@digitalpresence/cliclaw-auth 0.1.0 → 0.2.0

package/dist/oauth-client-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-manager.d.ts","sourceRoot":"","sources":["../src/oauth-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAE5D,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,gBAAgB;IACxB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,UAAU;IALpB,OAAO,CAAC,OAAO,CAAmC;gBAGxC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU;IAGhC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY;IAmBxC,YAAY,IAAI,YAAY;IAI5B,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GACpD,YAAY;IAcf,aAAa,IAAI,UAAU;IAI3B,YAAY,IAAI,MAAM,EAAE;CAGzB"}
+{"version":3,"file":"oauth-client-manager.d.ts","sourceRoot":"","sources":["../src/oauth-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAE5D,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,gBAAgB;IACxB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,UAAU;IALpB,OAAO,CAAC,OAAO,CAAmC;gBAGxC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,UAAU;IAGhC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY;IAmBxC,YAAY,IAAI,YAAY;IAI5B,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GACpD,YAAY;IAcf,aAAa,IAAI,UAAU;IAI3B,YAAY,IAAI,MAAM,EAAE;CAYzB"}

package/dist/oauth-client-manager.js

@@ -43,7 +43,16 @@ export class OAuthClientManager {
         return this.tokenStore;
     }
     listAccounts() {
-        return this.tokenStore.list();
+        const keys = this.tokenStore.list();
+        // Include both raw keys and bare account names (from integration:account format)
+        const accounts = new Set(keys);
+        for (const key of keys) {
+            const colonIdx = key.indexOf(":");
+            if (colonIdx !== -1) {
+                accounts.add(key.slice(colonIdx + 1));
+            }
+        }
+        return [...accounts];
     }
 }
 //# sourceMappingURL=oauth-client-manager.js.map

package/dist/oauth-client-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-manager.js","sourceRoot":"","sources":["../src/oauth-client-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKpD,MAAM,OAAO,kBAAkB;IAInB;IACA;IACA;IALF,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAElD,YACU,gBAAwB,EACxB,WAAmB,EACnB,UAAsB;QAFtB,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,gBAAW,GAAX,WAAW,CAAQ;QACnB,eAAU,GAAV,UAAU,CAAY;IAC7B,CAAC;IAEJ,SAAS,CAAC,OAAe;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,cAAc,CACZ,OAAe,EACf,MAAqD;QAErD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE9B,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"oauth-client-manager.js","sourceRoot":"","sources":["../src/oauth-client-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKpD,MAAM,OAAO,kBAAkB;IAInB;IACA;IACA;IALF,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAElD,YACU,gBAAwB,EACxB,WAAmB,EACnB,UAAsB;QAFtB,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,gBAAW,GAAX,WAAW,CAAQ;QACnB,eAAU,GAAV,UAAU,CAAY;IAC7B,CAAC;IAEJ,SAAS,CAAC,OAAe;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,cAAc,CACZ,OAAe,EACf,MAAqD;QAErD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE9B,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACpC,iFAAiF;QACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/scoped-client-manager.d.ts

@@ -1,15 +1,14 @@
 import { google } from "googleapis";
 import { OAuthClientManager } from "./oauth-client-manager.js";
 import { TokenStore } from "./token-store.js";
-import type { AgentPermission } from "./agent-store.js";
 type OAuth2Client = InstanceType<typeof google.auth.OAuth2>;
 export declare class PermissionDeniedError extends Error {
     constructor(integration: string, account: string);
 }
 export declare class ScopedClientManager {
     private inner;
-    private permissions;
-    constructor(inner: OAuthClientManager, permissions: AgentPermission[]);
+    private integrations;
+    constructor(inner: OAuthClientManager, integrations: string[]);
     private hasPermission;
     getClient(accountKey: string): OAuth2Client;
     listAccounts(): string[];

