agentbundle-cli 0.2.1 → 0.2.2

package/README.md

@@ -10,12 +10,12 @@ npx agentbundle-cli
 
 ## What it does
 
-It asks for **one email up front** and reuses it for all three sign-ups (the Agentcard magic
-link and the AgentMail + AgentPhone verification codes), then runs a guided, three-step onboarding:
+It asks for **one email up front** and reuses it for all three sign-ups (each product emails a
+verification code), then runs a guided, three-step onboarding:
 
-1. **Agentcard** — installs the `agent-cards` CLI, signs you up (one magic-link email click),
-   registers + authenticates the MCP server via `agent-cards setup-mcp` (hosted HTTP), and offers
-   to switch to production (real cards).
+1. **Agentcard** — signs you up (you type in the emailed verification code), registers the
+   hosted HTTP MCP server (OAuth sign-in on first tool use), and offers to switch to
+   production (real cards).
 2. **AgentMail** — fully automated: signs you up via the API (no console visit), provisions an
    inbox, you type in the verification code, and it registers the hosted HTTP MCP server
    (`mcp.agentmail.to`). Sign-ups are tagged with the `agentbundle` referrer.

package/bin/agent-bundle.js

@@ -59,7 +59,7 @@ function icon(kind) {
   return kind === 'ok' ? ui.c.green('✓') : kind === 'warn' ? ui.c.yellow('!') : ui.c.red('✗');
 }
 
-// One email drives all three sign-ups (Agentcard magic link, AgentMail + AgentPhone OTP). Collect
+// One email drives all three sign-ups (Agentcard, AgentMail + AgentPhone verification codes). Collect
 // it once up front so each product reuses it instead of asking three times. Stores it on ctx.email.
 async function collectEmail(ctx) {
   if (ctx.email && ac.isValidEmail(ctx.email)) return ctx.email; // from --email / AGENT_BUNDLE_EMAIL
@@ -101,7 +101,7 @@ async function main() {
   }
 
   // Step one: collect the single email FIRST — before the confirm or any product — so every
-  // sign-up reuses it (Agentcard magic link, AgentMail + AgentPhone codes) and no step ever asks
+  // sign-up reuses it (Agentcard + AgentMail + AgentPhone verification codes) and no step ever asks
   // for it again. A pre-set --email / AGENT_BUNDLE_EMAIL skips the prompt entirely.
   // Only prompt when a selected product actually needs signup; if everything is already
   // configured the prompt is skipped and the run stays a clean no-op.

package/lib/agentcard-api.js

@@ -1,11 +1,15 @@
 'use strict';
 // Minimal Agentcard auth client used to complete signup from inside agent-bundle, so the whole
-// flow (ask email → magic link → verify) happens here AND the signup is tagged with our source.
+// flow (ask email → enter the emailed code → verify) happens here AND the signup is tagged with
+// our source.
 //
-// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json ({email,jwt,mode},
-// mode 0600), same endpoints (POST /auth/signup, poll GET /auth/me with X-Magic-Token). The one
-// difference: we send `x-platform: agentbundle` so the backend records these signups as coming
-// from the bundle.
+// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json (mode 0600), same
+// endpoints. Current backends answer POST /auth/signup with { mode: 'workos' } and email a
+// numeric code, completed via POST /auth/verify-code → { accessToken, refreshToken, email }.
+// Older backends return { sessionId } and email a magic link, completed by polling GET /auth/me
+// with X-Magic-Token — both flows are supported. The one difference from the agent-cards CLI:
+// we send `x-platform: agentbundle` so the backend records these signups as coming from the
+// bundle.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -76,16 +80,36 @@ async function getJson(pathname, extraHeaders) {
   }
 }
 
-// Request a magic link. Returns { sessionId } or throws with a readable message.
-async function requestMagicLink(email) {
+// Start a signup/login. Returns { mode: 'workos' } (a numeric code was emailed; finish with
+// verifyCode) or { mode: 'legacy', sessionId } (a magic link was emailed; finish with
+// waitForVerification). Throws with a readable message on failure.
+async function startSignup(email) {
   const r = await postJson('/auth/signup', { email });
-  if (!r.ok || !r.data.sessionId) {
+  if (!r.ok) {
     throw new Error(r.data.error || r.data.message || `signup failed (HTTP ${r.status})`);
   }
-  return { sessionId: r.data.sessionId };
+  if (r.data.mode === 'workos' || !r.data.sessionId) {
+    return { mode: 'workos' };
+  }
+  if (r.data._emailError) {
+    throw new Error('Email delivery failed on our side. Try again in a minute — if it keeps happening, email support@agentcard.sh.');
+  }
+  return { mode: 'legacy', sessionId: r.data.sessionId };
 }
 
