@visa/cli 4.1.0-rc.6 → 4.1.0-rc.61

package/dist/skills/pair-visa-agent/RUNTIMES.md

@@ -0,0 +1,92 @@
+# Running Visa pairing in OpenClaw and Hermes
+
+`@visa/visa-cli-openclaw` is packaged for OpenClaw, but the pairing v2 skill is
+runtime-agnostic. OpenClaw, Hermes, and any runtime that can execute the `visa` CLI or
+mount its MCP server all use the same identity-only enrollment ceremony.
+
+## Plugins are runtime-specific
+
+| Axis            | OpenClaw                                                  | Hermes                                                                                          |
+| --------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
+| Language        | JavaScript/TypeScript                                     | Python                                                                                          |
+| Plugin manifest | `openclaw.plugin.json` + `definePluginEntry` (`index.ts`) | `~/.hermes/plugins/<name>/plugin.yaml` + `__init__.py`, `ctx.register_tool(...)`                |
+| Config file     | `~/.openclaw/openclaw.json`                               | `~/.hermes/config.yaml`                                                                         |
+| Skills          | Markdown `SKILL.md`                                       | Markdown under `~/.hermes/skills/<name>/`                                                       |
+| MCP             | `mcp.servers.*`                                           | `mcp_servers.*`                                                                                 |
+| Migration       | —                                                         | `hermes claw migrate` imports skills, allowlists, compatible MCP servers, memory, and `SOUL.md` |
+
+The OpenClaw JavaScript tools do not load as a Hermes plugin. Portability comes from the
+Markdown skill, CLI, and MCP protocol instead.
+
+## One ceremony, three surfaces
+
+All supported surfaces share the same local pending record and pairing v2 protocol:
+
+1. OpenClaw: `pair_agent_start` / `pair_agent_poll`.
+2. Visa MCP server: `enroll_agent` with `action: "start"` / `action: "claim"`.
+3. Raw CLI: `visa agent enroll --format json` /
+   `visa agent enroll-claim --format json`.
+
+The start operation returns an authorization URL for the human. The browser receives only
+that URL. The runtime retains its private Ed25519 key and local claim material. Polling
+resumes the same pending identity and safely replays the same signed request after an
+interruption.
+
+On activation, use `agentId` as the stable identity. `identityKeyJkt` identifies the
+currently bound Ed25519 public key and can change after key rotation. Activation means the
+identity is paired only; payment methods, email, and tap bindings are separate future or
+follow-up configuration.
+
+## Install and mount
+
+Install the prerelease CLI, which provides both command names and the MCP server:
+
+```sh
+npm install -g @visa/cli@rc
+```
+
+There is no `visa mcp` subcommand. Run `visa-cli connect <runtime>` when supported, or
+configure `@visa/cli/dist/mcp-server/index.js` directly. Replace `<npm root -g>` below
+with the output of `npm root -g`.
+
+OpenClaw (`~/.openclaw/openclaw.json`):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "visa-cli": {
+        "command": "node",
+        "args": ["<npm root -g>/@visa/cli/dist/mcp-server/index.js"]
+      }
+    }
+  }
+}
+```
+
+Hermes (`~/.hermes/config.yaml`):
+
+```yaml
+mcp_servers:
+  visa-cli:
+    command: node
+    args: ['<npm root -g>/@visa/cli/dist/mcp-server/index.js']
+```
+
+## Runtime setup map
+
+| Runtime       | Setup and pairing surface                                                                                                                                                            |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| OpenClaw      | Install `@visa/visa-cli-openclaw` for the `pair_agent_*` tools and bundled skill. The plugin auto-mounts the Visa MCP server. The MCP or raw CLI surfaces remain valid alternatives. |
+| Hermes        | Run `visa-cli connect hermes`, install `pair-visa-agent/SKILL.md` under `~/.hermes/skills/`, and use `enroll_agent`. `hermes claw migrate` can import an existing OpenClaw setup.    |
+| Other runtime | Put `visa` on `PATH`, mount the same MCP server if supported, or use the raw `visa agent enroll` and `visa agent enroll-claim` commands as the universal fallback.                   |
+
+The skill itself can be installed with `visa agent skill`. Pass `--runtime <name>` or
+`--dir <path>` when auto-detection is not appropriate, then reload the runtime.
+
+## Optional Hermes wrapper
+
+A Hermes Python plugin may expose the same `pair_agent_start` and `pair_agent_poll` names
+by calling the canonical raw CLI commands and registering tools with
+`ctx.register_tool(...)`. It is optional: the MCP server and skill already expose the
+same protocol and persisted pairing state without a second implementation.