package/dist/scoped-client-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-client-manager.d.ts","sourceRoot":"","sources":["../src/scoped-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAE5D,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIjD;AAUD,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,WAAW;gBADX,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,eAAe,EAAE;IAGxC,OAAO,CAAC,aAAa;IAMrB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IAQ3C,YAAY,IAAI,MAAM,EAAE;IAOxB,aAAa,IAAI,UAAU;IAI3B,YAAY,IAAI,YAAY;IAI5B,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY;CAOrG"}
+{"version":3,"file":"scoped-client-manager.d.ts","sourceRoot":"","sources":["../src/scoped-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAE5D,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIjD;AAUD,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,YAAY;gBADZ,KAAK,EAAE,kBAAkB,EACzB,YAAY,EAAE,MAAM,EAAE;IAGhC,OAAO,CAAC,aAAa;IAIrB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IAQ3C,YAAY,IAAI,MAAM,EAAE;IAOxB,aAAa,IAAI,UAAU;IAI3B,YAAY,IAAI,YAAY;IAI5B,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY;CAOrG"}

package/dist/scoped-client-manager.js

@@ -13,25 +13,25 @@ function parseAccountKey(key) {
 }
 export class ScopedClientManager {
     inner;
-    permissions;
-    constructor(inner, permissions) {
+    integrations;
+    constructor(inner, integrations) {
         this.inner = inner;
-        this.permissions = permissions;
+        this.integrations = integrations;
     }
-    hasPermission(integration, account) {
-        return this.permissions.some((p) => p.integration === integration && p.account === account);
+    hasPermission(integration) {
+        return this.integrations.includes(integration);
     }
     getClient(accountKey) {
         const { integration, account } = parseAccountKey(accountKey);
-        if (!this.hasPermission(integration, account)) {
+        if (!this.hasPermission(integration)) {
             throw new PermissionDeniedError(integration, account);
         }
         return this.inner.getClient(accountKey);
     }
     listAccounts() {
         return this.inner.listAccounts().filter((key) => {
-            const { integration, account } = parseAccountKey(key);
-            return this.hasPermission(integration, account);
+            const { integration } = parseAccountKey(key);
+            return this.hasPermission(integration);
         });
     }
     getTokenStore() {
@@ -42,7 +42,7 @@ export class ScopedClientManager {
     }
     setCredentials(account, tokens) {
         const { integration, account: acct } = parseAccountKey(account);
-        if (!this.hasPermission(integration, acct)) {
+        if (!this.hasPermission(integration)) {
             throw new PermissionDeniedError(integration, acct);
         }
         return this.inner.setCredentials(account, tokens);

package/dist/scoped-client-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-client-manager.js","sourceRoot":"","sources":["../src/scoped-client-manager.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,WAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,sCAAsC,WAAW,IAAI,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,OAAO,mBAAmB;IAEpB;IACA;IAFV,YACU,KAAyB,EACzB,WAA8B;QAD9B,UAAK,GAAL,KAAK,CAAoB;QACzB,gBAAW,GAAX,WAAW,CAAmB;IACrC,CAAC;IAEI,aAAa,CAAC,WAAmB,EAAE,OAAe;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAC9D,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,UAAkB;QAC1B,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAC9C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAqD;QACnF,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"scoped-client-manager.js","sourceRoot":"","sources":["../src/scoped-client-manager.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,WAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,sCAAsC,WAAW,IAAI,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,OAAO,mBAAmB;IAEpB;IACA;IAFV,YACU,KAAyB,EACzB,YAAsB;QADtB,UAAK,GAAL,KAAK,CAAoB;QACzB,iBAAY,GAAZ,YAAY,CAAU;IAC7B,CAAC;IAEI,aAAa,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,UAAkB;QAC1B,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAC9C,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAqD;QACnF,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD,qBAAa,UAAU;IACT,OAAO,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEtC,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,IAAI;IAQZ,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAKxC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAM/C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAQhC,IAAI,IAAI,MAAM,EAAE;CAGjB"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD,qBAAa,UAAU;IACT,OAAO,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEtC,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,IAAI;IAQZ,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAaxC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAM/C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAmBhC,IAAI,IAAI,MAAM,EAAE;CAGjB"}

