agentbundle-cli 0.2.1 → 0.2.3

package/README.md

@@ -10,17 +10,21 @@ npx agentbundle-cli
 
 ## What it does
 
-It asks for **one email up front** and reuses it for all three sign-ups (the Agentcard magic
-link and the AgentMail + AgentPhone verification codes), then runs a guided, three-step onboarding:
+It asks for **one email up front** and reuses it for all three sign-ups (each product emails a
+verification code), then runs a guided, four-step onboarding:
 
-1. **Agentcard** — installs the `agent-cards` CLI, signs you up (one magic-link email click),
-   registers + authenticates the MCP server via `agent-cards setup-mcp` (hosted HTTP), and offers
-   to switch to production (real cards).
+1. **Agentcard** — signs you up (you type in the emailed verification code), registers the
+   hosted HTTP MCP server (OAuth sign-in on first tool use), and offers to switch to
+   production (real cards).
 2. **AgentMail** — fully automated: signs you up via the API (no console visit), provisions an
    inbox, you type in the verification code, and it registers the hosted HTTP MCP server
    (`mcp.agentmail.to`). Sign-ups are tagged with the `agentbundle` referrer.
 3. **AgentPhone** — fully automated: requests a verification code by email, you type it in, it
    provisions a real US number, and registers the stdio MCP server (`npx -y agentphone-mcp`). No browser.
+4. **Agent Bundle subscription** — checks whether your email already has the $20/mo bundle and,
+   if not, prints a Stripe checkout link for you to open. Nothing is charged by the CLI, and
+   nothing is charged until you confirm on that page. Until you do, the three products bill
+   separately. Skipped with `--only` and in `--sandbox`/`--dry-run`.
 
 All MCP servers are registered at **user scope** (available in every project), via `claude mcp add`.
 

package/bin/agent-bundle.js

@@ -8,6 +8,7 @@ const ac = require('../lib/agentcard-api');
 const agentcard = require('../lib/steps/agentcard');
 const agentmail = require('../lib/steps/agentmail');
 const agentphone = require('../lib/steps/agentphone');
+const bundle = require('../lib/steps/bundle');
 
 const MODULES = {
   agentcard,
@@ -59,7 +60,7 @@ function icon(kind) {
   return kind === 'ok' ? ui.c.green('✓') : kind === 'warn' ? ui.c.yellow('!') : ui.c.red('✗');
 }
 
-// One email drives all three sign-ups (Agentcard magic link, AgentMail + AgentPhone OTP). Collect
+// One email drives all three sign-ups (Agentcard, AgentMail + AgentPhone verification codes). Collect
 // it once up front so each product reuses it instead of asking three times. Stores it on ctx.email.
 async function collectEmail(ctx) {
   if (ctx.email && ac.isValidEmail(ctx.email)) return ctx.email; // from --email / AGENT_BUNDLE_EMAIL
@@ -86,7 +87,7 @@ async function main() {
   if (ctx.sandbox) ui.warn('SANDBOX — stub signups, throwaway config, no real accounts or charges.');
 
   // Preflight
-  ui.heading(0, 3, 'Preflight');
+  ui.heading(0, 4, 'Preflight');
   ui.info('Node ' + process.version);
   ui.info('MCP config target: ' + ui.c.bold(mcp.describeBackend()));
   ui.dim('Each product loads as MCP tools after you restart your agent session at the end.');
@@ -101,7 +102,7 @@ async function main() {
   }
 
   // Step one: collect the single email FIRST — before the confirm or any product — so every
-  // sign-up reuses it (Agentcard magic link, AgentMail + AgentPhone codes) and no step ever asks
+  // sign-up reuses it (Agentcard + AgentMail + AgentPhone verification codes) and no step ever asks
   // for it again. A pre-set --email / AGENT_BUNDLE_EMAIL skips the prompt entirely.
   // Only prompt when a selected product actually needs signup; if everything is already
   // configured the prompt is skipped and the run stays a clean no-op.
@@ -138,6 +139,18 @@ async function main() {
     }
   }
 
