agentbundle-cli 0.2.0 → 0.2.2

package/README.md

@@ -5,27 +5,22 @@ One command to give your AI agent the three things it needs to act online — a
 you through installing all three, one at a time, and registers each as an MCP server.
 
 ```bash
-npx agent-bundle
+npx agentbundle-cli
 ```
 
 ## What it does
 
-A guided, three-step onboarding:
+It asks for **one email up front** and reuses it for all three sign-ups (each product emails a
+verification code), then runs a guided, three-step onboarding:
 
-1. **Agentcard** — installs the `agent-cards` CLI, signs you up (one magic-link email click),
-   registers + authenticates the MCP server via `agent-cards setup-mcp` (hosted HTTP), and offers
-   to switch to production (real cards).
-2. **AgentMail** — takes your API key (or points you to the console to make one) and registers the
-   hosted HTTP MCP server (`mcp.agentmail.to`).
+1. **Agentcard** — signs you up (you type in the emailed verification code), registers the
+   hosted HTTP MCP server (OAuth sign-in on first tool use), and offers to switch to
+   production (real cards).
+2. **AgentMail** — fully automated: signs you up via the API (no console visit), provisions an
+   inbox, you type in the verification code, and it registers the hosted HTTP MCP server
+   (`mcp.agentmail.to`). Sign-ups are tagged with the `agentbundle` referrer.
 3. **AgentPhone** — fully automated: requests a verification code by email, you type it in, it
    provisions a real US number, and registers the stdio MCP server (`npx -y agentphone-mcp`). No browser.
-4. **Agent Bundle** — with all three installed, it offers the bundle subscription: **$20/mo** for
-   Agentcard + AgentMail + AgentPhone together (about half of buying them standalone). It opens a
-   Stripe-hosted checkout on the bundle server (theagentbundle.com), keyed by your email — no charge
-   until you enter a card and confirm on Stripe's page. Re-run with `--only bundle` anytime.
-
-Every account is created in **production** — real inboxes, real numbers, and live Agentcard cards.
-There is no test or sandbox mode.
 
 All MCP servers are registered at **user scope** (available in every project), via `claude mcp add`.
 
@@ -35,7 +30,9 @@ It's **idempotent** — anything already configured is skipped, so it's safe to
 
 | Flag | Effect |
 |---|---|
-| `--only <agentcard\|agentmail\|agentphone\|bundle>` | Run just one product, or `bundle` for the $20/mo bundle checkout. |
+| `--only <agentcard\|agentmail\|agentphone>` | Run just one product. |
+| `--email <you@example.com>` | Email used for all three sign-ups (skips the up-front prompt). |
+| `--sandbox` | Walk the whole flow with stub signups + a throwaway config — no real accounts, no charges. |
 | `--dry-run` | Print what it would do, change nothing. |
 | `--yes`, `-y` | Accept defaults, skip confirmations. |
 | `--no-color` | Plain output. |
@@ -44,17 +41,20 @@ It's **idempotent** — anything already configured is skipped, so it's safe to
 ## Skip prompts with env vars
 
 ```bash
-export AGENTMAIL_API_KEY=am_...
+export AGENT_BUNDLE_EMAIL=you@example.com   # used for all three sign-ups
+export AGENTMAIL_API_KEY=am_...              # already have a key? skip the AgentMail sign-up
 export AGENTPHONE_API_KEY=sk_live_...
-npx agent-bundle
+npx agentbundle-cli
 ```
 
-## Preview without changing anything
+## Test it safely
 
-Use `--dry-run` to print every step it would take without touching your config or creating accounts:
+This writes the MCP config to a throwaway file and uses stub signups — your real `~/.claude`
+config is never touched and no money is spent:
 
 ```bash
-npx agent-bundle --dry-run
+AGENT_BUNDLE_MCP_CONFIG=/tmp/bundle-test.json npx . --sandbox
+cat /tmp/bundle-test.json
 ```
 
 ## How config is written

package/bin/agent-bundle.js

@@ -4,30 +4,35 @@
 
 const ui = require('../lib/ui');
 const mcp = require('../lib/mcp');
+const ac = require('../lib/agentcard-api');
 const agentcard = require('../lib/steps/agentcard');
 const agentmail = require('../lib/steps/agentmail');
 const agentphone = require('../lib/steps/agentphone');
-const bundle = require('../lib/steps/bundle');
 
+const MODULES = {
+  agentcard,
+  agentmail,
+  agentphone,
+};
 const STEPS = {
   agentcard: agentcard.step,
   agentmail: agentmail.step,
   agentphone: agentphone.step,
 };
 
-// The bundle subscription runs after the three products, not as one of them.
-const ONLY_TARGETS = new Set([...Object.keys(STEPS), 'bundle']);
-
 function parseArgs(argv) {
-  const ctx = { dryRun: false, yes: false, only: null, help: false };
+  const ctx = { dryRun: false, sandbox: false, yes: false, only: null, help: false, email: (process.env.AGENT_BUNDLE_EMAIL || '').trim() };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--dry-run') ctx.dryRun = true;
+    else if (a === '--sandbox') ctx.sandbox = true;
     else if (a === '--yes' || a === '-y') ctx.yes = true;
     else if (a === '--no-color') {/* handled in ui */}
     else if (a === '--help' || a === '-h') ctx.help = true;
     else if (a === '--only') ctx.only = (argv[++i] || '').toLowerCase();
     else if (a.startsWith('--only=')) ctx.only = a.slice(7).toLowerCase();
+    else if (a === '--email') ctx.email = (argv[++i] || '').trim();
+    else if (a.startsWith('--email=')) ctx.email = a.slice(8).trim();
   }
   return ctx;
 }
@@ -37,13 +42,16 @@ function help() {
   ui.info('Guided setup for your agent\'s card, inbox, and phone.\n');
   ui.info(ui.c.bold('Usage:') + '  npx agentbundle-cli [options]\n');
   ui.info(ui.c.bold('Options:'));
-  ui.dim('--only <agentcard|agentmail|agentphone|bundle>   run just one product (or the $20/mo bundle checkout)');
+  ui.dim('--only <agentcard|agentmail|agentphone>   run just one product');
+  ui.dim('--email <you@example.com>   email used for all three sign-ups (skips the prompt)');
+  ui.dim('--sandbox    walk the whole flow with stub signups + a throwaway config (no money, no real accounts)');
   ui.dim('--dry-run    print what it would do, change nothing');
   ui.dim('--yes, -y    accept defaults, skip confirmations');
   ui.dim('--no-color   disable colored output');
   ui.dim('--help, -h   show this help');
   ui.blank();
-  ui.info(ui.c.bold('Pre-set keys to skip prompts:') + ' AGENTMAIL_API_KEY, AGENTPHONE_API_KEY');
+  ui.info(ui.c.bold('Pre-set to skip prompts:') + ' AGENT_BUNDLE_EMAIL, AGENTMAIL_API_KEY, AGENTPHONE_API_KEY');
+  ui.info(ui.c.bold('Test safely:') + ' AGENT_BUNDLE_MCP_CONFIG=/tmp/x.json npx agentbundle-cli --sandbox');
   ui.blank();
 }
 
