agentbundle-cli 0.1.2 → 0.2.0

package/README.md

@@ -5,22 +5,27 @@ One command to give your AI agent the three things it needs to act online — a
 you through installing all three, one at a time, and registers each as an MCP server.
 
 ```bash
-npx agentbundle-cli
+npx agent-bundle
 ```
 
 ## What it does
 
-It asks for **one email up front** and reuses it for all three sign-ups (the Agentcard magic
-link and the AgentMail + AgentPhone verification codes), then runs a guided, three-step onboarding:
+A guided, three-step onboarding:
 
 1. **Agentcard** — installs the `agent-cards` CLI, signs you up (one magic-link email click),
    registers + authenticates the MCP server via `agent-cards setup-mcp` (hosted HTTP), and offers
    to switch to production (real cards).
-2. **AgentMail** — fully automated: signs you up via the API (no console visit), provisions an
-   inbox, you type in the verification code, and it registers the hosted HTTP MCP server
-   (`mcp.agentmail.to`). Sign-ups are tagged with the `agentbundle` referrer.
+2. **AgentMail** — takes your API key (or points you to the console to make one) and registers the
+   hosted HTTP MCP server (`mcp.agentmail.to`).
 3. **AgentPhone** — fully automated: requests a verification code by email, you type it in, it
    provisions a real US number, and registers the stdio MCP server (`npx -y agentphone-mcp`). No browser.
+4. **Agent Bundle** — with all three installed, it offers the bundle subscription: **$20/mo** for
+   Agentcard + AgentMail + AgentPhone together (about half of buying them standalone). It opens a
+   Stripe-hosted checkout on the bundle server (theagentbundle.com), keyed by your email — no charge
+   until you enter a card and confirm on Stripe's page. Re-run with `--only bundle` anytime.
+
+Every account is created in **production** — real inboxes, real numbers, and live Agentcard cards.
+There is no test or sandbox mode.
 
 All MCP servers are registered at **user scope** (available in every project), via `claude mcp add`.
 
@@ -30,9 +35,7 @@ It's **idempotent** — anything already configured is skipped, so it's safe to
 
 | Flag | Effect |
 |---|---|
-| `--only <agentcard\|agentmail\|agentphone>` | Run just one product. |
-| `--email <you@example.com>` | Email used for all three sign-ups (skips the up-front prompt). |
-| `--sandbox` | Walk the whole flow with stub signups + a throwaway config — no real accounts, no charges. |
+| `--only <agentcard\|agentmail\|agentphone\|bundle>` | Run just one product, or `bundle` for the $20/mo bundle checkout. |
 | `--dry-run` | Print what it would do, change nothing. |
 | `--yes`, `-y` | Accept defaults, skip confirmations. |
 | `--no-color` | Plain output. |
@@ -41,20 +44,17 @@ It's **idempotent** — anything already configured is skipped, so it's safe to
 ## Skip prompts with env vars
 
 ```bash
-export AGENT_BUNDLE_EMAIL=you@example.com   # used for all three sign-ups
-export AGENTMAIL_API_KEY=am_...              # already have a key? skip the AgentMail sign-up
+export AGENTMAIL_API_KEY=am_...
 export AGENTPHONE_API_KEY=sk_live_...
-npx agentbundle-cli
+npx agent-bundle
 ```
 
-## Test it safely
+## Preview without changing anything
 
-This writes the MCP config to a throwaway file and uses stub signups — your real `~/.claude`
-config is never touched and no money is spent:
+Use `--dry-run` to print every step it would take without touching your config or creating accounts:
 
 ```bash
-AGENT_BUNDLE_MCP_CONFIG=/tmp/bundle-test.json npx . --sandbox
-cat /tmp/bundle-test.json
+npx agent-bundle --dry-run
 ```
 
 ## How config is written

package/bin/agent-bundle.js

@@ -4,35 +4,30 @@
 
 const ui = require('../lib/ui');
 const mcp = require('../lib/mcp');
-const ac = require('../lib/agentcard-api');
 const agentcard = require('../lib/steps/agentcard');
 const agentmail = require('../lib/steps/agentmail');
 const agentphone = require('../lib/steps/agentphone');
+const bundle = require('../lib/steps/bundle');
 
-const MODULES = {
-  agentcard,
-  agentmail,
-  agentphone,
-};
 const STEPS = {
   agentcard: agentcard.step,
   agentmail: agentmail.step,
   agentphone: agentphone.step,
 };
 