package/dist/skills/pair-visa-agent/SKILL.md

@@ -0,0 +1,315 @@
+---
+name: pair-visa-agent
+description: Pair a Visa CLI v4 agent identity to this runtime. Present one authorization link and the full public request-key fingerprint to the human, then poll until the runtime's local Ed25519 identity is activated. Use when the user says "pair my agent", "enroll my Visa CLI", "connect my Visa agent", or "set up my agent identity".
+compatibility: Needs the `visa` CLI (`npm i -g @visa/cli@rc`) — run `node scripts/setup.mjs` to install it if missing — plus network access to the Visa authorization service. Works in OpenClaw, Hermes, or any Agent Skills runtime.
+allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*)
+metadata:
+  author: visa
+  homepage: https://visacli.sh/agents
+  version: '0.6.5'
+  # OpenClaw-namespaced extension (agentskills.io keeps `metadata` free-form, so
+  # non-standard runtime config lives here — `user-invocable` is not a standard
+  # top-level field). OpenClaw auto-installs `install[]` when `requires.bins` are
+  # missing; other runtimes (Hermes, Claude Code, …) self-provision via the
+  # bundled `scripts/setup.mjs` (see compatibility + Getting set up). @rc pinned
+  # until 4.1.0 is promoted to latest.
+  openclaw:
+    user-invocable: true
+    emoji: '🔐'
+    requires:
+      bins:
+        - visa
+    install:
+      - kind: node
+        package: '@visa/cli@rc'
+        bins:
+          - visa
+          - visa-cli
+---
+
+# Pair a Visa CLI v4 agent identity
+
+Pair this runtime's locally generated identity with a human-approved Visa agent. Pairing
+protocol v2 has one ceremony and three equivalent ways to drive it:
+
+- **`pair_agent_start` / `pair_agent_poll`** — OpenClaw plugin tools.
+- **`enroll_agent` with `action: "start"` / `action: "claim"`** — the `visa` MCP server tool.
+- **`visa agent enroll --format json` / `visa agent enroll-claim --format json`** — the raw
+  CLI and universal fallback.
+
+Use the first surface available. Do not mix this flow with older pairing or login flows;
+all three surfaces above wrap the same v2 enrollment ceremony and local pending state.
+
+## What pairing establishes
+
+Pairing activates an agent identity on this runtime:
+
+- `agentId` is the server-assigned, stable identifier for the agent.
+- The runtime creates and retains the private Ed25519 identity key. It sends only the
+  public JWK to the service.
+- `identityKeyJkt` is the thumbprint of the currently bound Ed25519 public key. It can
+  change when that key rotates, so it must never be presented or stored as the stable
+  agent identifier.
+- The human receives the authorization URL, stable agent ID, and full public request-key
+  fingerprint for exact comparison. Private key material, the local claim token, and signed
+  protocol messages stay with the runtime.
+- An `activated` result means **identity paired only**. Payment methods, an email address,
+  and tap bindings are separate configuration that may be added later. Do not infer any
+  of those capabilities from pairing success.
+
+## Getting this skill
+
+The skill ships inside the public `@visa/cli` npm package. No clone of the private
+monorepo is required:
+
+```sh
+npm install -g @visa/cli@rc
+visa agent skill
+```
+
+`visa agent skill` auto-detects OpenClaw, Hermes, and Claude Code, falling back to the
+project-local `./.agents/skills`. Pass `--runtime <name>` or `--dir <path>` to choose a
+target, `--force` to overwrite, or `--print` to read without writing. Reload or restart
+the agent runtime after installation so it registers the skill.
+
+Access remains enforced by the Visa service. Installing the public package or skill does
+not authorize an account to pair.
+
+OpenClaw users also receive the skill with the `@visa/visa-cli-openclaw` plugin.
+
+## Getting set up
+
+1. **Install the prerelease CLI.** Run `npm install -g @visa/cli@rc`, or run the bundled
+   idempotent provisioner `node scripts/setup.mjs`. The `@latest` tag may not yet expose
+   the v4 agent commands. Installation puts `visa` and `visa-cli` on `PATH` and includes
+   `@visa/cli/dist/mcp-server/index.js`.
+2. **Mount the MCP server when the runtime supports MCP.**
+   - **OpenClaw:** installing `@visa/visa-cli-openclaw` auto-mounts the server by writing
+     `mcp.servers["visa-cli"]` in `~/.openclaw/openclaw.json`.
+   - **Hermes or another supported runtime:** run `visa-cli connect hermes` or
+     `visa-cli connect <runtime>`. For Hermes, the entry is written under `mcp_servers`
+     in `~/.hermes/config.yaml`.
+   - **No MCP integration:** use the raw `visa agent …` commands.
+3. **Pair.** Follow the core flow below.
+
+## MCP mounting examples
+
+Both runtimes use the same server entrypoint. Replace `<npm root -g>` with the output of
+`npm root -g`.
+
+OpenClaw (`~/.openclaw/openclaw.json`):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "visa-cli": {