@@ -51,12 +59,31 @@ function icon(kind) {
   return kind === 'ok' ? ui.c.green('✓') : kind === 'warn' ? ui.c.yellow('!') : ui.c.red('✗');
 }
 
+// One email drives all three sign-ups (Agentcard, AgentMail + AgentPhone verification codes). Collect
+// it once up front so each product reuses it instead of asking three times. Stores it on ctx.email.
+async function collectEmail(ctx) {
+  if (ctx.email && ac.isValidEmail(ctx.email)) return ctx.email; // from --email / AGENT_BUNDLE_EMAIL
+  if (ctx.sandbox) { ctx.email = 'agent@sandbox.local'; return ctx.email; }
+  // An invalid --email / AGENT_BUNDLE_EMAIL with no TTY to fix it must be cleared, otherwise the
+  // steps would post the bad value to the signup APIs and fail. Treat it as "no email set".
+  if (ctx.dryRun || !process.stdin.isTTY) { ctx.email = ''; return ''; }
+  for (let tries = 0; tries < 3; tries++) {
+    const entered = await ui.ask("What email should your agent's card, inbox, and phone use?");
+    if (!entered) break;
+    if (ac.isValidEmail(entered)) { ctx.email = entered; return entered; }
+    ui.warn("That doesn't look like an email — try again.");
+  }
+  ctx.email = '';
+  return '';
+}
+
 async function main() {
   const ctx = parseArgs(process.argv.slice(2));
   if (ctx.help) return help();
 
   ui.banner();
   if (ctx.dryRun) ui.warn('DRY RUN — nothing will be changed.');
+  if (ctx.sandbox) ui.warn('SANDBOX — stub signups, throwaway config, no real accounts or charges.');
 
   // Preflight
   ui.heading(0, 3, 'Preflight');
@@ -66,15 +93,29 @@ async function main() {
 
   let order = ['agentcard', 'agentmail', 'agentphone'];
   if (ctx.only) {
-    if (!ONLY_TARGETS.has(ctx.only)) {
-      ui.fail(`Unknown --only target: ${ctx.only} (use agentcard | agentmail | agentphone | bundle)`);
+    if (!STEPS[ctx.only]) {
+      ui.fail(`Unknown --only target: ${ctx.only} (use agentcard | agentmail | agentphone)`);
       process.exit(2);
     }
-    order = ctx.only === 'bundle' ? [] : [ctx.only];
+    order = [ctx.only];
   }
 
-  // The $20/mo bundle is offered after a full run, or when explicitly requested.
-  const runBundle = !ctx.only || ctx.only === 'bundle';
+  // Step one: collect the single email FIRST — before the confirm or any product — so every
+  // sign-up reuses it (Agentcard + AgentMail + AgentPhone verification codes) and no step ever asks
+  // for it again. A pre-set --email / AGENT_BUNDLE_EMAIL skips the prompt entirely.
+  // Only prompt when a selected product actually needs signup; if everything is already
+  // configured the prompt is skipped and the run stays a clean no-op.
+  if (!ctx.dryRun) {
+    const needEmail = order.some((key) => MODULES[key].needsSetup(ctx));
+    if (needEmail) {
+      ui.blank();
+      ui.info(ui.c.bold(ui.c.blue('Step one — your email')));
+      ui.dim('Asked once here, then reused for the sign-ups below — you won\'t be asked again.');
+      await collectEmail(ctx);
+      if (ctx.email) ui.ok('Using ' + ui.c.bold(ctx.email) + ' for the products that need it.');
+      else ui.warn('No email set up front — each product will ask only if it needs one.');
+    }
+  }
 
   if (!ctx.yes && !ctx.dryRun) {
     ui.blank();
@@ -97,17 +138,6 @@ async function main() {
     }
   }
 
-  // Offer the $20/mo bundle once the products are in place.
-  if (runBundle) {
-    ui.blank();
-    try {
-      results.push(await bundle.step(ctx));
-    } catch (e) {
-      ui.fail(`bundle crashed: ${e.message}`);
-      results.push({ product: 'Bundle', icon: 'fail', note: e.message });
-    }
-  }
-
   // Summary
   ui.blank();
   ui.info(ui.c.bold('── Summary ──────────────────────────────────────────'));

package/lib/agentcard-api.js

@@ -1,11 +1,15 @@
 'use strict';
 // Minimal Agentcard auth client used to complete signup from inside agent-bundle, so the whole
-// flow (ask email → magic link → verify) happens here AND the signup is tagged with our source.
+// flow (ask email → enter the emailed code → verify) happens here AND the signup is tagged with
+// our source.
 //
-// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json ({email,jwt,mode},
-// mode 0600), same endpoints (POST /auth/signup, poll GET /auth/me with X-Magic-Token). The one
-// difference: we send `x-platform: agentbundle` so the backend records these signups as coming
-// from the bundle.
+// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json (mode 0600), same
+// endpoints. Current backends answer POST /auth/signup with { mode: 'workos' } and email a
+// numeric code, completed via POST /auth/verify-code → { accessToken, refreshToken, email }.
+// Older backends return { sessionId } and email a magic link, completed by polling GET /auth/me
+// with X-Magic-Token — both flows are supported. The one difference from the agent-cards CLI:
+// we send `x-platform: agentbundle` so the backend records these signups as coming from the
+// bundle.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -76,18 +80,39 @@ async function getJson(pathname, extraHeaders) {
   }
 }
 
