@goplus/agentguard 1.1.13 → 1.1.18

package/dist/cli.js

@@ -15,6 +15,8 @@ const installers_js_1 = require("./installers.js");
 const version_js_1 = require("./version.js");
 const selfcheck_js_1 = require("./feed/selfcheck.js");
 const state_js_1 = require("./feed/state.js");
+const client_js_2 = require("./cloud/client.js");
+const openclaw_notify_js_1 = require("./cloud/openclaw-notify.js");
 const cron_js_1 = require("./feed/cron.js");
 const SUPPORTED_AGENT_INSTALLERS = ['claude-code', 'codex', 'openclaw', 'hermes', 'qclaw'];
 const AUTO_AGENT_DETECTION = [
@@ -38,8 +40,10 @@ async function main() {
         .option('--agent <agent>', 'Install hook/template for claude-code, codex, openclaw, hermes, or qclaw')
         .option('--cloud <url>', 'AgentGuard Cloud URL to store in local config')
         .option('--force', 'Overwrite existing hook/template files')
+        .option('--no-force', 'Do not overwrite existing hook/template files')
         .action((options) => {
-        const config = (0, config_js_1.ensureConfig)();
+        const forceTemplates = options.force !== false;
+        let config = (0, config_js_1.ensureConfig)();
         if (options.level) {
             if (!['strict', 'balanced', 'permissive'].includes(options.level)) {
                 throw new Error('Invalid level. Use strict, balanced, or permissive.');
@@ -57,7 +61,7 @@ async function main() {
         if (options.agent) {
             const normalizedAgent = String(options.agent).trim().toLowerCase();
             if (normalizedAgent === 'auto') {
-                const results = initAutoAgents(config, Boolean(options.force));
+                const results = initAutoAgents(config, forceTemplates);
                 if (results.detected.length === 0) {
                     console.log('No supported agent directories found. Looked for .claude, .openclaw, .hermes, .qclaw, and .codex.');
                 }
@@ -81,7 +85,7 @@ async function main() {
             config.agentHost = agent;
             config.agentHosts = appendAgentHost(config.agentHosts, agent);
             (0, config_js_1.saveConfig)(config);
-            const result = (0, installers_js_1.installAgentTemplates)(agent, { force: options.force });
+            const result = (0, installers_js_1.installAgentTemplates)(agent, { force: forceTemplates });
             console.log(`Installed ${result.agent} template:`);
             for (const file of result.files)
                 console.log(`- ${file}`);
@@ -97,7 +101,52 @@ async function main() {
         .action(async (options) => {
         const apiKey = options.key || options.apiKey || process.env.AGENTGUARD_API_KEY;
         if (!apiKey) {
-            throw new Error('Missing API key. Pass --key, --api-key, or set AGENTGUARD_API_KEY.');
+            const config = (0, config_js_1.ensureConfig)();
+            if (!isOpenClawAgentConfigured(config)) {
+                throw new Error('Missing API key. Pass --key, --api-key, set AGENTGUARD_API_KEY, or run `agentguard init --agent openclaw` before using Agent JWT registration.');
+            }
+            const cloudUrl = (0, config_js_1.normalizeCloudUrl)(options.cloud || options.url || config.cloudUrl || 'https://agentguard.gopluslabs.io');
+            if (config.agentId && config.agentJwt) {
+                const existingConfig = { ...config, cloudUrl };
+                const client = new client_js_1.AgentGuardCloudClient(existingConfig);
+                try {
+                    const policy = await client.fetchEffectivePolicy();
+                    const savedConfig = (0, config_js_1.connectAgentJwt)({
+                        agentId: config.agentId,
+                        agentJwt: config.agentJwt,
+                        agentRegisterUrl: config.agentRegisterUrl,
+                        cloudUrl,
+                    });
+                    (0, policy_js_1.saveCachedPolicy)(savedConfig.policyCachePath, policy);
+                    console.log(`Connected to AgentGuard Cloud (${savedConfig.cloudUrl}).`);
+                    console.log(`Agent JWT is active for local agent ${savedConfig.agentId}.`);
+                    console.log(`Cached policy ${policy.policyVersion} at ${savedConfig.policyCachePath}.`);
+                    return;
+                }
+                catch (err) {
+                    if (!(err instanceof client_js_2.CloudRequestError && err.status === 401)) {