+// The bundle subscription runs after the three products, not as one of them.
+const ONLY_TARGETS = new Set([...Object.keys(STEPS), 'bundle']);
+
 function parseArgs(argv) {
-  const ctx = { dryRun: false, sandbox: false, yes: false, only: null, help: false, email: (process.env.AGENT_BUNDLE_EMAIL || '').trim() };
+  const ctx = { dryRun: false, yes: false, only: null, help: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--dry-run') ctx.dryRun = true;
-    else if (a === '--sandbox') ctx.sandbox = true;
     else if (a === '--yes' || a === '-y') ctx.yes = true;
     else if (a === '--no-color') {/* handled in ui */}
     else if (a === '--help' || a === '-h') ctx.help = true;
     else if (a === '--only') ctx.only = (argv[++i] || '').toLowerCase();
     else if (a.startsWith('--only=')) ctx.only = a.slice(7).toLowerCase();
-    else if (a === '--email') ctx.email = (argv[++i] || '').trim();
-    else if (a.startsWith('--email=')) ctx.email = a.slice(8).trim();
   }
   return ctx;
 }
@@ -42,16 +37,13 @@ function help() {
   ui.info('Guided setup for your agent\'s card, inbox, and phone.\n');
   ui.info(ui.c.bold('Usage:') + '  npx agentbundle-cli [options]\n');
   ui.info(ui.c.bold('Options:'));
-  ui.dim('--only <agentcard|agentmail|agentphone>   run just one product');
-  ui.dim('--email <you@example.com>   email used for all three sign-ups (skips the prompt)');
-  ui.dim('--sandbox    walk the whole flow with stub signups + a throwaway config (no money, no real accounts)');
+  ui.dim('--only <agentcard|agentmail|agentphone|bundle>   run just one product (or the $20/mo bundle checkout)');
   ui.dim('--dry-run    print what it would do, change nothing');
   ui.dim('--yes, -y    accept defaults, skip confirmations');
   ui.dim('--no-color   disable colored output');
   ui.dim('--help, -h   show this help');
   ui.blank();
-  ui.info(ui.c.bold('Pre-set to skip prompts:') + ' AGENT_BUNDLE_EMAIL, AGENTMAIL_API_KEY, AGENTPHONE_API_KEY');
-  ui.info(ui.c.bold('Test safely:') + ' AGENT_BUNDLE_MCP_CONFIG=/tmp/x.json npx agentbundle-cli --sandbox');
+  ui.info(ui.c.bold('Pre-set keys to skip prompts:') + ' AGENTMAIL_API_KEY, AGENTPHONE_API_KEY');
   ui.blank();
 }
 
@@ -59,31 +51,12 @@ function icon(kind) {
   return kind === 'ok' ? ui.c.green('✓') : kind === 'warn' ? ui.c.yellow('!') : ui.c.red('✗');
 }
 
-// One email drives all three sign-ups (Agentcard magic link, AgentMail + AgentPhone OTP). Collect
-// it once up front so each product reuses it instead of asking three times. Stores it on ctx.email.
-async function collectEmail(ctx) {
-  if (ctx.email && ac.isValidEmail(ctx.email)) return ctx.email; // from --email / AGENT_BUNDLE_EMAIL
-  if (ctx.sandbox) { ctx.email = 'agent@sandbox.local'; return ctx.email; }
-  // An invalid --email / AGENT_BUNDLE_EMAIL with no TTY to fix it must be cleared, otherwise the
-  // steps would post the bad value to the signup APIs and fail. Treat it as "no email set".
-  if (ctx.dryRun || !process.stdin.isTTY) { ctx.email = ''; return ''; }
-  for (let tries = 0; tries < 3; tries++) {
-    const entered = await ui.ask("What email should your agent's card, inbox, and phone use?");
-    if (!entered) break;
-    if (ac.isValidEmail(entered)) { ctx.email = entered; return entered; }
-    ui.warn("That doesn't look like an email — try again.");
-  }
-  ctx.email = '';
-  return '';
-}
-
 async function main() {
   const ctx = parseArgs(process.argv.slice(2));
   if (ctx.help) return help();
 
   ui.banner();
   if (ctx.dryRun) ui.warn('DRY RUN — nothing will be changed.');
-  if (ctx.sandbox) ui.warn('SANDBOX — stub signups, throwaway config, no real accounts or charges.');
 
   // Preflight
   ui.heading(0, 3, 'Preflight');
@@ -93,29 +66,15 @@ async function main() {
 
   let order = ['agentcard', 'agentmail', 'agentphone'];
   if (ctx.only) {
-    if (!STEPS[ctx.only]) {
-      ui.fail(`Unknown --only target: ${ctx.only} (use agentcard | agentmail | agentphone)`);
+    if (!ONLY_TARGETS.has(ctx.only)) {
+      ui.fail(`Unknown --only target: ${ctx.only} (use agentcard | agentmail | agentphone | bundle)`);
       process.exit(2);
     }
-    order = [ctx.only];
+    order = ctx.only === 'bundle' ? [] : [ctx.only];
   }
 