-// Request a magic link. Returns { sessionId } or throws with a readable message.
-async function requestMagicLink(email) {
+// Start a signup/login. Returns { mode: 'workos' } (a numeric code was emailed; finish with
+// verifyCode) or { mode: 'legacy', sessionId } (a magic link was emailed; finish with
+// waitForVerification). Throws with a readable message on failure.
+async function startSignup(email) {
   const r = await postJson('/auth/signup', { email });
-  if (!r.ok || !r.data.sessionId) {
+  if (!r.ok) {
     throw new Error(r.data.error || r.data.message || `signup failed (HTTP ${r.status})`);
   }
-  return { sessionId: r.data.sessionId };
+  if (r.data.mode === 'workos' || !r.data.sessionId) {
+    return { mode: 'workos' };
+  }
+  if (r.data._emailError) {
+    throw new Error('Email delivery failed on our side. Try again in a minute — if it keeps happening, email support@agentcard.sh.');
+  }
+  return { mode: 'legacy', sessionId: r.data.sessionId };
+}
+
+// Complete a code-based (WorkOS) login. Returns { accessToken, refreshToken, email }.
+// Throws with err.status set (401 = wrong/expired code → worth re-prompting, 429 = throttled).
+async function verifyCode(email, code) {
+  const r = await postJson('/auth/verify-code', { email, code });
+  if (r.ok && r.data && (r.data.accessToken || r.data.jwt)) {
+    return r.data;
+  }
+  const err = new Error(r.data.error || r.data.message || `verification failed (HTTP ${r.status})`);
+  err.status = r.status;
+  throw err;
 }
 
-// Poll until the user clicks the magic link. Returns { jwt, email, mode }.
+// Legacy flow only: poll until the user clicks the magic link. Returns { jwt, email, mode }.
 async function waitForVerification(sessionId, { intervalMs = 2500, timeoutMs = 10 * 60 * 1000 } = {}) {
   const deadline = Date.now() + timeoutMs;
+  // Date.now is fine at runtime; this module is never run inside the workflow sandbox.
   for (;;) {
     const r = await getJson('/auth/me', { 'X-Magic-Token': sessionId });
     if (r.ok && r.data && r.data.status === 'verified' && r.data.jwt) {
@@ -102,14 +127,11 @@ function isValidEmail(s) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
 }
 
-// Put the signed-in account into production mode (real cards). New accounts are
-// created live, so we call this right after signup. Returns the resulting mode.
-async function setMode(jwt, mode) {
-  const r = await postJson('/users/me/mode', { mode }, { Authorization: `Bearer ${jwt}` });
-  if (!r.ok) throw new Error(r.data.error || r.data.message || `mode change failed (HTTP ${r.status})`);
-  // Keep the local config in sync with the account's mode.
-  writeConfig({ mode });
-  return r.data.mode || mode;
+// A stored session in ~/.agent-cards/config.json: either a WorkOS token pair
+// (current) or a legacy magic-link JWT.
+function hasSession(cfg) {
+  const c = cfg || readConfig();
+  return !!(c.accessToken || c.jwt);
 }
 
 module.exports = {
@@ -117,8 +139,9 @@ module.exports = {
   API_URL,
   readConfig,
   writeConfig,
-  requestMagicLink,
+  hasSession,
+  startSignup,
+  verifyCode,
   waitForVerification,
   isValidEmail,
-  setMode,
 };

package/lib/mcp.js

@@ -4,7 +4,8 @@
 // Two backends, auto-selected:
 //   * "claude": uses the `claude` CLI (`claude mcp get` / `claude mcp add`). Default in real use.
 //   * "file":   merges into a JSON config file. Used when AGENT_BUNDLE_MCP_CONFIG is set, or when
-//               `claude` isn't on PATH — writes to that file instead of the user's ~/.claude config.
+//               `claude` isn't on PATH. Perfect for isolated/sandbox testing — never touches the
+//               user's real ~/.claude config.
 
 const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');

package/lib/steps/agentcard.js

@@ -1,8 +1,11 @@
 'use strict';
-// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → magic link →
-// verify), tagging the signup source as `agentbundle`, then registers the MCP server with the JWT
-// and puts the account into production (real cards) — there's no test mode in this flow.
+// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → enter the
+// emailed code → verify), tagging the signup source as `agentbundle`, then registers the MCP
+// server. Registration uses OAuth (no static Authorization header): Claude opens a browser
+// sign-in the first time a tool runs. A baked bearer would be a short-lived WorkOS access token
+// that silently starts 401ing within hours — same reason `agent-cards setup-mcp` dropped it.
 
