@agentvalet/register 0.4.12 → 0.4.13

package/dist/index.js

@@ -192,7 +192,7 @@ async function saveOutput(opts) {
 }
 
 // src/commands/refresh.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync, statSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, statSync } from "fs";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 
 // src/lib/jwt.ts
@@ -211,7 +211,7 @@ function signJwt(agentId, ownerId, privateKeyPem) {
 }
 
 // src/lib/skill-writer.ts
-import { existsSync, writeFileSync } from "fs";
+import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { execSync } from "child_process";
 import path from "path";
 import chalk2 from "chalk";
@@ -316,6 +316,11 @@ The \`.mcp.json\` in this directory has been configured. Run \`/mcp\` in Claude
     if (detected.openclaw) {
       lines.push(`### OpenClaw
 See \`SKILL.md\` for platform call instructions.`);
+    }
+    if (detected.factoryDroid) {
+      lines.push(`### Factory Droid
+\`~/.factory/mcp.json\` has been updated with the AgentValet MCP server block.
+Type \`@AgentValet\` in Factory Droid to activate governance. Use \`/av-status\` to verify connections.`);
     }
     if (lines.length === 0) {
       lines.push(`Add the MCP server to your IDE manually. See: https://docs.agentvalet.ai/setup`);
@@ -370,6 +375,203 @@ AGENT_PRIVATE_KEY_PATH=${keyPath}
   console.log(chalk2.green("  \u2713 AGENTVALET.md created \u2014 quick reference for this agent"));
   console.log(chalk2.dim("    Add to .gitignore if it contains sensitive paths"));
 }
+function writeFactoryDroidDroid() {
+  const droidsDir = path.join(process.cwd(), ".factory", "droids");
+  if (!existsSync(droidsDir)) mkdirSync(droidsDir, { recursive: true });
+  const dest = path.join(droidsDir, "agentvalet.yaml");
+  if (existsSync(dest)) {
+    console.log(chalk2.dim("  Factory Droid: .factory/droids/agentvalet.yaml already exists"));
+    return;
+  }
+  const content = `# AgentValet Governance Droid
+# Automatically created by @agentvalet/register
+# Commit this file to your repo
+
+name: AgentValet
+description: >
+  Routes all platform API calls through AgentValet's credential
+  proxy. Enforces per-agent permissions, rate limits, and human
+  approval for high-risk operations. Every call is logged.
+
+model: inherit
+
+mcp_servers:
+  - agentvalet
+
+autonomy: Low
+
+instructions: |
+  You are operating under AgentValet credential governance.
+
+  ## Rules \u2014 read before every platform call
+
+  1. NEVER call platform APIs (Slack, Stripe, Gmail, GitHub, etc.) directly.
+     Always use the \`use_platform\` MCP tool.
+
+  2. Call \`list_platforms\` at the start of any session that involves
+     platform calls. Do not assume platforms are available.
+
+  3. Call \`authzen_evaluate\` before any destructive operation
+     (delete, send, charge, publish). Do not proceed if decision=false.
+
+  4. If \`use_platform\` returns \`{ status: "pending_approval" }\`,
+     wait for human approval. Do not retry the call.
+
+  5. If AgentValet MCP tools are unavailable, stop and tell the user:
+     "AgentValet MCP is not connected. Run: npx @agentvalet/register"
+     Do not attempt platform calls without governance.
+
+  ## Making a platform call
+
+  \`\`\`
+  use_platform({
+    platform: "slack",
+    endpoint: "/api/chat.postMessage",
+    method: "POST",
+    scope: "slack:write",
+    data: { channel: "#general", text: "Hello" }
+  })
+  \`\`\`
+
+  ## Scope categories
+
+  - Read scopes (*.read, *.list) \u2014 lower risk, may auto-approve
+  - Write scopes (*.write, *.create) \u2014 check authzen_evaluate first
+  - Destructive scopes (*.delete, stripe:charge, mail:send) \u2014 always
+    call authzen_evaluate, always inform user before proceeding
+
+  Dashboard: https://app.agentvalet.ai
+  Docs: https://docs.agentvalet.ai
+`;
+  writeFileSync(dest, content, "utf8");
+  console.log(chalk2.green("  \u2713 Factory Droid: created .factory/droids/agentvalet.yaml"));
+  console.log(chalk2.dim("    Commit this file to your repo"));
+}
+function writeFactoryDroidCommand() {
+  const commandsDir = path.join(process.cwd(), ".factory", "commands");
+  if (!existsSync(commandsDir)) mkdirSync(commandsDir, { recursive: true });
+  const statusDest = path.join(commandsDir, "av-status.md");
+  if (!existsSync(statusDest)) {
+    const statusContent = `# /av-status
+
+Check your AgentValet agent status and approved platform connections.