+                        console.log(`Agent JWT is configured for ${cloudUrl}.`);
+                        console.log(`Could not verify it right now; local protection still works offline. ${err instanceof Error ? err.message : ''}`.trim());
+                        return;
+                    }
+                }
+            }
+            const registration = await registerAgentCredential({
+                cloudUrl,
+                reason: 'connect',
+                notifyOpenClaw: true,
+                resetExistingJwt: true,
+            });
+            console.log(`Registered local AgentGuard agent (${registration.config.agentId}).`);
+            console.log('Open this link to bind AgentGuard Cloud to your email:');
+            console.log(registration.registerUrl);
+            if (registration.openClawNotification.notified) {
+                console.log('Sent the activation link to the last OpenClaw channel.');
+            }
+            else if (registration.openClawNotification.reason) {
+                console.log(`OpenClaw notification skipped: ${registration.openClawNotification.reason}`);
+            }
+            return;
         }
         const config = (0, config_js_1.connectCloud)({ apiKey, cloudUrl: options.cloud || options.url });
         const client = new client_js_1.AgentGuardCloudClient(config);
@@ -118,7 +167,7 @@ async function main() {
         .action(() => {
         const config = (0, config_js_1.disconnectCloud)();
         console.log('Disconnected from AgentGuard Cloud.');
-        console.log('Removed local Cloud API key, connection timestamp, pending event spool, and cached Cloud policy.');
+        console.log('Removed local Cloud API key, Agent JWT, connection timestamp, pending event spool, and cached Cloud policy.');
         console.log(`Local protection remains active using the built-in policy. Audit log: ${config.auditPath}`);
     });
     program
@@ -131,6 +180,9 @@ async function main() {
         console.log(`Protection level: ${config.level}`);
         console.log(`Cloud URL: ${config.cloudUrl || 'not configured'}`);
         console.log(`API key: ${(0, config_js_1.maskApiKey)(config.apiKey)}`);
+        console.log(`Agent ID: ${config.agentId || 'not configured'}`);
+        console.log(`Agent JWT: ${config.agentJwt ? 'configured' : 'not configured'}`);
+        console.log(`Agent activation URL: ${config.agentRegisterUrl || 'not configured'}`);
         console.log(`Agent host: ${config.agentHost || 'not configured'}`);
         console.log(`Agent hosts: ${config.agentHosts?.join(', ') || 'not configured'}`);
         console.log(`Policy cache: ${config.policyCachePath}`);
@@ -145,10 +197,10 @@ async function main() {
         .description('Pull the latest effective runtime policy from AgentGuard Cloud into the local cache')
         .option('--json', 'Print JSON output')
         .action(async (options) => {
-        const config = (0, config_js_1.ensureConfig)();
-        const client = new client_js_1.AgentGuardCloudClient(config);
+        let config = (0, config_js_1.ensureConfig)();
+        let client = new client_js_1.AgentGuardCloudClient(config);
         if (!client.connected) {
-            const message = 'AgentGuard Cloud is not connected. Run `agentguard connect --key <key>` first.';
+            const message = 'AgentGuard Cloud is not connected. Run `agentguard connect` first.';
             if (options.json) {
                 console.log(JSON.stringify({ success: false, error: message }, null, 2));
             }
@@ -159,7 +211,16 @@ async function main() {
             return;
         }
         try {
-            const pulledPolicy = await client.fetchEffectivePolicy();
+            const result = await runCloudRequestWithAgentJwtReauth({
+                config,
+                client,
+                reason: 'reauth',
+                notifyOpenClaw: true,
+                operation: (activeClient) => activeClient.fetchEffectivePolicy(),
+            });
+            config = result.config;
+            client = result.client;
+            const pulledPolicy = result.value;
             (0, policy_js_1.saveCachedPolicy)(config.policyCachePath, pulledPolicy);
             if (options.json) {
                 console.log(JSON.stringify({
@@ -229,8 +290,8 @@ async function main() {
         console.log(`✓ Home: ${paths.home}`);
         console.log(`✓ Config: ${paths.configPath}`);
