@onride/agent 0.0.0-stage → 0.5.1-rc.0

package/docs/ride-agent-migration.md

@@ -0,0 +1,127 @@
+# Ride Agent distribution migration
+
+Ride Agent is the **AI Copy-Trading Agent**. It helps you discover traders, build a personalized copy-trading portfolio, and start copying after your confirmation.
+
+## Release state
+
+This migration introduces **@onride/agent 0.5.1** in the company npm organization and the company GitHub repository **onride-app/ride-agent**. Registry publication, GitHub release integrity and hosted deployment each have separate acceptance checks below.
+
+Company ownership and transfer verified on 2026-10-17:
+
+| Item | Verified state |
+| --- | --- |
+| Company name | `onride`; independent GitHub organization registered under Corporate terms, Free plan |
+| Old public npm latest | `@glenyang/ride-cli@0.5.0` |
+| New package/release | `@onride/agent@0.5.1`, `onride-app/ride-agent#v0.5.1`; use registry/install checks below to verify availability |
+| npm CLI | Authenticated as `glenyang`; account 2FA enabled for authorization and publishing |
+| npm organization | `onride` exists; Free plan, unlimited public packages, $0 monthly; sole current Owner `glenyang`, account 2FA and organization 2FA enforcement enabled |
+| GitHub source | Original `Glen-yang/ride-mcp` transferred in place; leave the old location unused to retain redirects |
+| GitHub destination | `onride-app/ride-agent`, public, same repository ID; all 50 pre-transfer Git refs, 14 releases and 13 issue/PR records retained |
+| Company ownership | Founder Glen confirmed as final responsible owner: GitHub `Glen-yang` is organization Owner, npm `glenyang` is organization Owner; `admin@onride.me` verified on npm and set as GitHub organization billing email |
+| Developer access | Only the founder is currently a member; add independent developer accounts through repository/team permissions when their usernames are supplied |
+| Production MCP | Retain `https://mcp.onride.me/mcp` and its OAuth issuer |
+| Website/directories | `onride.me` is the Ride App website; update actual Agent entries after package acceptance and record each existing directory listing separately |
+
+Release maintainers must pass the registry installation checks below before announcing a new version or deprecating the old package. Namespace ownership alone does not establish that a package version is downloadable.
+
+## New installation and existing-user upgrade
+
+New users run:
+
+```sh
+npx -y @onride/agent
+```
+
+Existing users run once on their original computer:
+
+```sh
+npx -y --prefer-online @onride/agent@latest setup --skip-login
+```
+
+Add `--client codex`, `--client claude-code` or `--client cursor` to choose a client explicitly. Run once per client if several are installed. Omit `--server` to preserve the installed URL; an environment override `RIDE_MCP_URL` is an explicit server selection and must match the existing registration. Reconnect MCP or open a new chat afterwards.
+
+The CLI command, MCP registration key and Skill directory remain `ride`. MCP implementations advertise the independent display title `Ride Agent`. Tool names, `ride:read`/`ride:trade` scopes and the `~/.ride` session path remain unchanged. Codex keeps its native OAuth store and HTTP entry; Claude Code/Cursor retain their stdio session. Migration does not request login or broader scopes when `--skip-login` is used.
+
+The installer recognizes released fixed-version npm/GitHub launchers and the old npm `latest` launcher, including the actual published 0.5.0 Skill tree. It replaces only managed registrations and known unmodified Skills. Custom servers and unrelated client settings survive. Custom arguments, environment entries, wrappers, unrecognized versions or edited Skills require manual review; conflicts leave the original files untouched and report their paths.
+
+An old namespace cannot redirect its `latest` dist-tag to another package. The explicit command above performs the namespace migration. A globally installed old `ride` binary also stays on its installed package. Prefer the npx command for migration. To switch the optional global binary after the new package is verified:
+
+```sh
+npm uninstall -g @glenyang/ride-cli
+npm install -g @onride/agent@latest
+```
+
+If global installation fails, restore the previous binary with `npm install -g @glenyang/ride-cli@0.5.0` or keep using the new npx command. Neither global operation deletes `~/.ride`.
