@elisym/mcp 0.3.3 → 0.4.0

package/README.md

@@ -36,7 +36,7 @@ npx @elisym/mcp
 
 ### Docker
 
-The wallet lives in `~/.elisym/agents/<name>/config.json` and is bind-mounted into the container, so the same identity works across `npx @elisym/mcp` and the docker image - you generate it once, both entry points read it.
+The wallet lives in `~/.elisym/<name>/` (`elisym.yaml` + encrypted `.secrets.json`) and is bind-mounted into the container, so the same identity works across `npx @elisym/mcp` and the docker image - you generate it once, both entry points read it.
 
 **1. Bootstrap an agent** (one-time, interactive):
 
@@ -46,7 +46,7 @@ docker run --rm -it \
   ghcr.io/elisymlabs/mcp init
 ```
 
-Generates a Nostr identity and a Solana keypair and writes them to `~/.elisym/agents/<chosen-name>/` on the host.
+Generates a Nostr identity and a Solana keypair and writes them to `~/.elisym/<chosen-name>/` on the host.
 
 **2. Edit your MCP client's config file** and add the entry below. Replace `/Users/you/.elisym` with the absolute path to your home `.elisym` directory:
 
@@ -70,7 +70,7 @@ Generates a Nostr identity and a Solana keypair and writes them to `~/.elisym/ag
 }
 ```
 
-With a single agent in `~/.elisym/agents/`, you can omit `ELISYM_AGENT`. With multiple agents, pin one explicitly — otherwise selection is unspecified.
+With a single agent in `~/.elisym/`, you can omit `ELISYM_AGENT`. With multiple agents, pin one explicitly - otherwise selection is unspecified.
 
 **Claude Code shortcut.** Instead of editing `~/.claude.json` by hand, use the built-in CLI: `claude mcp add elisym -- docker run --rm -i -e ELISYM_AGENT=<name> -v "$HOME/.elisym:/root/.elisym" ghcr.io/elisymlabs/mcp`.
 
@@ -108,7 +108,7 @@ The bootstrap step is unchanged - the wizard collects the passphrase interactive
 
 | Variable                    | Description                                                                     |
 | --------------------------- | ------------------------------------------------------------------------------- |
-| `ELISYM_AGENT`              | Load agent from `~/.elisym/agents/<name>/`                                      |
+| `ELISYM_AGENT`              | Load agent from `~/.elisym/<name>/` (or a project-local `.elisym/<name>/`)      |
 | `ELISYM_NOSTR_SECRET`       | Nostr secret key (hex or nsec) for ephemeral mode                               |
 | `ELISYM_AGENT_NAME`         | Agent display name (default: mcp-agent)                                         |
 | `ELISYM_NETWORK`            | Solana network for ephemeral mode. Only `devnet` is supported (default: devnet) |

package/dist/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, ElisymIdentity, ElisymClient, RELAYS, validateAgentName, serializeConfig, toDTag, getProtocolProgramId, getProtocolConfig } from '@elisym/sdk';
-import { generateKeyPairSigner, createKeyPairSignerFromBytes, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, isAddress } from '@solana/kit';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, validateAgentName, RELAYS, toDTag, ElisymIdentity, ElisymClient, getProtocolProgramId, getProtocolConfig } from '@elisym/sdk';
+import { generateKeyPairSigner, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, createSolanaRpc, isAddress } from '@solana/kit';
 import bs58 from 'bs58';
 import { Command } from 'commander';
-import { nip19, generateSecretKey, getPublicKey } from 'nostr-tools';
-import { readFile, readdir, stat, mkdir, writeFile, rename, unlink } from 'node:fs/promises';
+import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
+import { listAgents, createAgentDir, writeYaml, writeSecrets, loadAgent } from '@elisym/sdk/agent-store';
+import { readFile, writeFile, rename, unlink } from 'node:fs/promises';
 import { homedir, platform } from 'node:os';
 import { dirname, join } from 'node:path';
-import { parseConfig } from '@elisym/sdk/node';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -18,155 +18,71 @@ import { zodToJsonSchema } from 'zod-to-json-schema';
 import { randomBytes } from 'node:crypto';
 import { getTransferSolInstruction } from '@solana-program/system';
 