+const { spawnSync } = require('node:child_process');
 const ui = require('../ui');
 const mcp = require('../mcp');
 const ac = require('../agentcard-api');
@@ -10,36 +13,84 @@ const ac = require('../agentcard-api');
 const MCP_NAME = 'agent-cards';
 const MCP_URL = 'https://mcp.agentcard.sh/mcp';
 
-// Ask for the email, send the magic link, and wait for the click. Returns the JWT, or null.
-async function completeSignup() {
-  let email = '';
+function have(cmd) {
+  const r = spawnSync(cmd, ['--version'], { stdio: 'ignore' });
+  return !r.error && r.status === 0;
+}
+function run(cmd, args) {
+  ui.pause();
+  const r = spawnSync(cmd, args, { stdio: 'inherit' });
+  ui.resume();
+  return !r.error && r.status === 0;
+}
+
+const CODE_MAX_ENTRIES = 3;
+
+// Sign up (or in): current backends email a numeric code we verify; legacy backends email a
+// magic link we poll for. Reuses the shared email collected up front (ctx.email); only asks if
+// one wasn't provided. Returns true when a session is stored in ~/.agent-cards/config.json.
+async function completeSignup(ctx) {
+  let email = ctx && ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
   for (let tries = 0; tries < 3 && !email; tries++) {
     const entered = await ui.ask('What email should your Agentcard account use?');
-    if (!entered) return null; // blank = skip
+    if (!entered) return false; // blank = skip
     if (ac.isValidEmail(entered)) email = entered;
     else ui.warn('That doesn\'t look like an email — try again.');
   }
-  if (!email) return null;
+  if (!email) return false;
 
-  let sessionId;
+  let start;
   try {
-    ui.step(`Sending a magic link to ${email}…`);
-    ({ sessionId } = await ac.requestMagicLink(email));
+    ui.step(`Starting Agentcard sign-in for ${email}…`);
+    start = await ac.startSignup(email);
   } catch (e) {
     ui.fail('Could not start signup: ' + e.message);
-    return null;
+    return false;
+  }
+
+  if (start.mode === 'workos') {
+    ui.ok(`We emailed a sign-in code to ${ui.c.bold(email)}.`);
+    for (let attempt = 1; attempt <= CODE_MAX_ENTRIES; attempt++) {
+      const code = (await ui.ask('Enter the code from your email:')).trim();
+      if (!code) {
+        ui.warn('No code entered — skipping Agentcard signup.');
+        return false;
+      }
+      try {
+        const verified = await ac.verifyCode(email, code);
+        // Replace the whole session: a stale legacy jwt left in place would shadow
+        // the fresh token pair for anything that still reads it.
+        ac.writeConfig({
+          email: verified.email || email,
+          accessToken: verified.accessToken,
+          refreshToken: verified.refreshToken,
+          jwt: undefined,
+        });
+        ui.ok(`Signed in as ${ui.c.bold(verified.email || email)}`);
+        return true;
+      } catch (e) {
+        if (e.status === 401 && attempt < CODE_MAX_ENTRIES) {
+          ui.warn(`That code didn't work (attempt ${attempt}/${CODE_MAX_ENTRIES}) — check the newest email to ${email}.`);
+          continue;
+        }
+        ui.fail('Signup not completed: ' + e.message);
+        return false;
+      }
+    }
+    return false;
   }
 
+  // Legacy magic-link backend.
   ui.ok(`Magic link sent to ${ui.c.bold(email)}.`);
   ui.info('Open your inbox and click the link — ' + ui.c.dim('waiting for you…'));
   try {
-    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(sessionId);
-    ac.writeConfig({ email: verifiedEmail || email, jwt, mode });
-    ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}`);
-    return jwt;
+    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(start.sessionId);
+    ac.writeConfig({ email: verifiedEmail || email, jwt, mode, accessToken: undefined, refreshToken: undefined });
+    ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}` + (mode ? ` (${mode} mode)` : ''));
+    return true;
   } catch (e) {
     ui.fail('Signup not completed: ' + e.message);
-    return null;
+    return false;
   }
 }
 
@@ -52,33 +103,34 @@ async function step(ctx) {
     return { product: 'Agentcard', icon: 'ok', note: 'already configured' };
   }
 
-  // 1. Get an authenticated session (JWT).
-  let jwt;
+  // 1. Get an authenticated session (so the signup is attributed to the bundle and
+  //    go-live has an account to work with). The MCP server itself authenticates via
+  //    OAuth, so no token is threaded into the registration below.
   if (ctx.dryRun) {
-    ui.step('would ask for your email, POST /auth/signup (x-platform: agentbundle), and wait for the magic link');
-    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "Authorization: Bearer <jwt>"`);
-    ui.dim('would: POST /users/me/mode { mode: "prod" } to put the account into production');
+    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and verify the emailed code');
+    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} (OAuth — no static header)`);
     return { product: 'Agentcard', icon: 'ok', note: 'configured (dry-run)' };
-  } else if (ac.readConfig().jwt) {
+  } else if (ctx.sandbox) {
+    ui.step('[sandbox] simulating email → code → verified');
+  } else if (ac.hasSession()) {
     const cfg = ac.readConfig();
     ui.ok(`Already signed in to Agentcard${cfg.email ? ' as ' + ui.c.bold(cfg.email) : ''} — skipping signup.`);
-    jwt = cfg.jwt;
   } else if (!process.stdin.isTTY) {
     ui.warn('Not signed in to Agentcard, and no interactive terminal to complete signup.');
-    ui.info('Re-run this in a terminal so it can collect your email and the magic link.');
+    ui.info('Re-run this in a terminal so it can collect your email and the emailed sign-in code.');
     return { product: 'Agentcard', icon: 'warn', note: 'needs interactive signup' };
   } else {
-    jwt = await completeSignup();
-    if (!jwt) {
+    const signedIn = await completeSignup(ctx);
+    if (!signedIn) {
       ui.warn('Skipped Agentcard signup — re-run with --only agentcard when ready.');
       return { product: 'Agentcard', icon: 'warn', note: 'signup not completed' };
     }
   }
 
-  // 2. Register the MCP server with the JWT (matches the authenticated hosted-HTTP setup).
+  // 2. Register the MCP server (OAuth: a browser sign-in appears the first time a tool runs).
   ui.step('Registering the Agentcard MCP server…');
   const res = mcp.addServer(
-    { name: MCP_NAME, transport: 'http', url: MCP_URL, headers: { Authorization: `Bearer ${jwt}` } },
+    { name: MCP_NAME, transport: 'http', url: MCP_URL },
     { dryRun: ctx.dryRun }
   );
   if (res.error) {
@@ -87,20 +139,32 @@ async function step(ctx) {
   }
   ui.ok('Agentcard MCP server registered.');
 