+  // The bundle subscription itself. Without this the three products are just three separate
+  // sign-ups billed separately — the customer finishes the flow believing they're on the
+  // bundle. Skipped for --only runs (one product isn't a bundle) and never fatal.
+  if (!ctx.only) {
+    try {
+      results.push(await bundle.step(ctx));
+    } catch (e) {
+      ui.fail(`bundle crashed: ${e.message}`);
+      results.push({ product: 'bundle', icon: 'fail', note: e.message });
+    }
+  }
+
   // Summary
   ui.blank();
   ui.info(ui.c.bold('── Summary ──────────────────────────────────────────'));
@@ -146,7 +159,8 @@ async function main() {
   }
   ui.blank();
 
-  const anyConfigured = results.some((r) => r.icon === 'ok');
+  // Only the three products register MCP servers — a bundle 'ok' must not imply a restart is due.
+  const anyConfigured = results.some((r) => r.icon === 'ok' && r.product !== 'bundle');
   if (anyConfigured && !ctx.dryRun) {
     ui.info(ui.c.bold('Next:'));
     ui.step('Restart your agent session so the new MCP tools load.');

package/lib/agentcard-api.js

@@ -1,11 +1,15 @@
 'use strict';
 // Minimal Agentcard auth client used to complete signup from inside agent-bundle, so the whole
-// flow (ask email → magic link → verify) happens here AND the signup is tagged with our source.
+// flow (ask email → enter the emailed code → verify) happens here AND the signup is tagged with
+// our source.
 //
-// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json ({email,jwt,mode},
-// mode 0600), same endpoints (POST /auth/signup, poll GET /auth/me with X-Magic-Token). The one
-// difference: we send `x-platform: agentbundle` so the backend records these signups as coming
-// from the bundle.
+// Mirrors the agent-cards CLI: same API base, same ~/.agent-cards/config.json (mode 0600), same
+// endpoints. Current backends answer POST /auth/signup with { mode: 'workos' } and email a
+// numeric code, completed via POST /auth/verify-code → { accessToken, refreshToken, email }.
+// Older backends return { sessionId } and email a magic link, completed by polling GET /auth/me
+// with X-Magic-Token — both flows are supported. The one difference from the agent-cards CLI:
+// we send `x-platform: agentbundle` so the backend records these signups as coming from the
+// bundle.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -76,16 +80,36 @@ async function getJson(pathname, extraHeaders) {
   }
 }
 
-// Request a magic link. Returns { sessionId } or throws with a readable message.
-async function requestMagicLink(email) {
+// Start a signup/login. Returns { mode: 'workos' } (a numeric code was emailed; finish with
+// verifyCode) or { mode: 'legacy', sessionId } (a magic link was emailed; finish with
+// waitForVerification). Throws with a readable message on failure.
+async function startSignup(email) {
   const r = await postJson('/auth/signup', { email });
-  if (!r.ok || !r.data.sessionId) {
+  if (!r.ok) {
     throw new Error(r.data.error || r.data.message || `signup failed (HTTP ${r.status})`);
   }
-  return { sessionId: r.data.sessionId };
+  if (r.data.mode === 'workos' || !r.data.sessionId) {
+    return { mode: 'workos' };
+  }
+  if (r.data._emailError) {
+    throw new Error('Email delivery failed on our side. Try again in a minute. If it keeps happening, email support@agentcard.com.');
+  }
+  return { mode: 'legacy', sessionId: r.data.sessionId };
 }
 