-async function writeFileAtomic(path, content, mode = 384) {
-  const tmpPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  try {
-    await writeFile(tmpPath, content, { mode });
-    await rename(tmpPath, path);
-  } catch (err) {
-    try {
-      await unlink(tmpPath);
-    } catch {
-    }
-    throw err;
-  }
-}
-
-// src/config.ts
-function rawConfigIsEncrypted(raw) {
-  return raw.includes('"encrypted:v1:');
-}
-function agentsDir() {
-  return join(homedir(), ".elisym", "agents");
-}
-function agentConfigPath(name) {
-  return join(agentsDir(), name, "config.json");
-}
-function coerceNetwork(raw, agentName) {
+function coerceNetwork(raw, name) {
   if (raw === void 0 || raw === "devnet") {
     return "devnet";
   }
   if (raw === "mainnet") {
     throw new Error(
-      `Agent "${agentName}" is configured for mainnet, which is not supported until the elisym-config program is deployed there. Re-create the agent with --network devnet: rm -rf ~/.elisym/agents/${agentName} && elisym-mcp init ${agentName} --network devnet`
+      `Agent "${name}" is configured for mainnet, which is not supported until the elisym-config program is deployed there. Re-create the agent with --network devnet: rm -rf ~/.elisym/${name} && elisym-mcp init ${name} --network devnet`
     );
   }
-  throw new Error(`Agent "${agentName}" has unsupported network "${raw}". Expected "devnet".`);
+  throw new Error(`Agent "${name}" has unsupported network "${raw}". Expected "devnet".`);
 }
 async function loadAgentConfig(name, passphrase) {
   validateAgentName(name);
-  const configPath = agentConfigPath(name);
-  const raw = await readFile(configPath, "utf-8");
-  const rawEncrypted = rawConfigIsEncrypted(raw);
-  const effectivePassphrase = process.env.ELISYM_PASSPHRASE;
-  if (rawEncrypted && !effectivePassphrase) {
-    throw new Error(
-      `Agent "${name}" has an encrypted config but no passphrase. Set the ELISYM_PASSPHRASE environment variable.`
-    );
-  }
-  let config;
-  try {
-    config = parseConfig(raw, effectivePassphrase);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    throw new Error(
-      `Failed to load agent "${name}": ${msg}. If this config was created by an earlier version, delete ~/.elisym/agents/${name} and run "elisym-mcp init ${name}" again.`
-    );
-  }
-  const network = coerceNetwork(config.wallet?.network ?? config.payments?.[0]?.network, name);
+  const loaded = await loadAgent(name, process.cwd(), passphrase);
+  const solPayment = loaded.yaml.payments.find((entry) => entry.chain === "solana");
+  const network = coerceNetwork(solPayment?.network, name);
   return {
-    nostrSecretKey: config.identity.secret_key,
-    solanaSecretKey: config.wallet?.secret_key,
-    relays: config.relays?.length ? config.relays : void 0,
+    nostrSecretKey: loaded.secrets.nostr_secret_key,
+    solanaSecretKey: loaded.secrets.solana_secret_key,
+    relays: loaded.yaml.relays.length > 0 ? loaded.yaml.relays : void 0,
     network,
-    payments: config.payments,
-    security: config.security ?? {},
-    encrypted: rawEncrypted
+    payments: loaded.yaml.payments.length > 0 ? loaded.yaml.payments.map((payment2) => ({
+      chain: payment2.chain,
+      network: payment2.network,
+      address: payment2.address
+    })) : void 0,
+    security: {
+      withdrawals_enabled: loaded.yaml.security.withdrawals_enabled,
+      agent_switch_enabled: loaded.yaml.security.agent_switch_enabled
+    },
+    encrypted: loaded.encrypted
   };
 }
-async function saveAgentConfig(name, config) {
+async function saveAgentConfig(name, input) {
   validateAgentName(name);
-  const agentDirPath = join(agentsDir(), name);
-  await mkdir(agentDirPath, { recursive: true, mode: 448 });
-  const network = config.network ?? "devnet";
-  const { encryptSecret } = await import('@elisym/sdk/node');
-  const encrypt = (v) => config.passphrase ? encryptSecret(v, config.passphrase) : v;
-  const nostrSecret = encrypt(config.nostrSecretKey);
-  const solanaSecret = config.solanaSecretKey ? encrypt(config.solanaSecretKey) : void 0;
-  const agentConfig = {
-    identity: {