-  // 3. Put the account into PRODUCTION (real cards). New accounts go live by default.
-  let note = 'configured (production)';
-  try {
-    ui.step('Setting your account to production…');
-    await ac.setMode(jwt, 'prod');
-    ui.ok('Agentcard account is in ' + ui.c.bold('production') + ' mode.');
-    ui.dim('Add a payment method to fund real cards: ' + ui.c.bold('agent-cards payment-method') + ' (or in the dashboard).');
-  } catch (e) {
-    ui.warn('Could not set production mode automatically: ' + e.message);
-    ui.dim('Set it from the dashboard, or run ' + ui.c.bold('agent-cards mode prod') + '.');
-    note = 'configured (set production in the dashboard)';
+  // 3. Production (go live) — needs payment method + identity; opt-in. Uses the CLI when present.
+  let note = 'configured (TEST mode)';
+  if (ctx.sandbox) {
+    ui.dim('TEST mode by default. Going live (real cards) is offered here in a real run.');
+  } else {
+    const live = ctx.yes ? false : await ui.confirm('Switch to PRODUCTION now (issue real cards)? Needs a payment method + a quick identity check.', false);
+    if (live) {
+      if (have('agent-cards') && run('agent-cards', ['mode', 'prod'])) {
+        ui.info('To fund real cards, run ' + ui.c.bold('agent-cards payment-method') + ' (one-time Stripe page) and finish the identity prompts.');
+        note = 'configured (PROD mode — finish payment method to issue real cards)';
+      } else {
+        ui.info('Install the CLI (' + ui.c.bold('npm i -g agent-cards') + ') then run ' + ui.c.bold('agent-cards mode prod') + ' to go live.');
+        note = 'configured (TEST mode — install CLI to go live)';
+      }
+    } else {
+      ui.info('Staying in ' + ui.c.bold('TEST') + ' mode (sandbox cards). Go live anytime with ' + ui.c.bold('agent-cards mode prod') + '.');
+    }
   }
 
   return { product: 'Agentcard', icon: 'ok', note };
 }
 
-module.exports = { step, MCP_NAME };
+// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
+// Lets the launcher skip the up-front email prompt when nothing needs signup.
+function needsSetup() {
+  return !mcp.exists(MCP_NAME) && !ac.hasSession();
+}
+
+module.exports = { step, MCP_NAME, needsSetup };

package/lib/steps/agentmail.js

@@ -1,12 +1,66 @@
 'use strict';
-// [2/3] AgentMail — an email inbox. API-key driven (one console visit only if no key yet).
+// [2/3] AgentMail — an email inbox. Fully API-driven: sign-up -> OTP -> verify (no console visit).
+// Signs up via https://docs.agentmail.to/api-reference/agent/sign-up, tagging referrer=agentbundle,
+// reusing the email collected up front. The sign-up response carries the api_key directly; the OTP
+// verify step lifts the unverified-org send allowlist.
 
 const ui = require('../ui');
 const mcp = require('../mcp');
+const ac = require('../agentcard-api'); // shared email validation (isValidEmail)
 
 const MCP_NAME = 'agentmail';
 const MCP_URL = 'https://mcp.agentmail.to/mcp';
+const API = 'https://api.agentmail.to';
 const CONSOLE = 'https://console.agentmail.to';
+const REFERRER = 'agentbundle';     // the channel we report this sign-up came from
+const SOURCE = 'agentbundle-cli';   // platform identifier
+
+async function apiPost(path, body, token) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), 30000);
+  try {
+    const res = await fetch(API + path, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      },
+      body: JSON.stringify(body),
+      signal: ctrl.signal,
+    });
+    const text = await res.text();
+    let data;
+    try { data = JSON.parse(text); } catch { data = { raw: text }; }
+    return { ok: res.ok, status: res.status, data };
+  } catch (e) {
+    return { ok: false, status: 0, data: { error: e.message } };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// Derive an inbox username from the email local-part, plus a short suffix so the globally-unique
+// inbox address (username@agentmail.to) is unlikely to collide with an existing one.
+function usernameFor(email) {
+  const local = String(email).split('@')[0].toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  const base = local || 'agent';
+  const suffix = Math.random().toString(36).slice(2, 6);
+  return `${base}-${suffix}`;
+}
+
+function register(key, ctx, extraNote) {
+  ui.step('Registering the AgentMail MCP server…');
+  const res = mcp.addServer(
+    { name: MCP_NAME, transport: 'http', url: MCP_URL, headers: { 'x-api-key': key } },
+    { dryRun: ctx.dryRun }
+  );
+  if (res.error) {
+    ui.fail('Failed to register MCP server: ' + res.error);
+    return { product: 'AgentMail', icon: 'fail', note: res.error };
+  }
+  ui.ok('AgentMail MCP server registered.');
+  return { product: 'AgentMail', icon: 'ok', note: extraNote || 'configured' };
+}
 
 async function step(ctx) {
   ui.heading(2, 3, 'AgentMail — an email inbox for your agent');
@@ -17,35 +71,94 @@ async function step(ctx) {
     return { product: 'AgentMail', icon: 'ok', note: 'already configured' };
   }
 
