run402-mcp 4.16.0 → 4.16.1

package/README.md

@@ -376,14 +376,22 @@ The SDK is organised into focused namespaces: `actions` (Node recursive action r
 
 An agent can publicly prove that its separately-held Buzz/Nostr key and Run402 EOA belong to the same principal. This is attribution only: projects remain organization-owned, and Nostr identities never authenticate, authorize, pay, deploy, or receive transfers. Run402 never accepts or derives from an `nsec`, Nostr private key, mnemonic, seed, or derivation path.
 
-Install the self-contained Buzz skill directly into the managed-agent workspace (normally `~/.buzz`):
+The human-facing install is a Buzz message—no terminal required:
+
+```text
+@Fizz install the Run402 Buzz skill and set up Run402.
+```
+
+The managed agent installs the self-contained skill into its workspace (normally `~/.buzz`). For a Codex runtime, the exact agent-executed command is:
 
 ```sh
 cd ~/.buzz
-npx skills add https://github.com/kychee-com/run402/tree/main/buzz -a codex -y
+DO_NOT_TRACK=1 npx --yes skills@latest add https://run402.com -s run402-buzz -a codex -y
 ```
 
-Installation is inert. Setup later publishes a durable public kind-1 Nostr event and durable Run402 proof connecting the two public identities; revocation does not erase their history, and a Buzz-managed event may also expose its owner's public NIP-OA attestation. After reading that disclosure, tell the intended managed agent `@Builder, set up Run402.` The agent uses the user's global npm installation, initializes only if needed, creates or reuses the link, independently verifies it, and reports `Run402 is ready` with `Deployment: none`. It then offers one context-relevant quick test or demo and waits for explicit approval before building, provisioning, spending, or deploying.
+Claude Code uses `-a claude-code`, Goose uses `-a goose`, a confirmed `.agents/skills` consumer may use `-a universal`, and Claude Code plus Codex uses `-a claude-code codex`. `universal` is the shared path, not all runtimes; do not use the invalid explicit target `-a claude`. The skill bytes come from immutable digest-verified artifacts at `run402.com`; first-run `npx` can still require npm. GitHub is the one availability-only fallback, while any integrity failure stops before setup.
+
+Installation is inert. Setup later publishes a durable public kind-1 Nostr event and durable Run402 proof connecting the two public identities; revocation does not erase their history, and a Buzz-managed event may also expose its owner's public NIP-OA attestation. The agent uses the user's global npm installation, initializes only if needed, creates or reuses the link, independently verifies it, and reports `Run402 is ready` with `Deployment: none`. It then offers one context-relevant quick test or demo and waits for explicit approval before building, provisioning, spending, or deploying.
 