-      secret_key: nostrSecret,
-      name: config.name,
-      description: config.description
-    },
-    relays: config.relays,
-    capabilities: config.capabilities ?? [],
-    ...config.solanaAddress && {
-      payments: [
-        {
-          chain: "solana",
-          network,
-          address: config.solanaAddress
-        }
-      ]
-    },
-    ...solanaSecret && {
-      wallet: {
-        chain: "solana",
-        network,
-        secret_key: solanaSecret
-      }
+  const created = await createAgentDir({ target: "home", name, cwd: process.cwd() });
+  const network = input.network ?? "devnet";
+  await writeYaml(created.dir, {
+    display_name: void 0,
+    description: input.description,
+    picture: void 0,
+    banner: void 0,
+    relays: input.relays,
+    payments: input.solanaAddress ? [{ chain: "solana", network, address: input.solanaAddress }] : [],
+    llm: void 0,
+    security: input.security ?? {}
+  });
+  await writeSecrets(
+    created.dir,
+    {
+      nostr_secret_key: input.nostrSecretKey,
+      solana_secret_key: input.solanaSecretKey
     },
-    ...config.security && { security: config.security }
-  };
-  await writeFileAtomic(join(agentDirPath, "config.json"), serializeConfig(agentConfig), 384);
+    input.passphrase
+  );
 }
 async function updateAgentSecurity(name, patch, passphrase) {
-  validateAgentName(name);
-  const configPath = agentConfigPath(name);
-  const raw = await readFile(configPath, "utf-8");
-  const effectivePassphrase = process.env.ELISYM_PASSPHRASE;
-  const config = parseConfig(raw, effectivePassphrase);
-  const rawEncrypted = rawConfigIsEncrypted(raw);
-  if (rawEncrypted && !effectivePassphrase) {
-    throw new Error(
-      `Agent "${name}" is encrypted - set ELISYM_PASSPHRASE to update security flags.`
-    );
-  }
-  const merged = { ...config.security, ...patch };
-  const { encryptSecret } = await import('@elisym/sdk/node');
-  const encrypt = (v) => effectivePassphrase ? encryptSecret(v, effectivePassphrase) : v;
-  const next = {
-    ...config,
-    // parseConfig returns decrypted secrets; re-encrypt them if the file was encrypted
-    identity: {
-      ...config.identity,
-      secret_key: rawEncrypted ? encrypt(config.identity.secret_key) : config.identity.secret_key
-    },
-    wallet: config.wallet ? {
-      ...config.wallet,
-      secret_key: rawEncrypted ? encrypt(config.wallet.secret_key) : config.wallet.secret_key
-    } : void 0,
-    security: merged
-  };
-  await writeFileAtomic(configPath, serializeConfig(next), 384);
+  const loaded = await loadAgent(name, process.cwd(), passphrase);
+  const merged = { ...loaded.yaml.security, ...patch };
+  await writeYaml(loaded.dir, { ...loaded.yaml, security: merged });
   return merged;
 }
 async function listAgentNames() {
-  try {
-    const entries = await readdir(agentsDir());
-    const names = [];
-    for (const entry of entries) {
-      try {
-        await stat(join(agentsDir(), entry, "config.json"));
-        names.push(entry);
-      } catch {
-      }
-    }
-    return names;
-  } catch {
-    return [];
-  }
+  const agents = await listAgents(process.cwd());
+  return agents.map((agent) => agent.name);
 }
 function rpcUrlFor(_network) {
   return "https://api.devnet.solana.com";
@@ -258,6 +174,19 @@ var AgentContext = class _AgentContext {
     return nonce;
   }
 };
+async function writeFileAtomic(path, content, mode = 384) {
+  const tmpPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    await writeFile(tmpPath, content, { mode });
+    await rename(tmpPath, path);
+  } catch (err) {
+    try {
+      await unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
 var LAMPORTS_PER_SOL = 1000000000n;
 function readPackageVersion() {
   try {
@@ -690,7 +619,7 @@ async function buildAgentInstance(name, config) {
 var agentTools = [
   defineTool({
     name: "create_agent",
-    description: "Create a new agent identity. Generates Nostr keypair and Solana wallet, saves config to ~/.elisym/agents/<name>/. When activate=true (default), the current active agent must have `security.agent_switch_enabled` set to true, otherwise the new agent is created but NOT activated (pass activate=false or run `elisym-mcp enable-agent-switch <current-agent>`).",