-// Poll until the user clicks the magic link. Returns { jwt, email, mode }.
+// Complete a code-based (WorkOS) login. Returns { accessToken, refreshToken, email }.
+// Throws with err.status set (401 = wrong/expired code → worth re-prompting, 429 = throttled).
+async function verifyCode(email, code) {
+  const r = await postJson('/auth/verify-code', { email, code });
+  if (r.ok && r.data && (r.data.accessToken || r.data.jwt)) {
+    return r.data;
+  }
+  const err = new Error(r.data.error || r.data.message || `verification failed (HTTP ${r.status})`);
+  err.status = r.status;
+  throw err;
+}
+
+// Legacy flow only: poll until the user clicks the magic link. Returns { jwt, email, mode }.
 async function waitForVerification(sessionId, { intervalMs = 2500, timeoutMs = 10 * 60 * 1000 } = {}) {
   const deadline = Date.now() + timeoutMs;
   // Date.now is fine at runtime; this module is never run inside the workflow sandbox.
@@ -103,12 +127,21 @@ function isValidEmail(s) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
 }
 
+// A stored session in ~/.agent-cards/config.json: either a WorkOS token pair
+// (current) or a legacy magic-link JWT.
+function hasSession(cfg) {
+  const c = cfg || readConfig();
+  return !!(c.accessToken || c.jwt);
+}
+
 module.exports = {
   SOURCE,
   API_URL,
   readConfig,
   writeConfig,
-  requestMagicLink,
+  hasSession,
+  startSignup,
+  verifyCode,
   waitForVerification,
   isValidEmail,
 };

package/lib/steps/agentcard.js

@@ -1,6 +1,9 @@
 'use strict';
-// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → magic link →
-// verify), tagging the signup source as `agentbundle`, then registers the MCP server with the JWT.
+// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → enter the
+// emailed code → verify), tagging the signup source as `agentbundle`, then registers the MCP
+// server. Registration uses OAuth (no static Authorization header): Claude opens a browser
+// sign-in the first time a tool runs. A baked bearer would be a short-lived WorkOS access token
+// that silently starts 401ing within hours — same reason `agent-cards setup-mcp` dropped it.
 
 const { spawnSync } = require('node:child_process');
 const ui = require('../ui');
@@ -21,37 +24,73 @@ function run(cmd, args) {
   return !r.error && r.status === 0;
 }
 
-// Send the magic link and wait for the click. Reuses the shared email collected up front
-// (ctx.email); only asks if one wasn't provided. Returns the JWT, or null.
+const CODE_MAX_ENTRIES = 3;
+
+// Sign up (or in): current backends email a numeric code we verify; legacy backends email a
+// magic link we poll for. Reuses the shared email collected up front (ctx.email); only asks if
+// one wasn't provided. Returns true when a session is stored in ~/.agent-cards/config.json.
 async function completeSignup(ctx) {
   let email = ctx && ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
   for (let tries = 0; tries < 3 && !email; tries++) {
     const entered = await ui.ask('What email should your Agentcard account use?');
-    if (!entered) return null; // blank = skip
+    if (!entered) return false; // blank = skip
     if (ac.isValidEmail(entered)) email = entered;
     else ui.warn('That doesn\'t look like an email — try again.');
   }
-  if (!email) return null;
+  if (!email) return false;
 
-  let sessionId;
+  let start;
   try {
-    ui.step(`Sending a magic link to ${email}…`);
-    ({ sessionId } = await ac.requestMagicLink(email));
+    ui.step(`Starting Agentcard sign-in for ${email}…`);
+    start = await ac.startSignup(email);
   } catch (e) {
     ui.fail('Could not start signup: ' + e.message);
-    return null;
+    return false;
+  }
+
+  if (start.mode === 'workos') {
+    ui.ok(`We emailed a sign-in code to ${ui.c.bold(email)}.`);
+    for (let attempt = 1; attempt <= CODE_MAX_ENTRIES; attempt++) {
+      const code = (await ui.ask('Enter the code from your email:')).trim();
+      if (!code) {
+        ui.warn('No code entered — skipping Agentcard signup.');
+        return false;
+      }
+      try {
+        const verified = await ac.verifyCode(email, code);
+        // Replace the whole session: a stale legacy jwt left in place would shadow
+        // the fresh token pair for anything that still reads it.
+        ac.writeConfig({
+          email: verified.email || email,
+          accessToken: verified.accessToken,
+          refreshToken: verified.refreshToken,
+          jwt: undefined,
+        });
+        ui.ok(`Signed in as ${ui.c.bold(verified.email || email)}`);
+        return true;
+      } catch (e) {
+        if (e.status === 401 && attempt < CODE_MAX_ENTRIES) {
+          ui.warn(`That code didn't work (attempt ${attempt}/${CODE_MAX_ENTRIES}) — check the newest email to ${email}.`);
+          continue;
+        }
+        ui.fail('Signup not completed: ' + e.message);
+        return false;
+      }
+    }
+    return false;
   }
 