+
+## Instructions for the droid
+
+1. Call \`list_platforms\` using the AgentValet MCP server
+2. Display the results in a clean table:
+   - Platform name
+   - Approved scopes
+   - Whether any scope requires human approval
+3. If no platforms are approved yet, tell the user to visit
+   https://app.agentvalet.ai/agents to configure permissions
+4. If AgentValet MCP is not connected, explain how to set it up:
+   Run: npx @agentvalet/register
+`;
+    writeFileSync(statusDest, statusContent, "utf8");
+    console.log(chalk2.green("  \u2713 Factory Droid: created .factory/commands/av-status.md"));
+  } else {
+    console.log(chalk2.dim("  Factory Droid: .factory/commands/av-status.md already exists"));
+  }
+  const registerDest = path.join(commandsDir, "av-register.md");
+  if (!existsSync(registerDest)) {
+    const registerContent = `# /av-register
+
+Register or re-register this project with AgentValet.
+
+## Instructions for the droid
+
+Tell the user to run the following command in their terminal:
+
+\`\`\`bash
+npx @agentvalet/register
+\`\`\`
+
+This will:
+1. Authenticate with GitHub (opens browser)
+2. Create or find their AgentValet account
+3. Register this machine as an agent
+4. Configure Factory Droid MCP integration automatically
+
+After running, approve the agent at: https://app.agentvalet.ai/agents
+`;
+    writeFileSync(registerDest, registerContent, "utf8");
+    console.log(chalk2.green("  \u2713 Factory Droid: created .factory/commands/av-register.md"));
+  }
+}
+function writeFactoryDroidReliabilityDroid() {
+  const droidsDir = path.join(process.cwd(), ".factory", "droids");
+  if (!existsSync(droidsDir)) mkdirSync(droidsDir, { recursive: true });
+  const dest = path.join(droidsDir, "agentvalet-reliability.yaml");
+  if (existsSync(dest)) return;
+  const content = `# AgentValet Reliability Droid
+# Monitors agent call patterns and surfaces governance issues
+# Commit this file to your repo
+
+name: AgentValet Reliability
+description: >
+  Monitors AI agent behaviour against AgentValet governance rules.
+  Surfaces approval-required actions, scope violations, rate limit
+  warnings, and audit anomalies directly in Factory Droid.
+
+type: reliability
+model: inherit
+mcp_servers:
+  - agentvalet
+autonomy: Low
+
+triggers:
+  - on_agent_action: true
+  - on_approval_required: true
+  - on_scope_violation: true
+
+instructions: |
+  You are a governance monitor. You observe what the other droids
+  are doing and flag any actions that require human oversight.
