@visa/cli 4.1.0-rc.35 → 4.1.0-rc.37

package/dist/skills/pair-visa-agent/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*
 metadata:
   author: visa
   homepage: https://visacli.sh/agents
-  version: '0.6.4'
+  version: '0.6.5'
   # OpenClaw-namespaced extension (agentskills.io keeps `metadata` free-form, so
   # non-standard runtime config lives here — `user-invocable` is not a standard
   # top-level field). OpenClaw auto-installs `install[]` when `requires.bins` are
@@ -151,6 +151,32 @@ It returns `browserUrl` + `confirmCode` **immediately** and finishes the claim i
 tell the user it will pair automatically. Use the step-by-step flow below only when
 `pair` isn't available (older build) or you need the plugin/MCP tools.
 
+## Returning & already-connected — do NOT re-pair
+
+If `pair`/`enroll` returns **`already_connected`** (or `alreadyConnected: true`), this
+device is **already set up** as an agent — a fresh pairing is neither needed nor
+possible (re-pairing an existing identity silently dead-ends). Do this instead:
+
+1. **Tell the user plainly:** "This device is already connected as `<name>.visa`."
+   Read the name from the response. Do **not** start another hand-off. `--new` /
+   `force:true` exists only if they explicitly want a _second, separate_ agent.
+2. **Report status honestly — "connected" is five separate things**, not one. Never
+   imply the agent can spend just because it's connected:
+   - **Identity** — connected (`.visa` name bound to _this user's_ account). ✓ once `already_connected`.
+   - **Spending** — a _separate human approval_. If `keyBound`/spend isn't set, say:
+     "To let me pay, approve spending in your **account settings → agent card → Spend**."
+     You **cannot** self-grant it; never tell the user to run `visa agent add-rail`
+     (it refuses identity-only agents).
+   - **Mesh (`.visa` messaging)** — with `SUBWAY_MESH=visa`, a returning device now
+     registers on `pair`; if `meshRegistered` is false, `visa register <name>` joins it.
+   - **Trusted (TAP)** — follows spend/provisioning; don't promise it before then.
+3. **Scope everything to the user.** The identity is bound to the account the user
+   signed in with (their email); the wallet + spend limits are theirs. Speak in terms
+   of "your agent / your account / the limits you approved," never a shared identity.
+
+The paid wallet keeps working regardless of the account's spend flag — see "What you
+can do once paired." Missing **spend** blocks _checkout mandates_, not local x402 pay.
+
 ## Core flow
 
 Copy this checklist and track progress:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.35",
+  "version": "4.1.0-rc.37",
   "description": "AI-powered payments for Claude Code",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.35",
+  "version": "4.1.0-rc.37",
   "title": "Visa CLI",
   "description": "Visa Verified Agent payments for coding agents. Enroll a .visa identity, pair a delegated self-custodial wallet with human-approved spend caps, and discover and pay x402 services — all from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.35",
+      "version": "4.1.0-rc.37",
       "transport": {
         "type": "stdio"
       },