+  // Legacy magic-link backend.
   ui.ok(`Magic link sent to ${ui.c.bold(email)}.`);
   ui.info('Open your inbox and click the link — ' + ui.c.dim('waiting for you…'));
   try {
-    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(sessionId);
-    ac.writeConfig({ email: verifiedEmail || email, jwt, mode });
+    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(start.sessionId);
+    ac.writeConfig({ email: verifiedEmail || email, jwt, mode, accessToken: undefined, refreshToken: undefined });
     ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}` + (mode ? ` (${mode} mode)` : ''));
-    return jwt;
+    return true;
   } catch (e) {
     ui.fail('Signup not completed: ' + e.message);
-    return null;
+    return false;
   }
 }
 
@@ -64,35 +103,34 @@ async function step(ctx) {
     return { product: 'Agentcard', icon: 'ok', note: 'already configured' };
   }
 
-  // 1. Get an authenticated session (JWT).
-  let jwt;
+  // 1. Get an authenticated session (so the signup is attributed to the bundle and
+  //    go-live has an account to work with). The MCP server itself authenticates via
+  //    OAuth, so no token is threaded into the registration below.
   if (ctx.dryRun) {
-    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and wait for the magic link');
-    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "Authorization: Bearer <jwt>"`);
+    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and verify the emailed code');
+    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} (OAuth — no static header)`);
     return { product: 'Agentcard', icon: 'ok', note: 'configured (dry-run)' };
   } else if (ctx.sandbox) {
-    ui.step('[sandbox] simulating email → magic link → verified');
-    jwt = 'sandbox_placeholder_jwt';
-  } else if (ac.readConfig().jwt) {
+    ui.step('[sandbox] simulating email → code → verified');
+  } else if (ac.hasSession()) {
     const cfg = ac.readConfig();
     ui.ok(`Already signed in to Agentcard${cfg.email ? ' as ' + ui.c.bold(cfg.email) : ''} — skipping signup.`);
-    jwt = cfg.jwt;
   } else if (!process.stdin.isTTY) {
     ui.warn('Not signed in to Agentcard, and no interactive terminal to complete signup.');
-    ui.info('Re-run this in a terminal so it can collect your email and the magic link.');
+    ui.info('Re-run this in a terminal so it can collect your email and the emailed sign-in code.');
     return { product: 'Agentcard', icon: 'warn', note: 'needs interactive signup' };
   } else {
-    jwt = await completeSignup(ctx);
-    if (!jwt) {
+    const signedIn = await completeSignup(ctx);
+    if (!signedIn) {
       ui.warn('Skipped Agentcard signup — re-run with --only agentcard when ready.');
       return { product: 'Agentcard', icon: 'warn', note: 'signup not completed' };
     }
   }
 
-  // 2. Register the MCP server with the JWT (matches the authenticated hosted-HTTP setup).
+  // 2. Register the MCP server (OAuth: a browser sign-in appears the first time a tool runs).
   ui.step('Registering the Agentcard MCP server…');
   const res = mcp.addServer(
-    { name: MCP_NAME, transport: 'http', url: MCP_URL, headers: { Authorization: `Bearer ${jwt}` } },
+    { name: MCP_NAME, transport: 'http', url: MCP_URL },
     { dryRun: ctx.dryRun }
   );
   if (res.error) {
@@ -126,7 +164,7 @@ async function step(ctx) {
 // Whether a real run would need the shared email for this product (i.e. it isn't already set up).
 // Lets the launcher skip the up-front email prompt when nothing needs signup.
 function needsSetup() {
-  return !mcp.exists(MCP_NAME) && !ac.readConfig().jwt;
+  return !mcp.exists(MCP_NAME) && !ac.hasSession();
 }
 
 module.exports = { step, MCP_NAME, needsSetup };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbundle-cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "One command to give your AI agent a card, an inbox, and a phone — installs Agentcard, AgentMail, and AgentPhone via a guided onboarding flow.",
   "bin": {
     "agentbundle-cli": "bin/agent-bundle.js",