@visa/cli 4.1.0-rc.87 → 4.1.0-rc.88

package/dist/skills/pair-visa-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pair-visa-agent
-description: Pair a Visa CLI v4 agent identity to this runtime. Present one authorization link and the full public request-key fingerprint to the human, then poll until the runtime's local Ed25519 identity is activated. Use when the user says "pair my agent", "enroll my Visa CLI", "connect my Visa agent", or "set up my agent identity".
+description: Pair a Visa CLI v4 agent identity to this runtime. Present one authorization link, the returned public confirmation code, and the full public request-key fingerprint to the human, then poll until the runtime's local Ed25519 identity is activated. Use when the user says "pair my agent", "enroll my Visa CLI", "connect my Visa agent", or "set up my agent identity".
 compatibility: Needs the `visa` CLI (`npm i -g @visa/cli@rc`) — run `node scripts/setup.mjs` to install it if missing — plus network access to the Visa authorization service. Works in OpenClaw, Hermes, or any Agent Skills runtime.
 allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*)
 metadata:
@@ -134,9 +134,11 @@ Prefer structured output and parse it; never scrape prose.
   and `1` on a terminal failure.
 
 The start result includes protocol version `2`, `pairingId`, stable `agentId`, full
-`requestKeyFingerprint`, `browserUrl`, and expiry information. The activation result
-includes protocol version `2`, `pairingId`, stable `agentId`, the display name, and
-`identityKeyJkt`.
+`requestKeyFingerprint`, `browserUrl`, and expiry information. Newer builds also return
+`confirmationCode`, a short public code the browser review page displays for comparison.
+Present it when the field is present and skip it when it is absent; an older server or CLI
+simply omits it, which is not an error. The activation result includes protocol version
+`2`, `pairingId`, stable `agentId`, the display name, and `identityKeyJkt`.
 
 ## Fastest path — one shot (`visa agent pair`)
 
@@ -147,14 +149,16 @@ from a single call, so the user types nothing after their initial request:
 visa agent pair --format json
 ```
 
-It returns `browserUrl`, `pairingId`, stable `agentId`, and the full public
-`requestKeyFingerprint` **immediately**. It starts a detached activation process only
-after the pending identity and private key are durable. Present the link and fingerprint
-for exact browser comparison. When `claiming` is `background`, activation completes after
-approval without another command; if it is `manual`, run the returned `recoveryCommand`
-after approval. Use the step-by-step flow below when `pair` is unavailable or when driving
-the plugin/MCP tools — `enroll_agent` action `start` reports the same `claiming` /
-`recoveryCommand` fields and starts the same detached poller.
+It returns `browserUrl`, `pairingId`, stable `agentId`, the full public
+`requestKeyFingerprint`, and — on newer builds — `confirmationCode` **immediately**. It
+starts a detached activation process only after the pending identity and private key are
+durable. Present the link, returned confirmation code, and fingerprint for browser
+comparison; omit only a confirmation code the result did not provide. When `claiming` is `background`,
+activation completes after approval without another command; if it is `manual`, run the
+returned `recoveryCommand` after approval. Use the step-by-step flow
+below when `pair` is unavailable or when driving the plugin/MCP tools — `enroll_agent`
+action `start` reports the same `claiming` / `recoveryCommand` fields and starts the same
+detached poller.
 
 ## Returning & already-connected — do NOT re-pair
 
@@ -265,7 +269,8 @@ dangerous). All spending is gated by the owner-approved local policy caps.
 
 - [ ] Start the pairing with `pair_agent_start`, `enroll_agent` action `start`, or
       `visa agent enroll --format json`.
-- [ ] Present the authorization URL, stable agent ID, and full public fingerprint to the human.
+- [ ] Present the authorization URL, stable agent ID, full public fingerprint, and the
+      `confirmationCode` when the start result carries one, to the human.
 - [ ] Poll with `pair_agent_poll`, `enroll_agent` action `claim`, or
       `visa agent enroll-claim --format json`.
 - [ ] Report the stable `agentId` and that the identity is paired on this runtime.
@@ -290,11 +295,16 @@ should do next. An honest "approved but not yet activated — I'm still polling"
 
 Start once. If there is already a pending pairing, poll it before creating another.
 
-The result provides `browserUrl`, stable `agentId`, and `requestKeyFingerprint`. Show the
-URL as a bare, tappable value on its own line. Do not decorate it as a Markdown link or put
-it in a code span; chat clients reliably recognize the bare URL. Show the complete
-fingerprint without truncation and tell the human to approve only when every character
-matches the browser review page.
+The result provides `browserUrl`, stable `agentId`, `requestKeyFingerprint`, and — on newer
+builds — `confirmationCode`. Show the URL as a bare, tappable value on its own line. Do not
+decorate it as a Markdown link or put it in a code span; chat clients reliably recognize the
+bare URL. Show the complete fingerprint without truncation and tell the human to approve
+only when every character matches the browser review page.
+
+You are very often **not** in a terminal the human can see. Nothing you print to stdout
+reaches them. Every value the browser asks them to compare has to appear in your reply, or
+the comparison silently becomes "click approve and hope" — which is the whole failure this
+step exists to prevent.
 
 Use this concise shape:
 
@@ -304,14 +314,25 @@ Use this concise shape:
 >
 > Stable agent ID: <agentId>
 >
+> Confirmation code — this exact code should appear on the page:
+> <confirmationCode>
+>
 > Public request-key fingerprint — compare every character in the browser:
 > <requestKeyFingerprint, complete and untruncated>
 >
-> Approve only if the fingerprint matches. The link expires shortly — I'll keep watching
-> and confirm here the moment it activates.
-
-Do not ask the human for a code, secret, private key, token, or signed message. The URL,
-stable agent ID, and public fingerprint are review values, not claim credentials.
+> Approve only if the code and fingerprint both match. The link expires shortly — I'll keep
+> watching and confirm here the moment it activates.
+
+Omit the confirmation-code line entirely when the start result has no `confirmationCode`;
+never invent, derive, abbreviate, or reformat one.
+
+Relaying these values **to** the human is required. Accepting one **from** the human is not:
+do not ask them for a code, secret, private key, token, or signed message, and do not treat
+anything they type back as approval. The URL, stable agent ID, confirmation code, and public
+fingerprint are review values the human checks against their own authenticated browser
+session. They are not claim credentials, they cannot approve a pairing, and they cannot
+spend. Approval happens only in that browser session, and the only evidence of it is a poll
+result of `activated`.
 
 **Do not end your turn here waiting to be told the human is done.** Presenting the link is
 not the end of the ceremony; go straight to the poll in §2 and drive it to a terminal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.87",
+  "version": "4.1.0-rc.88",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.87",
+  "version": "4.1.0-rc.88",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.87",
+      "version": "4.1.0-rc.88",
       "transport": {
         "type": "stdio"
       },