package/dist/token-store.js

@@ -25,7 +25,16 @@ export class TokenStore {
     }
     get(account) {
         const data = this.load();
-        return data[account] ?? null;
+        if (data[account])
+            return data[account];
+        // Fall back to integration:account key format (portal token injection)
+        for (const key of Object.keys(data)) {
+            const colonIdx = key.indexOf(":");
+            if (colonIdx !== -1 && key.slice(colonIdx + 1) === account) {
+                return data[key];
+            }
+        }
+        return null;
     }
     set(account, tokens) {
         const data = this.load();
@@ -37,11 +46,21 @@ export class TokenStore {
     }
     delete(account) {
         const data = this.load();
-        if (!(account in data))
-            return false;
-        delete data[account];
-        this.save(data);
-        return true;
+        if (account in data) {
+            delete data[account];
+            this.save(data);
+            return true;
+        }
+        // Try integration:account key format
+        for (const key of Object.keys(data)) {
+            const colonIdx = key.indexOf(":");
+            if (colonIdx !== -1 && key.slice(colonIdx + 1) === account) {
+                delete data[key];
+                this.save(data);
+                return true;
+            }
+        }
+        return false;
     }
     list() {
         return Object.keys(this.load());

package/dist/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,OAAO,UAAU;IACD;IAApB,YAAoB,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAElC,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAc,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAe;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,MAAmB;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,OAAO,UAAU;IACD;IAApB,YAAoB,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAElC,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAc,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAe;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,uEAAuE;QACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,MAAmB;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qCAAqC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitalpresence/cliclaw-auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/agent-store.ts

@@ -7,14 +7,12 @@ import {
   readdirSync,
   renameSync,
   statSync,
-  unlinkSync,
-  symlinkSync,
-  lstatSync,
 } from "fs";
 import { join } from "path";
-import { generateClaudeMd } from "./claude-md-generator.js";
+import { generateContextMd } from "./claude-md-generator.js";
 import { MemoryStore } from "./memory-store.js";
 
+/** @deprecated Use `integrations: string[]` on AgentConfig instead */
 export interface AgentPermission {
   integration: string;
   account: string;
@@ -23,9 +21,8 @@ export interface AgentPermission {
 export interface CronJobConfig {
   id: string;
   schedule: string;
-  task: string;
+  taskFile: string;           // relative path to markdown task description
   maxIterations: number;
-  completionPromise: string;
   enabled: boolean;
   createdAt: string;
 }
@@ -34,8 +31,7 @@ export interface AgentConfig {
   name: string;
   displayName: string;
   role: string;
-  permissions: AgentPermission[];
-  memory: string[];
+  integrations: string[];     // integration IDs (e.g. ["gmail", "gdrive"])
   cronJobs: CronJobConfig[];
   createdAt: string;
   updatedAt: string;
@@ -83,33 +79,25 @@ export class AgentStore {
     return join(this.agentsDir, name);
   }
 
-  /** Get or create a per-client workspace, symlinking shared agent files */
-  clientWorkspacePath(agentName: string, userId: string): string {
-    const clientDir = join(this.agentsDir, agentName, "clients", userId);
-    if (!existsSync(clientDir)) {
-      mkdirSync(clientDir, { recursive: true });
-    }
-
-    // Symlink shared agent files into the client workspace
-    const agentDir = this.workspacePath(agentName);
-    for (const file of ["CLAUDE.md", "SOUL.md", "ROLE.md"]) {
-      const target = join(agentDir, file);
-      const link = join(clientDir, file);
-      if (existsSync(target) && !existsSync(link)) {
-        symlinkSync(target, link);
-      }
-    }
-
-    return clientDir;
-  }
-
   get(name: string): AgentConfig | null {
     const path = this.filePath(name);
     if (!existsSync(path)) return null;
     try {
-      const config = JSON.parse(readFileSync(path, "utf-8")) as AgentConfig;
-      if (!config.cronJobs) config.cronJobs = [];
-      return config;
+      const raw = JSON.parse(readFileSync(path, "utf-8"));
+      // Migrate legacy formats
+      if (!raw.cronJobs) raw.cronJobs = [];
+      if (!raw.integrations) {
+        // Migrate from permissions[] → integrations[]
+        if (raw.permissions && Array.isArray(raw.permissions)) {
+          raw.integrations = [...new Set(raw.permissions.map((p: AgentPermission) => p.integration))];
+        } else {
+          raw.integrations = [];
+        }
+      }
+      // Drop legacy fields
+      delete raw.permissions;
+      delete raw.memory;
+      return raw as AgentConfig;
     } catch {
       return null;
     }
@@ -170,35 +158,25 @@ export class AgentStore {
     this.writeWorkspaceFiles(config, dir);
   }
 