+    description: "Create a new agent identity. Generates Nostr keypair and Solana wallet, saves config to ~/.elisym/<name>/. When activate=true (default), the current active agent must have `security.agent_switch_enabled` set to true, otherwise the new agent is created but NOT activated (pass activate=false or run `elisym-mcp enable-agent-switch <current-agent>`).",
     schema: CreateAgentSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
@@ -2408,150 +2337,170 @@ process.on("warning", (w) => {
   }
   console.warn(w);
 });
-var program = new Command().name("elisym-mcp").description("MCP server for the elisym agent network").version(PACKAGE_VERSION);
-program.action(async () => {
-  const ctx = new AgentContext();
-  const agentName = process.env.ELISYM_AGENT;
-  const nostrSecret = process.env.ELISYM_NOSTR_SECRET;
-  if (agentName) {
+function safe(fn) {
+  return async (...args) => {
     try {
-      const config = await loadAgentConfig(agentName);
-      const instance = await buildAgentInstance(agentName, config);
-      ctx.register(instance);
-      console.error(`Loaded agent: ${agentName}`);
+      await fn(...args);
     } catch (e) {
-      console.error(`Failed to load agent "${agentName}": ${e.message}`);
+      console.error(`Error: ${e instanceof Error ? e.message : String(e)}`);
       process.exit(1);
     }
-  } else if (nostrSecret) {
-    let identity;
-    if (nostrSecret.startsWith("nsec")) {
-      const decoded = nip19.decode(nostrSecret);
-      if (decoded.type !== "nsec") {
-        console.error(`ELISYM_NOSTR_SECRET: expected nsec, got ${decoded.type}`);
+  };
+}
+var program = new Command().name("elisym-mcp").description("MCP server for the elisym agent network").version(PACKAGE_VERSION);
+program.action(
+  safe(async () => {
+    const ctx = new AgentContext();
+    const agentName = process.env.ELISYM_AGENT;
+    const nostrSecret = process.env.ELISYM_NOSTR_SECRET;
+    if (agentName) {
+      try {
+        const config = await loadAgentConfig(agentName);
+        const instance = await buildAgentInstance(agentName, config);
+        ctx.register(instance);
+        console.error(`Loaded agent: ${agentName}`);
+      } catch (e) {
+        console.error(`Failed to load agent "${agentName}": ${e.message}`);
+        process.exit(1);
+      }
+    } else if (nostrSecret) {
+      let identity;
+      if (nostrSecret.startsWith("nsec")) {
+        const decoded = nip19.decode(nostrSecret);
+        if (decoded.type !== "nsec") {
+          console.error(`ELISYM_NOSTR_SECRET: expected nsec, got ${decoded.type}`);
+          process.exit(1);
+        }
+        identity = ElisymIdentity.fromSecretKey(decoded.data);
+      } else {
+        identity = ElisymIdentity.fromHex(nostrSecret);
+      }
+      const client = new ElisymClient({ relays: RELAYS });
+      const name = process.env.ELISYM_AGENT_NAME ?? "mcp-agent";
+      if (process.env.ELISYM_NETWORK && process.env.ELISYM_NETWORK !== "devnet") {
+        console.error(
+          `ELISYM_NETWORK="${process.env.ELISYM_NETWORK}" is not supported. Only "devnet" is available until the on-chain protocol program ships on mainnet.`
+        );
         process.exit(1);
       }
-      identity = ElisymIdentity.fromSecretKey(decoded.data);
+      ctx.register({ client, identity, name, network: "devnet", security: {} });
+      console.error(`Ephemeral agent: ${name} (devnet)`);
     } else {
-      identity = ElisymIdentity.fromHex(nostrSecret);
+      const names = (await listAgentNames()).slice().sort();
+      if (names.length > 0) {
+        const name = names[0];
+        try {
+          const config = await loadAgentConfig(name);
+          const instance = await buildAgentInstance(name, config);
+          ctx.register(instance);
+          console.error(`Loaded default agent: ${name} (${instance.network})`);
+        } catch (e) {
+          console.error(`Failed to load agent "${name}": ${e.message}`);
+          process.exit(1);
+        }
+      } else {
