@agentvalet/register 0.5.3 → 0.6.0

package/dist/index.js

@@ -10,8 +10,8 @@ import {
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
-import { Command as Command6 } from "commander";
-import chalk13 from "chalk";
+import { Command as Command7 } from "commander";
+import chalk14 from "chalk";
 
 // src/wizard.ts
 import prompts from "prompts";
@@ -196,7 +196,7 @@ async function saveOutput(opts) {
 }
 
 // src/commands/refresh.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, statSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync2, statSync } from "fs";
 import { dirname, resolve as resolve2 } from "path";
 
 // src/lib/jwt.ts
@@ -685,7 +685,115 @@ function tryResolveAgent(envFile = ".env.agentvalet") {
   return { agentId, ownerId, keyPath, apiUrl };
 }
 
+// src/config/frameworks.ts
+import { existsSync as existsSync3 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import os from "os";
+import path2 from "path";
+import prompts2 from "prompts";
+import chalk4 from "chalk";
+function tryBinary(cmd) {
+  try {
+    execSync2(`${cmd} --version`, { stdio: "ignore", timeout: 3e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function codexDesktopInstalled() {
+  const home = os.homedir();
+  const platform = process.platform;
+  if (platform === "darwin") {
+    return existsSync3("/Applications/Codex.app") || existsSync3(path2.join(home, "Applications", "Codex.app"));
+  }
+  if (platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA ?? path2.join(home, "AppData", "Local");
+    const programFiles = process.env["ProgramFiles"] ?? "C:\\Program Files";
+    return existsSync3(path2.join(localAppData, "Programs", "codex")) || existsSync3(path2.join(localAppData, "Programs", "Codex")) || existsSync3(path2.join(programFiles, "Codex"));
+  }
+  return existsSync3("/usr/share/applications/codex.desktop") || existsSync3(path2.join(home, ".local", "share", "applications", "codex.desktop"));
+}
+function cursorInstalled() {
+  const home = os.homedir();
+  const platform = process.platform;
+  if (platform === "win32") {
+    const appData = process.env.APPDATA ?? path2.join(home, "AppData", "Roaming");
+    const localAppData = process.env.LOCALAPPDATA ?? path2.join(home, "AppData", "Local");
+    return existsSync3(path2.join(appData, "Cursor")) || existsSync3(path2.join(localAppData, "Programs", "cursor"));
+  }
+  if (platform === "darwin") {
+    return existsSync3(path2.join(home, "Library", "Application Support", "Cursor")) || existsSync3("/Applications/Cursor.app");
+  }
+  return existsSync3(path2.join(home, ".config", "Cursor")) || existsSync3("/usr/share/applications/cursor.desktop");
+}
+function detectFrameworks() {
+  const home = os.homedir();
+  return {
+    codex: existsSync3(path2.join(home, ".codex")) || tryBinary("codex"),
+    codexDesktop: codexDesktopInstalled(),
+    claudeCode: existsSync3(path2.join(home, ".claude")) || tryBinary("claude"),
+    cursor: existsSync3(path2.join(process.cwd(), ".cursor")) || cursorInstalled(),
+    cursorCli: tryBinary("cursor-agent"),
+    openclaw: existsSync3(path2.join(home, ".openclaw")),
+    factoryDroid: existsSync3(path2.join(home, ".factory")) || existsSync3(path2.join(process.cwd(), ".factory"))
+  };
+}
+function resolveAgentType(detected) {
+  if (detected.claudeCode) return "claude-code";
+  if (detected.codexDesktop) return "codex-desktop";
+  if (detected.codex) return "codex-cli";
+  if (detected.cursor) return "cursor-ide";
+  if (detected.cursorCli) return "cursor-agent-cli";
+  if (detected.factoryDroid) return "factory-droid";
+  if (detected.openclaw) return "openclaw";
+  return "unknown";
+}
+async function frameworkSetupConsent(detected) {
+  const items = [];
+  if (detected.claudeCode) {
+    items.push("Claude Code  \u2192 .mcp.json (MCP server)");
+    items.push("             \u2192 CLAUDE.md (usage rules)");
+  }
+  if (detected.cursor || detected.cursorCli) {
+    const surfaces = [];
+    if (detected.cursor) surfaces.push("IDE");
+    if (detected.cursorCli) surfaces.push("cursor-agent CLI");
+    items.push(`Cursor (${surfaces.join(" + ")}) \u2192 .cursor/mcp.json (MCP server)`);
+  }
+  if (detected.codex || detected.codexDesktop) {
+    const surfaces = [];
+    if (detected.codex) surfaces.push("Codex CLI");
+    if (detected.codexDesktop) surfaces.push("Desktop app");
+    items.push(`Codex (${surfaces.join(" + ")}) \u2192 ~/.codex/config.toml (MCP server)`);
+    items.push("             \u2192 AGENTS.md (usage rules)");
+  }
+  if (detected.openclaw) {
+    items.push("OpenClaw     \u2192 SKILL.md (usage rules)");
+  }
+  if (detected.factoryDroid) {
+    items.push("Factory Droid \u2192 add MCP server to ~/.factory/mcp.json");
+    items.push("              \u2192 create .factory/droids/agentvalet.yaml");
+    items.push("              \u2192 create .factory/commands/av-status.md");
+  }
+  if (items.length === 0) return false;
+  console.log("");
+  console.log(chalk4.bold("  Detected agent frameworks"));
+  for (const item of items) {
+    console.log(chalk4.dim(`    ${item}`));
+  }
+  console.log("");
+  const { confirm } = await prompts2({
+    type: "confirm",
+    name: "confirm",
+    message: "Configure these automatically?",
+    initial: true
+  });
+  return confirm ?? false;
+}
+
 // src/commands/refresh.ts
+var PERMISSIONS_START = "<!-- agentvalet:permissions:start -->";
+var PERMISSIONS_END = "<!-- agentvalet:permissions:end -->";
 var CLAUDE_START = "<!-- agentvalet:start -->";
 var CLAUDE_END = "<!-- agentvalet:end -->";
 var HOOK_COMMAND = "npx @agentvalet/register refresh --if-stale --quiet 2>/dev/null || true";
@@ -705,7 +813,7 @@ async function runRefresh(options) {
       const stat = statSync(outputPath);
       const fileIsFresh = Date.now() - stat.mtimeMs < 36e5;
       const claudeMdPath = resolve2("CLAUDE.md");
-      const claudeMd = existsSync3(claudeMdPath) ? readFileSync3(claudeMdPath, "utf-8") : "";
+      const claudeMd = existsSync4(claudeMdPath) ? readFileSync3(claudeMdPath, "utf-8") : "";
       const blockStart = claudeMd.indexOf(CLAUDE_START);
       const blockEnd = claudeMd.indexOf(CLAUDE_END);
       const blockContent = blockStart !== -1 && blockEnd !== -1 ? claudeMd.slice(blockStart, blockEnd) : "";
@@ -715,7 +823,7 @@ async function runRefresh(options) {
     }
   }
   const creds = tryResolveAgent(options.envFile);
-  if (!creds || !existsSync3(resolve2(creds.keyPath))) {
+  if (!creds || !existsSync4(resolve2(creds.keyPath))) {
     console.error("  \u2717 No agent registered.\n  Run the following command first to register an agent in this directory:\n\n    npx @agentvalet/register\n");
     process.exit(1);
   }
@@ -744,8 +852,42 @@ async function runRefresh(options) {
   writeFileSync2(outputPath, content, "utf-8");
   embedInClaudeMd(content);
   ensureHook();
+  const detected = detectFrameworks();
+  const refreshed = [];
+  if (detected.codex || detected.codexDesktop) {
+    if (embedPermissionsBlock(resolve2("AGENTS.md"), content)) refreshed.push("AGENTS.md");
+  }
+  if (detected.openclaw) {
+    if (embedPermissionsBlock(resolve2("SKILL.md"), content)) refreshed.push("SKILL.md");
+  }
   if (!options.quiet) {
-    console.log(`Permissions refreshed \u2192 ${outputPath} (${platforms.length} platform${platforms.length !== 1 ? "s" : ""})`);
+    const extras = refreshed.length > 0 ? ` (also: ${refreshed.join(", ")})` : "";
+    console.log(`Permissions refreshed \u2192 ${outputPath} (${platforms.length} platform${platforms.length !== 1 ? "s" : ""})${extras}`);
+  }
+}
+function embedPermissionsBlock(filePath, permissionsContent) {
+  if (!existsSync4(filePath)) return false;
+  try {
+    const existing = readFileSync3(filePath, "utf-8");
+    const block = `${PERMISSIONS_START}
+${permissionsContent.trimEnd()}
+${PERMISSIONS_END}`;
+    let next;
+    if (existing.includes(PERMISSIONS_START)) {
+      next = existing.replace(
+        new RegExp(`${PERMISSIONS_START}[\\s\\S]*?${PERMISSIONS_END}`, "m"),
+        block
+      );
+    } else {
+      next = `${existing.trimEnd()}
+
+${block}
+`;
+    }
+    writeFileSync2(filePath, next, "utf-8");
+    return true;
+  } catch {
+    return false;
   }
 }
 function embedInClaudeMd(permissionsContent) {
@@ -753,7 +895,7 @@ function embedInClaudeMd(permissionsContent) {
   const block = `${CLAUDE_START}
 ${permissionsContent.trimEnd()}
 ${CLAUDE_END}`;
-  if (!existsSync3(claudeMdPath)) {
+  if (!existsSync4(claudeMdPath)) {
     writeFileSync2(claudeMdPath, `# Agent Instructions
 