+        "command": "node",
+        "args": ["<npm root -g>/@visa/cli/dist/mcp-server/index.js"]
+      }
+    }
+  }
+}
+```
+
+Hermes (`~/.hermes/config.yaml`):
+
+```yaml
+mcp_servers:
+  visa-cli:
+    command: node
+    args: ['<npm root -g>/@visa/cli/dist/mcp-server/index.js']
+```
+
+In Hermes, `hermes claw migrate` can also import this skill and MCP configuration from an
+existing OpenClaw installation. See `RUNTIMES.md` for the complete runtime map.
+
+## JSON and exit-code contract
+
+Prefer structured output and parse it; never scrape prose.
+
+- The OpenClaw and MCP tools return structured objects directly.
+- Raw CLI commands support `--format json`.
+- `visa agent enroll-claim` exits `0` when activated, `3` when the human has not finished,
+  and `1` on a terminal failure.
+
+The start result includes protocol version `2`, `pairingId`, stable `agentId`, full
+`requestKeyFingerprint`, `browserUrl`, and expiry information. The activation result
+includes protocol version `2`, `pairingId`, stable `agentId`, the display name, and
+`identityKeyJkt`.
+
+## Fastest path — one shot (`visa agent pair`)
+
+If the `visa` CLI is on PATH, prefer the one-shot command — it does the whole flow
+from a single call, so the user types nothing after their initial request:
+
+```
+visa agent pair --format json
+```
+
+It returns `browserUrl`, `pairingId`, stable `agentId`, and the full public
+`requestKeyFingerprint` **immediately**. It starts a detached activation process only
+after the pending identity and private key are durable. Present the link and fingerprint
+for exact browser comparison. When `claiming` is `background`, activation completes after
+approval without another command; if it is `manual`, run the returned `recoveryCommand`
+after approval. Use the step-by-step flow below when `pair` is unavailable or when driving
+the plugin/MCP tools.
+
+## Returning & already-connected — do NOT re-pair
+
+If `pair`/`enroll` returns **`already_connected`** (or `alreadyConnected: true`), this
+device is **already set up** as an agent — a fresh pairing is neither needed nor
+possible (re-pairing an existing identity silently dead-ends). Do this instead:
+
+1. **Tell the user plainly:** "This device is already connected as `<name>.visa`."
+   Read the name from the response. Do **not** start another hand-off. `--new` /
+   `force:true` exists only if they explicitly want a _second, separate_ agent.
+2. **Report status honestly — "connected" is five separate things**, not one. Never
+   imply the agent can spend just because it's connected:
+   - **Identity** — connected (`.visa` name bound to _this user's_ account). ✓ once `already_connected`.
+   - **Spending** — a _separate human approval_. If `keyBound`/spend isn't set, say:
+     "To let me pay, approve spending in your **account settings → agent card → Spend**."
+     You **cannot** self-grant it; never tell the user to run `visa agent add-rail`
+     (it refuses identity-only agents).
+   - **Mesh (`.visa` messaging)** — with `SUBWAY_MESH=visa`, a returning device now
+     registers on `pair`; if `meshRegistered` is false, `visa register <name>` joins it.
+   - **Trusted (TAP)** — follows spend/provisioning; don't promise it before then.
+3. **Scope everything to the user.** The identity is bound to the account the user
+   signed in with (their email); the wallet + spend limits are theirs. Speak in terms
+   of "your agent / your account / the limits you approved," never a shared identity.
+
+The paid wallet keeps working regardless of the account's spend flag — see "What you
+can do once paired." Missing **spend** blocks _checkout mandates_, not local x402 pay.
+
+## Core flow
+
+- [ ] Start the pairing with `pair_agent_start`, `enroll_agent` action `start`, or
+      `visa agent enroll --format json`.
+- [ ] Present the authorization URL, stable agent ID, and full public fingerprint to the human.
+- [ ] Poll with `pair_agent_poll`, `enroll_agent` action `claim`, or
+      `visa agent enroll-claim --format json`.
+- [ ] Report the stable `agentId` and that the identity is paired on this runtime.
+
+### 1. Start
+
+Start once. If there is already a pending pairing, poll it before creating another.
+
+The result provides `browserUrl`, stable `agentId`, and `requestKeyFingerprint`. Show the
+URL as a bare, tappable value on its own line. Do not decorate it as a Markdown link or put
+it in a code span; chat clients reliably recognize the bare URL. Show the complete
+fingerprint without truncation and tell the human to approve only when every character
+matches the browser review page.
+
+Use this concise shape:
+
+> 🔐 Pair your Visa agent — open this authorization page:
+>
+> 👉 &lt;browserUrl, bare and on its own line&gt;
+>
+> Stable agent ID: &lt;agentId&gt;
+>
+> Public request-key fingerprint — compare every character in the browser:
