPath], {
+    stdio: "inherit",
+    env: process.env
+  });
+  child.on("error", (err) => {
+    process.stderr.write(`[agentvalet] Failed to start MCP server: ${err.message}
+`);
+    process.exit(1);
+  });
+  child.on("exit", (code) => {
+    process.exit(code ?? 0);
+  });
+}
+export {
+  mcpServerCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/register",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Self-register AI agents with AgentValet",
   "type": "module",
   "bin": {
@@ -10,14 +10,8 @@
     "dist",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean --shims",
-    "dev": "tsx src/index.ts",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "pnpm build"
-  },
   "dependencies": {
+    "@agentvalet/mcp-server": "*",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@octokit/auth-oauth-device": "^7.0.0",
     "chalk": "^5.3.0",
@@ -54,5 +48,11 @@
     "valet",
     "agentvalet"
   ],
-  "license": "MIT"
-}
+  "license": "MIT",
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts --clean --shims",
+    "dev": "tsx src/index.ts",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/dist/mcp-server-SBGWYBP7.js

@@ -1,139 +0,0 @@
-// src/commands/mcp-server.ts
-import { readFileSync } from "fs";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { SignJWT, importPKCS8 } from "jose";
-if (!process.env.AGENT_PRIVATE_KEY && process.env.AGENT_PRIVATE_KEY_PATH) {
-  try {
-    process.env.AGENT_PRIVATE_KEY = readFileSync(process.env.AGENT_PRIVATE_KEY_PATH, "utf-8").trim();
-  } catch (err) {
-    process.stderr.write(`[agentvalet] Cannot read AGENT_PRIVATE_KEY_PATH: ${err instanceof Error ? err.message : err}
-`);
-    process.exit(1);
-  }
-}
-var REQUIRED = ["AGENT_PRIVATE_KEY", "AGENT_ID", "OWNER_ID", "PROXY_URL"];
-for (const key of REQUIRED) {
-  if (!process.env[key]) {
-    process.stderr.write(`[agentvalet] Missing env var: ${key}
-`);
-    process.exit(1);
-  }
-}
-var AGENT_PRIVATE_KEY_RAW = process.env.AGENT_PRIVATE_KEY;
-var AGENT_ID = process.env.AGENT_ID;
-var OWNER_ID = process.env.OWNER_ID;
-var PROXY_URL = process.env.PROXY_URL.replace(/\/$/, "");
-var _privateKey = null;
-var _keyError = null;
-async function getPrivateKey() {
-  if (_keyError) throw new Error(_keyError);
-  if (_privateKey) return _privateKey;
-  if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") return null;
-  const raw = AGENT_PRIVATE_KEY_RAW.trim();
-  const pem = raw.startsWith("-----") ? raw.replace(/\\n/g, "\n") : `-----BEGIN PRIVATE KEY-----
-${raw}
------END PRIVATE KEY-----`;
-  try {
-    _privateKey = await importPKCS8(pem, "RS256");
-    return _privateKey;
-  } catch (err) {
-    _keyError = `Invalid private key: ${err instanceof Error ? err.message : err}`;
-    throw new Error(_keyError);
-  }
-}
-async function signJWT() {
-  const key = await getPrivateKey();
-  if (!key) throw new Error("Private key not loaded");
-  return new SignJWT({ agent_id: AGENT_ID, owner_id: OWNER_ID }).setProtectedHeader({ alg: "RS256" }).setIssuedAt().setExpirationTime("60s").sign(key);
-}
-function fetchWithTimeout(url, init, ms = 15e3) {
-  const ac = new AbortController();
-  const t = setTimeout(() => ac.abort(), ms);
-  return fetch(url, { ...init, signal: ac.signal }).finally(() => clearTimeout(t));
-}
-async function bearerFetch(url, init) {
-  const token = await signJWT();
-  return fetchWithTimeout(url, {
-    ...init,
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init.headers }
-  });
-}
-function errResult(msg) {
-  return { content: [{ type: "text", text: msg }], isError: true };
-}
-var ALLOWED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-var server = new Server(
-  { name: "agentvalet", version: "1.0.0" },
-  { capabilities: { tools: {} } }
-);
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-  tools: [
-    {
-      name: "list_platforms",
-      description: "List the platforms and permission scopes this agent has access to.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "use_platform",
-      description: "Call an external platform API through the AgentValet proxy.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          platform: { type: "string", description: "Platform ID (e.g. slack, github)" },
-          endpoint: { type: "string", description: "API path on the target platform" },
-          method: { type: "string", enum: ["GET", "POST", "PUT", "PATCH", "DELETE"] },
-          scope: { type: "string", description: "Permission scope required" },
-          data: { type: "object", description: "Optional request body" }
-        },
-        required: ["platform", "endpoint", "method", "scope"]
-      }
-    }
-  ]
-}));
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-  const { name, arguments: args } = request.params;
-  if (name === "list_platforms") {
-    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
-      return errResult("Agent not yet activated \u2014 owner confirmation pending. Retry in 60 seconds.");
-    }
-    try {
-      const res = await bearerFetch(`${PROXY_URL}/v1/agent/permissions`, { method: "GET", headers: {} });
-      const body = await res.text();
-      if (!res.ok) return errResult(`Proxy error ${res.status}: ${body}`);
-      return { content: [{ type: "text", text: body }] };
-    } catch (e) {
-      return errResult(`Error: ${e instanceof Error ? e.message : e}`);
-    }
-  }
-  if (name === "use_platform") {
-    if (AGENT_PRIVATE_KEY_RAW === "PENDING_FIRST_CALL") {
-      return errResult("Agent not yet activated \u2014 owner confirmation pending. Retry in 60 seconds.");
-    }
-    if (!args || typeof args.platform !== "string" || typeof args.endpoint !== "string" || typeof args.method !== "string" || typeof args.scope !== "string") {
-      return errResult("Missing required args: platform, endpoint, method, scope");
-    }
-    if (!ALLOWED_METHODS.includes(args.method)) return errResult(`Invalid method: ${args.method}`);
-    try {
-      const res = await bearerFetch(`${PROXY_URL}/v1/actions`, {
-        method: "POST",
-        body: JSON.stringify({
-          platform: args.platform,
-          endpoint: args.endpoint,
-          method: args.method,
-          scope: args.scope,
-          ...args.data !== void 0 && { data: args.data }
-        })
-      });
-      const body = await res.text();
-      if (!res.ok) return errResult(`Proxy error ${res.status}: ${body}`);
-      return { content: [{ type: "text", text: body }] };
-    } catch (e) {
-      return errResult(`Error: ${e instanceof Error ? e.message : e}`);
-    }
-  }
-  return errResult(`Unknown tool: ${name}`);
-});
-var transport = new StdioServerTransport();
-await server.connect(transport);