 See the [`buzz/` guide](./buzz/README.md) for prerequisites, the no-secret signer model, released-client fixtures, migration guidance, and the full workflow, or inspect the exact [`run402-buzz` listing on skills.sh](https://skills.sh/kychee-com/run402/run402-buzz). The low-level CLI commands remain available for debugging, but they are not a competing onboarding path.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402-mcp",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "mcpName": "com.run402/mcp",
   "description": "MCP server for Run402 — pay-per-call infrastructure for AI agents over x402 USDC micropayments. Generate an image for $0.03 with no signup, or provision Postgres databases with REST API, auth, storage and row-level security.",
   "type": "module",
@@ -27,12 +27,12 @@
     "build:sdk": "rm -rf sdk/dist sdk/core-dist && mkdir -p sdk/core-dist && cp core/dist/*.js sdk/core-dist/ && cp core/dist/*.d.ts sdk/core-dist/ && tsc -p sdk/tsconfig.json",
     "build": "rm -rf dist cli/core-dist cli/sdk/dist cli/sdk/core-dist && npm run build:core && npm run build:sdk && tsc && mkdir -p cli/core-dist cli/sdk/dist cli/sdk/core-dist && cp core/dist/*.js cli/core-dist/ && cp -R sdk/dist/. cli/sdk/dist/ && cp sdk/core-dist/*.js cli/sdk/core-dist/",
     "start": "node dist/index.js",
-    "test:skill": "node --test --import tsx SKILL.test.ts buzz/setup.test.mjs buzz/helper.test.mjs buzz/package.test.mjs",
+    "test:skill": "node scripts/build-agent-skills-index.mjs --check && node --test --import tsx SKILL.test.ts buzz/setup.test.mjs buzz/helper.test.mjs buzz/package.test.mjs scripts/build-agent-skills-index.test.mjs",
     "test:buzz-installer": "node buzz/install-smoke.mjs",
     "test:sync": "node --test --import tsx sync.test.ts examples/tenant-x402-wallet-stats/example.test.mjs",
     "test:run402-app-schema-drift": "node scripts/check-run402-app-schema-drift.mjs",
     "test:docs": "node scripts/check-typed-config-docs.mjs && npm run check:docs --workspace=@run402/sdk -- --skip-build",
-    "test": "npm run build && node --experimental-test-module-mocks --test --import tsx SKILL.test.ts sync.test.ts buzz/setup.test.mjs buzz/helper.test.mjs buzz/package.test.mjs examples/tenant-x402-wallet-stats/example.test.mjs 'core/src/**/*.test.ts' 'sdk/src/**/*.test.ts' 'src/**/*.test.ts' && node --test cli-core-target.test.mjs && node --experimental-test-module-mocks --test cli-up-argv.test.mjs cli-identity-link.test.mjs cli-identity-link-matrix.test.mjs cli/lib/buzz.test.mjs && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-typed-config-modes.test.mjs cli-argv.test.mjs cli-conventions-gate.test.mjs paid-stack-deps.test.mjs profile-guidance.test.mjs settlement-disclosure.test.mjs cli-suggestions-gate.test.mjs cli-env.test.mjs cli-wallets.test.mjs cli-org.test.mjs cli-ci.test.mjs cli-deploy-ci.test.mjs cli-operator-loopback.test.mjs cli/lib/doctor-source-scan.test.mjs cli/lib/errors.test.mjs cli/lib/pay.test.mjs cli-bootstrap-next-actions.test.mjs && npm run test:docs",
+    "test": "npm run build && node scripts/build-agent-skills-index.mjs --check && node --experimental-test-module-mocks --test --import tsx SKILL.test.ts sync.test.ts buzz/setup.test.mjs buzz/helper.test.mjs buzz/package.test.mjs scripts/build-agent-skills-index.test.mjs examples/tenant-x402-wallet-stats/example.test.mjs 'core/src/**/*.test.ts' 'sdk/src/**/*.test.ts' 'src/**/*.test.ts' && node --test cli-core-target.test.mjs && node --experimental-test-module-mocks --test cli-up-argv.test.mjs cli-identity-link.test.mjs cli-identity-link-matrix.test.mjs cli/lib/buzz.test.mjs && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-typed-config-modes.test.mjs cli-argv.test.mjs cli-conventions-gate.test.mjs paid-stack-deps.test.mjs profile-guidance.test.mjs settlement-disclosure.test.mjs cli-suggestions-gate.test.mjs cli-env.test.mjs cli-wallets.test.mjs cli-org.test.mjs cli-ci.test.mjs cli-deploy-ci.test.mjs cli-operator-loopback.test.mjs cli/lib/doctor-source-scan.test.mjs cli/lib/errors.test.mjs cli/lib/pay.test.mjs cli-bootstrap-next-actions.test.mjs && npm run test:docs",
     "test:e2e": "npm run build && node --test cli-core-target.test.mjs && node --experimental-test-module-mocks --test cli-identity-link.test.mjs cli-identity-link-matrix.test.mjs && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-typed-config-modes.test.mjs cli-argv.test.mjs cli-conventions-gate.test.mjs paid-stack-deps.test.mjs profile-guidance.test.mjs settlement-disclosure.test.mjs cli-suggestions-gate.test.mjs cli-env.test.mjs cli-wallets.test.mjs cli-org.test.mjs cli-ci.test.mjs cli-deploy-ci.test.mjs cli-operator-loopback.test.mjs cli/lib/doctor-source-scan.test.mjs cli/lib/errors.test.mjs cli-bootstrap-next-actions.test.mjs",
     "test:help": "npm run build && node --test cli-help.test.mjs",
     "test:integration": "node --test --import tsx core/src/siwx-integration.integ.ts",