+> &lt;requestKeyFingerprint, complete and untruncated&gt;
+>
+> Approve only if the fingerprint matches, then tell me when it is finished. The link
+> expires shortly.
+
+Do not ask the human for a code, secret, private key, token, or signed message. The URL,
+stable agent ID, and public fingerprint are review values, not claim credentials.
+
+### 2. Poll
+
+Poll the same pending pairing. Interpret results as follows:
+
+- `activated` — pairing is complete. Continue to the completion report.
+- `not_ready` with `likelyExpired: false` — the human has not finished. Wait and poll
+  again, using bounded retries rather than an endless loop.
+- `not_ready` with `likelyExpired: true` — the authorization window probably expired.
+  Start a fresh pairing.
+- `no_pending` — this runtime has no resumable pairing. Start a fresh pairing.
+- `error` — surface the error without exposing local pending data. Retry once if it is a
+  transient network failure; otherwise stop and ask the human to start again.
+
+### 3. Report completion
+
+On `activated`, report the display name when present and the stable `agentId`. You may
+also report `identityKeyJkt` as the current key fingerprint, but label it clearly as a
+rotatable key identifier.
+
+Use precise completion language:
+
+> Visa agent &lt;displayName&gt; is paired to this runtime. Stable agent ID: &lt;agentId&gt;.
+
+Do not claim that activation configured payments, email, tap bindings, or any other
+product capability. Those are separate follow-up configuration flows.
+
+## Interruption and replay safety
+
+The runtime persists its v2 pending record before sending the signed claim. If a request
+or response is interrupted, the next poll resumes the exact same `pairingId`, `agentId`,
+Ed25519 identity, and claim material. This makes an identical retry safe and avoids
+creating a second identity because a response was lost.
+
+The pending record remains until the activated agent record has been written durably.
+Therefore:
+
+- Poll before starting over.
+- Do not delete or edit pending files to fix a transient failure.
+- Do not regenerate keys for an existing pairing.
+- Do not copy pending state between runtimes.
+
+## Optional `.visa` mesh binding (separate from pairing)
+
+Pairing does not register a `.visa` name, TAP key, or Subway peer. If the operator has
+separately enabled and registered those channel bindings, the mounted `visa-cli` MCP server
+may expose `subway_register`, `subway_send`, `subway_inbox`, and `subway_find`.
+
+Mesh messaging is available only on a compatible RC/dev build with `SUBWAY_MESH=visa` and
+a reachable `SUBWAY_RELAY_MULTIADDR`. If those tools or the relay are unavailable, report
+that clearly and stop. Do not imply that identity pairing alone granted directory or
+messaging authority, and do not improvise another transport.
+
+## Optional checkout profile (separate from pairing)
+
+Pairing does not enable card checkout. If the operator has separately provisioned card
+authority, enabled `checkout_agent_access`, and opted the MCP server into submission with
+`CHECKOUT_AGENT_ALLOW_SUBMIT=1`, the experimental `pay_merchant` flow also needs a local
+`~/.visa-mcp/contact.json` file. Collect every value from the human before the first review;
+never infer or invent identity or address data. Write the file with mode `0600`.
+
+```jsonc
+{
+  "fullName": "Ada Lovelace",
+  "email": "ada@example.com",
+  "addressLine1": "1 Analytical Way",
+  "addressLine2": "",
+  "city": "San Francisco",
+  "state": "CA",
+  "postalCode": "94105",
+  "country": "US",
+}
+```
+
+`fullName` must be non-blank; `firstName` plus `lastName` is also accepted. The engine reads
+the exact keys `fullName`, `firstName`, `lastName`, `email`, `addressLine1`, `addressLine2`,
+`city`, `state`, `postalCode`, and `country`. The profile supplies checkout/cardholder and
+billing data only. Its `email` value is not the account's verified owner email, an agent
+mailbox, key proof, recovery factor, or permission to spend.
+
+## Security rules
+
+- Never read, print, log, paste, or transmit the private Ed25519 JWK or local claim token.
+- Never read or echo the pending pairing file. Present only the authorization URL returned
+  by the supported command or tool.
+- Never treat `identityKeyJkt` as the stable identity. Use `agentId` for references and
+  persistence.
+- Never fetch the authorization URL on the human's behalf. The human reviews and approves
+  it in their browser.
+- Never invent a secondary pairing path when polling fails. Preserve the pending state,
+  surface the error, and retry or restart through the same canonical enrollment flow.
+
+## Further docs
+
+- `RUNTIMES.md` — OpenClaw, Hermes, and raw CLI setup.
+- `docs/agents/ARCHITECTURE.md` — where enrollment sits in the v4 request paths.
+- `visacli.sh/agents` — product-facing agent documentation.