 ${block}
@@ -778,7 +920,7 @@ ${block}
 function ensureHook() {
   const settingsPath = resolve2(".claude/settings.local.json");
   let settings = {};
-  if (existsSync3(settingsPath)) {
+  if (existsSync4(settingsPath)) {
     try {
       settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
     } catch {
@@ -809,7 +951,7 @@ function ensureHook() {
 function ensureMcpJson() {
   const mcpJsonPath = resolve2(".mcp.json");
   let mcpConfig = {};
-  if (existsSync3(mcpJsonPath)) {
+  if (existsSync4(mcpJsonPath)) {
     try {
       mcpConfig = JSON.parse(readFileSync3(mcpJsonPath, "utf-8"));
     } catch {
@@ -844,7 +986,7 @@ import prompts3 from "prompts";
 import { createServer } from "http";
 import { createRequire } from "module";
 import open from "open";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 var _require = createRequire(import.meta.url);
 var FUNCTIONS_URL = "https://jmodblrolfoavrxqgbps.supabase.co/functions/v1";
 var SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Imptb2RibHJvbGZvYXZyeHFnYnBzIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzQwODIzNzYsImV4cCI6MjA4OTY1ODM3Nn0.xQQiYHXbDsHyiTd5TsAfXtNWBUGkT4eO7Ew9UH8n6UE";
@@ -916,13 +1058,13 @@ async function browserLogin() {
     }, CALLBACK_TIMEOUT_MS);
   });
   const authUrl = `${APP_URL}/cli-auth?state=${state}&port=${port}`;
-  console.log(chalk4.dim(`
+  console.log(chalk5.dim(`
   Opening browser to authorize...`));
-  console.log(chalk4.dim(`  URL: ${authUrl}
+  console.log(chalk5.dim(`  URL: ${authUrl}
 `));
   await open(authUrl).catch(() => {
-    console.log(chalk4.yellow(`  Could not open browser automatically.`));
-    console.log(chalk4.yellow(`  Please open this URL in your browser:
+    console.log(chalk5.yellow(`  Could not open browser automatically.`));
+    console.log(chalk5.yellow(`  Please open this URL in your browser:
 `));
     console.log(`  ${authUrl}
 `);
@@ -976,12 +1118,12 @@ async function registerAgent2(params, apiKey) {
 
 // src/config/local.ts
 import { mkdir as mkdir2, writeFile as writeFile2, appendFile, readFile } from "fs/promises";
-import path2 from "path";
+import path3 from "path";
 async function writeLocalConfig(config) {
-  const dir = path2.join(process.cwd(), ".agentvalet");
+  const dir = path3.join(process.cwd(), ".agentvalet");
   await mkdir2(dir, { recursive: true });
   await writeFile2(
-    path2.join(dir, "config.json"),
+    path3.join(dir, "config.json"),
     JSON.stringify({
       agent_id: config.agentId,
       agent_name: config.agentName,
@@ -991,14 +1133,14 @@ async function writeLocalConfig(config) {
     { encoding: "utf8", mode: 384 }
   );
   await writeFile2(
-    path2.join(dir, "agent.key"),
+    path3.join(dir, "agent.key"),
     config.privateKeyPem,
     { encoding: "utf8", mode: 384 }
   );
   if (process.platform === "win32") {
     console.warn("  Note: file permissions (0o600) are not enforced on Windows. Keep .agentvalet/ in a secure location.");
   }
-  const gitignorePath = path2.join(process.cwd(), ".gitignore");
+  const gitignorePath = path3.join(process.cwd(), ".gitignore");
   const gitignoreContent = await readFile(gitignorePath, "utf8").catch(() => null);
   if (gitignoreContent !== null) {
     const lines = gitignoreContent.split("\n").map((l) => l.trim());
@@ -1009,22 +1151,22 @@ async function writeLocalConfig(config) {
 }
 
 // src/output/env.ts
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import { appendFile as appendFile2, writeFile as writeFile3 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import path3 from "path";
+import { existsSync as existsSync5 } from "fs";
+import path4 from "path";
 function formatEnvBlock(vars) {
   return Object.entries(vars).map(([key, value]) => {
     const truncated = value.length > 60 ? value.substring(0, 40) + "..." + value.substring(value.length - 10) : value;
-    return `  ${chalk5.dim(key + "=")}${chalk5.white(truncated)}`;
+    return `  ${chalk6.dim(key + "=")}${chalk6.white(truncated)}`;
   }).join("\n");
 }
 