+
+For a fixed source/version:
+
+```sh
+npx -y @onride/agent@0.5.1 setup --client cursor --skip-login
+npx -y github:onride-app/ride-agent#v0.5.1 setup --client cursor --skip-login --distribution github
+```
+
+The first command pins the installer; generated npm MCP launches deliberately follow `@onride/agent@latest`. Explicit GitHub distribution pins subsequent launches to the release tag. The GitHub tag must point to the exact reviewed release commit.
+
+## Conflicts and failure recovery
+
+Back up a custom client's configuration and `skills/ride` before reviewing it. In a custom stdio registration, update only the package argument after checking its flags and server; keep `ride`, unrelated MCP entries and user options. Merge the packaged Skill with the user's notes manually. Setup will continue refusing to overwrite a customized Skill; the merged instructions can be used as a deliberately user-managed installation.
+
+Setup stages its configuration and Skill, checks that both originals still match, and commits using rename. If the configuration commit fails after a Skill replacement, it restores the old Skill and leaves the original configuration and session untouched. Resolve the reported file/access error and rerun the same upgrade command. Login failure after a successful installation retains the valid installation; retry login separately. Never delete the user's session or original configuration to force a migration.
+
+## Company ownership and repository transfer
+
+1. Create/confirm npm `onride` using the **Unlimited public packages** free plan. Verify availability during creation, not from a public 404. Confirm the company/founder Owner and developer account names. Enforce 2FA and give developers package publishing access through an appropriate team; do not distribute passwords or tokens.
+2. Finish the GitHub **onride-app** Free organization as a business-owned organization, using business name `onride` and the owner-confirmed contact email. Accept its agreement only with the authorized person's approval. Confirm company/founder Owner access, developer repository access and 2FA.
+3. Transfer the existing repository to that organization and rename it **ride-agent**. Do not create a replacement empty repository, rewrite history or recreate releases. Before/after evidence must compare commit and tag refs, releases, issues/PRs and project access. Check installed GitHub Apps, Actions/environment protection, webhooks, Railway source integration and deployment configuration.
+4. Update `origin` only after transfer is confirmed. Preserve the old GitHub redirect by leaving the previous repository location unused. Confirm clone/fetch and fixed release-tag installs at the new URL. Package repository metadata, homepage and issues links must all resolve to the company repository.
+
+Official references: [npm organization creation](https://docs.npmjs.com/creating-an-organization/), [GitHub repository transfer](https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository).
+
+## Publish and distribution sequence
+
+Run the source checks, isolated database tests, package verification and online release checks from the reviewed/tagged company repository:
+
+```sh
+npm ci
+npm run check
+RIDE_AGENT_TEST_DATABASE_URL=postgresql://LOCAL_DISPOSABLE_DATABASE npm test
+RIDE_AGENT_FUNCTIONAL_DATABASE_URL=postgresql://LOCAL_DISPOSABLE_DATABASE npm run test:functional
+npm run verify:package
+npm run verify:release -- --online
+```
+
+`verify:package` rebuilds, packs and installs a local tarball, checks its file list/common credential formats, exercises fresh and repeat setup for all three clients, and initializes the built stdio MCP. `verify:release -- --online` requires an accessible company-owned repository, an exact release tag and an unused npm version. Passing the local metadata check alone does not establish ownership or publication.
+
+For the initial authenticated publish, use `npm publish --access public` only after owner/team/2FA checks. For CI, bind npm trusted publishing to **onride-app / ride-agent / publish.yml / npm-production**, allowing direct publish. Configure the GitHub `npm-production` environment with company release reviewers and tag restrictions before using it. The manual workflow runs only from a version tag, checks the repository/ref against package metadata and uses GitHub OIDC without storing a publishing token. Node 24 supplies the supported npm client. See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/).