-  /** Get or create a MemoryStore for an agent, auto-migrating legacy memory */
+  /** Get or create a MemoryStore for an agent */
   getMemoryStore(name: string): MemoryStore {
     let store = this.memoryStores.get(name);
     if (store) return store;
 
     const memoryDir = join(this.workspacePath(name), "memory");
     store = new MemoryStore(memoryDir);
-
-    // Lazy migration: move config.memory[] → JSONL
-    const config = this.get(name);
-    if (config && config.memory.length > 0) {
-      store.migrate(config.memory);
-      config.memory = [];
-      config.updatedAt = new Date().toISOString();
-      this.save(config);
-    }
-
     this.memoryStores.set(name, store);
     return store;
   }
 
-  /** Regenerate CLAUDE.md from current config */
-  regenerateClaudeMd(name: string): void {
+  /** Regenerate CONTEXT.md from current config */
+  regenerateContextMd(name: string): void {
     const config = this.get(name);
     if (!config) return;
     const dir = this.workspacePath(name);
     const memoryStore = this.getMemoryStore(name);
     const memories = memoryStore.list();
-    writeFileSync(join(dir, "CLAUDE.md"), generateClaudeMd(config, memories), "utf-8");
+    writeFileSync(join(dir, "CONTEXT.md"), generateContextMd(config, memories), "utf-8");
   }
 
   addCronJob(agentName: string, job: CronJobConfig): void {
@@ -207,7 +185,7 @@ export class AgentStore {
     config.cronJobs.push(job);
     config.updatedAt = new Date().toISOString();
     this.save(config);
-    this.regenerateClaudeMd(agentName);
+    this.regenerateContextMd(agentName);
   }
 
   removeCronJob(agentName: string, jobId: string): void {
@@ -218,7 +196,7 @@ export class AgentStore {
     config.cronJobs.splice(idx, 1);
     config.updatedAt = new Date().toISOString();
     this.save(config);
-    this.regenerateClaudeMd(agentName);
+    this.regenerateContextMd(agentName);
   }
 
   listCronJobs(agentName: string): CronJobConfig[] {
@@ -240,7 +218,7 @@ export class AgentStore {
   private writeWorkspaceFiles(config: AgentConfig, dir: string): void {
     const memoryStore = this.getMemoryStore(config.name);
     const memories = memoryStore.list();
-    writeFileSync(join(dir, "CLAUDE.md"), generateClaudeMd(config, memories), "utf-8");
+    writeFileSync(join(dir, "CONTEXT.md"), generateContextMd(config, memories), "utf-8");
 
     const soulPath = join(dir, "SOUL.md");
     if (!existsSync(soulPath)) {

package/src/claude-md-generator.ts

@@ -1,44 +1,73 @@
 import type { AgentConfig } from "./agent-store.js";
 import type { MemoryEntry } from "./memory-store.js";
 
-export function generateClaudeMd(config: AgentConfig, memories: MemoryEntry[] = []): string {
-  const { displayName, permissions } = config;
-
-  const hasPermissions = permissions.length > 0;
-
-  // Deduplicate integrations for the summary
-  const integrations = [...new Set(permissions.map((p) => p.integration))];
-
+/**
+ * Generates the universal ~/.cliclaw/CLAUDE.md shared by all agents.
+ * Contains safety rules, CLI usage patterns, memory instructions, and behavioral guidelines.
+ */
+export function generateUniversalClaudeMd(): string {
   const lines: string[] = [];
 