-  // Step one: collect the single email FIRST — before the confirm or any product — so every
-  // sign-up reuses it (Agentcard magic link, AgentMail + AgentPhone codes) and no step ever asks
-  // for it again. A pre-set --email / AGENT_BUNDLE_EMAIL skips the prompt entirely.
-  // Only prompt when a selected product actually needs signup; if everything is already
-  // configured the prompt is skipped and the run stays a clean no-op.
-  if (!ctx.dryRun) {
-    const needEmail = order.some((key) => MODULES[key].needsSetup(ctx));
-    if (needEmail) {
-      ui.blank();
-      ui.info(ui.c.bold(ui.c.blue('Step one — your email')));
-      ui.dim('Asked once here, then reused for the sign-ups below — you won\'t be asked again.');
-      await collectEmail(ctx);
-      if (ctx.email) ui.ok('Using ' + ui.c.bold(ctx.email) + ' for the products that need it.');
-      else ui.warn('No email set up front — each product will ask only if it needs one.');
-    }
-  }
+  // The $20/mo bundle is offered after a full run, or when explicitly requested.
+  const runBundle = !ctx.only || ctx.only === 'bundle';
 
   if (!ctx.yes && !ctx.dryRun) {
     ui.blank();
@@ -138,6 +97,17 @@ async function main() {
     }
   }
 
+  // Offer the $20/mo bundle once the products are in place.
+  if (runBundle) {
+    ui.blank();
+    try {
+      results.push(await bundle.step(ctx));
+    } catch (e) {
+      ui.fail(`bundle crashed: ${e.message}`);
+      results.push({ product: 'Bundle', icon: 'fail', note: e.message });
+    }
+  }
+
   // Summary
   ui.blank();
   ui.info(ui.c.bold('── Summary ──────────────────────────────────────────'));

package/lib/agentcard-api.js

@@ -88,7 +88,6 @@ async function requestMagicLink(email) {
 // Poll until the user clicks the magic link. Returns { jwt, email, mode }.
 async function waitForVerification(sessionId, { intervalMs = 2500, timeoutMs = 10 * 60 * 1000 } = {}) {
   const deadline = Date.now() + timeoutMs;
-  // Date.now is fine at runtime; this module is never run inside the workflow sandbox.
   for (;;) {
     const r = await getJson('/auth/me', { 'X-Magic-Token': sessionId });
     if (r.ok && r.data && r.data.status === 'verified' && r.data.jwt) {
@@ -103,6 +102,16 @@ function isValidEmail(s) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
 }
 
+// Put the signed-in account into production mode (real cards). New accounts are
+// created live, so we call this right after signup. Returns the resulting mode.
+async function setMode(jwt, mode) {
+  const r = await postJson('/users/me/mode', { mode }, { Authorization: `Bearer ${jwt}` });
+  if (!r.ok) throw new Error(r.data.error || r.data.message || `mode change failed (HTTP ${r.status})`);
+  // Keep the local config in sync with the account's mode.
+  writeConfig({ mode });
+  return r.data.mode || mode;
+}
+
 module.exports = {
   SOURCE,
   API_URL,
@@ -111,4 +120,5 @@ module.exports = {
   requestMagicLink,
   waitForVerification,
   isValidEmail,
+  setMode,
 };

package/lib/mcp.js

@@ -4,8 +4,7 @@
 // Two backends, auto-selected:
 //   * "claude": uses the `claude` CLI (`claude mcp get` / `claude mcp add`). Default in real use.
 //   * "file":   merges into a JSON config file. Used when AGENT_BUNDLE_MCP_CONFIG is set, or when
-//               `claude` isn't on PATH. Perfect for isolated/sandbox testing — never touches the
-//               user's real ~/.claude config.
+//               `claude` isn't on PATH — writes to that file instead of the user's ~/.claude config.
 
 const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');

package/lib/steps/agentcard.js

@@ -1,8 +1,8 @@
 'use strict';
 // [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → magic link →
-// verify), tagging the signup source as `agentbundle`, then registers the MCP server with the JWT.
+// verify), tagging the signup source as `agentbundle`, then registers the MCP server with the JWT
+// and puts the account into production (real cards) — there's no test mode in this flow.
 
-const { spawnSync } = require('node:child_process');
 const ui = require('../ui');
 const mcp = require('../mcp');
 const ac = require('../agentcard-api');
@@ -10,21 +10,9 @@ const ac = require('../agentcard-api');
 const MCP_NAME = 'agent-cards';
 const MCP_URL = 'https://mcp.agentcard.sh/mcp';
 