         console.log(`✓ Node: ${process.version}`);
-        if (config.apiKey) {
-            const client = new client_js_1.AgentGuardCloudClient(config);
+        const client = new client_js_1.AgentGuardCloudClient(config);
+        if (client.connected) {
             try {
                 const status = await client.status();
                 const label = status.status || (status.ok ? 'ok' : status.service || 'reachable');
@@ -302,29 +363,143 @@ async function main() {
         .option('--cron-run', 'Internal: run from the OpenClaw cron prompt without trying to install cron again')
         .option('--cron-notify-run', 'Internal: run from an OpenClaw cron prompt and print only the notification body or NO_REPLY')
         .action(async (options) => {
-        const config = (0, config_js_1.ensureConfig)();
-        const client = new client_js_1.AgentGuardCloudClient(config);
+        let config = (0, config_js_1.ensureConfig)();
+        let client = new client_js_1.AgentGuardCloudClient(config);
+        const cronAgentHost = resolveCronAgentHost(config);
         const state = (0, state_js_1.loadFeedState)();
-        const since = options.since ?? state.lastPulledAt;
+        const since = options.since;
         const quiet = Boolean(options.quiet);
         const cronNotifyRun = Boolean(options.cronNotifyRun);
         const cronTarget = validateCronTarget(options.cronTarget);
+        const cronRunSendsToOpenClaw = Boolean(options.cronRun) && cronAgentHost === 'openclaw';
         const cronExpression = options.cron && !options.cronRun
             ? (0, cron_js_1.validateCronExpression)(options.cron)
             : undefined;
+        let registration = null;
+        if (!client.connected) {
+            if (!isOpenClawAgentConfigured(config)) {
+                const message = 'AgentGuard Cloud is not connected. Run `agentguard connect --key <key>` first, or run `agentguard init --agent openclaw` to use Agent JWT registration.';
+                if (cronNotifyRun) {
+                    console.log('NO_REPLY');
+                }
+                else if (options.json) {
+                    console.log(JSON.stringify({ success: false, error: message }, null, 2));
+                }
+                else {
+                    console.error(message);
+                }
+                process.exitCode = 1;
+                return;
+            }
+            try {
+                registration = await registerAgentCredential({
+                    cloudUrl: config.cloudUrl,
+                    reason: 'subscribe',
+                    notifyOpenClaw: resolveCronAgentHost(config) === 'openclaw',
+                });
+                config = registration.config;
+                client = registration.client;
+            }
+            catch (err) {
+                if (cronNotifyRun) {
+                    console.log('NO_REPLY');
+                    process.exitCode = 0;
+                    return;
+                }
+                console.error(`! Could not register AgentGuard agent: ${err.message}`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        try {
+            await client.subscribeFeed();
+        }
+        catch (err) {
+            if (err instanceof client_js_2.CloudRequestError && err.status === 401) {
+                if (!isOpenClawAgentConfigured(config)) {
+                    console.error('! AgentGuard Cloud credential was rejected. Run `agentguard connect --key <key>` again.');
+                    process.exitCode = 1;
+                    return;
+                }
+                try {
+                    registration = await registerAgentCredential({
+                        cloudUrl: config.cloudUrl,
+                        reason: 'subscribe',
+                        notifyOpenClaw: resolveCronAgentHost(config) === 'openclaw',
+                        resetExistingJwt: true,
+                    });
+                    config = registration.config;
+                    client = registration.client;
+                    await client.subscribeFeed();
+                }
+                catch (retryErr) {
+                    if (cronNotifyRun) {
+                        console.log('NO_REPLY');
+                        process.exitCode = 0;
+                        return;
+                    }
+                    printAgentActivationRequired(registration, retryErr);