package/dist/skills/pair-visa-agent/scripts/setup.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Portable provisioner for the pair-visa-agent skill.
+//
+// Ensures the `visa` CLI is installed so ANY Agent Skills runtime can pair —
+// not just OpenClaw (whose `metadata.openclaw.install` auto-runs). Hermes,
+// Claude Code, and any other agentskills.io-compatible runtime run this bundled
+// script per the standard's `scripts/` execution stage.
+//
+// Safe to run repeatedly: it no-ops when `visa` already resolves. Pinned to @rc
+// because the v4 agent surface is prerelease (the @latest tag predates the
+// `visa agent` commands); drop the tag once 4.1.0 is promoted to latest.
+
+import { execSync } from 'node:child_process'
+
+function resolves(cmd) {
+  try {
+    execSync(`${cmd} --version`, { stdio: 'ignore' })
+    return true
+  } catch {
+    return false
+  }
+}
+
+if (resolves('visa') || resolves('visa-cli')) {
+  console.log('✓ visa CLI already installed — nothing to do. Run the pairing flow in SKILL.md.')
+  process.exit(0)
+}
+
+console.log('Installing @visa/cli@rc (the v4 agent surface is prerelease)…')
+try {
+  execSync('npm install -g @visa/cli@rc', { stdio: 'inherit' })
+} catch {
+  console.error(
+    'Global install failed. Try `npm install -g @visa/cli@rc` manually (may need sudo, or set a\n' +
+      'user-writable npm prefix: `npm config set prefix ~/.npm-global` and add its `bin` to PATH).'
+  )
+  process.exit(1)
+}
+
+if (!resolves('visa') && !resolves('visa-cli')) {
+  console.error(
+    'Installed, but `visa` is not on PATH. Ensure your npm global bin dir is on PATH\n' +
+      '(`npm bin -g` shows it), then re-run this script.'
+  )
+  process.exit(1)
+}
+
+console.log('✓ visa CLI ready. Now run the pairing flow in SKILL.md.')