 // src/config/ide.ts
 import { mkdir as mkdir3, writeFile as writeFile4, readFile as readFile2, appendFile as appendFile3, copyFile } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
-import path4 from "path";
-import os from "os";
+import { existsSync as existsSync6 } from "fs";
+import path5 from "path";
+import os2 from "os";
 function buildMcpEntry(params) {
   return {
     command: "npx",
@@ -1039,7 +1181,7 @@ function buildMcpEntry(params) {
 }
 async function mergeJsonFile(filePath, key, value) {
   let existing = {};
-  if (existsSync5(filePath)) {
+  if (existsSync6(filePath)) {
     try {
       const text = await readFile2(filePath, "utf8");
       existing = JSON.parse(text);
@@ -1093,31 +1235,52 @@ Tell the user: "AgentValet MCP is not connected. Run: npx @agentvalet/register"
 Dashboard: ${proxyUrl.replace("api.", "app.")}
 `;
 }
-async function writeGlobalFrameworkConfigs(params) {
-  const written = [];
-  const codexDir = path4.join(os.homedir(), ".codex");
-  const codexConfigPath = path4.join(codexDir, "config.toml");
-  if (existsSync5(codexDir)) {
-    try {
-      const existing = existsSync5(codexConfigPath) ? await readFile2(codexConfigPath, "utf8") : "";
-      if (!existing.includes("[mcp_servers.agentvalet]")) {
-        const addition = `
+function buildCodexTomlBlock(params) {
+  return `
 [mcp_servers.agentvalet]
 command = "npx"
 args = ["-y", "@agentvalet/register", "mcp-server"]
 env = { AGENT_ID = "${params.agentId}", OWNER_ID = "${params.ownerId}", PROXY_URL = "${params.proxyUrl}", AGENT_PRIVATE_KEY_PATH = "${params.keyPath.replace(/\\/g, "/")}" }
 `;
-        await appendFile3(codexConfigPath, addition, "utf8");
-        written.push("~/.codex/config.toml");
-      }
-    } catch (err) {
-      console.warn(`  Warning: could not write Codex CLI config: ${err.message}`);
+}
+async function appendCodexConfig(configPath) {
+  const dir = path5.dirname(configPath);
+  if (!existsSync6(dir)) await mkdir3(dir, { recursive: true });
+  const existing = existsSync6(configPath) ? await readFile2(configPath, "utf8") : "";
+  if (existing.includes("[mcp_servers.agentvalet]")) return false;
+  return true;
+}
+async function writeGlobalFrameworkConfigs(params) {
+  const written = [];
+  const codexDir = path5.join(os2.homedir(), ".codex");
+  const codexConfigPath = path5.join(codexDir, "config.toml");
+  try {
+    if (!existsSync6(codexDir)) await mkdir3(codexDir, { recursive: true });
+    if (await appendCodexConfig(codexConfigPath)) {
+      await appendFile3(codexConfigPath, buildCodexTomlBlock(params), "utf8");
+      written.push("~/.codex/config.toml");
+    }
+  } catch (err) {
+    console.warn(`  Warning: could not write Codex config: ${err.message}`);
+  }
+  return written;
+}
+async function writeCodexProjectConfig(params) {
+  const cwd = process.cwd();
+  const configPath = path5.join(cwd, ".codex", "config.toml");
+  const written = [];
+  try {
+    if (await appendCodexConfig(configPath)) {
+      await appendFile3(configPath, buildCodexTomlBlock(params), "utf8");
+      written.push(".codex/config.toml");
     }
+  } catch (err) {
+    console.warn(`  Warning: could not write .codex/config.toml: ${err.message}`);
   }
   return written;
 }
 async function stripAgentvaletFromMcpJson(filePath) {
-  if (!existsSync5(filePath)) return false;
+  if (!existsSync6(filePath)) return false;
   try {
     const text = await readFile2(filePath, "utf8");
     const config = JSON.parse(text);
@@ -1134,14 +1297,14 @@ async function stripAgentvaletFromMcpJson(filePath) {
 async function cleanProjectScopedEntries() {
   const cleaned = [];
   const cwd = process.cwd();
-  if (await stripAgentvaletFromMcpJson(path4.join(cwd, ".mcp.json"))) {
+  if (await stripAgentvaletFromMcpJson(path5.join(cwd, ".mcp.json"))) {
     cleaned.push(".mcp.json (project entry removed)");
   }
-  if (await stripAgentvaletFromMcpJson(path4.join(cwd, ".cursor/mcp.json"))) {
+  if (await stripAgentvaletFromMcpJson(path5.join(cwd, ".cursor/mcp.json"))) {
     cleaned.push(".cursor/mcp.json (project entry removed)");
   }
-  const factoryProjectMcp = path4.join(cwd, ".factory/mcp.json");
-  if (existsSync5(factoryProjectMcp)) {
+  const factoryProjectMcp = path5.join(cwd, ".factory/mcp.json");
+  if (existsSync6(factoryProjectMcp)) {
     try {
       const text = await readFile2(factoryProjectMcp, "utf8");
       const config = JSON.parse(text);
@@ -1158,12 +1321,12 @@ async function cleanProjectScopedEntries() {
 async function writeIdeConfigs(params) {
   const { detected, scope = "user", ...mcpParams } = params;
   const cwd = process.cwd();
-  const home = os.homedir();
+  const home = os2.homedir();
   const written = [];
   const entry = buildMcpEntry(mcpParams);
   if (scope === "user") {
     if (detected.claudeCode) {
-      const claudeUserConfig = path4.join(home, ".claude.json");
+      const claudeUserConfig = path5.join(home, ".claude.json");
       try {
         await mergeJsonFile(claudeUserConfig, "agentvalet", entry);
         written.push("~/.claude.json");
@@ -1171,9 +1334,9 @@ async function writeIdeConfigs(params) {
         console.warn(`  Warning: could not write ~/.claude.json: ${err.message}`);
       }
     }
-    if (detected.cursor) {
-      const cursorUserDir = path4.join(home, ".cursor");
-      const cursorUserMcp = path4.join(cursorUserDir, "mcp.json");
+    if (detected.cursor || detected.cursorCli) {
+      const cursorUserDir = path5.join(home, ".cursor");
+      const cursorUserMcp = path5.join(cursorUserDir, "mcp.json");
       try {
         await mkdir3(cursorUserDir, { recursive: true });
         await mergeJsonFile(cursorUserMcp, "agentvalet", entry);
@@ -1190,15 +1353,15 @@ async function writeIdeConfigs(params) {
     written.push(...cleaned);
   } else {
     if (detected.claudeCode) {
-      const claudeMcpPath = path4.join(cwd, ".mcp.json");
+      const claudeMcpPath = path5.join(cwd, ".mcp.json");
       try {
         await mergeJsonFile(claudeMcpPath, "agentvalet", entry);
         written.push(".mcp.json");
       } catch (err) {
         console.warn(`  Warning: could not write .mcp.json: ${err.message}`);
       }
-      const claudeMdPath = path4.join(cwd, "CLAUDE.md");
-      if (!existsSync5(claudeMdPath)) {
+      const claudeMdPath = path5.join(cwd, "CLAUDE.md");
+      if (!existsSync6(claudeMdPath)) {
         try {
           await writeFile4(claudeMdPath, buildClaudeMd(params.agentId, params.ownerId, params.proxyUrl), "utf8");
           written.push("CLAUDE.md");
@@ -1209,9 +1372,9 @@ async function writeIdeConfigs(params) {
         written.push("CLAUDE.md (already exists \u2014 skipped)");
       }
     }
-    if (detected.cursor) {
-      const cursorDir = path4.join(cwd, ".cursor");
-      const cursorMcpPath = path4.join(cursorDir, "mcp.json");
+    if (detected.cursor || detected.cursorCli) {
+      const cursorDir = path5.join(cwd, ".cursor");
+      const cursorMcpPath = path5.join(cursorDir, "mcp.json");
       try {
         await mkdir3(cursorDir, { recursive: true });
         await mergeJsonFile(cursorMcpPath, "agentvalet", entry);
@@ -1224,12 +1387,16 @@ async function writeIdeConfigs(params) {
       const fdResults = await writeFactoryDroidConfig({ ...mcpParams, scope: "project" });
       written.push(...fdResults);
     }
+    if (detected.codex || detected.codexDesktop) {
+      const codexResults = await writeCodexProjectConfig(mcpParams);
+      written.push(...codexResults);
+    }
   }
   return written;
 }
 async function mergeFactoryDroidMcpJson(filePath, key, value) {
   let existing = {};
-  if (existsSync5(filePath)) {
+  if (existsSync6(filePath)) {
     try {
       const text = await readFile2(filePath, "utf8");
       existing = JSON.parse(text);
@@ -1242,8 +1409,8 @@ async function mergeFactoryDroidMcpJson(filePath, key, value) {
   await writeFile4(filePath, JSON.stringify(existing, null, 2) + "\n", "utf8");
 }
 async function updateGitignoreForFactoryDroid() {
-  const gitignorePath = path4.join(process.cwd(), ".gitignore");
-  if (!existsSync5(gitignorePath)) return;
+  const gitignorePath = path5.join(process.cwd(), ".gitignore");
+  if (!existsSync6(gitignorePath)) return;
   const existing = await readFile2(gitignorePath, "utf8");
   if (existing.includes(".factory/mcp.json")) return;
   const additions = [
@@ -1258,16 +1425,16 @@ async function updateGitignoreForFactoryDroid() {
   await appendFile3(gitignorePath, additions + "\n", "utf8");
 }
 async function writeFactoryDroidConfig(params) {
-  const home = os.homedir();
+  const home = os2.homedir();
   const written = [];
   const entry = buildMcpEntry(params);
   const scope = params.scope ?? "user";
-  const globalDir = path4.join(home, ".factory");
-  const projectDir = path4.join(process.cwd(), ".factory");
+  const globalDir = path5.join(home, ".factory");
+  const projectDir = path5.join(process.cwd(), ".factory");
   if (scope === "user") {
     try {
       await mkdir3(globalDir, { recursive: true });
-      await mergeFactoryDroidMcpJson(path4.join(globalDir, "mcp.json"), "agentvalet", entry);
+      await mergeFactoryDroidMcpJson(path5.join(globalDir, "mcp.json"), "agentvalet", entry);
       written.push("~/.factory/mcp.json");
     } catch (err) {
       console.warn(`  Warning: could not write ~/.factory/mcp.json: ${err.message}`);
@@ -1275,7 +1442,7 @@ async function writeFactoryDroidConfig(params) {
   } else {
     try {
       await mkdir3(projectDir, { recursive: true });
-      await mergeFactoryDroidMcpJson(path4.join(projectDir, "mcp.json"), "agentvalet", entry);
+      await mergeFactoryDroidMcpJson(path5.join(projectDir, "mcp.json"), "agentvalet", entry);
       written.push(".factory/mcp.json");
     } catch (err) {
       console.warn(`  Warning: could not write .factory/mcp.json: ${err.message}`);
@@ -1288,81 +1455,6 @@ async function writeFactoryDroidConfig(params) {
   return written;
 }
 