+                    process.exitCode = 1;
+                    return;
+                }
+            }
+            else {
+                if (cronNotifyRun) {
+                    console.log('NO_REPLY');
+                    process.exitCode = 0;
+                    return;
+                }
+                console.error(`! Could not subscribe to AgentGuard Cloud feed: ${err.message}`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        if (registration && !cronNotifyRun && !quiet && !options.json) {
+            printAgentRegistrationNotice(registration);
+        }
         let advisories;
         try {
             advisories = await client.pullAdvisories(since);
         }
         catch (err) {
-            if (cronNotifyRun) {
-                console.log('NO_REPLY');
-                process.exitCode = 0;
+            if (err instanceof client_js_2.CloudRequestError && err.status === 401) {
+                if (!isOpenClawAgentConfigured(config)) {
+                    console.error('! AgentGuard Cloud credential was rejected. Run `agentguard connect --key <key>` again.');
+                    process.exitCode = 1;
+                    return;
+                }
+                try {
+                    registration = await registerAgentCredential({
+                        cloudUrl: config.cloudUrl,
+                        reason: 'subscribe',
+                        notifyOpenClaw: resolveCronAgentHost(config) === 'openclaw',
+                        resetExistingJwt: true,
+                    });
+                    config = registration.config;
+                    client = registration.client;
+                    advisories = await client.pullAdvisories(since);
+                }
+                catch (retryErr) {
+                    if (cronNotifyRun) {
+                        console.log('NO_REPLY');
+                        process.exitCode = 0;
+                        return;
+                    }
+                    printAgentActivationRequired(registration, retryErr);
+                    process.exitCode = 1;
+                    return;
+                }
+            }
+            else {
+                if (cronNotifyRun) {
+                    console.log('NO_REPLY');
+                    process.exitCode = 0;
+                    return;
+                }
+                console.error(`! Could not reach AgentGuard Cloud: ${err.message}`);
+                process.exitCode = 1;
                 return;
             }
-            console.error(`! Could not reach AgentGuard Cloud: ${err.message}`);
-            process.exitCode = 1;
-            return;
         }
         if (advisories === null) {
             // 404 — older Cloud build without the feed endpoint. Not an error.
@@ -339,16 +514,17 @@ async function main() {
             }
             return;
         }
-        const seen = new Set(state.seenAdvisoryIds ?? []);
-        // Process oldest-first so the cursor can advance monotonically and we
-        // never skip over an advisory that failed mid-batch.
+        const seen = new Set((0, state_js_1.getSeenAdvisoryIds)(state));
+        // Process oldest-first so output stays deterministic when Cloud returns
+        // multiple fresh advisories.
         const fresh = advisories
             .filter((a) => !seen.has(a.id))
             .sort((a, b) => (a.publishedAt < b.publishedAt ? -1 : 1));
         const results = [];
-        let cursorOk = true; // stops advancing on the first hard failure
-        let latestPublishedAt = state.lastPulledAt;
         let hardFailures = 0;
+        const newSeenIds = [];
+        const foundIds = [];
+        const pulledAt = new Date().toISOString();
         if (quiet) {
             for (const advisory of fresh) {
                 let processed = true;
@@ -361,7 +537,6 @@ async function main() {
                     // not been evaluated — don't mark it seen and don't advance.
                     console.error(`! Self-check threw for ${advisory.id}: ${err.message}`);
                     hardFailures += 1;
-                    cursorOk = false;
                     continue;
                 }
                 results.push(result);
@@ -370,10 +545,20 @@ async function main() {
                     // match, we must NOT mark the advisory seen, otherwise a
                     // transient network blip silently buries a real hit.