+        const identity = ElisymIdentity.generate();
+        const client = new ElisymClient({ relays: RELAYS });
+        ctx.register({ client, identity, name: "mcp-agent", network: "devnet", security: {} });
+        console.error("Created ephemeral agent (no persistent identity, devnet).");
+      }
+    }
+    await startServer(ctx);
+  })
+);
+program.command("init [name]").description("Create a new agent identity").option("-d, --description <desc>", "Agent description", "Elisym MCP agent").option("-n, --network <network>", "Solana network (devnet only)", "devnet").option("--install", "Also install into MCP clients").action(
+  safe(async (name, options) => {
+    const { default: inquirer } = await import('inquirer');
+    if (!name) {
+      const answers = await inquirer.prompt([
+        {
+          type: "input",
+          name: "name",
+          message: "Agent name:",
+          validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Alphanumeric, _, - only"
+        },
+        {
+          type: "input",
+          name: "description",
+          message: "Description:",
+          default: "Elisym MCP agent"
+        },
+        {
+          type: "list",
+          name: "network",
+          message: "Solana network:",
+          // Only devnet is supported until the elisym-config program ships on mainnet.
+          choices: ["devnet"],
+          default: "devnet"
+        }
+      ]);
+      name = answers.name;
+      options.description = answers.description;
+      options.network = answers.network;
     }
-    const client = new ElisymClient({ relays: RELAYS });
-    const name = process.env.ELISYM_AGENT_NAME ?? "mcp-agent";
-    if (process.env.ELISYM_NETWORK && process.env.ELISYM_NETWORK !== "devnet") {
+    if (options.network !== "devnet") {
       console.error(
-        `ELISYM_NETWORK="${process.env.ELISYM_NETWORK}" is not supported. Only "devnet" is available until the on-chain protocol program ships on mainnet.`
+        `Network must be "devnet", got "${options.network}". Mainnet is not supported until the on-chain protocol program is deployed.`
       );
       process.exit(1);
     }
-    ctx.register({ client, identity, name, network: "devnet", security: {} });
-    console.error(`Ephemeral agent: ${name} (devnet)`);
-  } else {
-    const names = (await listAgentNames()).slice().sort();
-    if (names.length > 0) {
-      const name = names[0];
-      try {
-        const config = await loadAgentConfig(name);
-        const instance = await buildAgentInstance(name, config);
-        ctx.register(instance);
-        console.error(`Loaded default agent: ${name} (${instance.network})`);
-      } catch (e) {
-        console.error(`Failed to load agent "${name}": ${e.message}`);
-        process.exit(1);
-      }
-    } else {
-      const identity = ElisymIdentity.generate();
-      const client = new ElisymClient({ relays: RELAYS });
-      ctx.register({ client, identity, name: "mcp-agent", network: "devnet", security: {} });
-      console.error("Created ephemeral agent (no persistent identity, devnet).");
-    }
-  }
-  await startServer(ctx);
-});
-program.command("init [name]").description("Create a new agent identity").option("-d, --description <desc>", "Agent description", "Elisym MCP agent").option("-n, --network <network>", "Solana network (devnet only)", "devnet").option("--install", "Also install into MCP clients").action(async (name, options) => {
-  const { default: inquirer } = await import('inquirer');
-  if (!name) {
-    const answers = await inquirer.prompt([
-      {
-        type: "input",
-        name: "name",
-        message: "Agent name:",
-        validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Alphanumeric, _, - only"
-      },
-      {
-        type: "input",
-        name: "description",
-        message: "Description:",
-        default: "Elisym MCP agent"
-      },
+    const { passphrase } = await inquirer.prompt([
       {
-        type: "list",
-        name: "network",
-        message: "Solana network:",
-        // Only devnet is supported until the elisym-config program ships on mainnet.