-// src/config/frameworks.ts
-import { existsSync as existsSync6 } from "fs";
-import { execSync as execSync2 } from "child_process";
-import os2 from "os";
-import path5 from "path";
-import prompts2 from "prompts";
-import chalk6 from "chalk";
-function tryBinary(cmd) {
-  try {
-    execSync2(`${cmd} --version`, { stdio: "ignore", timeout: 3e3 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function cursorInstalled() {
-  const home = os2.homedir();
-  const platform = process.platform;
-  if (platform === "win32") {
-    const appData = process.env.APPDATA ?? path5.join(home, "AppData", "Roaming");
-    const localAppData = process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local");
-    return existsSync6(path5.join(appData, "Cursor")) || existsSync6(path5.join(localAppData, "Programs", "cursor"));
-  }
-  if (platform === "darwin") {
-    return existsSync6(path5.join(home, "Library", "Application Support", "Cursor")) || existsSync6("/Applications/Cursor.app");
-  }
-  return existsSync6(path5.join(home, ".config", "Cursor")) || existsSync6("/usr/share/applications/cursor.desktop");
-}
-function detectFrameworks() {
-  const home = os2.homedir();
-  return {
-    codex: existsSync6(path5.join(home, ".codex")) || tryBinary("codex"),
-    claudeCode: existsSync6(path5.join(home, ".claude")) || tryBinary("claude"),
-    cursor: existsSync6(path5.join(process.cwd(), ".cursor")) || cursorInstalled(),
-    openclaw: existsSync6(path5.join(home, ".openclaw")),
-    factoryDroid: existsSync6(path5.join(home, ".factory")) || existsSync6(path5.join(process.cwd(), ".factory"))
-  };
-}
-async function frameworkSetupConsent(detected) {
-  const items = [];
-  if (detected.claudeCode) {
-    items.push("Claude Code  \u2192 .mcp.json (MCP server)");
-    items.push("             \u2192 CLAUDE.md (usage rules)");
-  }
-  if (detected.cursor) {
-    items.push("Cursor       \u2192 .cursor/mcp.json (MCP server)");
-  }
-  if (detected.codex) {
-    items.push("Codex CLI    \u2192 ~/.codex/config.toml (MCP server)");
-    items.push("             \u2192 AGENTS.md (usage rules)");
-  }
-  if (detected.openclaw) {
-    items.push("OpenClaw     \u2192 SKILL.md (usage rules)");
-  }
-  if (detected.factoryDroid) {
-    items.push("Factory Droid \u2192 add MCP server to ~/.factory/mcp.json");
-    items.push("              \u2192 create .factory/droids/agentvalet.yaml");
-    items.push("              \u2192 create .factory/commands/av-status.md");
-  }
-  if (items.length === 0) return false;
-  console.log("");
-  console.log(chalk6.bold("  Detected agent frameworks"));
-  for (const item of items) {
-    console.log(chalk6.dim(`    ${item}`));
-  }
-  console.log("");
-  const { confirm } = await prompts2({
-    type: "confirm",
-    name: "confirm",
-    message: "Configure these automatically?",
-    initial: true
-  });
-  return confirm ?? false;
-}
-
 // src/commands/onboard.ts
 import os3 from "os";
 import path6 from "path";
@@ -1425,7 +1517,7 @@ async function runOnboard(opts = {}) {
 }
 async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
   const hostname = os3.hostname().split(".")[0];
-  const dirName = process.cwd().split("/").pop() ?? process.cwd().split("\\").pop() ?? "agent";
+  const dirName = path6.basename(process.cwd()) || "agent";
   let agentName;
   if (presetName) {
     agentName = presetName;
@@ -1443,13 +1535,16 @@ async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
     }
     agentName = answer.agentName;
   }
+  const detectedAtRegister = detectFrameworks();
+  const agentType = resolveAgentType(detectedAtRegister);
   const spinner = ora("  Registering agent...").start();
   let agent;
   try {
     agent = await registerAgent2({
       owner_id: ownerId,
       name: agentName.trim(),
-      source: "cli"
+      source: "cli",
+      agent_type: agentType
     }, apiKey);
     spinner.succeed(`  Agent registered: ${chalk7.bold(agent.agent_id)}`);
   } catch (err) {
@@ -1519,7 +1614,7 @@ async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
       console.log(chalk7.green(`  \u2713 ${r}`));
     }
     if (scope === "project") {
-      if (detected.codex) writeAgentsMd();
+      if (detected.codex || detected.codexDesktop) writeAgentsMd();
       if (detected.openclaw) writeSkillMd();
       if (detected.factoryDroid) {
         writeFactoryDroidDroid();
@@ -1564,9 +1659,11 @@ async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
     if (scope === "user") {
       const restartList = [];
       if (detected.claudeCode) restartList.push("Claude Code");
-      if (detected.cursor) restartList.push("Cursor");
+      if (detected.cursor) restartList.push("Cursor IDE");
+      if (detected.cursorCli) restartList.push("cursor-agent CLI (next session picks it up automatically)");
       if (detected.factoryDroid) restartList.push("Factory Droid");
       if (detected.codex) restartList.push("Codex CLI");
+      if (detected.codexDesktop) restartList.push('Codex Desktop app (approve "agentvalet" in Settings \u2192 MCP)');
       if (restartList.length > 0) {
         console.log(chalk7.dim("  Restart these to pick up the new MCP server (no trust prompt \u2014 user-scoped):"));
         for (const r of restartList) console.log(chalk7.dim(`      ${r}`));
@@ -1580,7 +1677,10 @@ async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
         console.log("");
       }
       if (detected.cursor) {
-        console.log(chalk7.dim("  Cursor: restart Cursor (or reopen the workspace) to pick up the MCP."));
+        console.log(chalk7.dim("  Cursor IDE: restart Cursor (or reopen the workspace) to pick up the MCP."));
+      }
+      if (detected.cursorCli) {
+        console.log(chalk7.dim("  cursor-agent CLI: next `cursor-agent` invocation will pick up the MCP \u2014 verify with `cursor-agent mcp list`."));
       }
       if (detected.factoryDroid) {
         console.log(chalk7.dim("  Factory Droid: restart Factory to pick up the MCP."));
@@ -1588,6 +1688,9 @@ async function registerAgentFlow(apiKey, ownerId, scope = "user", presetName) {
       if (detected.codex) {
         console.log(chalk7.dim("  Codex CLI: start a new codex session to pick up the MCP."));
       }
+      if (detected.codexDesktop) {
+        console.log(chalk7.dim('  Codex Desktop: trust this project, then approve "agentvalet" in Settings \u2192 MCP.'));
+      }
       console.log("");
     }
   }
@@ -1646,9 +1749,18 @@ function listCommand() {
   return new Command("list").description("List all registered agents").action(async () => {
     const config = getStoredConfig();
     if (!config.cliToken) {
-      process.stderr.write(
-        chalk8.red("\n  \u2717 No agent registered.\n") + chalk8.dim("  Run the following command first:\n\n    npx @agentvalet/register\n\n")
-      );
+      const creds = tryResolveAgent();
+      if (creds) {
+        process.stderr.write(
+          chalk8.red("\n  \u2717 CLI session not authenticated.\n") + chalk8.dim(
+            "  An agent is registered (" + creds.agentId + "), but `list` needs an\n  authenticated CLI session. Run `npx @agentvalet/register` to sign in,\n  or view your agents at:\n\n    " + creds.apiUrl.replace("api.", "app.") + "/agents\n\n"
+          )
+        );
+      } else {
+        process.stderr.write(
+          chalk8.red("\n  \u2717 No agent registered.\n") + chalk8.dim("  Run the following command first:\n\n    npx @agentvalet/register\n\n")
+        );
+      }
       process.exit(1);
     }
     try {
@@ -1673,141 +1785,32 @@ function listCommand() {
 }
 
 // src/commands/revoke.ts
-import { Command as Command2 } from "commander";
-import chalk9 from "chalk";
-import * as readline from "readline";
-function revokeCommand() {
-  return new Command2("revoke").description("Revoke an agent (cascades to all child agents)").requiredOption("--agent-id <agentId>", "Agent ID to revoke (agt_...)").action(async (opts) => {
-    const config = getStoredConfig();
-    if (!config.cliToken) {
-      process.stderr.write(
-        chalk9.red("\n  \u2717 No agent registered.\n") + chalk9.dim("  Run the following command first:\n\n    npx @agentvalet/register\n\n")
-      );
-      process.exit(1);
-    }
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const confirmed = await new Promise((resolve4) => {
-      rl.question(
-        chalk9.yellow(`Revoke ${opts.agentId}? This cascades to all child agents and cannot be undone. (y/N) `),
-        (ans) => {
-          rl.close();
-          resolve4(ans.trim().toLowerCase() === "y");
-        }
-      );
-    });
-    if (!confirmed) {
-      console.log("Cancelled.");
-      return;
-    }
-    try {
-      const result = await revokeAgent(opts.agentId);
-      console.log(chalk9.green(`Revoked ${result.revokedAgentIds.length} agent(s)`));
-      if (result.revokedAgentIds.length > 1) {
-        console.log("Revoked:", result.revokedAgentIds.join(", "));
-      }
-    } catch (err) {
-      console.error(chalk9.red(String(err)));
-      process.exit(1);
-    }
-  });
-}
-
-// src/commands/inject.ts
 import { Command as Command3 } from "commander";
 import chalk10 from "chalk";
-import { readFile as readFile5 } from "fs/promises";
-
-// src/lib/claude-config.ts
-import { homedir } from "os";
-import { join } from "path";
-import { readFile as readFile3, writeFile as writeFile6, mkdir as mkdir4, access } from "fs/promises";
-var CLAUDE_CONFIG_PATH = join(homedir(), ".claude", "config");
-async function writeKeyToClaudeConfig(agentId, privateKeyPem) {
-  let config = {};
-  try {
-    await access(CLAUDE_CONFIG_PATH);
-    const raw = await readFile3(CLAUDE_CONFIG_PATH, "utf-8");
-    config = JSON.parse(raw);
-  } catch {
-  }
-  config.agent_keys = config.agent_keys ?? {};
-  config.agent_keys[agentId] = Buffer.from(privateKeyPem).toString("base64");
-  await mkdir4(join(homedir(), ".claude"), { recursive: true });
-  await writeFile6(CLAUDE_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
-}
-
-// src/lib/env-writer.ts
-import { readFile as readFile4, writeFile as writeFile7, access as access2 } from "fs/promises";
-var ENV_VAR_NAME = (agentId) => `AGENTVALET_PRIVATE_KEY_${agentId.replace(/-/g, "_").toUpperCase()}`;
-async function writeKeyToEnvLocal(agentId, privateKeyPem) {
-  const varName = ENV_VAR_NAME(agentId);
-  const b64Key = Buffer.from(privateKeyPem).toString("base64");
-  const line = `
-# AgentValet private key for ${agentId} (base64-encoded PEM)
-${varName}=${b64Key}
-`;
-  let existing = "";
-  try {
-    await access2(".env.local");
-    existing = await readFile4(".env.local", "utf-8");
-  } catch {
-  }
-  if (existing.includes(varName)) {
-    const lines = existing.split("\n");
-    const filtered = lines.filter((l) => !l.startsWith(`${varName}=`));
-    await writeFile7(".env.local", filtered.join("\n") + line, "utf-8");
-  } else {
-    await writeFile7(".env.local", existing + line, "utf-8");
-  }
-}
-
-// src/commands/inject.ts
-function injectCommand() {
-  return new Command3("inject").description("Inject agent private key into Claude Code config or .env.local").requiredOption("--agent-id <agentId>", "Agent ID (agt_...)").requiredOption("--key-file <path>", "Path to the private key PEM file").option("--target <target>", "Injection target: claude-code or env-local", "claude-code").action(async (opts) => {
-    let privateKeyPem;
-    try {
-      privateKeyPem = await readFile5(opts.keyFile, "utf-8");
-    } catch {
-      console.error(chalk10.red(`Could not read key file: ${opts.keyFile}`));
-      process.exit(1);
-    }
-    if (!privateKeyPem.includes("BEGIN PRIVATE KEY")) {
-      console.error(chalk10.red("File does not appear to be a PEM private key"));
-      process.exit(1);
-    }
-    try {
-      if (opts.target === "claude-code") {
-        await writeKeyToClaudeConfig(opts.agentId, privateKeyPem);
-        console.log(chalk10.green("Key injected into ~/.claude/config"));
-      } else if (opts.target === "env-local") {
-        await writeKeyToEnvLocal(opts.agentId, privateKeyPem);
-        console.log(chalk10.green("Key appended to .env.local"));
-      } else {
-        console.error(chalk10.red(`Unknown target: ${opts.target}. Use 'claude-code' or 'env-local'`));
-        process.exit(1);
-      }
-    } catch (err) {
-      console.error(chalk10.red(String(err)));
-      process.exit(1);
-    }
-    if (opts.target === "env-local") {
-      console.log(chalk10.dim("Add .env.local to .gitignore \u2014 do not commit private keys to git."));
-    } else {
-      console.log(chalk10.dim("The key is stored in ~/.claude/config \u2014 it is NOT committed to git."));
-    }
-    console.log(chalk10.green("Done. Your agent is ready to use."));
-  });
-}
 