                     try {
-                        await client.reportSelfCheck(advisory.id, result.matchedArtifacts, {
-                            elapsedMs: result.elapsedMs,
-                            warnings: result.warnings,
+                        const reportResult = await runCloudRequestWithAgentJwtReauth({
+                            config,
+                            client,
+                            reason: 'reauth',
+                            notifyOpenClaw: resolveCronAgentHost(config) === 'openclaw',
+                            operation: (activeClient) => activeClient.reportSelfCheck(advisory.id, result.matchedArtifacts, {
+                                elapsedMs: result.elapsedMs,
+                                warnings: result.warnings,
+                            }),
                         });
+                        config = reportResult.config;
+                        client = reportResult.client;
+                        if (reportResult.registration)
+                            registration = reportResult.registration;
                     }
                     catch (err) {
                         console.error(`! Failed to report self-check for ${advisory.id}: ${err.message}`);
@@ -382,28 +567,29 @@ async function main() {
                     }
                 }
                 if (processed) {
-                    Object.assign(state, (0, state_js_1.markAdvisorySeen)(state, advisory.id));
-                    if (cursorOk && (!latestPublishedAt || advisory.publishedAt > latestPublishedAt)) {
-                        latestPublishedAt = advisory.publishedAt;
+                    newSeenIds.push(advisory.id);
+                    if (result.matchedArtifacts.length > 0) {
+                        foundIds.push(advisory.id);
                     }
                 }
                 else {
-                    // From this point we no longer advance the pull cursor — the
-                    // failed advisory must be re-pulled on the next run.
-                    cursorOk = false;
+                    // Failed advisories are left out of newSeenIds, so the ID-based
+                    // state will re-process them on the next subscribe run.
                 }
             }
         }
         else {
             for (const advisory of fresh) {
-                Object.assign(state, (0, state_js_1.markAdvisorySeen)(state, advisory.id));
-                if (cursorOk && (!latestPublishedAt || advisory.publishedAt > latestPublishedAt)) {
-                    latestPublishedAt = advisory.publishedAt;
-                }
+                newSeenIds.push(advisory.id);
             }
         }
-        state.lastPulledAt = latestPublishedAt;
-        (0, state_js_1.saveFeedState)(state);
+        const pendingStateEntry = newSeenIds.length > 0 || foundIds.length > 0
+            ? {
+                pulledAt,
+                newSeenIds,
+                foundIds,
+            }
+            : null;
         const totalMatches = results.reduce((acc, r) => acc + r.matchedArtifacts.length, 0);
         const summary = buildSubscribeSummary({
             supported: true,
@@ -433,6 +619,33 @@ async function main() {
                 throw err;
             }
         }
+        if (cronRunSendsToOpenClaw) {
+            if (summary.shouldNotify && summary.hardFailures === 0) {
+                const body = summary.notification?.body;
+                if (!body) {
+                    console.error('! OpenClaw cron notification was requested, but no notification body was generated.');
+                    process.exitCode = 1;
+                    return;
+                }
+                const notification = await (0, openclaw_notify_js_1.notifyOpenClawMessage)(body, resolveOpenClawGatewayOptionsFromEnv(), {
+                    idempotencyKeyPrefix: 'agentguard-subscribe',
+                });
+                if (!notification.notified) {
+                    console.error(`! Could not send OpenClaw cron notification: ${notification.reason ?? 'Unknown error'}`);
+                    process.exitCode = 1;