-        choices: ["devnet"],
-        default: "devnet"
+        type: "password",
+        name: "passphrase",
+        message: "Passphrase to encrypt secret keys (leave blank for none):",
+        mask: "*"
       }
     ]);
-    name = answers.name;
-    options.description = answers.description;
-    options.network = answers.network;
-  }
-  if (options.network !== "devnet") {
-    console.error(
-      `Network must be "devnet", got "${options.network}". Mainnet is not supported until the on-chain protocol program is deployed.`
-    );
-    process.exit(1);
-  }
-  const { passphrase } = await inquirer.prompt([
-    {
-      type: "password",
-      name: "passphrase",
-      message: "Passphrase to encrypt secret keys (leave blank for none):",
-      mask: "*"
+    const nostrSecretKey = generateSecretKey();
+    const nostrPubkey = getPublicKey(nostrSecretKey);
+    const solanaSigner = await generateKeyPairSigner(true);
+    const solanaSecretBytes = await exportKeyPairBytes(solanaSigner);
+    await saveAgentConfig(name, {
+      name,
+      description: options.description,
+      relays: [...RELAYS],
+      nostrSecretKey: Buffer.from(nostrSecretKey).toString("hex"),
+      solanaSecretKey: bs58.encode(solanaSecretBytes),
+      solanaAddress: solanaSigner.address,
+      network: "devnet",
+      security: { withdrawals_enabled: false, agent_switch_enabled: false },
+      passphrase: passphrase || void 0
+    });
+    const npub = nip19.npubEncode(nostrPubkey);
+    console.log(`Agent "${name}" created.`);
+    console.log(`  Nostr: ${npub}`);
+    console.log(`  Solana: ${solanaSigner.address}`);
+    console.log(`  Network: ${options.network}`);
+    console.log(`  Encrypted: ${passphrase ? "yes" : "no"}`);
+    console.log(`  Config: ~/.elisym/${name}/elisym.yaml`);
+    if (passphrase) {
+      console.log(`  Note: set ELISYM_PASSPHRASE before launching the MCP server.`);
+    }
+    if (options.install) {
+      await runInstall({ agent: name });
     }
-  ]);
-  const nostrSecretKey = generateSecretKey();
-  const nostrPubkey = getPublicKey(nostrSecretKey);
-  const solanaSigner = await generateKeyPairSigner(true);
-  const solanaSecretBytes = await exportKeyPairBytes(solanaSigner);
-  await saveAgentConfig(name, {
-    name,
-    description: options.description,
-    relays: [...RELAYS],
-    nostrSecretKey: Buffer.from(nostrSecretKey).toString("hex"),
-    solanaSecretKey: bs58.encode(solanaSecretBytes),
-    solanaAddress: solanaSigner.address,
-    network: "devnet",
-    security: { withdrawals_enabled: false, agent_switch_enabled: false },
-    passphrase: passphrase || void 0
-  });
-  const npub = nip19.npubEncode(nostrPubkey);
-  console.log(`Agent "${name}" created.`);
-  console.log(`  Nostr: ${npub}`);
-  console.log(`  Solana: ${solanaSigner.address}`);
-  console.log(`  Network: ${options.network}`);
-  console.log(`  Encrypted: ${passphrase ? "yes" : "no"}`);
-  console.log(`  Config: ~/.elisym/agents/${name}/config.json`);
-  if (passphrase) {
-    console.log(`  Note: set ELISYM_PASSPHRASE before launching the MCP server.`);
-  }
-  if (options.install) {
-    await runInstall({ agent: name });
-  }
-});
-program.command("install").description("Install elisym MCP server into client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Bind to specific agent").option("--list", "List detected clients").action(async (options) => {
-  if (options.list) {
-    await runList();
-  } else {
