@visa/cli 4.1.0-rc.163 → 4.1.0-rc.165

package/dist/skills/pair-visa-agent/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*
 metadata:
   author: visa
   homepage: https://visacli.sh/agents
-  version: '0.7.0'
+  version: '0.7.1'
   # OpenClaw-namespaced extension (agentskills.io keeps `metadata` free-form, so
   # non-standard runtime config lives here — `user-invocable` is not a standard
   # top-level field). OpenClaw auto-installs `install[]` when `requires.bins` are
@@ -40,6 +40,16 @@ protocol v2 has one ceremony and three equivalent ways to drive it:
 Use the first surface available. Do not mix this flow with older pairing or login flows;
 all three surfaces above wrap the same v2 enrollment ceremony and local pending state.
 
+**Console handoff codes are a separate, compound ceremony.** When the human brings a
+one-time code minted by the Console's Create-agent flow, claim it instead of pairing:
+the code carries server-held, pre-approved terms and resolves identity + spending in one
+run (card auto-activates from the mint consent; wallet still needs one browser approval).
+The MCP tool `agent_handoff_claim` exists only on `@visa/cli` **4.1.0-rc.159 and newer**
+— on an older CLI it is absent from the served tool list and the only path is shelling
+`visa agent handoff-claim <code> --format json`, a different integration with different
+failure modes (the approval URL and verification code arrive mid-run as a structured
+stderr frame). Never assume the tool from documentation alone: check the served list.
+
 ## What pairing establishes
 
 Pairing activates an agent identity on this runtime:
@@ -134,9 +144,16 @@ mcp_servers:
 ```
 
 Hermes also loads skills **per profile** from `~/.hermes/profiles/<profile>/skills/`, not
-from `~/.hermes/skills/` — on a multi-profile box, install with an explicit target:
-`visa agent skill --dir ~/.hermes/profiles/<profile>/skills`. A flat-dir install exits 0
-and is silently never loaded.
+from `~/.hermes/skills/`. `visa agent skill --runtime hermes` resolves this automatically:
+it targets the single profile when exactly one exists (or the one named by
+`HERMES_PROFILE`), and **fails loudly** on a multi-profile box instead of planting into
+the flat dir nothing reads — pass `--dir ~/.hermes/profiles/<profile>/skills` to choose.
+
+**Hermes sanitizes MCP server names when registering tools.** A server declared
+`visa-cli` in `mcp_servers:` registers its tools as `mcp__visa_cli__<tool>` — with an
+UNDERSCORE, not the declared hyphen. Anything that hardcodes `mcp__visa-cli__<tool>` gets
+`unknown tool` on every call while looking correct in review. Read tool names off the
+live registry; never derive them from the config key.
 
 In Hermes, `hermes claw migrate` can also import this skill and MCP configuration from an
 existing OpenClaw installation. See `RUNTIMES.md` for the complete runtime map.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.163",
+  "version": "4.1.0-rc.165",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.163",
+  "version": "4.1.0-rc.165",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.163",
+      "version": "4.1.0-rc.165",
       "transport": {
         "type": "stdio"
       },