+
+  ## Your responsibilities
+
+  1. BEFORE any droid makes a platform API call, check if the scope
+     requires approval using \`authzen_evaluate\`:
+     - If decision=false: block the call, explain why, suggest alternatives
+     - If decision=true: allow, but log it
+
+  2. WHEN a droid calls \`use_platform\`, verify:
+     - The platform is in the approved list from \`list_platforms\`
+     - The scope matches what was approved
+     - The call hasn't exceeded rate limits
+
+  3. SURFACE approval-required actions clearly:
+     "\u26A0 This action requires human approval: [action description]
+      Waiting for approval at app.agentvalet.ai/approvals"
+
+  4. MONITOR for unusual patterns:
+     - Multiple calls to the same destructive scope in quick succession
+     - Calls to platforms not in the approved list
+     - Call volume spikes beyond normal operation
+
+  5. REPORT governance status when asked:
+     - Current approved platforms and scopes
+     - Pending approvals
+     - Recent audit log entries (call list_platforms + agent_status)
+
+  ## What you do NOT do
+
+  - You do not make platform API calls yourself
+  - You do not approve actions on behalf of the human
+  - You do not bypass governance even if another droid requests it
+
+  ## Escalation
+
+  If you detect a potential security concern (unexpected scope,
+  unusual call pattern), immediately tell the human:
+  "\u{1F534} Governance alert: [description]. Recommend reviewing at
+  app.agentvalet.ai/audit"
+`;
+  writeFileSync(dest, content, "utf8");
+  console.log(chalk2.green("  \u2713 Factory Droid: created .factory/droids/agentvalet-reliability.yaml"));
+  console.log(chalk2.dim("    Commit this file to your repo"));
+}
 function ensureMcpServer() {
   try {
     execSync("npx --yes @agentvalet/mcp-server --version", {
@@ -518,7 +720,7 @@ var HOOK_MARKER = "agentvalet/register refresh";
 function writePermissionsFromEvent(agentId, ownerId, platforms, outputPath = "./.claude/agentvalet-permissions.md") {
   const content = generatePermissionsFile(agentId, ownerId, platforms);
   const resolvedPath = resolve3(outputPath);
-  mkdirSync(dirname2(resolvedPath), { recursive: true });
+  mkdirSync2(dirname2(resolvedPath), { recursive: true });
   writeFileSync2(resolvedPath, content, "utf-8");
   embedInClaudeMd(content);
   ensureHook();
@@ -565,7 +767,7 @@ async function runRefresh(options) {
   const json = await res.json();
   const platforms = json.data?.platforms ?? [];
   const content = generatePermissionsFile(agentId, ownerId, platforms);
-  mkdirSync(dirname2(outputPath), { recursive: true });
+  mkdirSync2(dirname2(outputPath), { recursive: true });
   writeFileSync2(outputPath, content, "utf-8");
   embedInClaudeMd(content);
   ensureHook();
@@ -627,7 +829,7 @@ function ensureHook() {
     perms.allow = [...allow, ...missing];
     settings.permissions = perms;
   }
-  mkdirSync(dirname2(settingsPath), { recursive: true });
+  mkdirSync2(dirname2(settingsPath), { recursive: true });
   writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   ensureMcpJson();
 }
@@ -849,7 +1051,7 @@ function formatEnvBlock(vars) {
 }
 
 // src/config/ide.ts
-import { mkdir as mkdir3, writeFile as writeFile4, readFile as readFile2, appendFile as appendFile3 } from "fs/promises";
+import { mkdir as mkdir3, writeFile as writeFile4, readFile as readFile2, appendFile as appendFile3, copyFile } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import path4 from "path";
 import os from "os";
@@ -980,6 +1182,72 @@ async function writeIdeConfigs(params) {
       console.warn(`  Warning: could not write .cursor/mcp.json: ${err.message}`);
     }
   }
+  if (detected.factoryDroid) {
+    const fdResults = await writeFactoryDroidConfig(mcpParams);
+    written.push(...fdResults);
+  }
+  return written;
+}
+async function mergeFactoryDroidMcpJson(filePath, key, value) {
+  let existing = {};
+  if (existsSync5(filePath)) {
+    try {
+      const text = await readFile2(filePath, "utf8");
+      existing = JSON.parse(text);
+    } catch {
+      await copyFile(filePath, filePath + ".backup");
+    }
+  }
+  if (existing[key]) return;
+  existing[key] = value;
