Auto-install @zvec/zvec into ~/.atxp/deps on first `memory index` or
`memory search` call so agents using npx get local vector search
without manual setup. Fix zvec optional dep version to ^0.2.0. When
`npx atxp` is run with no arguments, install the atxp skill via
`npx skills add`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix three zvec integration bugs: ESM dynamic import not unwrapping
CJS default export, wrong indexParams key (type→indexType), and search
query being contaminated with flag values. Replace .md-only file filter
with gitignore-aware collection of all text files, skip binary files
and common directories (node_modules, .git, etc.), and increase file
limit to 500.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Obfuscated .cjs vendor files cause lint errors in CI. Exclude
src/vendor/ from the lint command since vendor code shouldn't be linted.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace separate `topup` and `deposit` commands with a unified `fund`
command that calls POST /api/funding/fund and displays both crypto
deposit addresses and payment links (for agent accounts).
- Rewrite deposit.ts to use Bearer auth and call unified endpoint
- Remove topup.ts (functionality merged into fund)
- Update help.ts and index.ts routing
- Include transactions command and memory from main merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Refactor the backup tool and skill into a broader "memory management"
system. Cloud backup/restore (push/pull/status) is preserved with full
backward compatibility ('backup' is an alias for 'memory'). Two new
subcommands are added:
- memory index --path <dir>: chunks .md files by heading, generates
feature-hash embeddings (256-dim), and stores them in a local zvec
HNSW index for fast approximate nearest-neighbor search.
- memory search <query> --path <dir>: converts the query to the same
vector space and returns the top-k most similar memory chunks with
file paths, headings, line numbers, and similarity scores.
Local search is fully offline — no network or authentication required.
https://claude.ai/code/session_017TjuWQCrpzPM4rYdTTPFBQ
The backup tool now uses jszip to create DEFLATE-compressed zip archives
instead of sending raw JSON payloads. This reduces transfer size and
bandwidth usage. Includes server migration instructions for the
corresponding endpoint changes.
https://claude.ai/code/session_01HZSR7WQPTnnuo8Pmi8UwAw
The OpenClaw LLM scanner flagged the skill as "suspicious" across
five dimensions. Changes to improve the score:
- Add top-level permissions field to frontmatter declaring network,
filesystem, subprocess, and credential access explicitly
- Expand compatibility field to mention all runtime requirements
(credential, network, filesystem, npx download)
- Add Runtime Execution Model section documenting npx download
behavior, version pinning, source verification, and cache location
- Add human-approval recommendations for financial operations:
require approval before first paid call, use test wallets,
implement per-session spending caps, treat email send as high-risk
- Remove "No human approval per transaction" claim and replace with
pointer to Financial Safety guardrails
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address Snyk W007 (HIGH): remove --token CLI examples and echo
$ATXP_CONNECTION pattern that expose secrets in process listings
and shell history. Add explicit rule against passing credentials
as CLI arguments.
Address Snyk W011 / Trust Hub prompt injection: add boundary
marker guidance ([BEGIN/END UNTRUSTED CONTENT]) for untrusted
output from search, email, and X commands.
Address Snyk W009: add Financial Safety section with guardrails
against externally-triggered spending, payment link generation,
and social engineering vectors.
Address Trust Hub command execution: add explicit rule against
sourcing ~/.atxp/config (uses export syntax = shell execution).
Update version pinning guidance to recommend exact versions and
npm audit signatures for supply-chain verification.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Push/pull .md files to ATXP servers so agents can preserve their
identity (SOUL.md, MEMORY.md, etc.) across workspace rebuilds.
Separate skill file with its own security boundary since it reads/writes
arbitrary directories.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rewrite description as keyword-dense routing rule for skills.sh, ClawHub,
and find-skills. Move security and provenance sections to end of document.
Condense security from 47 lines to 4 paragraphs. Remove inline warning
badges from command tables.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add `npx atxp topup` command for agent funding via Stripe Payment Links
with payer-adjustable amounts ($1-$1000, default $10). Update whoami to
display owner email and orphan status for agent accounts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When passing a full connection string (starting with http) via --token,
the login command was wrapping it inside another URL, producing an invalid
doubled connection string. Now detects full URLs and uses them as-is.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove the two-step challenge/verify flow from `agent register` — now a
single POST creates the agent account and returns credentials immediately.
Add `whoami` command that displays account info (ID, email, wallet, team,
connection string) by hitting GET /me with Basic auth.
- Remove readline import, promptForInput helper, --answer/--registration-id flags
- Single POST to /agents/register returns full account data
- New commands/whoami.ts with formatted output matching register style
- Wire whoami into index.ts and help.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- reply: Reply to a message with auto-populated threading headers ($0.01)
- search: Search emails by subject or sender address (FREE)
- delete: Soft-delete an email (FREE)
- get-attachment: Download attachment content as base64 (FREE)
- Show read/unread status in inbox and search listings
- Show attachment list when reading a message
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Support the new email_claim_username and email_release_username MCP
tools. Users can claim a human-readable username ($1.00) to use
{username}@atxp.email instead of {user_id}@atxp.email.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `npx atxp deposit` to fetch and display the user's deposit
addresses (typically Base and Solana) for topping up their ATXP
account with USDC.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allows agents to resume a previous registration challenge without
fetching a new one. When both --registration-id and --answer are
provided, the CLI skips step 1 (challenge fetch) and goes directly
to verification. This enables non-interactive registration flows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `npx atxp agent register` for AI agents to self-register without
requiring an existing login. The command handles the 2-step flow:
fetches a base64-encoded captcha challenge, decodes and displays it,
prompts for the answer, then verifies and creates the account.
Supports --server flag for custom server URL and --answer for
non-interactive use.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
David Noël-Romas