+
+After publishing, verify public registry metadata/integrity; run both `npx -y @onride/agent --help` and `npx -y --prefer-online @onride/agent@latest --help`; install the fixed version and GitHub tag into isolated client homes; initialize each supported transport and perform read-only queries. Exercise proposal confirmation and execution only with the isolated simulated venue. Local/CI tests do not establish a live client login or real exchange execution.
+
+Deploy the reviewed display changes to the existing hosted gateway using the normal deployment sequence; check OAuth display, MCP title, live guide and read paths separately. Do not change endpoints, scopes, tool identifiers, trading flags or service role identifiers as part of the branding rollout.
+
+Update actual Agent website/install entries and existing plugin/MCP listings only after registry and hosted acceptance. The public `onride.me` homepage currently presents the Ride App; its App branding is a separate surface. Obtain its editing access and identify the actual Agent entry/listings before changing it. Do not claim an unverified directory submission or replace the native App brand globally.
+
+Finally publish the old-package migration notice/deprecation. Example **only after new-package acceptance**:
+
+```sh
+npm deprecate '@glenyang/ride-cli@*' 'Renamed to @onride/agent. Upgrade once: npx -y --prefer-online @onride/agent@latest setup --skip-login. Details: https://github.com/onride-app/ride-agent/blob/main/docs/ride-agent-migration.md'
+```
+
+Keep the old package downloadable. Do not unpublish it or move its latest tag as a substitute for migration.
+
+## Acceptance evidence
+
+| Check | Local result |
+| --- | --- |
+| TypeScript check / Skill validation | Passed |
+| Regression tests with isolated PostgreSQL | 211 passed, 0 failed, 0 skipped, including current main's confirmation-card compatibility fixes |
+| Functional OAuth/MCP/CLI/Pg and simulated execution | 45 passed, 0 failed; no real funds moved |
+| Packed files / installed CLI / all-client fresh and repeat setup | Passed; see the verification JSON for the final file count and tarball size |
+| Built MCP identity | `name=ride`, `title=Ride Agent`, release 0.5.1 |
+| Published 0.5.0 upgrades | Fixed npm, old npm latest and GitHub launchers on all 3 clients passed |
+| Custom server, unrelated settings and session preservation | Passed |
+| Custom configuration refusal / failed commit rollback and retry | Passed |
+| GitHub transfer integrity | Same repository ID and all pre-transfer refs, releases, issue/PR records and environments preserved |
+| Online release gate | Must verify the company repository, exact release tag and unused npm version immediately before publishing |
+| Registry, hosted service and external entries | Verify and record separately using the release checks above; local tests alone do not establish publication or deployment |
+
+Compatibility strings remain intentionally in `src/cli/setup.ts`, migration tests/fixtures and upgrade/rollback documentation. Historical service names such as Railway `ride-mcp`, internal health identifiers, App names, existing OAuth scopes and storage keys retain their meanings.

package/docs/v17-completion-checklist.md

@@ -0,0 +1,31 @@
+# Ride V17 completion and release checklist
+
+Scope: finish the supplied conversational HTML in isolated Ride MCP services. Old App service sources, GraphQL/RPC contracts, copy tables and client notification branches remain unchanged.
+
+Implemented:
+- Single trader and explicit 2–8 trader baskets; old plans keep 3–6.
+- Independent risk tolerance, Fixed/proportional settings and amount/leverage editing.
+- Verified source-fill entry sizing and same-window reductions; gaps block increases.
+- New 30% pause / 70% emergency exit, portfolio stop precedence; legacy single-threshold semantics retained.
+- Persisted free preview batches, quota enforcement, cross-batch basket editing.
+- Overlap warnings, improving alternatives, frozen-plan acknowledgment.
+- Supported deposit routes, owned receiving address/QR, owner-isolated status; wallet/bridge receipt and trade-ready collateral are separate.
+- Once-per-local-day check-in, daily/weekly/inception reports, profit/value chart and recorded fills.