-function have(cmd) {
-  const r = spawnSync(cmd, ['--version'], { stdio: 'ignore' });
-  return !r.error && r.status === 0;
-}
-function run(cmd, args) {
-  ui.pause();
-  const r = spawnSync(cmd, args, { stdio: 'inherit' });
-  ui.resume();
-  return !r.error && r.status === 0;
-}
-
-// Send the magic link and wait for the click. Reuses the shared email collected up front
-// (ctx.email); only asks if one wasn't provided. Returns the JWT, or null.
-async function completeSignup(ctx) {
-  let email = ctx && ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
+// Ask for the email, send the magic link, and wait for the click. Returns the JWT, or null.
+async function completeSignup() {
+  let email = '';
   for (let tries = 0; tries < 3 && !email; tries++) {
     const entered = await ui.ask('What email should your Agentcard account use?');
     if (!entered) return null; // blank = skip
@@ -47,7 +35,7 @@ async function completeSignup(ctx) {
   try {
     const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(sessionId);
     ac.writeConfig({ email: verifiedEmail || email, jwt, mode });
-    ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}` + (mode ? ` (${mode} mode)` : ''));
+    ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}`);
     return jwt;
   } catch (e) {
     ui.fail('Signup not completed: ' + e.message);
@@ -67,12 +55,10 @@ async function step(ctx) {
   // 1. Get an authenticated session (JWT).
   let jwt;
   if (ctx.dryRun) {
-    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and wait for the magic link');
+    ui.step('would ask for your email, POST /auth/signup (x-platform: agentbundle), and wait for the magic link');
     ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "Authorization: Bearer <jwt>"`);
+    ui.dim('would: POST /users/me/mode { mode: "prod" } to put the account into production');
     return { product: 'Agentcard', icon: 'ok', note: 'configured (dry-run)' };
-  } else if (ctx.sandbox) {
-    ui.step('[sandbox] simulating email → magic link → verified');
-    jwt = 'sandbox_placeholder_jwt';
   } else if (ac.readConfig().jwt) {
     const cfg = ac.readConfig();
     ui.ok(`Already signed in to Agentcard${cfg.email ? ' as ' + ui.c.bold(cfg.email) : ''} — skipping signup.`);
@@ -82,7 +68,7 @@ async function step(ctx) {
     ui.info('Re-run this in a terminal so it can collect your email and the magic link.');
     return { product: 'Agentcard', icon: 'warn', note: 'needs interactive signup' };
   } else {
-    jwt = await completeSignup(ctx);
+    jwt = await completeSignup();
     if (!jwt) {
       ui.warn('Skipped Agentcard signup — re-run with --only agentcard when ready.');
       return { product: 'Agentcard', icon: 'warn', note: 'signup not completed' };
@@ -101,32 +87,20 @@ async function step(ctx) {
   }
   ui.ok('Agentcard MCP server registered.');
 
-  // 3. Production (go live) — needs payment method + identity; opt-in. Uses the CLI when present.
-  let note = 'configured (TEST mode)';
-  if (ctx.sandbox) {
-    ui.dim('TEST mode by default. Going live (real cards) is offered here in a real run.');
-  } else {
-    const live = ctx.yes ? false : await ui.confirm('Switch to PRODUCTION now (issue real cards)? Needs a payment method + a quick identity check.', false);
-    if (live) {
-      if (have('agent-cards') && run('agent-cards', ['mode', 'prod'])) {
-        ui.info('To fund real cards, run ' + ui.c.bold('agent-cards payment-method') + ' (one-time Stripe page) and finish the identity prompts.');
-        note = 'configured (PROD mode — finish payment method to issue real cards)';
-      } else {
-        ui.info('Install the CLI (' + ui.c.bold('npm i -g agent-cards') + ') then run ' + ui.c.bold('agent-cards mode prod') + ' to go live.');
-        note = 'configured (TEST mode — install CLI to go live)';
-      }
-    } else {
-      ui.info('Staying in ' + ui.c.bold('TEST') + ' mode (sandbox cards). Go live anytime with ' + ui.c.bold('agent-cards mode prod') + '.');
-    }
+  // 3. Put the account into PRODUCTION (real cards). New accounts go live by default.
+  let note = 'configured (production)';
+  try {
+    ui.step('Setting your account to production…');
+    await ac.setMode(jwt, 'prod');
+    ui.ok('Agentcard account is in ' + ui.c.bold('production') + ' mode.');
+    ui.dim('Add a payment method to fund real cards: ' + ui.c.bold('agent-cards payment-method') + ' (or in the dashboard).');
+  } catch (e) {
+    ui.warn('Could not set production mode automatically: ' + e.message);
+    ui.dim('Set it from the dashboard, or run ' + ui.c.bold('agent-cards mode prod') + '.');
+    note = 'configured (set production in the dashboard)';
   }
 
   return { product: 'Agentcard', icon: 'ok', note };
 }
 
-// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
-// Lets the launcher skip the up-front email prompt when nothing needs signup.
-function needsSetup() {
-  return !mcp.exists(MCP_NAME) && !ac.readConfig().jwt;
-}
-
-module.exports = { step, MCP_NAME, needsSetup };
+module.exports = { step, MCP_NAME };

package/lib/steps/agentmail.js

@@ -1,66 +1,12 @@
 'use strict';
-// [2/3] AgentMail — an email inbox. Fully API-driven: sign-up -> OTP -> verify (no console visit).
-// Signs up via https://docs.agentmail.to/api-reference/agent/sign-up, tagging referrer=agentbundle,
-// reusing the email collected up front. The sign-up response carries the api_key directly; the OTP
-// verify step lifts the unverified-org send allowlist.
+// [2/3] AgentMail — an email inbox. API-key driven (one console visit only if no key yet).
 