 // src/commands/uninstall.ts
-import { Command as Command4 } from "commander";
-import chalk11 from "chalk";
+import { Command as Command2 } from "commander";
+import chalk9 from "chalk";
 import { existsSync as existsSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync3, rmSync } from "fs";
-import { resolve as resolve3, join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { resolve as resolve3, join } from "path";
+import { homedir } from "os";
 var CLAUDE_START2 = "<!-- agentvalet:start -->";
 var CLAUDE_END2 = "<!-- agentvalet:end -->";
+var PERMISSIONS_START2 = "<!-- agentvalet:permissions:start -->";
+var PERMISSIONS_END2 = "<!-- agentvalet:permissions:end -->";
 var HOOK_MARKER2 = "agentvalet/register refresh";
+function stripPermissionsBlock(filePath) {
+  if (!existsSync7(filePath)) return false;
+  try {
+    const content = readFileSync4(filePath, "utf-8");
+    if (!content.includes(PERMISSIONS_START2)) return false;
+    const stripped = content.replace(new RegExp(`${PERMISSIONS_START2}[\\s\\S]*?${PERMISSIONS_END2}`, "m"), "").replace(/(\r?\n){3,}/g, "\n\n").trimEnd();
+    writeFileSync3(filePath, stripped + "\n", "utf-8");
+    return true;
+  } catch {
+    return false;
+  }
+}
 function stripClaudeMd() {
   const path8 = resolve3("CLAUDE.md");
   if (!existsSync7(path8)) return;
@@ -1862,17 +1865,16 @@ function stripMcpJson(filePath, options = {}) {
     return false;
   }
 }
-function stripCodexToml() {
-  const path8 = join2(homedir2(), ".codex", "config.toml");
-  if (!existsSync7(path8)) return false;
+function stripCodexTomlAt(filePath) {
+  if (!existsSync7(filePath)) return false;
   try {
-    const content = readFileSync4(path8, "utf-8");
+    const content = readFileSync4(filePath, "utf-8");
     if (!content.includes("[mcp_servers.agentvalet]")) return false;
     const stripped = content.replace(
       /\r?\n?\[mcp_servers\.agentvalet\][\s\S]*?(?=\r?\n\[|\r?\n*$)/,
       ""
     );
-    writeFileSync3(path8, stripped.replace(/(\r?\n){3,}/g, "\n\n").trimEnd() + "\n", "utf-8");
+    writeFileSync3(filePath, stripped.replace(/(\r?\n){3,}/g, "\n\n").trimEnd() + "\n", "utf-8");
     return true;
   } catch {
     return false;
@@ -1921,21 +1923,24 @@ function cleanLocally() {
   if (stripMcpJson(resolve3(".mcp.json"))) stripped.push(".mcp.json");
   if (stripMcpJson(resolve3(".cursor/mcp.json"))) stripped.push(".cursor/mcp.json");
   if (stripMcpJson(resolve3(".factory/mcp.json"), { wrapped: false })) stripped.push(".factory/mcp.json");
-  const home = homedir2();
-  if (stripMcpJson(join2(home, ".claude.json"))) stripped.push("~/.claude.json");
-  if (stripMcpJson(join2(home, ".cursor", "mcp.json"))) stripped.push("~/.cursor/mcp.json");
-  if (stripMcpJson(join2(home, ".factory", "mcp.json"), { wrapped: false })) stripped.push("~/.factory/mcp.json");
-  if (stripCodexToml()) stripped.push("~/.codex/config.toml");
+  const home = homedir();
+  if (stripMcpJson(join(home, ".claude.json"))) stripped.push("~/.claude.json");
+  if (stripMcpJson(join(home, ".cursor", "mcp.json"))) stripped.push("~/.cursor/mcp.json");
+  if (stripMcpJson(join(home, ".factory", "mcp.json"), { wrapped: false })) stripped.push("~/.factory/mcp.json");
+  if (stripCodexTomlAt(join(home, ".codex", "config.toml"))) stripped.push("~/.codex/config.toml");
+  if (stripCodexTomlAt(resolve3(".codex/config.toml"))) stripped.push(".codex/config.toml");
   stripClaudeMd();
   stripSettingsJson();
   stripped.push("CLAUDE.md", ".claude/settings.local.json");
+  if (stripPermissionsBlock(resolve3("AGENTS.md"))) stripped.push("AGENTS.md");
+  if (stripPermissionsBlock(resolve3("SKILL.md"))) stripped.push("SKILL.md");
   if (removed.length > 0) {
-    console.log(chalk11.green("  \u2713 Removed files:"));
-    for (const f of removed) console.log(chalk11.dim(`      ${f}`));
+    console.log(chalk9.green("  \u2713 Removed files:"));
+    for (const f of removed) console.log(chalk9.dim(`      ${f}`));
   }
   if (stripped.length > 0) {
-    console.log(chalk11.green("  \u2713 Stripped agentvalet entries from:"));
-    for (const f of stripped) console.log(chalk11.dim(`      ${f}`));
+    console.log(chalk9.green("  \u2713 Stripped agentvalet entries from:"));
+    for (const f of stripped) console.log(chalk9.dim(`      ${f}`));
   }
 }
 var SSE_READ_TIMEOUT_MS = 25e3;
@@ -2016,13 +2021,13 @@ async function pollForApproval(apiUrl, revocationToken, timeoutMs) {
   });
 }
 function uninstallCommand() {
-  return new Command4("uninstall").description("Request agent revocation (requires owner approval) and remove all local files").option("--local-only", "Skip the server-side revoke request \u2014 just clean local files").option("--timeout <seconds>", "Seconds to wait for owner approval", "300").action(async (opts) => {
+  return new Command2("uninstall").description("Request agent revocation (requires owner approval) and remove all local files").option("--local-only", "Skip the server-side revoke request \u2014 just clean local files").option("--timeout <seconds>", "Seconds to wait for owner approval", "300").action(async (opts) => {
     const timeoutMs = parseInt(opts.timeout, 10) * 1e3;
     const creds = tryResolveAgent();
     if (opts.localOnly || !creds) {
-      if (!creds) console.log(chalk11.dim("  No agent credentials found \u2014 cleaning local files only."));
+      if (!creds) console.log(chalk9.dim("  No agent credentials found \u2014 cleaning local files only."));
       cleanLocally();
-      console.log(chalk11.dim("\n  To register a new agent: npx @agentvalet/register"));
+      console.log(chalk9.dim("\n  To register a new agent: npx @agentvalet/register"));
       return;
     }
     let privateKeyPem;
@@ -2031,11 +2036,11 @@ function uninstallCommand() {
     } catch {
     }
     if (!privateKeyPem) {
-      console.log(chalk11.yellow("  \u26A0 Private key not found \u2014 cannot submit revocation request."));
-      console.log(chalk11.dim("  Use --local-only to clean local files without revoking."));
+      console.log(chalk9.yellow("  \u26A0 Private key not found \u2014 cannot submit revocation request."));
+      console.log(chalk9.dim("  Use --local-only to clean local files without revoking."));
       process.exit(1);
     }
-    console.log(chalk11.dim(`
+    console.log(chalk9.dim(`
   Submitting revocation request for ${creds.agentId}...`));
     const jwt = signJwt(creds.agentId, creds.ownerId, privateKeyPem);
     let revocationToken;
@@ -2047,9 +2052,9 @@ function uninstallCommand() {
       });
       const body = await res.json();
       if (res.status === 404 || res.status === 409) {
-        console.log(chalk11.yellow(`  \u26A0 Agent not found on server (already revoked?) \u2014 cleaning local files.`));
+        console.log(chalk9.yellow(`  \u26A0 Agent not found on server (already revoked?) \u2014 cleaning local files.`));
         cleanLocally();
-        console.log(chalk11.dim("\n  To register a new agent: npx @agentvalet/register"));
+        console.log(chalk9.dim("\n  To register a new agent: npx @agentvalet/register"));
         return;
       }
       if (!res.ok || !body.revocation_token) {
@@ -2057,34 +2062,229 @@ function uninstallCommand() {
       }
       revocationToken = body.revocation_token;
     } catch (err) {
-      console.error(chalk11.red(`  \u2717 Failed to submit revocation request: ${err instanceof Error ? err.message : err}`));
+      console.error(chalk9.red(`  \u2717 Failed to submit revocation request: ${err instanceof Error ? err.message : err}`));
       process.exit(1);
     }
-    console.log(chalk11.green("  \u2713 Revocation request submitted"));
+    console.log(chalk9.green("  \u2713 Revocation request submitted"));
     console.log("");
-    console.log(chalk11.yellow("  ACTION REQUIRED:"));
-    console.log(chalk11.yellow(`  Open ${creds.apiUrl.replace("api.", "app.")}/agents and approve the uninstall request.`));
-    console.log(chalk11.dim(`  Waiting up to ${opts.timeout}s for approval...
+    console.log(chalk9.yellow("  ACTION REQUIRED:"));
+    console.log(chalk9.yellow(`  Open ${creds.apiUrl.replace("api.", "app.")}/agents and approve the uninstall request.`));
+    console.log(chalk9.dim(`  Waiting up to ${opts.timeout}s for approval...
 `));
     const result = await pollForApproval(creds.apiUrl, revocationToken, timeoutMs);
     if (result === "rejected") {
-      console.log(chalk11.red("\n  \u2717 Owner rejected the uninstall request. Agent remains active."));
+      console.log(chalk9.red("\n  \u2717 Owner rejected the uninstall request. Agent remains active."));
       process.exit(1);
     }
     if (result === "timeout") {
-      console.log(chalk11.yellow("\n  \u26A0 Timed out waiting for owner approval."));
-      console.log(chalk11.dim("  The request remains pending in your dashboard. Run again to resume."));
+      console.log(chalk9.yellow("\n  \u26A0 Timed out waiting for owner approval."));
+      console.log(chalk9.dim("  The request remains pending in your dashboard. Run again to resume."));
       process.exit(1);
     }
-    console.log(chalk11.green("\n  \u2713 Approved \u2014 cleaning local files...\n"));
+    console.log(chalk9.green("\n  \u2713 Approved \u2014 cleaning local files...\n"));