package/install.ps1

@@ -168,7 +168,6 @@ if ($npmExitCode -ne 0) {
 # Verify
 $cliCommandNames = Get-InstalledCliCommands
 $verifiedCommand = $null
-$verifiedCommandPath = $null
 $visaVersion = $null
 
 foreach ($commandName in $cliCommandNames) {
@@ -177,12 +176,9 @@ foreach ($commandName in $cliCommandNames) {
         continue
     }
 
-    # Capture the resolved executable path so the setup hand-off below runs
-    # exactly the binary verified here, not a fresh PATH lookup.
     $versionOutput = (& $commandInfo.Source --version 2>$null | Select-Object -First 1)
     if ($LASTEXITCODE -eq 0 -and $versionOutput) {
         $verifiedCommand = $commandName
-        $verifiedCommandPath = $commandInfo.Source
         $visaVersion = $versionOutput.Trim()
         break
     }
@@ -191,46 +187,12 @@ foreach ($commandName in $cliCommandNames) {
 Write-Host ""
 if ($verifiedCommand) {
     Write-Host "  Visa CLI $visaVersion installed." -ForegroundColor Green
-
-    # Hand off straight into setup so install -> setup -> signed-in is one
-    # uninterrupted flow. Hardening:
-    #  * Auto-launch only on an interactive console with input/output/error
-    #    all attached - setup must prompt and open a browser. Redirected
-    #    streams and CI fall back to printing the next step.
-    #  * Invoke $verifiedCommandPath (the path verified just above), not a
-    #    bare command name re-resolved through PATH.
-    #  * Pass only the literal "setup" argument - nothing caller-controlled.
-    if ($Host.Name -eq 'ConsoleHost' -and -not [Console]::IsInputRedirected -and -not [Console]::IsOutputRedirected -and -not [Console]::IsErrorRedirected -and -not $env:CI) {
-        Write-Host ""
-        Write-Host "  Continuing to setup..." -ForegroundColor Cyan
-        Write-Host ""
-        try {
-            $setupProcess = Start-Process -FilePath $verifiedCommandPath -ArgumentList @('setup') -Wait -NoNewWindow -PassThru -ErrorAction Stop
-        } catch {
-            Write-Host ""
-            Write-Host "  Setup could not start. Visa CLI is installed." -ForegroundColor Yellow
-            Write-Host "  PowerShell error: $($_.Exception.Message)" -ForegroundColor Yellow
-            Write-Host "  run '$verifiedCommand setup' when you're ready to finish." -ForegroundColor Yellow
-            Wait-BeforeExit
-            exit 1
-        }
-        if ($setupProcess.ExitCode -ne 0) {
-            Write-Host ""
-            Write-Host "  Setup exited before completion. Visa CLI is installed." -ForegroundColor Yellow
-            Write-Host "  run '$verifiedCommand setup' when you're ready to finish." -ForegroundColor Yellow
-            Wait-BeforeExit
-            exit 1
-        }
-        exit 0
-    } else {
-        Write-Host "  Run '$verifiedCommand setup' to get started." -ForegroundColor Cyan
-        Write-Host "  After setup, run /mcp inside Claude Code, not PowerShell, if Claude Code was already open." -ForegroundColor Cyan
-    }
+    Write-Host "  Connect an AI client with: $verifiedCommand connect <client>" -ForegroundColor Cyan
+    Write-Host "  Then ask your agent to call enroll_agent." -ForegroundColor Cyan
     Write-Host ""
 } else {
     $primaryCommand = $cliCommandNames | Select-Object -First 1
     Write-Host "  Installed but '$primaryCommand' was not runnable from PATH yet." -ForegroundColor Yellow
-    Write-Host "  Close and reopen PowerShell, then run: $primaryCommand setup" -ForegroundColor Yellow
-    Write-Host "  Run /mcp inside Claude Code after setup if you need to reconnect the MCP server." -ForegroundColor Yellow
+    Write-Host "  Close and reopen PowerShell, then run: $primaryCommand connect <client>" -ForegroundColor Yellow
     Write-Host ""
 }

package/install.sh

@@ -99,9 +99,6 @@ fi
 echo "$NPM_OUTPUT"
 