+- Real RWA taxonomy, exact qualified symbols, Standard mode and scoped USDC collateral.
+- CLI/Skill parity and upgrade from the released 0.3.4 tree.
+
+Observed validation before deployment: 92 TypeScript tests passed with dedicated PostgreSQL; 35 functional HTTP/MCP/OAuth/CLI/PostgreSQL scenarios passed using simulated identities/fills; Skill validation passed; package verification passed for three clients and bare setup. The final Fixed regression proves that new assets and direction flips require fills even when a source history response reports complete coverage. Core: 8 Strategy gRPC tests, 37 execution tests, and a disposable-schema PostgreSQL trigger test passed.
+
+Browser acceptance after the final edits passed: single Fixed trader selection and replacement, amount/leverage recalculation, zero-balance rejection, funding-route restrictions and QR/status/resume, immutable proposal confirmation, unrecalculated edits staying disabled after overlap acknowledgment, profit/account-value switching, notification settings, and 390px layout without horizontal overflow. Evidence is in the ignored `output/deployment/v17-acceptance/` directory.
+
+Production checks completed: independent Core API/gRPC and dedicated worker are online with one running replica each; service authentication and API route isolation passed; four Agent guards are present and the shared 206-entry migration registry is unchanged. All three MCP services run Fixed safety revision `271081b` and release 0.4.0. Public health/OAuth metadata, 21-tool discovery and reviewed-card hash parity passed. Bridge uses the independent Core with RWA enabled, returned 30 candidates and nine funding routes. Authenticated App copy/portfolio reads have complete coverage; owned deposit address, QR and awaiting-deposit status passed. Empty performance/daily-check-in behavior and notification delivery readiness passed for the signed-in account without an Agent portfolio. Official RWA taxonomy and `xyz` USDC metadata passed; the current strict pool has no RWA-tagged traders and correctly returns no executable RWA plan. Funded fills and physical pushes remain unverified.
+
+Live new-flow acceptance: a 500 USDC single-trader preview returned nine eligible crypto candidates, one Fixed allocation with 20 USDC entry margin, and the opt-in pause/70% emergency-exit policy. No order was submitted.
+
+Account/device acceptance still required:
+- Native report PR 20 is prepared but still separate from the MCP release.
+- Actual wallet transfer, real funded fills and physical-device push require appropriate account/device acceptance; fixture results do not establish those outcomes.
+
+Distribution gate: publish only after server acceptance, complete npm's per-release publisher 2FA, and verify the publicly downloaded package. The release receipt records registry/GitHub URLs separately from runtime and device acceptance.
+
+The six-service Agent rollout has settled. Existing App API/gRPC/worker deployment IDs match the baseline and App readiness/GraphQL reads returned 200; scheduler had a separate deployment outside this Agent patch. Railway permission was explicitly changed by the user to a plugin-specific `Allow all actions` override to remove repeated deployment confirmation. See `v17-rollout.md` for deployment evidence, sequence and rollback boundary.

package/docs/v17-rollout.md

@@ -0,0 +1,44 @@
+# Ride V17 rollout: 0.4.0
+
+Complete the supplied conversational HTML in the independent Agent services. Keep existing App API/gRPC/worker/scheduler sources, environment flags, GraphQL/RPC contracts, copy tables and mobile release unchanged.
+
+## Reviewed source
+
+- MCP branch `codex/ride-v17-complete`, based on the account/login fixes from PR 3. Its new changes are reviewed separately from those prerequisite fixes.
+- Core branch `codex/ride-rwa-worker-v17`, commit `22cc5c0446432b94db88c7b1d48c2dc16b1104fd`, PR 6. It modifies Agent execution handling and adds an internal-only API mode. Qualified markets remain opt-in and require an Agent binding.
+- New Core gRPC initialization applies only Agent execution-table guards and leaves SQLx migration history unchanged. Lock/statement timeouts bound initialization. Non-Agent bindings retain their core-only market restrictions.