     cleanLocally();
     console.log("");
-    console.log(chalk11.dim("  Agent revoked. To register a new agent: npx @agentvalet/register"));
+    console.log(chalk9.dim("  Agent revoked. To register a new agent: npx @agentvalet/register"));
+  });
+}
+
+// src/commands/revoke.ts
+import * as readline from "readline";
+function revokeCommand() {
+  return new Command3("revoke").description("Revoke an agent (cascades to all child agents) and clean local config").requiredOption("--agent-id <agentId>", "Agent ID to revoke (agt_...)").option("--keep-local", "Skip cleaning local MCP configs and key files after revoke").action(async (opts) => {
+    const config = getStoredConfig();
+    if (!config.cliToken) {
+      const creds = tryResolveAgent();
+      if (creds) {
+        process.stderr.write(
+          chalk10.red("\n  \u2717 CLI session not authenticated.\n") + chalk10.dim(
+            "  An agent is registered (" + creds.agentId + "), but `revoke` needs an\n  authenticated CLI session. Run `npx @agentvalet/register` to sign in,\n  or revoke from the dashboard:\n\n    " + creds.apiUrl.replace("api.", "app.") + "/agents\n\n"
+          )
+        );
+      } else {
+        process.stderr.write(
+          chalk10.red("\n  \u2717 No agent registered.\n") + chalk10.dim("  Run the following command first:\n\n    npx @agentvalet/register\n\n")
+        );
+      }
+      process.exit(1);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const confirmed = await new Promise((resolve4) => {
+      rl.question(
+        chalk10.yellow(`Revoke ${opts.agentId}? This cascades to all child agents and cannot be undone. (y/N) `),
+        (ans) => {
+          rl.close();
+          resolve4(ans.trim().toLowerCase() === "y");
+        }
+      );
+    });
+    if (!confirmed) {
+      console.log("Cancelled.");
+      return;
+    }
+    let revokedAgentIds = [];
+    try {
+      const result = await revokeAgent(opts.agentId);
+      revokedAgentIds = result.revokedAgentIds;
+      console.log(chalk10.green(`Revoked ${revokedAgentIds.length} agent(s)`));
+      if (revokedAgentIds.length > 1) {
+        console.log("Revoked:", revokedAgentIds.join(", "));
+      }
+    } catch (err) {
+      console.error(chalk10.red(String(err)));
+      process.exit(1);
+    }
+    if (!opts.keepLocal) {
+      const creds = tryResolveAgent();
+      if (creds && revokedAgentIds.includes(creds.agentId)) {
+        console.log("");
+        console.log(chalk10.dim("  Cleaning local config for revoked agent..."));
+        cleanLocally();
+      }
+    }
+  });
+}
+
+// src/commands/inject.ts
+import { Command as Command4 } from "commander";
+import chalk11 from "chalk";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+
+// src/lib/claude-config.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { readFile as readFile3, writeFile as writeFile6, mkdir as mkdir4, access } from "fs/promises";
+var CLAUDE_CONFIG_PATH = join2(homedir2(), ".claude", "config");
+async function writeKeyToClaudeConfig(agentId, privateKeyPem) {
+  let config = {};
+  try {
+    await access(CLAUDE_CONFIG_PATH);
+    const raw = await readFile3(CLAUDE_CONFIG_PATH, "utf-8");
+    config = JSON.parse(raw);
+  } catch {
+  }
+  config.agent_keys = config.agent_keys ?? {};
+  config.agent_keys[agentId] = Buffer.from(privateKeyPem).toString("base64");
+  await mkdir4(join2(homedir2(), ".claude"), { recursive: true });
+  await writeFile6(CLAUDE_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+}
+
+// src/lib/env-writer.ts
+import { readFile as readFile4, writeFile as writeFile7, access as access2 } from "fs/promises";
+var ENV_VAR_NAME = (agentId) => `AGENTVALET_PRIVATE_KEY_${agentId.replace(/-/g, "_").toUpperCase()}`;
+async function writeKeyToEnvLocal(agentId, privateKeyPem) {
+  const varName = ENV_VAR_NAME(agentId);
+  const b64Key = Buffer.from(privateKeyPem).toString("base64");
+  const line = `
+# AgentValet private key for ${agentId} (base64-encoded PEM)
+${varName}=${b64Key}
+`;
+  let existing = "";
+  try {
+    await access2(".env.local");
+    existing = await readFile4(".env.local", "utf-8");
+  } catch {
+  }
+  if (existing.includes(varName)) {
+    const lines = existing.split("\n");
+    const filtered = lines.filter((l) => !l.startsWith(`${varName}=`));
+    await writeFile7(".env.local", filtered.join("\n") + line, "utf-8");
+  } else {
+    await writeFile7(".env.local", existing + line, "utf-8");
+  }
+}
+
+// src/commands/inject.ts
+function injectCommand() {
+  return new Command4("inject").description("Import an existing PEM private key for an agent into the local store + framework configs").requiredOption("--agent-id <agentId>", "Agent ID (agt_...)").requiredOption("--key-file <path>", "Path to the private key PEM file").option("--owner-id <ownerId>", "Owner ID (required for --target agentvalet so the MCP server can authenticate)").option("--proxy-url <url>", "Proxy base URL", "https://api.agentvalet.ai").option(
+    "--target <target>",
+    "Where to write the key: agentvalet (default \u2014 modern store + MCP configs), env-local (.env.local), claude-legacy (~/.claude/config, deprecated)",
+    "agentvalet"
+  ).option("--no-frameworks", "Skip IDE/framework configuration prompts (only with --target agentvalet)").option("--project", "Write project-scoped framework configs instead of user-scoped").action(async (opts) => {
+    let privateKeyPem;
+    try {
+      privateKeyPem = await readFile5(opts.keyFile, "utf-8");
+    } catch {
+      console.error(chalk11.red(`Could not read key file: ${opts.keyFile}`));
+      process.exit(1);
+    }
+    if (!privateKeyPem.includes("BEGIN PRIVATE KEY")) {
+      console.error(chalk11.red("File does not appear to be a PEM private key"));
+      process.exit(1);
+    }
+    const target = opts.target === "claude-code" ? "claude-legacy" : opts.target;
+    try {
+      if (target === "agentvalet") {
+        if (!opts.ownerId) {
+          console.error(chalk11.red("--owner-id is required when target is 'agentvalet' (the MCP server needs it to authenticate)"));
+          console.error(chalk11.dim("  Find it at https://app.agentvalet.ai or in your existing ~/.agentvalet/config.json"));
+          process.exit(1);
+        }
+        await mkdir5(dirname2(AGENT_KEY_PATH), { recursive: true });
+        await writeFile8(AGENT_KEY_PATH, privateKeyPem, { mode: 384 });
+        saveConfig({
+          agentId: opts.agentId,
+          ownerId: opts.ownerId,
+          apiUrl: opts.proxyUrl,
+          proxyUrl: opts.proxyUrl,
+          keyPath: AGENT_KEY_PATH,
+          lastAgentId: opts.agentId,
+          lastKeyPath: AGENT_KEY_PATH
+        });
+        console.log(chalk11.green(`  \u2713 Key imported \u2192 ${AGENT_KEY_PATH}`));
+        console.log(chalk11.green(`  \u2713 Agent ID saved to ~/.agentvalet/config.json`));
+        if (opts.frameworks !== false) {
+          const detected = detectFrameworks();
+          const shouldSetup = await frameworkSetupConsent(detected);
+          if (shouldSetup) {
+            console.log("");
+            console.log(chalk11.bold("  Configuring agent frameworks..."));
+            console.log("");
+            const ideResults = await writeIdeConfigs({
+              agentId: opts.agentId,
+              ownerId: opts.ownerId,
+              proxyUrl: opts.proxyUrl,
+              keyPath: AGENT_KEY_PATH,
+              detected,
+              scope: opts.project ? "project" : "user"
+            });
+            for (const r of ideResults) console.log(chalk11.green(`  \u2713 ${r}`));
+            const globalResults = await writeGlobalFrameworkConfigs({
+              agentId: opts.agentId,
+              ownerId: opts.ownerId,
+              proxyUrl: opts.proxyUrl,
+              keyPath: AGENT_KEY_PATH
+            });
+            for (const r of globalResults) console.log(chalk11.green(`  \u2713 ${r}`));
+          }
+        }
+        console.log("");
+        console.log(chalk11.dim(`  ${AGENT_DIR}/ is excluded from git by convention \u2014 do not commit it.`));
+      } else if (target === "env-local") {
+        await writeKeyToEnvLocal(opts.agentId, privateKeyPem);
+        console.log(chalk11.green("  \u2713 Key appended to .env.local"));
+        console.log(chalk11.dim("  Add .env.local to .gitignore \u2014 do not commit private keys to git."));
+      } else if (target === "claude-legacy") {
+        console.warn(chalk11.yellow("  \u26A0 --target claude-legacy is deprecated."));
+        console.warn(chalk11.dim("    Modern Claude Code reads MCP configs from ~/.claude.json, not ~/.claude/config."));
+        console.warn(chalk11.dim("    Use --target agentvalet (default) instead."));
+        await writeKeyToClaudeConfig(opts.agentId, privateKeyPem);
+        console.log(chalk11.green("  \u2713 Key written to ~/.claude/config (legacy location)"));
+      } else {
+        console.error(chalk11.red(`Unknown target: ${opts.target}. Use 'agentvalet', 'env-local', or 'claude-legacy'.`));
+        process.exit(1);
+      }
+    } catch (err) {
+      console.error(chalk11.red(String(err)));
+      process.exit(1);
+    }
+    console.log(chalk11.green("\n  Done. Your agent is ready to use."));
   });
 }
 
