@visa/cli 4.1.0-rc.162 → 4.1.0-rc.164

package/dist/skills/pair-visa-agent/RUNTIMES.md

@@ -79,6 +79,7 @@ mcp_servers:
 | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | OpenClaw      | Install `@visa/visa-cli-openclaw` for the `pair_agent_*` tools and bundled skill. The plugin auto-mounts the Visa MCP server. The MCP or raw CLI surfaces remain valid alternatives. |
 | Hermes        | Run `visa-cli connect hermes`, install `pair-visa-agent/SKILL.md` under `~/.hermes/skills/`, and use `enroll_agent`. `hermes claw migrate` can import an existing OpenClaw setup.    |
+| Codex         | Run `visa agent skill --runtime codex`. It plants the skill under `~/.codex/skills/` and mounts the Visa MCP server into `~/.codex/config.toml` in the same step.                   |
 | Other runtime | Put `visa` on `PATH`, mount the same MCP server if supported, or use the raw `visa agent enroll` and `visa agent enroll-claim` commands as the universal fallback.                   |
 
 The skill itself can be installed with `visa agent skill`. Pass `--runtime <name>` or

package/dist/skills/pair-visa-agent/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*
 metadata:
   author: visa
   homepage: https://visacli.sh/agents
-  version: '0.7.0'
+  version: '0.7.1'
   # OpenClaw-namespaced extension (agentskills.io keeps `metadata` free-form, so
   # non-standard runtime config lives here — `user-invocable` is not a standard
   # top-level field). OpenClaw auto-installs `install[]` when `requires.bins` are
@@ -40,6 +40,16 @@ protocol v2 has one ceremony and three equivalent ways to drive it:
 Use the first surface available. Do not mix this flow with older pairing or login flows;
 all three surfaces above wrap the same v2 enrollment ceremony and local pending state.
 
+**Console handoff codes are a separate, compound ceremony.** When the human brings a
+one-time code minted by the Console's Create-agent flow, claim it instead of pairing:
+the code carries server-held, pre-approved terms and resolves identity + spending in one
+run (card auto-activates from the mint consent; wallet still needs one browser approval).
+The MCP tool `agent_handoff_claim` exists only on `@visa/cli` **4.1.0-rc.159 and newer**
+— on an older CLI it is absent from the served tool list and the only path is shelling
+`visa agent handoff-claim <code> --format json`, a different integration with different
+failure modes (the approval URL and verification code arrive mid-run as a structured
+stderr frame). Never assume the tool from documentation alone: check the served list.
+
 ## What pairing establishes
 
 Pairing activates an agent identity on this runtime:
@@ -67,8 +77,8 @@ npm install -g @visa/cli@rc
 visa agent skill
 ```
 
-`visa agent skill` auto-detects OpenClaw, Hermes, and Claude Code, falling back to the
-project-local `./.agents/skills`. Pass `--runtime <name>` or `--dir <path>` to choose a
+`visa agent skill` auto-detects OpenClaw, Hermes, Claude Code, and Codex, falling back to
+the project-local `./.agents/skills`. Pass `--runtime <name>` or `--dir <path>` to choose a
 target, `--force` to overwrite, or `--print` to read without writing. Reload or restart
 the agent runtime after installation so it registers the skill.
 
@@ -134,9 +144,16 @@ mcp_servers:
 ```
 
 Hermes also loads skills **per profile** from `~/.hermes/profiles/<profile>/skills/`, not
-from `~/.hermes/skills/` — on a multi-profile box, install with an explicit target:
-`visa agent skill --dir ~/.hermes/profiles/<profile>/skills`. A flat-dir install exits 0
-and is silently never loaded.
+from `~/.hermes/skills/`. `visa agent skill --runtime hermes` resolves this automatically:
+it targets the single profile when exactly one exists (or the one named by
+`HERMES_PROFILE`), and **fails loudly** on a multi-profile box instead of planting into
+the flat dir nothing reads — pass `--dir ~/.hermes/profiles/<profile>/skills` to choose.
+
+**Hermes sanitizes MCP server names when registering tools.** A server declared
+`visa-cli` in `mcp_servers:` registers its tools as `mcp__visa_cli__<tool>` — with an
+UNDERSCORE, not the declared hyphen. Anything that hardcodes `mcp__visa-cli__<tool>` gets
+`unknown tool` on every call while looking correct in review. Read tool names off the
+live registry; never derive them from the config key.
 
 In Hermes, `hermes claw migrate` can also import this skill and MCP configuration from an
 existing OpenClaw installation. See `RUNTIMES.md` for the complete runtime map.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.162",
+  "version": "4.1.0-rc.164",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.162",
+  "version": "4.1.0-rc.164",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.162",
+      "version": "4.1.0-rc.164",
       "transport": {
         "type": "stdio"
       },