 const ui = require('../ui');
 const mcp = require('../mcp');
-const ac = require('../agentcard-api'); // shared email validation (isValidEmail)
 
 const MCP_NAME = 'agentmail';
 const MCP_URL = 'https://mcp.agentmail.to/mcp';
-const API = 'https://api.agentmail.to';
 const CONSOLE = 'https://console.agentmail.to';
-const REFERRER = 'agentbundle';     // the channel we report this sign-up came from
-const SOURCE = 'agentbundle-cli';   // platform identifier
-
-async function apiPost(path, body, token) {
-  const ctrl = new AbortController();
-  const t = setTimeout(() => ctrl.abort(), 30000);
-  try {
-    const res = await fetch(API + path, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        ...(token ? { Authorization: `Bearer ${token}` } : {}),
-      },
-      body: JSON.stringify(body),
-      signal: ctrl.signal,
-    });
-    const text = await res.text();
-    let data;
-    try { data = JSON.parse(text); } catch { data = { raw: text }; }
-    return { ok: res.ok, status: res.status, data };
-  } catch (e) {
-    return { ok: false, status: 0, data: { error: e.message } };
-  } finally {
-    clearTimeout(t);
-  }
-}
-
-// Derive an inbox username from the email local-part, plus a short suffix so the globally-unique
-// inbox address (username@agentmail.to) is unlikely to collide with an existing one.
-function usernameFor(email) {
-  const local = String(email).split('@')[0].toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-  const base = local || 'agent';
-  const suffix = Math.random().toString(36).slice(2, 6);
-  return `${base}-${suffix}`;
-}
-
-function register(key, ctx, extraNote) {
-  ui.step('Registering the AgentMail MCP server…');
-  const res = mcp.addServer(
-    { name: MCP_NAME, transport: 'http', url: MCP_URL, headers: { 'x-api-key': key } },
-    { dryRun: ctx.dryRun }
-  );
-  if (res.error) {
-    ui.fail('Failed to register MCP server: ' + res.error);
-    return { product: 'AgentMail', icon: 'fail', note: res.error };
-  }
-  ui.ok('AgentMail MCP server registered.');
-  return { product: 'AgentMail', icon: 'ok', note: extraNote || 'configured' };
-}
 
 async function step(ctx) {
   ui.heading(2, 3, 'AgentMail — an email inbox for your agent');
@@ -71,94 +17,35 @@ async function step(ctx) {
     return { product: 'AgentMail', icon: 'ok', note: 'already configured' };
   }
 
-  // A pre-set key short-circuits the whole sign-up. Trim it — a copied key often carries a
-  // trailing newline/space that would register a broken credential.
-  const envKey = (process.env.AGENTMAIL_API_KEY || '').trim();
-  if (envKey) {
-    ui.ok(`Using AGENTMAIL_API_KEY from your environment (${ui.mask(envKey)}).`);
-    return register(envKey, ctx);
-  }
-
-  if (ctx.dryRun) {
-    ui.step('would: POST /v0/agent/sign-up (referrer: agentbundle) → ask for OTP → POST /v0/agent/verify → get am_ key + inbox');
+  // Get the API key: env first, else prompt (the one possible browser touch).
+  let key = process.env.AGENTMAIL_API_KEY || '';
+  if (key) {
+    ui.ok(`Using AGENTMAIL_API_KEY from your environment (${ui.mask(key)}).`);
+  } else if (ctx.dryRun) {
+    ui.step('would prompt for an AgentMail API key (am_…)');
     ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "x-api-key: …"`);
     return { product: 'AgentMail', icon: 'ok', note: 'configured (dry-run)' };
-  }
-
-  if (ctx.sandbox) {
-    ui.step('[sandbox] simulating sign-up → OTP → verify…');
-    ui.ok('[sandbox] provisioned inbox my-agent@agentmail.to');
-    return register('am_sandbox_placeholder_key', ctx, 'configured (sandbox inbox)');
-  }
-
-  // Real flow — reuse the email collected up front; only ask (with validation) if one wasn't provided.
-  let email = ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
-  for (let tries = 0; !email && tries < 3; tries++) {
-    const entered = await ui.ask('What email should AgentMail send your verification code to?');
-    if (!entered) break;
-    if (ac.isValidEmail(entered)) email = entered;
-    else ui.warn("That doesn't look like an email — try again.");
-  }
-  if (!email) {
-    ui.warn('No email — skipping AgentMail. Re-run later.');
-    return { product: 'AgentMail', icon: 'warn', note: 'skipped (no email)' };
-  }
-
-  // Sign-up is idempotent on human_email (re-signup just rotates the key + returns it), so an
-  // existing account isn't a 409 — it returns 200. A 409 is a username collision (the random
-  // suffix clashed with another inbox), so retry with a fresh username before giving up.
-  ui.step('Creating your AgentMail inbox…');
-  let signup;
-  for (let attempt = 0; attempt < 3; attempt++) {
-    signup = await apiPost('/v0/agent/sign-up', {
-      human_email: email,
-      username: usernameFor(email),
-      source: SOURCE,
-      referrer: REFERRER,
-    });
-    if (signup.status !== 409) break;
-  }
-
-  if (signup.status === 409) {
-    ui.warn('Could not auto-pick an available inbox name after a few tries.');
-    ui.info('Grab a key from ' + ui.c.cyan(CONSOLE) + ' → Settings → API Keys.');
-    const key = (await ui.ask('Paste your AgentMail API key (am_…), or blank to skip:')).trim();
-    if (!key) return { product: 'AgentMail', icon: 'warn', note: 'needs key (set AGENTMAIL_API_KEY)' };
-    return register(key, ctx);
-  }
-  if (!signup.ok || !signup.data.api_key) {
-    ui.fail('Sign-up failed: ' + (signup.data.error || signup.data.message || `HTTP ${signup.status}`));
-    return { product: 'AgentMail', icon: 'fail', note: 'sign-up failed' };
-  }
-
-  const key = signup.data.api_key;
-  const inbox = signup.data.inbox_id;
-  if (inbox) ui.ok('Inbox created: ' + ui.c.bold(inbox));
-
-  // Verify the OTP to lift the unverified-org send allowlist. The key already works for receiving
-  // without it, so a missing/wrong code degrades gracefully rather than failing the whole step.
-  ui.ok(`Verification code sent to ${email}. Check your inbox.`);
-  const otp = await ui.ask('Enter the 6-digit code (or blank to verify later):');
-  if (otp) {
-    ui.step('Verifying…');
-    const verify = await apiPost('/v0/agent/verify', { otp_code: otp }, key);
-    if (verify.ok && verify.data.verified) {
-      ui.ok('AgentMail account verified — sending unlocked.');
-    } else {
-      ui.warn('Could not verify the code now (' + (verify.data.error || verify.data.message || `HTTP ${verify.status}`) + ').');
-      ui.dim('Your inbox still works for receiving; verify later to lift send limits.');
-    }
   } else {
-    ui.dim('Skipped verification — inbox works for receiving; verify later to send freely.');
+    ui.info('AgentMail needs an API key (starts with ' + ui.c.bold('am_') + ').');
+    ui.info('Get one (free tier) at ' + ui.c.cyan(CONSOLE) + ' → Settings → API Keys.');
+    key = await ui.ask('Paste your AgentMail API key (or leave blank to skip for now):');
+    if (!key) {
+      ui.warn('No key provided — skipping AgentMail. Re-run later with the key set.');
+      return { product: 'AgentMail', icon: 'warn', note: 'needs key (set AGENTMAIL_API_KEY)' };
+    }
   }
 