+  await writeFile4(filePath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+}
+async function updateGitignoreForFactoryDroid() {
+  const gitignorePath = path4.join(process.cwd(), ".gitignore");
+  if (!existsSync5(gitignorePath)) return;
+  const existing = await readFile2(gitignorePath, "utf8");
+  if (existing.includes(".factory/mcp.json")) return;
+  const additions = [
+    "",
+    "# Factory Droid \u2014 private key in MCP config",
+    ".factory/mcp.json",
+    "",
+    "# Factory Droid \u2014 commit these:",
+    "# .factory/droids/",
+    "# .factory/commands/"
+  ].join("\n");
+  await appendFile3(gitignorePath, additions + "\n", "utf8");
+}
+async function writeFactoryDroidConfig(params) {
+  const home = os.homedir();
+  const written = [];
+  const entry = buildMcpEntry(params);
+  const globalDir = path4.join(home, ".factory");
+  const projectDir = path4.join(process.cwd(), ".factory");
+  const globalDirExists = existsSync5(globalDir);
+  const projectDirExists = existsSync5(projectDir);
+  if (globalDirExists) {
+    try {
+      await mergeFactoryDroidMcpJson(path4.join(globalDir, "mcp.json"), "agentvalet", entry);
+      written.push("~/.factory/mcp.json");
+    } catch (err) {
+      console.warn(`  Warning: could not write ~/.factory/mcp.json: ${err.message}`);
+    }
+  }
+  if (projectDirExists && !globalDirExists) {
+    try {
+      await mergeFactoryDroidMcpJson(path4.join(projectDir, "mcp.json"), "agentvalet", entry);
+      written.push(".factory/mcp.json");
+    } catch (err) {
+      console.warn(`  Warning: could not write .factory/mcp.json: ${err.message}`);
+    }
+  }
+  if (written.length > 0) {
+    try {
+      await updateGitignoreForFactoryDroid();
+    } catch {
+    }
+  }
   return written;
 }
 
@@ -1017,7 +1285,8 @@ function detectFrameworks() {
     codex: existsSync6(path5.join(home, ".codex")) || tryBinary("codex"),
     claudeCode: existsSync6(path5.join(home, ".claude")) || tryBinary("claude"),
     cursor: existsSync6(path5.join(process.cwd(), ".cursor")) || cursorInstalled(),
-    openclaw: existsSync6(path5.join(home, ".openclaw"))
+    openclaw: existsSync6(path5.join(home, ".openclaw")),
+    factoryDroid: existsSync6(path5.join(home, ".factory")) || existsSync6(path5.join(process.cwd(), ".factory"))
   };
 }
 async function frameworkSetupConsent(detected) {
@@ -1036,6 +1305,11 @@ async function frameworkSetupConsent(detected) {
   if (detected.openclaw) {
     items.push("OpenClaw     \u2192 SKILL.md (usage rules)");
   }
+  if (detected.factoryDroid) {
+    items.push("Factory Droid \u2192 add MCP server to ~/.factory/mcp.json");
+    items.push("              \u2192 create .factory/droids/agentvalet.yaml");
+    items.push("              \u2192 create .factory/commands/av-status.md");
+  }
   if (items.length === 0) return false;
   console.log("");
   console.log(chalk6.bold("  Detected agent frameworks"));
@@ -1255,6 +1529,16 @@ async function registerAgentFlow(apiKey, ownerId) {
   }
   const detected = detectFrameworks();
   const shouldSetup = await frameworkSetupConsent(detected);
+  let installReliabilityDroid = false;
+  if (detected.factoryDroid && shouldSetup) {
+    const { reliability } = await prompts3({
+      type: "confirm",
+      name: "reliability",
+      message: "Also install AgentValet Reliability Droid for Factory Droid? (monitors agent governance)",
+      initial: false
+    });
+    installReliabilityDroid = reliability ?? false;
+  }
   if (shouldSetup) {
     console.log("");
     console.log(chalk7.bold("  Configuring agent frameworks..."));
@@ -1284,6 +1568,13 @@ async function registerAgentFlow(apiKey, ownerId) {
     if (detected.openclaw) {
       writeSkillMd();
     }
+    if (detected.factoryDroid) {
+      writeFactoryDroidDroid();
+      writeFactoryDroidCommand();
+      if (installReliabilityDroid) {
+        writeFactoryDroidReliabilityDroid();
+      }
+    }
     writeQuickstartDoc({
       agentId: agent.agent_id,
       ownerId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/register",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "Self-register AI agents with AgentValet",
   "type": "module",
   "bin": {