-    await runInstall({ client: options.client, agent: options.agent });
-  }
-});
-program.command("update").description("Refresh the elisym MCP entry in installed client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Override the agent binding").action(async (options) => {
-  await runUpdate({ client: options.client, agent: options.agent });
-});
-program.command("uninstall").description("Remove elisym from MCP client configs").option("--client <name>", "Specific client").action(async (options) => {
-  await runUninstall({ client: options.client });
-});
+  })
+);
+program.command("install").description("Install elisym MCP server into client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Bind to specific agent").option("--list", "List detected clients").action(
+  safe(async (options) => {
+    if (options.list) {
+      await runList();
+    } else {
+      await runInstall({ client: options.client, agent: options.agent });
+    }
+  })
+);
+program.command("update").description("Refresh the elisym MCP entry in installed client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Override the agent binding").action(
+  safe(async (options) => {
+    await runUpdate({ client: options.client, agent: options.agent });
+  })
+);
+program.command("uninstall").description("Remove elisym from MCP client configs").option("--client <name>", "Specific client").action(
+  safe(async (options) => {
+    await runUninstall({ client: options.client });
+  })
+);
 async function toggleFlag(agentName, field, enable) {
   const { default: inquirer } = await import('inquirer');
   if (enable) {
@@ -2572,10 +2521,10 @@ async function toggleFlag(agentName, field, enable) {
   console.log(`Agent "${agentName}" security:`, merged);
   console.log("Note: restart the MCP server for changes to take effect on a running session.");
 }
-program.command("enable-withdrawals <agent>").description("Enable SOL withdrawals for a specific agent (interactive confirmation)").action((agent) => toggleFlag(agent, "withdrawals_enabled", true));
-program.command("disable-withdrawals <agent>").description("Disable SOL withdrawals for a specific agent").action((agent) => toggleFlag(agent, "withdrawals_enabled", false));
-program.command("enable-agent-switch <agent>").description("Allow the MCP server to switch away from this agent at runtime").action((agent) => toggleFlag(agent, "agent_switch_enabled", true));
-program.command("disable-agent-switch <agent>").description("Forbid the MCP server from switching away from this agent at runtime").action((agent) => toggleFlag(agent, "agent_switch_enabled", false));
+program.command("enable-withdrawals <agent>").description("Enable SOL withdrawals for a specific agent (interactive confirmation)").action(safe((agent) => toggleFlag(agent, "withdrawals_enabled", true)));
+program.command("disable-withdrawals <agent>").description("Disable SOL withdrawals for a specific agent").action(safe((agent) => toggleFlag(agent, "withdrawals_enabled", false)));
+program.command("enable-agent-switch <agent>").description("Allow the MCP server to switch away from this agent at runtime").action(safe((agent) => toggleFlag(agent, "agent_switch_enabled", true)));
+program.command("disable-agent-switch <agent>").description("Forbid the MCP server from switching away from this agent at runtime").action(safe((agent) => toggleFlag(agent, "agent_switch_enabled", false)));
 program.parse();
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map