-  // Get the API key: env first, else prompt (the one possible browser touch).
-  let key = process.env.AGENTMAIL_API_KEY || '';
-  if (key) {
-    ui.ok(`Using AGENTMAIL_API_KEY from your environment (${ui.mask(key)}).`);
-  } else if (ctx.dryRun) {
-    ui.step('would prompt for an AgentMail API key (am_…)');
+  // A pre-set key short-circuits the whole sign-up. Trim it — a copied key often carries a
+  // trailing newline/space that would register a broken credential.
+  const envKey = (process.env.AGENTMAIL_API_KEY || '').trim();
+  if (envKey) {
+    ui.ok(`Using AGENTMAIL_API_KEY from your environment (${ui.mask(envKey)}).`);
+    return register(envKey, ctx);
+  }
+
+  if (ctx.dryRun) {
+    ui.step('would: POST /v0/agent/sign-up (referrer: agentbundle) → ask for OTP → POST /v0/agent/verify → get am_ key + inbox');
     ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "x-api-key: …"`);
     return { product: 'AgentMail', icon: 'ok', note: 'configured (dry-run)' };
-  } else {
-    ui.info('AgentMail needs an API key (starts with ' + ui.c.bold('am_') + ').');
-    ui.info('Get one (free tier) at ' + ui.c.cyan(CONSOLE) + ' → Settings → API Keys.');
-    key = await ui.ask('Paste your AgentMail API key (or leave blank to skip for now):');
-    if (!key) {
-      ui.warn('No key provided — skipping AgentMail. Re-run later with the key set.');
-      return { product: 'AgentMail', icon: 'warn', note: 'needs key (set AGENTMAIL_API_KEY)' };
-    }
   }
 
-  ui.step('Registering the AgentMail MCP server…');
-  const res = mcp.addServer(
-    { name: MCP_NAME, url: MCP_URL, headers: { 'x-api-key': key } },
-    { dryRun: ctx.dryRun }
-  );
-  if (res.error) {
-    ui.fail('Failed to register MCP server: ' + res.error);
-    return { product: 'AgentMail', icon: 'fail', note: res.error };
+  if (ctx.sandbox) {
+    ui.step('[sandbox] simulating sign-up → OTP → verify…');
+    ui.ok('[sandbox] provisioned inbox my-agent@agentmail.to');
+    return register('am_sandbox_placeholder_key', ctx, 'configured (sandbox inbox)');
   }
-  ui.ok('AgentMail MCP server registered.');
-  return { product: 'AgentMail', icon: 'ok', note: 'configured' };
+
+  // Real flow — reuse the email collected up front; only ask (with validation) if one wasn't provided.
+  let email = ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
+  for (let tries = 0; !email && tries < 3; tries++) {
+    const entered = await ui.ask('What email should AgentMail send your verification code to?');
+    if (!entered) break;
+    if (ac.isValidEmail(entered)) email = entered;
+    else ui.warn("That doesn't look like an email — try again.");
+  }
+  if (!email) {
+    ui.warn('No email — skipping AgentMail. Re-run later.');
+    return { product: 'AgentMail', icon: 'warn', note: 'skipped (no email)' };
+  }
+
+  // Sign-up is idempotent on human_email (re-signup just rotates the key + returns it), so an
+  // existing account isn't a 409 — it returns 200. A 409 is a username collision (the random
+  // suffix clashed with another inbox), so retry with a fresh username before giving up.
+  ui.step('Creating your AgentMail inbox…');
+  let signup;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    signup = await apiPost('/v0/agent/sign-up', {
+      human_email: email,
+      username: usernameFor(email),
+      source: SOURCE,
+      referrer: REFERRER,
+    });
+    if (signup.status !== 409) break;
+  }
+
+  if (signup.status === 409) {
+    ui.warn('Could not auto-pick an available inbox name after a few tries.');
+    ui.info('Grab a key from ' + ui.c.cyan(CONSOLE) + ' → Settings → API Keys.');
+    const key = (await ui.ask('Paste your AgentMail API key (am_…), or blank to skip:')).trim();
+    if (!key) return { product: 'AgentMail', icon: 'warn', note: 'needs key (set AGENTMAIL_API_KEY)' };
+    return register(key, ctx);
+  }
+  if (!signup.ok || !signup.data.api_key) {
+    ui.fail('Sign-up failed: ' + (signup.data.error || signup.data.message || `HTTP ${signup.status}`));
+    return { product: 'AgentMail', icon: 'fail', note: 'sign-up failed' };
+  }
+
+  const key = signup.data.api_key;
+  const inbox = signup.data.inbox_id;
+  if (inbox) ui.ok('Inbox created: ' + ui.c.bold(inbox));
+
+  // Verify the OTP to lift the unverified-org send allowlist. The key already works for receiving
+  // without it, so a missing/wrong code degrades gracefully rather than failing the whole step.
+  ui.ok(`Verification code sent to ${email}. Check your inbox.`);
+  const otp = await ui.ask('Enter the 6-digit code (or blank to verify later):');
+  if (otp) {
+    ui.step('Verifying…');
+    const verify = await apiPost('/v0/agent/verify', { otp_code: otp }, key);
+    if (verify.ok && verify.data.verified) {
+      ui.ok('AgentMail account verified — sending unlocked.');
+    } else {
+      ui.warn('Could not verify the code now (' + (verify.data.error || verify.data.message || `HTTP ${verify.status}`) + ').');
+      ui.dim('Your inbox still works for receiving; verify later to lift send limits.');
+    }
+  } else {
+    ui.dim('Skipped verification — inbox works for receiving; verify later to send freely.');
+  }
+
+  ui.dim('API key stored in the MCP config (masked: ' + ui.mask(key) + '). Never share it.');
+  return register(key, ctx, inbox ? `inbox ${inbox}` : 'configured');
+}
+
+// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
+function needsSetup() {
+  return !mcp.exists(MCP_NAME) && !(process.env.AGENTMAIL_API_KEY || '').trim();
 }
 
-module.exports = { step, MCP_NAME };
+module.exports = { step, MCP_NAME, needsSetup };

package/lib/steps/agentphone.js

@@ -3,10 +3,12 @@
 
 const ui = require('../ui');
 const mcp = require('../mcp');
+const ac = require('../agentcard-api'); // shared email validation (isValidEmail)
 
 const MCP_NAME = 'agentphone';
 const API = 'https://api.agentphone.ai';
 const SETTINGS = 'https://agentphone.ai/settings';
+const SOURCE = 'agentbundle';   // sent on verify so AgentPhone attributes the signup to the bundle
 
 async function apiPost(path, body) {
   const ctrl = new AbortController();
@@ -53,20 +55,34 @@ async function step(ctx) {
     return { product: 'AgentPhone', icon: 'ok', note: 'already configured' };
   }
 