-// Poll until the user clicks the magic link. Returns { jwt, email, mode }.
+// Complete a code-based (WorkOS) login. Returns { accessToken, refreshToken, email }.
+// Throws with err.status set (401 = wrong/expired code → worth re-prompting, 429 = throttled).
+async function verifyCode(email, code) {
+  const r = await postJson('/auth/verify-code', { email, code });
+  if (r.ok && r.data && (r.data.accessToken || r.data.jwt)) {
+    return r.data;
+  }
+  const err = new Error(r.data.error || r.data.message || `verification failed (HTTP ${r.status})`);
+  err.status = r.status;
+  throw err;
+}
+
+// Legacy flow only: poll until the user clicks the magic link. Returns { jwt, email, mode }.
 async function waitForVerification(sessionId, { intervalMs = 2500, timeoutMs = 10 * 60 * 1000 } = {}) {
   const deadline = Date.now() + timeoutMs;
   // Date.now is fine at runtime; this module is never run inside the workflow sandbox.
@@ -103,12 +127,21 @@ function isValidEmail(s) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
 }
 
+// A stored session in ~/.agent-cards/config.json: either a WorkOS token pair
+// (current) or a legacy magic-link JWT.
+function hasSession(cfg) {
+  const c = cfg || readConfig();
+  return !!(c.accessToken || c.jwt);
+}
+
 module.exports = {
   SOURCE,
   API_URL,
   readConfig,
   writeConfig,
-  requestMagicLink,
+  hasSession,
+  startSignup,
+  verifyCode,
   waitForVerification,
   isValidEmail,
 };

package/lib/steps/agentcard.js

@@ -1,6 +1,9 @@
 'use strict';
-// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → magic link →
-// verify), tagging the signup source as `agentbundle`, then registers the MCP server with the JWT.
+// [1/3] Agentcard — virtual cards. agent-bundle drives the full signup (ask email → enter the
+// emailed code → verify), tagging the signup source as `agentbundle`, then registers the MCP
+// server. Registration uses OAuth (no static Authorization header): Claude opens a browser
+// sign-in the first time a tool runs. A baked bearer would be a short-lived WorkOS access token
+// that silently starts 401ing within hours — same reason `agent-cards setup-mcp` dropped it.
 
 const { spawnSync } = require('node:child_process');
 const ui = require('../ui');
@@ -21,42 +24,78 @@ function run(cmd, args) {
   return !r.error && r.status === 0;
 }
 
-// Send the magic link and wait for the click. Reuses the shared email collected up front
-// (ctx.email); only asks if one wasn't provided. Returns the JWT, or null.
+const CODE_MAX_ENTRIES = 3;
+
+// Sign up (or in): current backends email a numeric code we verify; legacy backends email a
+// magic link we poll for. Reuses the shared email collected up front (ctx.email); only asks if
+// one wasn't provided. Returns true when a session is stored in ~/.agent-cards/config.json.
 async function completeSignup(ctx) {
   let email = ctx && ctx.email && ac.isValidEmail(ctx.email) ? ctx.email : '';
   for (let tries = 0; tries < 3 && !email; tries++) {
     const entered = await ui.ask('What email should your Agentcard account use?');
-    if (!entered) return null; // blank = skip
+    if (!entered) return false; // blank = skip
     if (ac.isValidEmail(entered)) email = entered;
     else ui.warn('That doesn\'t look like an email — try again.');
   }
-  if (!email) return null;
+  if (!email) return false;
 
-  let sessionId;
+  let start;
   try {
-    ui.step(`Sending a magic link to ${email}…`);
-    ({ sessionId } = await ac.requestMagicLink(email));
+    ui.step(`Starting Agentcard sign-in for ${email}…`);
+    start = await ac.startSignup(email);
   } catch (e) {
     ui.fail('Could not start signup: ' + e.message);
-    return null;
+    return false;
+  }
+
+  if (start.mode === 'workos') {
+    ui.ok(`We emailed a sign-in code to ${ui.c.bold(email)}.`);
+    for (let attempt = 1; attempt <= CODE_MAX_ENTRIES; attempt++) {
+      const code = (await ui.ask('Enter the code from your email:')).trim();
+      if (!code) {
+        ui.warn('No code entered — skipping Agentcard signup.');
+        return false;
+      }
+      try {
+        const verified = await ac.verifyCode(email, code);
+        // Replace the whole session: a stale legacy jwt left in place would shadow
+        // the fresh token pair for anything that still reads it.
+        ac.writeConfig({
+          email: verified.email || email,
+          accessToken: verified.accessToken,
+          refreshToken: verified.refreshToken,
+          jwt: undefined,
+        });
+        ui.ok(`Signed in as ${ui.c.bold(verified.email || email)}`);
+        return true;
+      } catch (e) {
+        if (e.status === 401 && attempt < CODE_MAX_ENTRIES) {
+          ui.warn(`That code didn't work (attempt ${attempt}/${CODE_MAX_ENTRIES}) — check the newest email to ${email}.`);
+          continue;
+        }
+        ui.fail('Signup not completed: ' + e.message);
+        return false;
+      }
+    }
+    return false;
   }
 