 // src/commands/install.ts
-import { writeFile as writeFile8, mkdir as mkdir5 } from "fs/promises";
+import { writeFile as writeFile9, mkdir as mkdir6 } from "fs/promises";
 import path7 from "path";
 import { Command as Command5 } from "commander";
 import chalk12 from "chalk";
@@ -2134,8 +2334,8 @@ function installCommand() {
     }
     const { agent_id, agent_name, owner_id, private_key_pem, proxy_url } = claim;
     try {
-      await mkdir5(AGENT_DIR, { recursive: true });
-      await writeFile8(AGENT_KEY_PATH, private_key_pem, { mode: 384 });
+      await mkdir6(AGENT_DIR, { recursive: true });
+      await writeFile9(AGENT_KEY_PATH, private_key_pem, { mode: 384 });
     } catch (err) {
       console.error(chalk12.red(`
   \u2717 Failed to write key: ${err instanceof Error ? err.message : err}`));
@@ -2186,7 +2386,7 @@ function installCommand() {
         });
         for (const r of globalResults) console.log(chalk12.green(`  \u2713 ${r}`));
         if (scope === "project") {
-          if (detected.codex) writeAgentsMd();
+          if (detected.codex || detected.codexDesktop) writeAgentsMd();
           if (detected.openclaw) writeSkillMd();
           if (detected.factoryDroid) {
             writeFactoryDroidDroid();
@@ -2213,7 +2413,7 @@ function installCommand() {
         `AGENTVALET_PRIVATE_KEY_PATH=${AGENT_KEY_PATH}`,
         ""
       ].join("\n");
-      await writeFile8(path7.join(process.cwd(), ".env.agentvalet"), envContent, { encoding: "utf8", mode: 384 });
+      await writeFile9(path7.join(process.cwd(), ".env.agentvalet"), envContent, { encoding: "utf8", mode: 384 });
     } catch {
     }
     console.log("");
@@ -2228,9 +2428,11 @@ function installCommand() {
       if (scope === "user") {
         const restartList = [];
         if (detected.claudeCode) restartList.push("Claude Code");
-        if (detected.cursor) restartList.push("Cursor");
+        if (detected.cursor) restartList.push("Cursor IDE");
+        if (detected.cursorCli) restartList.push("cursor-agent CLI (next session picks it up automatically)");
         if (detected.factoryDroid) restartList.push("Factory Droid");
         if (detected.codex) restartList.push("Codex CLI");
+        if (detected.codexDesktop) restartList.push('Codex Desktop app (approve "agentvalet" in Settings \u2192 MCP)');
         if (restartList.length > 0) {
           console.log(chalk12.dim("  Restart these to pick up the new MCP server (no trust prompt \u2014 user-scoped):"));
           for (const r of restartList) console.log(chalk12.dim(`      ${r}`));
@@ -2244,7 +2446,10 @@ function installCommand() {
           console.log("");
         }
         if (detected.cursor) {
-          console.log(chalk12.dim("  Cursor: restart Cursor (or reopen the workspace) to pick up the MCP."));
+          console.log(chalk12.dim("  Cursor IDE: restart Cursor (or reopen the workspace) to pick up the MCP."));
+        }
+        if (detected.cursorCli) {
+          console.log(chalk12.dim("  cursor-agent CLI: next `cursor-agent` invocation will pick up the MCP \u2014 verify with `cursor-agent mcp list`."));
         }
         if (detected.factoryDroid) {
           console.log(chalk12.dim("  Factory Droid: restart Factory to pick up the MCP."));
@@ -2252,6 +2457,9 @@ function installCommand() {
         if (detected.codex) {
           console.log(chalk12.dim("  Codex CLI: start a new codex session to pick up the MCP."));
         }
+        if (detected.codexDesktop) {
+          console.log(chalk12.dim('  Codex Desktop: trust this project, then approve "agentvalet" in Settings \u2192 MCP.'));
+        }
       }
     }
     console.log(`  Dashboard: ${chalk12.cyan.underline("https://app.agentvalet.ai/agents/" + agent_id)}`);
@@ -2260,13 +2468,154 @@ function installCommand() {
   });
 }
 
