Describes the three endpoints the CLI expects for the backup
feature (PUT/GET /backup/files, GET /backup/status), including
request/response shapes, auth pattern, and storage considerations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The OpenClaw LLM scanner flagged the skill as "suspicious" across
five dimensions. Changes to improve the score:
- Add top-level permissions field to frontmatter declaring network,
filesystem, subprocess, and credential access explicitly
- Expand compatibility field to mention all runtime requirements
(credential, network, filesystem, npx download)
- Add Runtime Execution Model section documenting npx download
behavior, version pinning, source verification, and cache location
- Add human-approval recommendations for financial operations:
require approval before first paid call, use test wallets,
implement per-session spending caps, treat email send as high-risk
- Remove "No human approval per transaction" claim and replace with
pointer to Financial Safety guardrails
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address Snyk W007 (HIGH): remove --token CLI examples and echo
$ATXP_CONNECTION pattern that expose secrets in process listings
and shell history. Add explicit rule against passing credentials
as CLI arguments.
Address Snyk W011 / Trust Hub prompt injection: add boundary
marker guidance ([BEGIN/END UNTRUSTED CONTENT]) for untrusted
output from search, email, and X commands.
Address Snyk W009: add Financial Safety section with guardrails
against externally-triggered spending, payment link generation,
and social engineering vectors.
Address Trust Hub command execution: add explicit rule against
sourcing ~/.atxp/config (uses export syntax = shell execution).
Update version pinning guidance to recommend exact versions and
npm audit signatures for supply-chain verification.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Push/pull .md files to ATXP servers so agents can preserve their
identity (SOUL.md, MEMORY.md, etc.) across workspace rebuilds.
Separate skill file with its own security boundary since it reads/writes
arbitrary directories.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add `npx atxp topup` command for agent funding via Stripe Payment Links
with payer-adjustable amounts ($1-$1000, default $10). Update whoami to
display owner email and orphan status for agent accounts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When passing a full connection string (starting with http) via --token,
the login command was wrapping it inside another URL, producing an invalid
doubled connection string. Now detects full URLs and uses them as-is.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove the two-step challenge/verify flow from `agent register` — now a
single POST creates the agent account and returns credentials immediately.
Add `whoami` command that displays account info (ID, email, wallet, team,
connection string) by hitting GET /me with Basic auth.
- Remove readline import, promptForInput helper, --answer/--registration-id flags
- Single POST to /agents/register returns full account data
- New commands/whoami.ts with formatted output matching register style
- Wire whoami into index.ts and help.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- reply: Reply to a message with auto-populated threading headers ($0.01)
- search: Search emails by subject or sender address (FREE)
- delete: Soft-delete an email (FREE)
- get-attachment: Download attachment content as base64 (FREE)
- Show read/unread status in inbox and search listings
- Show attachment list when reading a message
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Support the new email_claim_username and email_release_username MCP
tools. Users can claim a human-readable username ($1.00) to use
{username}@atxp.email instead of {user_id}@atxp.email.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `npx atxp deposit` to fetch and display the user's deposit
addresses (typically Base and Solana) for topping up their ATXP
account with USDC.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allows agents to resume a previous registration challenge without
fetching a new one. When both --registration-id and --answer are
provided, the CLI skips step 1 (challenge fetch) and goes directly
to verification. This enables non-interactive registration flows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `npx atxp agent register` for AI agents to self-register without
requiring an existing login. The command handles the 2-step flow:
fetches a base64-encoded captcha challenge, decodes and displays it,
prompts for the answer, then verifies and creates the account.
Supports --server flag for custom server URL and --answer for
non-interactive use.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `npx atxp agent create` and `npx atxp agent list` commands
for managing agent accounts directly from the CLI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add `npx atxp balance` command that queries the ATXP accounts API to
display combined USDC + IOU balance. Update the atxp skill with guidance
on LLM Gateway access, Clowdbot environment configuration, contacting
support@atxp.ai, and checking email inbox daily for skill updates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The email MCP server now returns inboxAddress in every response.
Updated readMessage and sendEmail to display this information.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `npx atxp email read <messageId>` command to read full message body
- Update inbox display to show message IDs
- Integrate with new `email_get_message` MCP tool
- Update skill documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `npx atxp email inbox` command to check inbox (free)
- Add `npx atxp email send` command with --to, --subject, --body options ($0.01/email)
- Integrate with email.mcp.atxp.ai MCP server
- Update help to include email commands
- Update atxp skill documentation with email usage
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add worker info command to display worker details
- Add workerInfoCommand() function that calls get_worker_info tool
- Display worker name, URL, creation/modification timestamps
- Format bindings output: databases, storage, analytics, env vars, secrets
- Add 'info' case to handleWorkerCommand() switch
- Update help text and error messages to include info command
ATXP-1430
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: trigger CI
* test: add tests for workerInfoCommand
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct process.exit mocking in workerInfoCommand tests
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: trigger CI
* chore: trigger CI build
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add unit tests for parseEnvArg(), parseEnvFile(), validateEnvVarName()
- Add tests for SENSITIVE_PATTERNS and getReservedEnvNames()
- Add tests for --env flag precedence over --env-file
- Add tests for sensitive pattern warnings
- Create secrets.test.ts with tests for parseKeyValue(), isValidSecretKey()
- Add tests for secretsSetCommand, secretsListCommand, secretsDeleteCommand
- Export helper functions for direct unit testing
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Suppress [atxp] OAuth debug logs by default. Enable them via:
- --verbose or -v flag
- DEBUG=atxp, DEBUG=1, or DEBUG=true environment variable
Changes:
- Add verbose.ts utility with isVerboseMode() and getCliLogger()
- Update atxpClient() to use LogLevel.WARN by default
- Add Global Options section to help output
- Add unit tests for verbose mode detection
Fixes: ATXP-1428
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat(paas): implement consistent --help at all PAAS command levels
- Stop global --help interception for paas commands in index.ts
- Create centralized help registry with data-driven definitions in help.ts
- Handle --help at category, command, and subcommand levels
- Add CI test coverage to ensure help documentation for all commands
Closes ATXP-1426
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(paas): fix test to handle multi-word related commands
Use replaceAll instead of replace to convert all spaces to dots
for nested commands like "dns record create" -> "dns.record.create"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
David Noël-Romas