+  // Legacy magic-link backend.
   ui.ok(`Magic link sent to ${ui.c.bold(email)}.`);
   ui.info('Open your inbox and click the link — ' + ui.c.dim('waiting for you…'));
   try {
-    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(sessionId);
-    ac.writeConfig({ email: verifiedEmail || email, jwt, mode });
+    const { jwt, email: verifiedEmail, mode } = await ac.waitForVerification(start.sessionId);
+    ac.writeConfig({ email: verifiedEmail || email, jwt, mode, accessToken: undefined, refreshToken: undefined });
     ui.ok(`Signed in as ${ui.c.bold(verifiedEmail || email)}` + (mode ? ` (${mode} mode)` : ''));
-    return jwt;
+    return true;
   } catch (e) {
     ui.fail('Signup not completed: ' + e.message);
-    return null;
+    return false;
   }
 }
 
 async function step(ctx) {
-  ui.heading(1, 3, 'Agentcard — a virtual card for your agent');
+  ui.heading(1, 4, 'Agentcard — a virtual card for your agent');
   ui.dim('Prepaid virtual cards with per-task budgets, controlled through MCP tools.');
 
   if (mcp.exists(MCP_NAME)) {
@@ -64,35 +103,34 @@ async function step(ctx) {
     return { product: 'Agentcard', icon: 'ok', note: 'already configured' };
   }
 
-  // 1. Get an authenticated session (JWT).
-  let jwt;
+  // 1. Get an authenticated session (so the signup is attributed to the bundle and
+  //    go-live has an account to work with). The MCP server itself authenticates via
+  //    OAuth, so no token is threaded into the registration below.
   if (ctx.dryRun) {
-    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and wait for the magic link');
-    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} --header "Authorization: Bearer <jwt>"`);
+    ui.step('would use the shared email, POST /auth/signup (x-platform: agentbundle), and verify the emailed code');
+    ui.dim(`would: claude mcp add --transport http ${MCP_NAME} ${MCP_URL} (OAuth — no static header)`);
     return { product: 'Agentcard', icon: 'ok', note: 'configured (dry-run)' };
   } else if (ctx.sandbox) {
-    ui.step('[sandbox] simulating email → magic link → verified');
-    jwt = 'sandbox_placeholder_jwt';
-  } else if (ac.readConfig().jwt) {
+    ui.step('[sandbox] simulating email → code → verified');
+  } else if (ac.hasSession()) {
     const cfg = ac.readConfig();
     ui.ok(`Already signed in to Agentcard${cfg.email ? ' as ' + ui.c.bold(cfg.email) : ''} — skipping signup.`);
-    jwt = cfg.jwt;
   } else if (!process.stdin.isTTY) {
     ui.warn('Not signed in to Agentcard, and no interactive terminal to complete signup.');
-    ui.info('Re-run this in a terminal so it can collect your email and the magic link.');
+    ui.info('Re-run this in a terminal so it can collect your email and the emailed sign-in code.');
     return { product: 'Agentcard', icon: 'warn', note: 'needs interactive signup' };
   } else {
-    jwt = await completeSignup(ctx);
-    if (!jwt) {
+    const signedIn = await completeSignup(ctx);
+    if (!signedIn) {
       ui.warn('Skipped Agentcard signup — re-run with --only agentcard when ready.');
       return { product: 'Agentcard', icon: 'warn', note: 'signup not completed' };
     }
   }
 