+                    return;
+                }
+            }
+            if (pendingStateEntry) {
+                (0, state_js_1.saveFeedState)((0, state_js_1.prependFeedStateEntry)(state, pendingStateEntry));
+            }
+            console.log('NO_REPLY');
+            process.exitCode = hardFailures > 0 ? 1 : 0;
+            return;
+        }
+        if (pendingStateEntry) {
+            (0, state_js_1.saveFeedState)((0, state_js_1.prependFeedStateEntry)(state, pendingStateEntry));
+        }
         if (cronNotifyRun) {
             console.log(summary.shouldNotify && summary.hardFailures === 0 ? summary.notification?.body ?? 'NO_REPLY' : 'NO_REPLY');
             process.exitCode = 0;
@@ -448,10 +661,7 @@ async function main() {
         }
         console.log(`Pulled ${advisories.length} advisory record(s); ${fresh.length} new.`);
         if (!quiet && fresh.length > 0) {
-            console.log('New threat-feed advisories found. Review and handle them manually:');
-            for (const advisory of fresh) {
-                console.log(`  - ${advisory.id} [${advisory.severity}] ${advisory.summary}`);
-            }
+            console.log(summary.notification?.body ?? formatNewAdvisoryNotification(fresh));
         }
         else if (quiet && fresh.length > 0) {
             console.log(`Self-check found ${totalMatches} match(es) across the new advisories.`);
@@ -466,8 +676,11 @@ async function main() {
         }
         if (summary.cron.result) {
             const label = summary.cron.result.backend ?? 'cron';
-            const action = summary.cron.result.created ? `Installed ${label} cron job` : `${label} cron job already exists`;
+            const action = summary.cron.result.created ? `Installed ${label} cron job` : `${label} cron job already exists and was left unchanged`;
             console.log(`${action} "${summary.cron.result.name}" (${summary.cron.result.schedule}, ${summary.cron.result.timezone}).`);
+            if (!summary.cron.result.created) {
+                console.log('Existing cron jobs are not reconfigured unless --force is passed; rerun with --force to apply the requested quiet/manual mode and schedule.');
+            }
             if (summary.cron.result.backend === 'system') {
                 console.log(`System cron output: ${(0, node_path_1.join)((0, config_js_1.getAgentGuardPaths)().home, 'feed-cron.log')}`);
             }
@@ -476,7 +689,7 @@ async function main() {
             }
         }
         // Exit codes: 2 = matches found, 1 = at least one advisory failed
-        // to evaluate or report (cursor was held back), 0 = clean.
+        // to evaluate or report, 0 = clean.
         if (hardFailures > 0) {
             console.error(`! ${hardFailures} advisory record(s) failed to process and will be re-pulled next run.`);
             process.exitCode = 1;
@@ -494,7 +707,7 @@ async function main() {
         .option('--against-advisory <id>', 'Restrict the check to a single advisory id (fetches it from Cloud if needed)')
         .option('--json', 'Emit machine-readable result')
         .action(async (options) => {
-        const config = (0, config_js_1.ensureConfig)();
+        let config = (0, config_js_1.ensureConfig)();
         const advisoryId = options.againstAdvisory;
         if (!advisoryId) {
             const report = await runLocalHealthCheckup(config);
@@ -513,9 +726,9 @@ async function main() {
             process.exitCode = 0;
             return;
         }
-        const client = new client_js_1.AgentGuardCloudClient(config);
+        let client = new client_js_1.AgentGuardCloudClient(config);
         if (!client.connected) {
-            const message = 'AgentGuard Cloud is not connected. Run `agentguard connect --key <key>` first.';
+            const message = 'AgentGuard Cloud is not connected. Run `agentguard connect` first.';
             if (options.json) {
                 console.log(JSON.stringify({ success: false, error: message }, null, 2));
             }
@@ -527,10 +740,25 @@ async function main() {
         }
         let advisory = null;