+
+## Deployment sequence
+
+1. In `generous-quietude/production`, create `ride-agent-core-grpc-v17` and `ride-agent-core-api-v17` from the pinned Core commit. gRPC listens on 50051; API listens on 8001, checks `/ready`, exposes only health/readiness and authenticated `/internal/agent-core/*`, and starts no legacy forwarders or Meme sync. Set `DIRECT_DEPOSIT_INDEXER_ENABLED=false` on the independent API to avoid duplicating the existing indexer.
+2. Wait for both deployments and readiness, and check the four Agent market guards. Generate an HTTPS API domain for the bridge in the separate Railway project. Verify GraphQL/public App routes are unavailable on this Agent API and internal operations reject missing/invalid service auth.
+3. Point only `ride-agent-execution-prod` at `http://ride-agent-core-grpc-v17.railway.internal:50051`, set its RWA opt-in, and deploy the pinned Core commit. Preserve existing execution/signing/epoch flags and worker mode. Its current baseline is deployment `37f05cc8-c559-4723-85c2-706ed4c97820`.
+4. In `ride-mcp/production`, deploy `agent-bridge` and `agent-backend` from the reviewed MCP commit. Point the bridge to the new protected HTTPS API and set `RIDE_AGENT_RWA_ENABLED=true`. Preserve Firebase, signing credentials, identity URLs and current execution activation flags. Keep one backend monitor and its current zero-overlap setting.
+5. Once bridge/backend health and authenticated read probes pass, deploy `ride-mcp` from the same MCP commit. Verify release 0.4.0, OAuth metadata, MCP tool discovery, cards, owned account reads, deposit options/address/status, performance and report settings without placing orders.
+6. Compare legacy App service deployment IDs/configs against `output/deployment/v17-acceptance/legacy-deployment-baseline.json`, then check App health and representative read paths. Publish npm/GitHub 0.4.0 only after server acceptance; npm requires the publisher's per-release 2FA.
+
+## Current production evidence (2026-10-12)
+
+The independent Core API, gRPC and dedicated execution worker are running pinned revision `22cc5c0`; all three Railway deployments succeeded with one running replica each. The worker connects to the new Agent gRPC in strategy-only mode with the existing Privy signer. Its superseded deployment was retired after the new instance started. Core `/ready` returns 200, missing/invalid service credentials return 401, an authenticated trader-pool read returns 81 rows, and GraphQL returns 404 on the independent API.
+
+The four Agent market guards are installed. The shared SQLx registry remains at 206 entries with the same checksum fingerprint as the pre-deploy baseline. Existing App API, gRPC and worker deployment IDs match the baseline. The App scheduler received a separate deployment during this window; its source branch remains unchanged and it was not included in any Agent patch.
+
+All three MCP services are running safety revision `271081b` and release 0.4.0. Bridge uses `https://ride-agent-core-api-v17-production.up.railway.app` with RWA enabled. Public health, both OAuth metadata endpoints, 21-tool discovery and MCP cards passed; the served card SHA-256 equals the reviewed build. Authenticated App copies and portfolio reads report complete coverage. Funding exposes nine supported routes, the account-owned Arbitrum USDC address and QR are valid, and status correctly reports awaiting deposit without trade-ready funds. Performance returns empty for this account's absent Agent portfolio, daily check-in reports no review, and notification preferences report delivery readiness without claiming a physical push. Live bridge candidate reads returned 30 candidates. Official RWA metadata exposes 207 qualified symbols and verifies USDC collateral for `xyz`; the current strict trader pool contains no RWA-tagged traders, and an RWA recommendation returns empty with `NO_EXECUTABLE_PLAN`.
+
+The final gateway/bridge source patch was applied and both deployments succeeded. During rollout, Railway inherited `Allow low-risk actions` and its approval layer cancelled deployment submission despite the user's authorization. The user explicitly selected a Railway-only `Allow all actions` override; it was set and read back successfully, and submission no longer returns cancellation. Other plugin defaults are unchanged. Registry publication still uses npm's publisher 2FA, which is independent of Railway permission.