+// src/commands/claim.ts
+import { Command as Command6 } from "commander";
+import { generateKeyPairSync } from "crypto";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, existsSync as existsSync8 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+import chalk13 from "chalk";
+var DEFAULT_PROXY_URL = "https://api.agentvalet.ai";
+function resolveAgentDir(label) {
+  const root = join3(homedir3(), ".agentvalet");
+  return label ? join3(root, label) : root;
+}
+function sanitiseLabel(label) {
+  return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+async function postBind(proxyUrl, bindSecret, publicKeyPem) {
+  const url = `${proxyUrl.replace(/\/$/, "")}/v1/invites/bind`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ bind_secret: bindSecret, public_key_pem: publicKeyPem })
+  });
+  if (!res.ok) {
+    let detail = `HTTP ${res.status}`;
+    try {
+      const body = await res.json();
+      if (body.error) detail = body.error;
+    } catch {
+    }
+    if (res.status === 410) {
+      throw new Error(
+        `Bind secret rejected (${detail}). It was either already used or expired \u2014 ask the inviting manager to re-issue.`
+      );
+    }
+    throw new Error(`Invite bind failed: ${detail}`);
+  }
+  return await res.json();
+}
+function claimCommand() {
+  return new Command6("claim").description("Bind an AgentValet agent from a one-shot invite secret").argument("<bind_secret>", "The bsec_\u2026 value shown on the AgentValet claim page").option("--label <name>", "Save under ~/.agentvalet/<label>/ for multi-agent machines").option("--api-url <url>", "AgentValet proxy URL", DEFAULT_PROXY_URL).option("--json", "Machine-readable JSON output").action(async (bindSecret, opts) => {
+    const isJson = !!opts.json;
+    const rawLabel = opts.label?.trim() ?? "";
+    const label = rawLabel ? sanitiseLabel(rawLabel) : null;
+    if (rawLabel && label !== rawLabel.toLowerCase()) {
+      if (!isJson) {
+        console.error(chalk13.yellow(`Note: label sanitised to "${label}"`));
+      }
+    }
+    if (!bindSecret.startsWith("bsec_")) {
+      const msg = "bind_secret should start with 'bsec_'";
+      console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(msg));
+      process.exit(3);
+    }
+    const agentDir = resolveAgentDir(label);
+    const keyPath = join3(agentDir, "agent.key");
+    const identityPath = join3(agentDir, "agent.json");
+    if (existsSync8(keyPath)) {
+      const msg = label ? `An agent already exists at ${keyPath}. Pick a different --label or remove the directory first.` : `A default agent already exists at ${keyPath}. Pass --label <name> to claim alongside it without overwriting.`;
+      console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(msg));
+      process.exit(3);
+    }
+    const proxyUrl = opts.apiUrl.replace(/\/$/, "");
+    const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+      modulusLength: 2048,
+      publicKeyEncoding: { type: "spki", format: "pem" },
+      privateKeyEncoding: { type: "pkcs8", format: "pem" }
+    });
+    let payload;
+    try {
+      payload = await postBind(proxyUrl, bindSecret, publicKey);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(msg));
+      process.exit(3);
+    }
+    if (!payload.agent_id || !payload.owner_id || !payload.proxy_url) {
+      const msg = "Bind succeeded but response was missing required fields";
+      console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(msg));
+      process.exit(3);
+    }
+    const identity = {
+      agent_id: payload.agent_id,
+      owner_id: payload.owner_id,
+      proxy_url: payload.proxy_url,
+      label,
+      bound_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    mkdirSync3(agentDir, { recursive: true, mode: 448 });
+    writeFileSync4(keyPath, privateKey, { mode: 384 });
+    writeFileSync4(identityPath, JSON.stringify(identity, null, 2));
+    const mcpServerName = label ? `agentvalet-${label}` : "agentvalet";
+    const mcpEnv = label ? {
+      AGENT_ID: payload.agent_id,
+      OWNER_ID: payload.owner_id,
+      PROXY_URL: payload.proxy_url,
+      AGENT_PRIVATE_KEY_PATH: keyPath
+    } : {
+      // For the default install, mcp-server picks up agent.key from
+      // ~/.agentvalet/ automatically — only PROXY_URL is needed.
+      PROXY_URL: payload.proxy_url
+    };
+    if (isJson) {
+      console.log(JSON.stringify({
+        status: "bound",
+        agent_id: payload.agent_id,
+        owner_id: payload.owner_id,
+        proxy_url: payload.proxy_url,
+        key_path: keyPath,
+        identity_path: identityPath,
+        label,
+        mcp_server_name: mcpServerName
+      }));
+      return;
+    }
+    console.log(chalk13.green(`
+\u2713 Bound as ${payload.agent_id}`));
+    console.log(chalk13.gray(`  owner:    ${payload.owner_id}`));
+    console.log(chalk13.gray(`  proxy:    ${payload.proxy_url}`));
+    console.log(chalk13.gray(`  key:      ${keyPath}`));
+    console.log(chalk13.gray(`  identity: ${identityPath}`));
+    console.log(chalk13.cyan("\nAdd this to your Claude Desktop / Claude Code MCP config:"));
+    const snippet = {
+      mcpServers: {
+        [mcpServerName]: {
+          command: "npx",
+          args: ["-y", "@agentvalet/mcp-server"],
+          env: mcpEnv
+        }
+      }
+    };
+    console.log(JSON.stringify(snippet, null, 2));
+    if (label) {
+      console.log(chalk13.gray(`
+Keep the named entry (${mcpServerName}) so it lives alongside any existing AgentValet agents on this machine.`));
+    } else {
+      console.log(chalk13.gray(`
+Or run 'agentvalet-register inject' to write this into ~/.claude.json automatically.`));
+    }
+  });
+}
+
 // src/index.ts
 var require2 = createRequire2(import.meta.url);
 var { version } = require2("../package.json");
 function collectScope(value, previous) {
   return [...previous, value];
 }
-var program = new Command6();
+var program = new Command7();
 program.name("agentvalet-register").description("Self-register an AI agent with AgentValet").version(version).option("--owner <uuid>", "Owner ID (or set AGENTVALET_OWNER env var)").option("--name <name>", "Agent name").option("--description <desc>", "Agent description").option("--scope <platform:scope>", "Requested scope, repeatable", collectScope, []).option("--api-url <url>", "AgentValet API base URL", "https://api.agentvalet.ai").option("--json", "Machine-readable JSON output").option("--no-wait", "Register only, do not wait for approval").option("--timeout <seconds>", "Approval wait timeout in seconds", "300").option("--project", "Write project-scoped MCP configs (.mcp.json, .cursor/mcp.json) instead of user-scoped (~/.claude.json, ~/.cursor/mcp.json)").action(async (opts) => {
   const isJson = !!opts.json;
   let ownerId = opts.owner ?? process.env.AGENTVALET_OWNER ?? "";
@@ -2300,7 +2649,7 @@ program.name("agentvalet-register").description("Self-register an AI agent with
       console.error(JSON.stringify({ error: "--owner or AGENTVALET_OWNER is required" }));
       process.exit(3);
     }
-    console.error(chalk13.red("Error: --owner or AGENTVALET_OWNER environment variable is required"));
+    console.error(chalk14.red("Error: --owner or AGENTVALET_OWNER environment variable is required"));
     process.exit(3);
   }
   const scopeMap = /* @__PURE__ */ new Map();
@@ -2308,7 +2657,7 @@ program.name("agentvalet-register").description("Self-register an AI agent with
     const colon = s.indexOf(":");
     if (colon === -1) {
       console.error(
-        isJson ? JSON.stringify({ error: `Invalid scope format: ${s} (expected platform:scope)` }) : chalk13.red(`Invalid scope format: ${s} (expected platform:scope)`)
+        isJson ? JSON.stringify({ error: `Invalid scope format: ${s} (expected platform:scope)` }) : chalk14.red(`Invalid scope format: ${s} (expected platform:scope)`)
       );
       process.exit(3);
     }
@@ -2331,11 +2680,11 @@ program.name("agentvalet-register").description("Self-register an AI agent with
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(`Registration failed: ${msg}`));
+    console.error(isJson ? JSON.stringify({ error: msg }) : chalk14.red(`Registration failed: ${msg}`));
     process.exit(3);
   }
   if (!isJson) {
-    console.log(chalk13.cyan(`
+    console.log(chalk14.cyan(`
 Approve at: https://app.agentvalet.ai/agents
 `));
   }
@@ -2343,7 +2692,7 @@ Approve at: https://app.agentvalet.ai/agents
     if (isJson) {
       console.log(JSON.stringify({ status: "pending", token }));
     } else {
-      console.log(chalk13.yellow("Registration submitted (--no-wait). Token:"), token);
+      console.log(chalk14.yellow("Registration submitted (--no-wait). Token:"), token);
     }
     process.exit(0);
   }
@@ -2354,14 +2703,14 @@ Approve at: https://app.agentvalet.ai/agents
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(`Wait failed: ${msg}`));
+    console.error(isJson ? JSON.stringify({ error: msg }) : chalk14.red(`Wait failed: ${msg}`));
     process.exit(3);
   }
   if (result.status === "rejected") {
     if (isJson) {
       console.log(JSON.stringify({ status: "rejected" }));
     } else {
-      console.log(chalk13.red("\nRegistration denied by owner."));
+      console.log(chalk14.red("\nRegistration denied by owner."));
     }
     process.exit(1);
   }
@@ -2369,7 +2718,7 @@ Approve at: https://app.agentvalet.ai/agents
     if (isJson) {
       console.log(JSON.stringify({ status: "timeout" }));
     } else {
-      console.log(chalk13.yellow("\nTimed out waiting for approval."));
+      console.log(chalk14.yellow("\nTimed out waiting for approval."));
     }
     process.exit(2);
   }
@@ -2387,7 +2736,7 @@ Approve at: https://app.agentvalet.ai/agents
       }));
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(isJson ? JSON.stringify({ error: msg }) : chalk13.red(`Failed to save output: ${msg}`));
+      console.error(isJson ? JSON.stringify({ error: msg }) : chalk14.red(`Failed to save output: ${msg}`));
       process.exit(3);
     }
   } else {
@@ -2397,25 +2746,25 @@ Approve at: https://app.agentvalet.ai/agents
   if (isJson) {
     console.log(JSON.stringify({ status: "approved", agentId, keyPath: keyWritten ? keyPath : null }));
   } else {
-    console.log(chalk13.green(`
+    console.log(chalk14.green(`
 Approved! Agent ID: ${agentId}`));
     if (keyWritten) {
-      console.log(chalk13.gray(`Key:  ${keyPath}`));
+      console.log(chalk14.gray(`Key:  ${keyPath}`));
     } else {
-      console.log(chalk13.yellow(`Key:  not written \u2014 copy it from the dashboard and paste into ${keyPath}`));
+      console.log(chalk14.yellow(`Key:  not written \u2014 copy it from the dashboard and paste into ${keyPath}`));
     }
   }
   if (keyWritten) {
     try {
       if (grantedPlatforms && grantedPlatforms.length > 0) {
         writePermissionsFromEvent(agentId, resolvedOwnerId, grantedPlatforms);
-        if (!isJson) console.log(chalk13.gray(`Permissions: .claude/agentvalet-permissions.md`));
+        if (!isJson) console.log(chalk14.gray(`Permissions: .claude/agentvalet-permissions.md`));
       } else {
         await runRefresh({ envFile: ".env.agentvalet", outputPath: ".claude/agentvalet-permissions.md", ifStale: false, quiet: isJson });
-        if (!isJson) console.log(chalk13.gray(`Permissions: .claude/agentvalet-permissions.md`));
+        if (!isJson) console.log(chalk14.gray(`Permissions: .claude/agentvalet-permissions.md`));
       }
     } catch {
-      if (!isJson) console.log(chalk13.yellow(`Permissions: run 'agentvalet-register refresh' to generate`));
+      if (!isJson) console.log(chalk14.yellow(`Permissions: run 'agentvalet-register refresh' to generate`));
     }
   }
   process.exit(0);
@@ -2430,7 +2779,7 @@ program.command("refresh").description("Refresh approved permissions and update
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(chalk13.red(`Refresh failed: ${msg}`));
+    console.error(chalk14.red(`Refresh failed: ${msg}`));
     process.exit(3);
   }
 });
@@ -2443,6 +2792,7 @@ program.addCommand(revokeCommand());
 program.addCommand(injectCommand());
 program.addCommand(uninstallCommand());
 program.addCommand(installCommand());
+program.addCommand(claimCommand());
 program.parseAsync().catch((err) => {
   console.error(err);
   process.exit(3);