-  // 2. Register the MCP server with the JWT (matches the authenticated hosted-HTTP setup).
+  // 2. Register the MCP server (OAuth: a browser sign-in appears the first time a tool runs).
   ui.step('Registering the Agentcard MCP server…');
   const res = mcp.addServer(
-    { name: MCP_NAME, transport: 'http', url: MCP_URL, headers: { Authorization: `Bearer ${jwt}` } },
+    { name: MCP_NAME, transport: 'http', url: MCP_URL },
     { dryRun: ctx.dryRun }
   );
   if (res.error) {
@@ -126,7 +164,7 @@ async function step(ctx) {
 // Whether a real run would need the shared email for this product (i.e. it isn't already set up).
 // Lets the launcher skip the up-front email prompt when nothing needs signup.
 function needsSetup() {
-  return !mcp.exists(MCP_NAME) && !ac.readConfig().jwt;
+  return !mcp.exists(MCP_NAME) && !ac.hasSession();
 }
 
 module.exports = { step, MCP_NAME, needsSetup };

package/lib/steps/agentmail.js

@@ -63,7 +63,7 @@ function register(key, ctx, extraNote) {
 }
 
 async function step(ctx) {
-  ui.heading(2, 3, 'AgentMail — an email inbox for your agent');
+  ui.heading(2, 4, 'AgentMail — an email inbox for your agent');
   ui.dim('Real inboxes the agent owns — for sign-ups, verification emails, and outreach.');
 
   if (mcp.exists(MCP_NAME)) {

package/lib/steps/agentphone.js

@@ -47,7 +47,7 @@ function register(key, ctx, extraNote) {
 }
 
 async function step(ctx) {
-  ui.heading(3, 3, 'AgentPhone — a real phone number for your agent');
+  ui.heading(3, 4, 'AgentPhone — a real phone number for your agent');
   ui.dim('A live US number for SMS + voice. This step is fully automated — no browser needed.');
 