+
+A public single-trader Fixed preview returned nine eligible crypto candidates and one allocation, with 20 USDC fixed entry margin and the opt-in pause/70% exit policy. No trading proposal was confirmed and no transfer or order was submitted.
+
+## Validation completed
+
+- TypeScript check and 92 automated tests, including legacy plan limits/stop behavior and new Fixed/proportional, two-stage stop, ownership and preview batch behavior. An additional Fixed regression requires source fills for new assets and direction flips; a complete-history flag with no supporting fills cannot introduce exposure.
+- 35 HTTP/MCP/OAuth/CLI/PostgreSQL scenarios with simulated identities/fills.
+- Package verification: three client setups, three bare-command setups, legacy upgrades, no private history. Skill validation passed.
+- Browser: single Fixed plans and trader replacement; precise edits/recalculation; zero-balance rejection; funding route/address/QR/status and saved-plan resume; frozen confirmation; dirty edits cannot be enabled by toggling the compatibility acknowledgment; portfolio management; chart switching; daily report time/timezone persistence; 390px no horizontal overflow.
+- Core evidence from the original continuation: 8 Strategy gRPC tests, 37 execution tests, disposable PostgreSQL trigger coverage, API/gRPC compilation.
+
+Browser screenshots and local acceptance records are deliberately excluded from the public package. These checks do not establish real-money fills, actual wallet transfers, physical-device push delivery or a mobile App release.
+
+## Rollback
+
+Stop accepting new scoped portfolios if scoped-market acceptance fails. Keep the updated worker reconciling owned scoped inventory and unknown submissions; never restore a core-only worker while such inventory remains. Preserve all receipts and the Agent state/guards. The legacy App release and rollback are independent.

package/docs/widget-account-v043.md

@@ -0,0 +1,17 @@
+# Widget, accounts and trader-count repair (0.4.3)
+
+The preference form previously injected Crypto/BTC/ETH restrictions, and `market=both` required cross-market allocation. Eleven otherwise eligible Perps traders could therefore fail with a hardcoded three-trader diversification message. The form now has one asset preference control, defaulting to `any`, `[]`, and `allow_altcoins=true`. Existing explicit saved choices remain visible. Market selects the allowed universe: either market may be the only market in a returned plan, and that coverage is disclosed.
+
+Candidates are returned and rendered independently of plan generation, including structured error responses. The list shows scores, assets, eligibility, budget qualification, total count, detail/selection controls and local pagination. Single and 2–8 trader plans share one count control. An explicit count is never silently reduced; failures offer feasible alternatives with unchanged risk and loss settings. Allocation minimums are applied before selection. Diagnostics include an ID, failure stage, sequential counts, per-trader exclusions, affected fields, current/required values and count actions. There is no generic success-status text in the Widget.
+
+`get_portfolio` returns `account_balances` separately from Agent and App copies. Copy allocation remaining and Agent bookkeeping are not additional account cash. Perps reads authenticated wallet generations and deduplicates them, matching the App's Classic/Unified equity and Spot valuation rules. Prediction verifies pUSD/USDC.e/native-USDC balances at one Polygon block, independently of the legacy GraphQL zero fallback, and reads complete owned position inventory with pagination. Retained Prediction cash is included in equity but separated from current-wallet availability; the response explains any App display difference. Native USDC funding cash is reported separately from trading equity. Source times and fetch times remain distinct. Reserves absent from the source stay null.
+
+Meme is a separate App wallet/inventory module. Its complete authenticated multi-chain valuation is not exposed by the current account API, so it is explicitly unsupported with null values. The full account total remains null; the verified subtotal includes covered modules only. Every failed, foreign, stale, incomplete or unpriced source remains unavailable rather than zero. Public venue/RPC reads receive only addresses verified by the authenticated Core session; they never receive a Ride token. A shared 22-second deadline bounds balance reads.