-  ui.dim('API key stored in the MCP config (masked: ' + ui.mask(key) + '). Never share it.');
-  return register(key, ctx, inbox ? `inbox ${inbox}` : 'configured');
-}
-
-// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
-function needsSetup() {
-  return !mcp.exists(MCP_NAME) && !(process.env.AGENTMAIL_API_KEY || '').trim();
+  ui.step('Registering the AgentMail MCP server…');
+  const res = mcp.addServer(
+    { name: MCP_NAME, url: MCP_URL, headers: { 'x-api-key': key } },
+    { dryRun: ctx.dryRun }
+  );
+  if (res.error) {
+    ui.fail('Failed to register MCP server: ' + res.error);
+    return { product: 'AgentMail', icon: 'fail', note: res.error };
+  }
+  ui.ok('AgentMail MCP server registered.');
+  return { product: 'AgentMail', icon: 'ok', note: 'configured' };
 }
 
-module.exports = { step, MCP_NAME, needsSetup };
+module.exports = { step, MCP_NAME };

package/lib/steps/agentphone.js

@@ -3,12 +3,10 @@
 
 const ui = require('../ui');
 const mcp = require('../mcp');
-const ac = require('../agentcard-api'); // shared email validation (isValidEmail)
 
 const MCP_NAME = 'agentphone';
 const API = 'https://api.agentphone.ai';
 const SETTINGS = 'https://agentphone.ai/settings';
-const SOURCE = 'agentbundle';   // sent on verify so AgentPhone attributes the signup to the bundle
 
 async function apiPost(path, body) {
   const ctrl = new AbortController();
@@ -55,34 +53,20 @@ async function step(ctx) {
     return { product: 'AgentPhone', icon: 'ok', note: 'already configured' };
   }
 
-  // Existing key in env? Trim it — a copied key often carries a trailing newline/space that
-  // would register a broken credential.
-  const envKey = (process.env.AGENTPHONE_API_KEY || '').trim();
-  if (envKey) {
-    ui.ok(`Using AGENTPHONE_API_KEY from your environment (${ui.mask(envKey)}).`);
-    return register(envKey, ctx);
+  // Existing key in env?
+  if (process.env.AGENTPHONE_API_KEY) {
+    ui.ok(`Using AGENTPHONE_API_KEY from your environment (${ui.mask(process.env.AGENTPHONE_API_KEY)}).`);
+    return register(process.env.AGENTPHONE_API_KEY, ctx);
   }
 
   if (ctx.dryRun) {
-    ui.step('would: POST /v0/agent/sign-up → ask for OTP → POST /v0/agent/verify (source: agentbundle) → get sk_live_ key + number');
+    ui.step('would: POST /v0/agent/sign-up → ask for OTP → POST /v0/agent/verify → get sk_live_ key + number');
     ui.dim(`would: claude mcp add ${MCP_NAME} --env AGENTPHONE_API_KEY=… -- npx -y agentphone-mcp`);
     return { product: 'AgentPhone', icon: 'ok', note: 'configured (dry-run)' };
   }
 