         try {
-            advisory = await client.getAdvisory(advisoryId);
+            const result = await runCloudRequestWithAgentJwtReauth({
+                config,
+                client,
+                reason: 'reauth',
+                notifyOpenClaw: true,
+                operation: (activeClient) => activeClient.getAdvisory(advisoryId),
+            });
+            config = result.config;
+            client = result.client;
+            advisory = result.value;
         }
         catch (err) {
-            console.error(`! Could not reach AgentGuard Cloud: ${err.message}`);
+            const message = `Could not reach AgentGuard Cloud: ${err.message}`;
+            if (options.json) {
+                console.log(JSON.stringify({ success: false, error: message }, null, 2));
+            }
+            else {
+                console.error(`! ${message}`);
+            }
             process.exitCode = 1;
             return;
         }
@@ -709,12 +937,39 @@ function discoverSkillDirs(roots) {
             if (!entry.isDirectory())
                 continue;
             const dir = (0, node_path_1.join)(root, entry.name);
-            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'SKILL.md')))
-                dirs.push(dir);
+            if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'SKILL.md')))
+                continue;
+            if (isManagedAgentGuardSkillDir(dir))
+                continue;
+            dirs.push(dir);
         }
     }
     return dirs;
 }
+function isManagedAgentGuardSkillDir(dir) {
+    if (!/[/\\]agentguard$/i.test(dir))
+        return false;
+    const manifest = (0, node_path_1.join)(dir, 'SKILL.md');
+    let body = '';
+    try {
+        body = (0, node_fs_1.readFileSync)(manifest, 'utf8').slice(0, 16 * 1024);
+    }
+    catch {
+        return false;
+    }
+    const hasAgentGuardIdentity = /^name:\s*agentguard\s*$/im.test(body) &&
+        /GoPlus AgentGuard|GoPlusSecurity/i.test(body);
+    if (!hasAgentGuardIdentity)
+        return false;
+    const expectedScripts = [
+        (0, node_path_1.join)(dir, 'scripts', 'guard-hook.js'),
+        (0, node_path_1.join)(dir, 'scripts', 'hermes-hook.js'),
+        (0, node_path_1.join)(dir, 'scripts', 'checkup-report.js'),
+    ];
+    if (!expectedScripts.every((path) => (0, node_fs_1.existsSync)(path)))
+        return false;
+    return true;
+}
 function checkCredentialSafety(skillDirs) {
     let score = 100;
     const findings = [];
@@ -870,6 +1125,102 @@ function runCommandText(command, args) {
         }
     });
 }
+async function runCloudRequestWithAgentJwtReauth(options) {
+    try {
+        return {
+            value: await options.operation(options.client),
+            config: options.config,
+            client: options.client,
+            registration: null,
+        };
+    }
+    catch (err) {
+        if (!(err instanceof client_js_2.CloudRequestError && err.status === 401) ||
+            !options.config.agentJwt ||
+            !isOpenClawAgentConfigured(options.config)) {
+            throw err;
+        }
+        const registration = await registerAgentCredential({
+            cloudUrl: options.config.cloudUrl,
+            reason: options.reason,
+            notifyOpenClaw: options.notifyOpenClaw,
+            resetExistingJwt: true,
+        });
+        return {
+            value: await options.operation(registration.client),
+            config: registration.config,
+            client: registration.client,
+            registration,
+        };
+    }
+}
+async function registerAgentCredential(options) {
+    if (options.resetExistingJwt) {
+        (0, config_js_1.clearAgentJwt)();
+    }
+    const baseConfig = (0, config_js_1.ensureConfig)();
+    const cloudUrl = (0, config_js_1.normalizeCloudUrl)(options.cloudUrl || baseConfig.cloudUrl || 'https://agentguard.gopluslabs.io');
+    const client = new client_js_1.AgentGuardCloudClient({ ...baseConfig, cloudUrl });
+    const registration = await client.registerAgent({
+        metadata: {
+            agentHost: baseConfig.agentHost,