-  // Existing key in env?
-  if (process.env.AGENTPHONE_API_KEY) {
-    ui.ok(`Using AGENTPHONE_API_KEY from your environment (${ui.mask(process.env.AGENTPHONE_API_KEY)}).`);
-    return register(process.env.AGENTPHONE_API_KEY, ctx);
+  // Existing key in env? Trim it — a copied key often carries a trailing newline/space that
+  // would register a broken credential.
+  const envKey = (process.env.AGENTPHONE_API_KEY || '').trim();
+  if (envKey) {
+    ui.ok(`Using AGENTPHONE_API_KEY from your environment (${ui.mask(envKey)}).`);
+    return register(envKey, ctx);
   }
 
   if (ctx.dryRun) {
-    ui.step('would: POST /v0/agent/sign-up → ask for OTP → POST /v0/agent/verify → get sk_live_ key + number');
+    ui.step('would: POST /v0/agent/sign-up → ask for OTP → POST /v0/agent/verify (source: agentbundle) → get sk_live_ key + number');
     ui.dim(`would: claude mcp add ${MCP_NAME} --env AGENTPHONE_API_KEY=… -- npx -y agentphone-mcp`);
     return { product: 'AgentPhone', icon: 'ok', note: 'configured (dry-run)' };
   }
 
-  // Real flow.
-  const email = await ui.ask('What email should AgentPhone send your verification code to?');
+  if (ctx.sandbox) {
+    ui.step('[sandbox] simulating sign-up → OTP → verify…');
+    ui.ok('[sandbox] provisioned number +1 (555) 010-0042');
+    return register('sk_live_sandbox_placeholder_key', ctx, 'configured (sandbox number)');
+  }
+
+  // Real flow — reuse the email collected up front; only ask (with validation) if one wasn't provided.
+  let email = ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
+  for (let tries = 0; !email && tries < 3; tries++) {
+    const entered = await ui.ask('What email should AgentPhone send your verification code to?');
+    if (!entered) break;
+    if (ac.isValidEmail(entered)) email = entered;
+    else ui.warn("That doesn't look like an email — try again.");
+  }
   if (!email) {
     ui.warn('No email — skipping AgentPhone. Re-run later.');
     return { product: 'AgentPhone', icon: 'warn', note: 'skipped (no email)' };
@@ -78,7 +94,7 @@ async function step(ctx) {
   if (signup.status === 409) {
     ui.warn('You already have an AgentPhone account for that email.');
     ui.info('Grab a key from ' + ui.c.cyan(SETTINGS) + ' → API Keys.');
-    const key = await ui.ask('Paste your AgentPhone API key (sk_live_…), or blank to skip:');
+    const key = (await ui.ask('Paste your AgentPhone API key (sk_live_…), or blank to skip:')).trim();
     if (!key) return { product: 'AgentPhone', icon: 'warn', note: 'needs key (set AGENTPHONE_API_KEY)' };
     return register(key, ctx);
   }
@@ -95,7 +111,7 @@ async function step(ctx) {
   }
 
   ui.step('Verifying and provisioning your number…');
-  const verify = await apiPost('/v0/agent/verify', { verification_id: signup.data.verification_id, otp_code: otp });
+  const verify = await apiPost('/v0/agent/verify', { verification_id: signup.data.verification_id, otp_code: otp, source: SOURCE });
   if (!verify.ok || !verify.data.api_key) {
     ui.fail('Verification failed: ' + (verify.data.error || verify.data.message || `HTTP ${verify.status}`));
     return { product: 'AgentPhone', icon: 'fail', note: 'verification failed' };
@@ -106,4 +122,9 @@ async function step(ctx) {
   return register(verify.data.api_key, ctx, `live number ${verify.data.phone_number}`);
 }
 
-module.exports = { step, MCP_NAME };
+// Whether a real run would need the shared email for this product (i.e. it isn't already set up).
+function needsSetup() {
+  return !mcp.exists(MCP_NAME) && !(process.env.AGENTPHONE_API_KEY || '').trim();
+}
+
+module.exports = { step, MCP_NAME, needsSetup };

package/lib/ui.js

@@ -36,9 +36,7 @@ function banner() {
 }
 
 function heading(n, total, title) {
-  // total falsy → a plain section heading with no [n/total] counter (e.g. the bundle step).
-  const prefix = total ? `[${n}/${total}] ` : '';
-  stdout.write('\n' + c.bold(c.blue(`${prefix}${title}`)) + '\n');
+  stdout.write('\n' + c.bold(c.blue(`[${n}/${total}] ${title}`)) + '\n');
 }
 
 const info = (m) => stdout.write('  ' + m + '\n');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentbundle-cli",
-  "version": "0.2.0",
-  "description": "One command to give your AI agent a card, an inbox, and a phone — installs AgentCard, AgentMail, and AgentPhone via a guided onboarding flow.",
+  "version": "0.2.2",
+  "description": "One command to give your AI agent a card, an inbox, and a phone — installs Agentcard, AgentMail, and AgentPhone via a guided onboarding flow.",
   "bin": {
     "agentbundle-cli": "bin/agent-bundle.js",
     "agentbundle": "bin/agent-bundle.js",
@@ -25,5 +25,13 @@
     "onboarding",
     "cli"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tiny-agent-company/tiny-agent-company.git",
+    "directory": "apps/agent-bundle-cli"
+  },
   "license": "MIT"
 }