-  lines.push(`# ${displayName}`);
+  lines.push("# Agent Instructions");
   lines.push("");
-  lines.push("Read SOUL.md for your identity and personality.");
-  lines.push("Read ROLE.md for your capabilities and instructions.");
+  lines.push("Read SOUL.md, ROLE.md, and CONTEXT.md before doing anything.");
   lines.push("");
+
+  lines.push("## Safety Rules");
+  lines.push("- Never access files outside your workspace directory");
+  lines.push("- Never modify or read system files, environment files, or credentials outside your workspace");
+  lines.push("- Never attempt to escalate permissions or bypass security boundaries");
+  lines.push("- Never share credentials, tokens, or sensitive data in your responses");
+  lines.push("- If a task requires access you don't have, say so — don't try to work around it");
+  lines.push("");
+
   lines.push("## CLI Usage");
   lines.push("All integrations are accessed via the `cliclaw` CLI. Always pass `--account <account>` to specify which account to use.");
   lines.push("");
   lines.push("For detailed usage of any command, run:");
   lines.push("  `cliclaw <command> --help` or `cliclaw <command> <subcommand> --help`");
   lines.push("");
-  lines.push("## Permitted Integrations");
 
-  if (!hasPermissions) {
-    lines.push("No permissions granted yet.");
+  lines.push("## Memory");
+  lines.push("Save, search, and remove memories with `cliclaw agent memory --help`.");
+  lines.push("Your agent name is in CONTEXT.md — use it for all memory commands.");
+  lines.push("");
+  lines.push("### Memory Guidelines");
+  lines.push("- Save important facts, preferences, and context that will be useful across conversations");
+  lines.push("- Use descriptive tags to categorize memories for easy retrieval");
+  lines.push("- Search existing memories before adding duplicates");
+  lines.push("- Use importance levels: 1 (low), 2 (normal), 3 (critical)");
+  lines.push("");
+
+  lines.push("## General Guidelines");
+  lines.push("- Be concise and direct in responses");
+  lines.push("- When running CLI commands, check `--help` first if unsure about options");
+  lines.push("- When in a client workspace, read CLIENT_INTEGRATIONS.md for available account names");
+  lines.push("- If no CLIENT_INTEGRATIONS.md exists, use `--account default`");
+
+  return lines.join("\n");
+}
+
+/**
+ * Generates per-instance CONTEXT.md with agent-specific context:
+ * name, integrations, cron schedules, and current memories.
+ */
+export function generateContextMd(config: AgentConfig, memories: MemoryEntry[] = []): string {
+  const lines: string[] = [];
+
+  lines.push(`# ${config.displayName} — Context`);
+  lines.push("");
+  lines.push(`Agent name: \`${config.name}\``);
+  lines.push("");
+
+  lines.push("## Permitted Integrations");
+  if (config.integrations.length === 0) {
+    lines.push("No integrations configured.");
   } else {
-    for (const perm of permissions) {
-      lines.push(`- **${perm.integration}** — account: \`${perm.account}\``);
+    for (const integration of config.integrations) {
+      lines.push(`- \`cliclaw ${integration}\``);
     }
-    lines.push("");
-    lines.push("IMPORTANT: ONLY access accounts listed above.");
-    lines.push("");
-    lines.push("Available integrations: " + integrations.map((i) => `\`cliclaw ${i}\``).join(", "));
   }
-
-  lines.push("");
-  lines.push("## Memory");
-  lines.push(`Save, search, and remove memories with \`cliclaw agent memory --help\`. Your agent name is \`${config.name}\`.`);
   lines.push("");
 
   if (config.cronJobs && config.cronJobs.length > 0) {
@@ -47,17 +76,17 @@ export function generateClaudeMd(config: AgentConfig, memories: MemoryEntry[] =
     for (const job of config.cronJobs) {
       const status = job.enabled ? "enabled" : "disabled";
       lines.push(`- **${job.id}** (${status}): \`${job.schedule}\``);
-      lines.push(`  Task: ${job.task}`);
-      lines.push(`  Completion word: ${job.completionPromise} | Max iterations: ${job.maxIterations}`);
+      lines.push(`  Task file: ${job.taskFile}`);
+      lines.push(`  Max iterations: ${job.maxIterations}`);
     }
     lines.push("");
   }
 