+
+New plans carry internal asset-filter metadata. Previously approved plans/portfolios retain their prior execution semantics. Editing an old unrestricted plan produces a new canonical preview and does not mutate the old one. Account coverage cannot overwrite authoritative partial-fill, uncertain or settling execution states. MCP public input schemas remain compatible with the released 0.4.2 clients. The live guide explains the new defaults, candidate errors, account data and count semantics without a new login.
+
+Validation before rollout: TypeScript checks, PostgreSQL-backed unit tests, HTTP/MCP/OAuth/CLI/Pg functional scenarios, package install/setup checks for Codex/Claude Code/Cursor, and browser use of the actual cards and backend with simulated account/venue sources. Regression inputs include 200 USDC, both markets, any assets, medium risk, 10% loss trigger and eleven Perps candidates, with exact 1/2/3/4 trader previews; two candidates retain the list and offer 1/2 instead of changing a four-person request silently. Browser confirmation is simulated and proves no real transfer, signature or exchange fill.
+
+Rollout scope: the independent ride-mcp gateway and agent-backend only. No Rust service, App binary, legacy API/gRPC/worker, schema migration or production preference rewrite is required. Apple login remains deferred. Before/after deployment IDs and legacy readiness are acceptance evidence; local success alone is not production verification.
+
+Local reproduction: `RIDE_AGENT_TEST_DATABASE_URL=postgresql:///DISPOSABLE_DB npm test`; `RIDE_AGENT_FUNCTIONAL_DATABASE_URL=postgresql:///DISPOSABLE_DB npm run test:functional`. Widget fixture: `RIDE_PREVIEW_PORT=17870 RIDE_PREVIEW_POOL_SIZE=11 RIDE_PREVIEW_WIDGET_REGRESSIONS=1 npm run preview:cards`. Loopback fixture endpoints and simulated financial actions are not production features.

package/package.json

@@ -1,6 +1,77 @@
 {
   "name": "@onride/agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.1-rc.0",
+  "private": false,
+  "type": "module",
+  "scripts": {
+    "build": "node scripts-build-ui.mjs && tsc",
+    "start": "node dist/start.js",
+    "test": "tsx --test src/*.test.ts src/agent/*.test.ts src/cli/*.test.ts",
+    "test:functional": "npm run build && tsx scripts/functional-acceptance.ts",
+    "preview:cards": "npm run build && tsx scripts/conversational-preview.ts",
+    "prepare": "npm run build",
+    "prepack": "npm run build",
+    "start:backend": "node dist/backend.js",
+    "start:bridge": "node dist/bridge.js",
+    "check": "tsc --noEmit -p tsconfig.test.json",
+    "dev": "tsx src/server.ts",
+    "verify:package": "node scripts/verify-package.mjs",
+    "verify:release": "node scripts/verify-release.mjs"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "decimal.js": "^10.6.0",
+    "dotenv": "^17.4.2",
+    "ethers": "^6.17.0",
+    "express": "^5.2.1",
+    "fflate": "0.8.3",
+    "pg": "^8.23.1",
+    "qrcode": "^1.5.4",
+    "redis": "^6.0.0",
+    "zod": "^4.1.13"
+  },
+  "overrides": {
+    "body-parser": "2.3.0",
+    "fast-uri": "4.2.1"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/node": "^24.10.1",
+    "@types/pg": "^8.23.1",
+    "@types/qrcode": "^1.5.5",
+    "prettier": "^3.9.9",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "description": "Ride Agent helps you discover traders, build a personalized copy-trading portfolio, and start copying after your confirmation.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/onride-app/ride-agent.git"
+  },
+  "homepage": "https://github.com/onride-app/ride-agent#readme",
+  "bugs": {
+    "url": "https://github.com/onride-app/ride-agent/issues"
+  },
+  "bin": {
+    "ride": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "public/agent.html",
+    "public/confirm.html",
+    "public/fund.html",
+    "skills",
+    "README.md",
+    "LICENSE",
+    "docs",
+    ".env.example"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}