   if (mcp.exists(MCP_NAME)) {

package/lib/steps/bundle.js

@@ -0,0 +1,114 @@
+'use strict';
+// [4/4] Agent Bundle subscription — the one thing that makes the three products a *bundle*.
+//
+// The three product steps each sign the customer up separately; none of them starts the
+// $20/mo bundle subscription. That subscription lives on the bundle site (Stripe, keyed by
+// email) — `apps/agent-bundle/src/app/api/checkout/route.ts` is written for this CLI to call
+// ("the `agent-bundle` CLI calls this after installing the three MCP servers") but nothing
+// ever did, so every run finished with the customer unsubscribed and no way to tell.
+//
+// We never charge here. We check status, and when there's no subscription we hand back the
+// Stripe hosted checkout URL — the customer enters a card there or ignores it. A missing or
+// unreachable bundle site is a warning, never a failure: the three products are already set up.
+
+const ui = require('../ui');
+const ac = require('../agentcard-api');
+
+const SITE_URL = (process.env.AGENT_BUNDLE_SITE_URL || 'https://theagentbundle.com').replace(/\/+$/, '');
+const PRICE = '$20/mo';
+
+async function getJson(url, init) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), 20000);
+  try {
+    const res = await fetch(url, { ...init, signal: ctrl.signal });
+    let body = null;
+    try {
+      body = await res.json();
+    } catch {
+      /* non-JSON body — treated as an empty response below */
+    }
+    return { status: res.status, body: body || {} };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// True when this run should not touch the bundle site at all.
+function needsSetup(ctx) {
+  return !ctx.dryRun && !ctx.sandbox;
+}
+
+async function step(ctx) {
+  const product = 'bundle';
+  ui.heading(4, 4, `Agent Bundle subscription (${PRICE})`);
+
+  if (ctx.dryRun) {
+    ui.step(`would GET ${SITE_URL}/api/status?email=… and, if not subscribed, POST /api/checkout for a ${PRICE} Stripe link`);
+    return { product, icon: 'ok', note: 'dry run — no subscription started' };
+  }
+  if (ctx.sandbox) {
+    ui.dim('sandbox — skipping the subscription (no money, no Stripe).');
+    return { product, icon: 'ok', note: 'skipped in sandbox' };
+  }
+  // On a re-run where all three products are already configured the CLI never asks for an email,
+  // so fall back to the one the Agentcard sign-up stored. Without this, exactly the customer who
+  // most needs the subscription check — the one who already finished the flow — never gets it.
+  const email = ctx.email || (ac.readConfig().email || '').trim();
+  if (!email) {
+    ui.warn('No email set, so I can\'t look up or start the bundle subscription.');
+    ui.dim(`Re-run with --email you@example.com, or subscribe at ${SITE_URL}.`);
+    return { product, icon: 'warn', note: 'no email — subscribe at ' + SITE_URL };
+  }
+
+  let status;
+  try {
+    status = await getJson(`${SITE_URL}/api/status?email=${encodeURIComponent(email)}`);
+  } catch (e) {
+    ui.warn(`Couldn't reach the bundle site (${e.message}).`);
+    ui.dim(`Your three products are set up. Subscribe when you can at ${SITE_URL}.`);
+    return { product, icon: 'warn', note: 'site unreachable — subscribe at ' + SITE_URL };
+  }
+
+  if (status.status !== 200 || status.body.configured !== true) {
+    ui.warn('The Agent Bundle subscription isn\'t open yet.');
+    ui.dim('Your three products work regardless — each is billed on its own for now.');
+    return { product, icon: 'warn', note: 'bundle not available yet' };
+  }
+  if (status.body.active === true) {
+    ui.ok(`Bundle already active for ${ui.c.bold(email)} — nothing to pay.`);
+    return { product, icon: 'ok', note: 'already subscribed' };
+  }
+
+  let checkout;
+  try {
+    checkout = await getJson(`${SITE_URL}/api/checkout`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
+    });
+  } catch (e) {
+    ui.warn(`Couldn't start the subscription (${e.message}).`);
+    ui.dim(`Subscribe at ${SITE_URL} whenever you're ready.`);
+    return { product, icon: 'warn', note: 'checkout failed — subscribe at ' + SITE_URL };
+  }
+
+  // 409 = this email already has an active bundle; the status call raced us. Not an error.
+  if (checkout.status === 409) {
+    ui.ok(`Bundle already active for ${ui.c.bold(email)} — nothing to pay.`);
+    return { product, icon: 'ok', note: 'already subscribed' };
+  }
+  if (checkout.status !== 200 || !checkout.body.checkoutUrl) {
+    ui.warn(`Couldn't start the subscription${checkout.body.error ? ': ' + checkout.body.error : '.'}`);
+    ui.dim(`Subscribe at ${SITE_URL} whenever you're ready.`);
+    return { product, icon: 'warn', note: 'checkout failed — subscribe at ' + SITE_URL };
+  }
+
+  ui.blank();
+  ui.info(`Last step — open this to start the ${ui.c.bold(PRICE)} bundle and enter a card:`);
+  ui.info('  ' + ui.c.cyan(checkout.body.checkoutUrl));
+  ui.dim('Nothing is charged until you confirm on that page. Until then the three products bill separately.');
+  return { product, icon: 'warn', note: `open the checkout link to start the ${PRICE} bundle` };
+}
+
+module.exports = { step, needsSetup, SITE_URL, PRICE };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentbundle-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "One command to give your AI agent a card, an inbox, and a phone — installs Agentcard, AgentMail, and AgentPhone via a guided onboarding flow.",
   "bin": {
     "agentbundle-cli": "bin/agent-bundle.js",
@@ -10,6 +10,9 @@
   "engines": {
     "node": ">=18"
   },
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
   "files": [
     "bin",
     "lib",