   if (memories.length === 0) {
-    lines.push("### Current Memories");
+    lines.push("## Current Memories");
     lines.push("No memories yet.");
   } else {
-    lines.push("### Current Memories");
+    lines.push("## Current Memories");
 
     let displayMemories: MemoryEntry[];
     let truncated = false;
@@ -65,7 +94,6 @@ export function generateClaudeMd(config: AgentConfig, memories: MemoryEntry[] =
     if (memories.length > 50) {
       const critical = memories.filter((m) => m.importance === 3);
       const recent = memories.slice(-30);
-      // Merge critical + recent, deduplicate by id
       const seen = new Set<string>();
       displayMemories = [];
       for (const m of [...critical, ...recent]) {

package/src/config.ts

@@ -22,6 +22,10 @@ export function getAgentsDir(): string {
   return join(CONFIG_DIR, "agents");
 }
 
+export function getInstancesDir(): string {
+  return join(CONFIG_DIR, "instances");
+}
+
 export function loadConfig(): CliclawConfig {
   if (!existsSync(CONFIG_DIR)) {
     mkdirSync(CONFIG_DIR, { recursive: true });

package/src/index.ts

@@ -2,6 +2,7 @@ export { TokenStore } from "./token-store.js";
 export { OAuthClientManager } from "./oauth-client-manager.js";
 export { AgentStore } from "./agent-store.js";
 export type { AgentConfig, AgentPermission, CronJobConfig } from "./agent-store.js";
+export { getInstancesDir } from "./config.js";
 export { ScopedClientManager, PermissionDeniedError } from "./scoped-client-manager.js";
 export { createOAuthClient, getAuthUrl } from "./gmail-auth.js";
 export { createGDriveOAuthClient, getGDriveAuthUrl } from "./gdrive-auth.js";
@@ -14,6 +15,7 @@ export { loadConfig, getConfigDir, getTokensPath, getAgentsDir } from "./config.
 export { INTEGRATIONS } from "./integration-registry.js";
 export type { IntegrationDef } from "./integration-registry.js";
 export type { CliclawConfig } from "./config.js";
-export { generateClaudeMd } from "./claude-md-generator.js";
+export { generateUniversalClaudeMd, generateContextMd } from "./claude-md-generator.js";
+export { InstanceStore } from "./instance-store.js";
 export { MemoryStore } from "./memory-store.js";
 export type { MemoryEntry } from "./memory-store.js";