 # ── verify ────────────────────────────────────────────────────────────────────
-# Capture the absolute path resolved here so the setup hand-off below invokes
-# exactly the binary we just verified, instead of re-resolving "visa-cli"
-# through $PATH a second time.
 VISA_BIN=""
 VISA_VERSION=""
 if VISA_BIN="$(command -v visa-cli 2>/dev/null)"; then
@@ -111,40 +108,11 @@ fi
 echo ""
 if [ -n "$VISA_VERSION" ]; then
   ok "Visa CLI ${VISA_VERSION} installed."
-  # Hand off straight into setup so install -> setup -> signed-in is one
-  # uninterrupted flow. Hardening:
-  #  * Auto-launch only when output streams are real terminals and setup can
-  #    read from either stdin or /dev/tty. That keeps `curl ... | bash` usable:
-  #    the script arrives on stdin, while setup prompts still read from the
-  #    user's terminal. CI and redirected output print the next step instead.
-  #  * Invoke "$VISA_BIN" (the path verified just above), never a bare
-  #    "visa-cli" re-resolved through $PATH at call time.
-  #  * Pass only the literal "setup" argument — "$@" is never forwarded — so
-  #    nothing the script's caller controls reaches the installed binary.
-  if [ -t 1 ] && [ -t 2 ] && { [ -t 0 ] || [ -r /dev/tty ]; }; then
-    echo ""
-    info "Continuing to setup..."
-    echo ""
-    SETUP_EXIT=0
-    if [ -t 0 ]; then
-      "$VISA_BIN" setup || SETUP_EXIT=$?
-    else
-      "$VISA_BIN" setup </dev/tty || SETUP_EXIT=$?
-    fi
-    if [ "$SETUP_EXIT" -ne 0 ]; then
-      echo ""
-      warn "Setup exited before completion. Visa CLI is installed."
-      warn "run 'visa-cli setup' when you're ready to finish."
-      exit 1
-    fi
-    exit 0
-  else
-    info "Run 'visa-cli setup' to get started."
-    info "After setup, run /mcp inside Claude Code, not Terminal, if Claude Code was already open."
-  fi
+  info "Connect an AI client with: visa-cli connect <client>"
+  info "Then ask your agent to call enroll_agent."
 else
   warn "Installed, but 'visa-cli' was not found on PATH."
-  warn "You may need to restart your shell, then run: visa-cli setup"
+  warn "Restart your shell, then run: visa-cli connect <client>"
 fi
 echo ""
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.6",
-  "description": "AI-powered payments for Claude Code",
+  "version": "4.1.0-rc.61",
+  "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",
     "visa": "./bin/visa-cli.js"
@@ -9,7 +9,7 @@
   "scripts": {
     "sync:server-json": "node scripts/sync-server-json.mjs",
     "check:server-json": "node scripts/sync-server-json.mjs --check",
-    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/wallet-tools build",
+    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/shared build && pnpm --filter @visa/observability build && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/agent-mail build && pnpm --filter @visa/wallet-tools build && pnpm --filter @visa/checkout-engine build",
     "build": "tsc --noEmit && node esbuild.config.js",
     "prepack": "node scripts/sync-server-json.mjs --check",
     "dev": "tsc --watch",
@@ -22,7 +22,6 @@
     "test:smoke": "VISA_AUTH_URL=https://auth.visacli.sh jest --config jest.smoke.config.js",
     "test:integration": "jest --config jest.integration.config.js",
     "test:e2e": "jest --config jest.e2e.config.js",
-    "test:catalog-e2e": "jest --config jest.catalog-e2e.config.js",
     "test:all": "npm run test:unit && npm run test:integration && npm run test:e2e",
     "prepublishOnly": "npm run build && npm test",
     "lint": "eslint src/**/*.ts",
@@ -43,6 +42,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "@ucp-js/sdk": "0.4.1",
     "commander": "^12.1.0",
     "zod": "^3.23.0"
   },
@@ -53,10 +53,14 @@
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
     "@multiformats/multiaddr": "^13.0.3",
-    "uint8arrays": "^6.1.1"
+    "uint8arrays": "^6.1.1",
+    "playwright-core": "^1.48.2"
   },
   "devDependencies": {
+    "@visa/agent-mail": "workspace:*",
+    "@visa/checkout-engine": "workspace:*",
     "@visa/crypto": "workspace:*",
+    "@visa/identity": "workspace:*",
     "subway-sdk": "workspace:*",
     "@visa/money": "workspace:*",
     "@visa/wallet": "workspace:*",
@@ -67,8 +71,8 @@
     "@changesets/cli": "^2.31.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.1.0",
-    "@typescript-eslint/eslint-plugin": "^8.63.0",
-    "@typescript-eslint/parser": "^8.63.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
     "@types/express": "^5.0.0",
     "esbuild": "^0.28.1",
     "express": "^4.21.0",

package/server.json

@@ -1,15 +1,15 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.6",
+  "version": "4.1.0-rc.61",
   "title": "Visa CLI",
-  "description": "AI-powered payments and creative tools for coding agents. Generate images, music, video, query crypto prices, and make purchases — all from your AI coding assistant.",
+  "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.6",
+      "version": "4.1.0-rc.61",
       "transport": {
         "type": "stdio"
       },