package/lib/steps/bundle.js

@@ -1,136 +0,0 @@
-'use strict';
-// Final step — the $20/mo bundle subscription. After all three MCP servers are
-// installed, this offers to subscribe to the Agent Bundle: one $20/mo charge for
-// Agentcard + AgentMail + AgentPhone (vs ~$43 buying them standalone).
-//
-// Billing runs on the Agent Bundle's OWN server (theagentbundle.com), on the
-// Agentcard Corporation Stripe account — separate from Agentcard's product
-// backend. The customer is keyed by email; we just open Stripe's hosted
-// checkout, so no charge happens until they enter a card and confirm there.
-
-const { spawn } = require('node:child_process');
-const ui = require('../ui');
-const ac = require('../agentcard-api');
-
-const PRICE_LABEL = '$20/mo';
-// The bundle server. Override for local/staging with AGENT_BUNDLE_API_URL.
-const BUNDLE_API_URL = (process.env.AGENT_BUNDLE_API_URL || 'https://theagentbundle.com').replace(/\/$/, '');
-
-async function fetchJson(method, path, body) {
-  const ctrl = new AbortController();
-  const t = setTimeout(() => ctrl.abort(), 30000);
-  try {
-    const res = await fetch(BUNDLE_API_URL + path, {
-      method,
-      headers: { 'Content-Type': 'application/json', 'x-source': 'agent-bundle-cli' },
-      ...(body ? { body: JSON.stringify(body) } : {}),
-      signal: ctrl.signal,
-    });
-    const text = await res.text();
-    let data;
-    try { data = JSON.parse(text); } catch { data = { raw: text }; }
-    return { ok: res.ok, status: res.status, data };
-  } finally {
-    clearTimeout(t);
-  }
-}
-
-// Open a URL in the user's default browser, best-effort and non-blocking.
-function openInBrowser(url) {
-  const cmd = process.platform === 'darwin' ? 'open'
-    : process.platform === 'win32' ? 'cmd'
-    : 'xdg-open';
-  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-  try {
-    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
-    child.on('error', () => {});
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// Use the email from the Agentcard signup; fall back to asking.
-async function resolveEmail(ctx) {
-  const saved = ac.readConfig().email;
-  if (saved && ac.isValidEmail(saved)) return saved;
-  if (ctx.yes || !process.stdin.isTTY) return null;
-  for (let tries = 0; tries < 3; tries++) {
-    const entered = await ui.ask('What email should your bundle subscription use?');
-    if (!entered) return null;
-    if (ac.isValidEmail(entered)) return entered;
-    ui.warn('That doesn\'t look like an email — try again.');
-  }
-  return null;
-}
-
-async function step(ctx) {
-  ui.heading(0, 0, 'Agent Bundle — one subscription for all three');
-  ui.dim(`Agentcard + AgentMail + AgentPhone together for ${PRICE_LABEL} (about half of buying them separately).`);
-
-  if (ctx.dryRun) {
-    ui.step(`would: POST ${BUNDLE_API_URL}/api/checkout {email} → open Stripe checkout for ${PRICE_LABEL}`);
-    return { product: 'Bundle', icon: 'ok', note: `offer ${PRICE_LABEL} (dry-run)` };
-  }
-  const email = await resolveEmail(ctx);
-  if (!email) {
-    ui.warn('No email for the bundle — skipping. Re-run with ' + ui.c.bold('--only bundle') + ' to subscribe.');
-    return { product: 'Bundle', icon: 'warn', note: 'needs email' };
-  }
-
-  // Is the bundle live, and is this email already subscribed?
-  try {
-    const r = await fetchJson('GET', `/api/status?email=${encodeURIComponent(email)}`);
-    if (r.ok && r.data && r.data.configured === false) {
-      ui.info('The bundle isn\'t available yet — your three MCP servers are installed and ready.');
-      return { product: 'Bundle', icon: 'ok', note: 'not offered (coming soon)' };
-    }
-    if (r.ok && r.data && r.data.active) {
-      ui.ok('This email already has an active Agent Bundle — nothing to do.');
-      return { product: 'Bundle', icon: 'ok', note: 'already subscribed' };
-    }
-  } catch {
-    ui.dim('(could not check bundle status — offering anyway)');
-  }
-
-  if (!ctx.yes) {
-    const go = await ui.confirm(`Subscribe to the Agent Bundle for ${PRICE_LABEL} now?`, true);
-    if (!go) {
-      ui.info('No problem — subscribe anytime by re-running with ' + ui.c.bold('--only bundle') + '.');
-      return { product: 'Bundle', icon: 'warn', note: 'declined' };
-    }
-  }
-
-  let checkoutUrl;
-  try {
-    ui.step('Creating your secure Stripe checkout…');
-    const r = await fetchJson('POST', '/api/checkout', { email });
-    if (r.status === 503) {
-      ui.info('The bundle isn\'t available yet — your three MCP servers are installed and ready.');
-      return { product: 'Bundle', icon: 'ok', note: 'not offered (coming soon)' };
-    }
-    if (r.status === 409) {
-      ui.ok('This email already has an active Agent Bundle — nothing to do.');
-      return { product: 'Bundle', icon: 'ok', note: 'already subscribed' };
-    }
-    if (!r.ok || !r.data || !r.data.checkoutUrl) {
-      throw new Error((r.data && r.data.error) || `HTTP ${r.status}`);
-    }
-    checkoutUrl = r.data.checkoutUrl;
-  } catch (e) {
-    ui.fail('Could not start checkout: ' + e.message);
-    return { product: 'Bundle', icon: 'fail', note: 'checkout failed' };
-  }
-
-  const opened = openInBrowser(checkoutUrl);
-  if (opened) ui.ok('Opened Stripe checkout in your browser.');
-  else ui.warn('Could not open your browser automatically.');
-  ui.info('Complete the ' + ui.c.bold(PRICE_LABEL) + ' subscription here:');
-  ui.info('  ' + ui.c.cyan(checkoutUrl));
-  ui.dim('No charge happens until you enter a card and confirm on Stripe\'s page.');
-
-  return { product: 'Bundle', icon: 'ok', note: `checkout opened (${PRICE_LABEL})` };
-}
-
-module.exports = { step };