package/src/instance-store.ts

@@ -0,0 +1,149 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  cpSync,
+  rmSync,
+  readdirSync,
+  statSync,
+} from "fs";
+import { join } from "path";
+import { AgentStore } from "./agent-store.js";
+import { generateUniversalClaudeMd, generateContextMd } from "./claude-md-generator.js";
+import { MemoryStore } from "./memory-store.js";
+import { getConfigDir } from "./config.js";
+
+export class InstanceStore {
+  constructor(
+    private instancesDir: string,
+    private agentStore: AgentStore,
+  ) {}
+
+  private ensureDir(path: string): void {
+    if (!existsSync(path)) {
+      mkdirSync(path, { recursive: true });
+    }
+  }
+
+  /** Get the root path for an instance */
+  getInstancePath(agentName: string, userId: string): string {
+    return join(this.instancesDir, agentName, userId);
+  }
+
+  /** Get the workspace subdir (what gets mounted into Docker) */
+  getWorkspacePath(agentName: string, userId: string): string {
+    return join(this.getInstancePath(agentName, userId), "workspace");
+  }
+
+  /** Create a new instance by copying template files and generating CONTEXT.md */
+  createInstance(agentName: string, userId: string): string {
+    const config = this.agentStore.get(agentName);
+    if (!config) throw new Error(`Agent "${agentName}" not found`);
+
+    const instancePath = this.getInstancePath(agentName, userId);
+    this.ensureDir(instancePath);
+    this.ensureDir(join(instancePath, "workspace"));
+    this.ensureDir(join(instancePath, "memory"));
+    this.ensureDir(join(instancePath, "cron"));
+
+    // Copy universal CLAUDE.md
+    const universalClaudeMd = join(getConfigDir(), "CLAUDE.md");
+    if (existsSync(universalClaudeMd)) {
+      cpSync(universalClaudeMd, join(instancePath, "CLAUDE.md"));
+    } else {
+      // Generate it if it doesn't exist yet
+      writeFileSync(join(instancePath, "CLAUDE.md"), generateUniversalClaudeMd(), "utf-8");
+    }
+
+    // Copy agent template files
+    const agentDir = this.agentStore.workspacePath(agentName);
+    for (const file of ["SOUL.md", "ROLE.md"]) {
+      const src = join(agentDir, file);
+      if (existsSync(src)) {
+        cpSync(src, join(instancePath, file));
+      }
+    }
+
+    // Generate CONTEXT.md
+    const memoryStore = new MemoryStore(join(instancePath, "memory"));
+    const memories = memoryStore.list();
+    writeFileSync(
+      join(instancePath, "CONTEXT.md"),
+      generateContextMd(config, memories),
+      "utf-8",
+    );
+
+    return instancePath;
+  }
+
+  /** Re-copy template files and regenerate CONTEXT.md after agent config changes */
+  syncInstance(agentName: string, userId: string): void {
+    const config = this.agentStore.get(agentName);
+    if (!config) throw new Error(`Agent "${agentName}" not found`);
+
+    const instancePath = this.getInstancePath(agentName, userId);
+    if (!existsSync(instancePath)) {
+      this.createInstance(agentName, userId);
+      return;
+    }
+
+    // Re-copy template files
+    const agentDir = this.agentStore.workspacePath(agentName);
+    for (const file of ["SOUL.md", "ROLE.md"]) {
+      const src = join(agentDir, file);
+      if (existsSync(src)) {
+        cpSync(src, join(instancePath, file));
+      }
+    }
+
+    // Re-copy universal CLAUDE.md
+    const universalClaudeMd = join(getConfigDir(), "CLAUDE.md");
+    if (existsSync(universalClaudeMd)) {
+      cpSync(universalClaudeMd, join(instancePath, "CLAUDE.md"));
+    }
+
+    // Regenerate CONTEXT.md
+    const memoryStore = new MemoryStore(join(instancePath, "memory"));
+    const memories = memoryStore.list();
+    writeFileSync(
+      join(instancePath, "CONTEXT.md"),
+      generateContextMd(config, memories),
+      "utf-8",
+    );
+  }
+
+  /** Delete an instance */
+  deleteInstance(agentName: string, userId: string): boolean {
+    const instancePath = this.getInstancePath(agentName, userId);
+    if (!existsSync(instancePath)) return false;
+    rmSync(instancePath, { recursive: true });
+    return true;
+  }
+
+  /** List all instances, optionally filtered by agent name */
+  listInstances(agentName?: string): Array<{ agentName: string; userId: string; path: string }> {
+    const results: Array<{ agentName: string; userId: string; path: string }> = [];
+
+    if (!existsSync(this.instancesDir)) return results;
+
+    const agentDirs = agentName ? [agentName] : readdirSync(this.instancesDir).filter((entry) => {
+      const entryPath = join(this.instancesDir, entry);
+      return statSync(entryPath).isDirectory();
+    });
+
+    for (const agent of agentDirs) {
+      const agentPath = join(this.instancesDir, agent);
+      if (!existsSync(agentPath)) continue;
+
+      for (const userId of readdirSync(agentPath)) {
+        const userPath = join(agentPath, userId);
+        if (statSync(userPath).isDirectory()) {
+          results.push({ agentName: agent, userId, path: userPath });
+        }
+      }
+    }
+
+    return results;
+  }
+}