+            agentHosts: baseConfig.agentHosts,
+            agentVersion: version_js_1.packageVersion,
+            platform: process.platform,
+            arch: process.arch,
+            reason: options.reason,
+        },
+    });
+    const config = (0, config_js_1.connectAgentJwt)({
+        agentId: registration.agentId,
+        agentJwt: registration.jwt,
+        agentRegisterUrl: registration.registerUrl,
+        cloudUrl,
+    });
+    const nextClient = new client_js_1.AgentGuardCloudClient(config);
+    const openClawNotification = options.notifyOpenClaw
+        ? await (0, openclaw_notify_js_1.notifyOpenClawRegistrationLink)(registration.registerUrl, resolveOpenClawGatewayOptionsFromEnv())
+        : { notified: false, reason: 'OpenClaw notification was not requested.' };
+    return {
+        config,
+        client: nextClient,
+        registerUrl: registration.registerUrl,
+        openClawNotification,
+    };
+}
+function printAgentRegistrationNotice(registration) {
+    console.log('AgentGuard Cloud activation is ready:');
+    console.log(registration.registerUrl);
+    if (registration.openClawNotification.notified) {
+        console.log('Sent the activation link to the last OpenClaw channel.');
+    }
+}
+function printAgentActivationRequired(registration, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`! AgentGuard Cloud authorization is not active yet. ${message}`);
+    const registerUrl = registration?.registerUrl || (0, config_js_1.ensureConfig)().agentRegisterUrl;
+    if (registerUrl) {
+        console.error('Open this link to bind this agent to your email, then rerun the command:');
+        console.error(registerUrl);
+    }
+}
+function isOpenClawAgentConfigured(config) {
+    return config.agentHost === 'openclaw' || config.agentHosts?.includes('openclaw') === true;
+}
+function resolveOpenClawGatewayOptionsFromEnv() {
+    const url = process.env.AGENTGUARD_OPENCLAW_GATEWAY_URL?.trim();
+    const host = process.env.AGENTGUARD_OPENCLAW_GATEWAY_HOST?.trim();
+    const portRaw = process.env.AGENTGUARD_OPENCLAW_GATEWAY_PORT?.trim();
+    const timeoutRaw = process.env.AGENTGUARD_OPENCLAW_GATEWAY_TIMEOUT_MS?.trim();
+    const port = portRaw ? Number(portRaw) : undefined;
+    const timeoutMs = timeoutRaw ? Number(timeoutRaw) : undefined;
+    return {
+        ...(url ? { url } : {}),
+        ...(host ? { host } : {}),
+        ...(Number.isFinite(port) ? { port } : {}),
+        ...(Number.isFinite(timeoutMs) ? { timeoutMs } : {}),
+    };
+}
 function calculateCompositeScore(dimensions) {
     const web3Score = dimensions.web3_safety.score;
     if (web3Score === null || dimensions.web3_safety.na) {
@@ -1003,13 +1354,30 @@ function formatNewAdvisoryNotification(advisories) {
     const lines = ['AgentGuard found new threat-feed advisories that need manual review:'];
     for (const advisory of advisories.slice(0, 10)) {
         lines.push(`- ${advisory.id} [${advisory.severity}] ${advisory.summary}`);
+        const remediation = formatAdvisoryRemediation(advisory);
+        if (remediation) {
+            lines.push('  Remediation guidance:');
+            for (const line of remediation.split('\n')) {
+                lines.push(`  ${line}`);
+            }
+        }
     }
     if (advisories.length > 10) {
         lines.push(`- ... ${advisories.length - 10} more`);
     }
-    lines.push('Run `agentguard subscribe --quiet` to execute the local self-check and report matches automatically.');
     return lines.join('\n');
 }
+function formatAdvisoryRemediation(advisory) {
+    const remediation = advisory.selfCheck?.remediationMd?.trim();
+    if (!remediation)
+        return null;
+    const compact = remediation
+        .replace(/\r\n/g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+    const maxLen = 1200;
+    return compact.length > maxLen ? `${compact.slice(0, maxLen).trimEnd()}\n...` : compact;
+}
 function formatThreatFeedNotification(results) {
     const lines = ['AgentGuard threat-feed self-check found local matches:'];
     for (const result of results) {