-  if (ctx.sandbox) {
-    ui.step('[sandbox] simulating sign-up → OTP → verify…');
-    ui.ok('[sandbox] provisioned number +1 (555) 010-0042');
-    return register('sk_live_sandbox_placeholder_key', ctx, 'configured (sandbox number)');
-  }
-
-  // Real flow — reuse the email collected up front; only ask (with validation) if one wasn't provided.
-  let email = ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
-  for (let tries = 0; !email && tries < 3; tries++) {
-    const entered = await ui.ask('What email should AgentPhone send your verification code to?');
-    if (!entered) break;
-    if (ac.isValidEmail(entered)) email = entered;
-    else ui.warn("That doesn't look like an email — try again.");
-  }
+  // Real flow.
+  const email = await ui.ask('What email should AgentPhone send your verification code to?');
   if (!email) {
     ui.warn('No email — skipping AgentPhone. Re-run later.');
     return { product: 'AgentPhone', icon: 'warn', note: 'skipped (no email)' };
@@ -94,7 +78,7 @@ async function step(ctx) {
   if (signup.status === 409) {
     ui.warn('You already have an AgentPhone account for that email.');
     ui.info('Grab a key from ' + ui.c.cyan(SETTINGS) + ' → API Keys.');
-    const key = (await ui.ask('Paste your AgentPhone API key (sk_live_…), or blank to skip:')).trim();
+    const key = await ui.ask('Paste your AgentPhone API key (sk_live_…), or blank to skip:');
     if (!key) return { product: 'AgentPhone', icon: 'warn', note: 'needs key (set AGENTPHONE_API_KEY)' };
     return register(key, ctx);
   }
@@ -111,7 +95,7 @@ async function step(ctx) {
   }
 
   ui.step('Verifying and provisioning your number…');
-  const verify = await apiPost('/v0/agent/verify', { verification_id: signup.data.verification_id, otp_code: otp, source: SOURCE });
+  const verify = await apiPost('/v0/agent/verify', { verification_id: signup.data.verification_id, otp_code: otp });
   if (!verify.ok || !verify.data.api_key) {
     ui.fail('Verification failed: ' + (verify.data.error || verify.data.message || `HTTP ${verify.status}`));
     return { product: 'AgentPhone', icon: 'fail', note: 'verification failed' };
@@ -122,9 +106,4 @@ async function step(ctx) {
   return register(verify.data.api_key, ctx, `live number ${verify.data.phone_number}`);
 }
 
-// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
-function needsSetup() {
-  return !mcp.exists(MCP_NAME) && !(process.env.AGENTPHONE_API_KEY || '').trim();
-}
-
-module.exports = { step, MCP_NAME, needsSetup };
+module.exports = { step, MCP_NAME };

package/lib/steps/bundle.js

@@ -0,0 +1,136 @@
+'use strict';
+// Final step — the $20/mo bundle subscription. After all three MCP servers are
+// installed, this offers to subscribe to the Agent Bundle: one $20/mo charge for
+// Agentcard + AgentMail + AgentPhone (vs ~$43 buying them standalone).
+//
+// Billing runs on the Agent Bundle's OWN server (theagentbundle.com), on the
+// Agentcard Corporation Stripe account — separate from Agentcard's product
+// backend. The customer is keyed by email; we just open Stripe's hosted
+// checkout, so no charge happens until they enter a card and confirm there.
+
+const { spawn } = require('node:child_process');
+const ui = require('../ui');
+const ac = require('../agentcard-api');
+
+const PRICE_LABEL = '$20/mo';
+// The bundle server. Override for local/staging with AGENT_BUNDLE_API_URL.
+const BUNDLE_API_URL = (process.env.AGENT_BUNDLE_API_URL || 'https://theagentbundle.com').replace(/\/$/, '');
+
+async function fetchJson(method, path, body) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), 30000);
+  try {
+    const res = await fetch(BUNDLE_API_URL + path, {
+      method,
+      headers: { 'Content-Type': 'application/json', 'x-source': 'agent-bundle-cli' },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+      signal: ctrl.signal,
+    });
+    const text = await res.text();
+    let data;
+    try { data = JSON.parse(text); } catch { data = { raw: text }; }
+    return { ok: res.ok, status: res.status, data };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// Open a URL in the user's default browser, best-effort and non-blocking.
+function openInBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+    : 'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Use the email from the Agentcard signup; fall back to asking.
+async function resolveEmail(ctx) {
+  const saved = ac.readConfig().email;
+  if (saved && ac.isValidEmail(saved)) return saved;
+  if (ctx.yes || !process.stdin.isTTY) return null;
+  for (let tries = 0; tries < 3; tries++) {
+    const entered = await ui.ask('What email should your bundle subscription use?');
+    if (!entered) return null;
+    if (ac.isValidEmail(entered)) return entered;
+    ui.warn('That doesn\'t look like an email — try again.');
+  }
+  return null;
+}
+
+async function step(ctx) {
+  ui.heading(0, 0, 'Agent Bundle — one subscription for all three');
+  ui.dim(`Agentcard + AgentMail + AgentPhone together for ${PRICE_LABEL} (about half of buying them separately).`);
+
+  if (ctx.dryRun) {
+    ui.step(`would: POST ${BUNDLE_API_URL}/api/checkout {email} → open Stripe checkout for ${PRICE_LABEL}`);
+    return { product: 'Bundle', icon: 'ok', note: `offer ${PRICE_LABEL} (dry-run)` };
+  }
+  const email = await resolveEmail(ctx);
+  if (!email) {
+    ui.warn('No email for the bundle — skipping. Re-run with ' + ui.c.bold('--only bundle') + ' to subscribe.');
+    return { product: 'Bundle', icon: 'warn', note: 'needs email' };
+  }
+
+  // Is the bundle live, and is this email already subscribed?
+  try {
+    const r = await fetchJson('GET', `/api/status?email=${encodeURIComponent(email)}`);
+    if (r.ok && r.data && r.data.configured === false) {
+      ui.info('The bundle isn\'t available yet — your three MCP servers are installed and ready.');
+      return { product: 'Bundle', icon: 'ok', note: 'not offered (coming soon)' };
+    }
+    if (r.ok && r.data && r.data.active) {
+      ui.ok('This email already has an active Agent Bundle — nothing to do.');
+      return { product: 'Bundle', icon: 'ok', note: 'already subscribed' };
+    }
+  } catch {
+    ui.dim('(could not check bundle status — offering anyway)');
+  }
+
+  if (!ctx.yes) {
+    const go = await ui.confirm(`Subscribe to the Agent Bundle for ${PRICE_LABEL} now?`, true);
+    if (!go) {
+      ui.info('No problem — subscribe anytime by re-running with ' + ui.c.bold('--only bundle') + '.');
+      return { product: 'Bundle', icon: 'warn', note: 'declined' };
+    }
+  }
+
+  let checkoutUrl;
+  try {
+    ui.step('Creating your secure Stripe checkout…');
+    const r = await fetchJson('POST', '/api/checkout', { email });
+    if (r.status === 503) {
+      ui.info('The bundle isn\'t available yet — your three MCP servers are installed and ready.');
+      return { product: 'Bundle', icon: 'ok', note: 'not offered (coming soon)' };
+    }
+    if (r.status === 409) {
+      ui.ok('This email already has an active Agent Bundle — nothing to do.');
+      return { product: 'Bundle', icon: 'ok', note: 'already subscribed' };
+    }
+    if (!r.ok || !r.data || !r.data.checkoutUrl) {
+      throw new Error((r.data && r.data.error) || `HTTP ${r.status}`);
+    }
+    checkoutUrl = r.data.checkoutUrl;
+  } catch (e) {
+    ui.fail('Could not start checkout: ' + e.message);
+    return { product: 'Bundle', icon: 'fail', note: 'checkout failed' };
+  }
+
+  const opened = openInBrowser(checkoutUrl);
+  if (opened) ui.ok('Opened Stripe checkout in your browser.');
+  else ui.warn('Could not open your browser automatically.');
+  ui.info('Complete the ' + ui.c.bold(PRICE_LABEL) + ' subscription here:');
+  ui.info('  ' + ui.c.cyan(checkoutUrl));
+  ui.dim('No charge happens until you enter a card and confirm on Stripe\'s page.');
+
+  return { product: 'Bundle', icon: 'ok', note: `checkout opened (${PRICE_LABEL})` };
+}
+
+module.exports = { step };

package/lib/ui.js

@@ -36,7 +36,9 @@ function banner() {
 }
 
 function heading(n, total, title) {
-  stdout.write('\n' + c.bold(c.blue(`[${n}/${total}] ${title}`)) + '\n');
+  // total falsy → a plain section heading with no [n/total] counter (e.g. the bundle step).
+  const prefix = total ? `[${n}/${total}] ` : '';
+  stdout.write('\n' + c.bold(c.blue(`${prefix}${title}`)) + '\n');
 }
 
 const info = (m) => stdout.write('  ' + m + '\n');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentbundle-cli",
-  "version": "0.1.2",
-  "description": "One command to give your AI agent a card, an inbox, and a phone — installs Agentcard, AgentMail, and AgentPhone via a guided onboarding flow.",
+  "version": "0.2.0",
+  "description": "One command to give your AI agent a card, an inbox, and a phone — installs AgentCard, AgentMail, and AgentPhone via a guided onboarding flow.",
   "bin": {
     "agentbundle-cli": "bin/agent-bundle.js",
     "agentbundle": "bin/agent-bundle.js",
@@ -25,13 +25,5 @@
     "onboarding",
     "cli"
   ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tiny-agent-company/tiny-agent-company.git",
-    "directory": "apps/agent-bundle-cli"
-  },
   "license": "MIT"
 }