@ochatemail/agent

ochat.email agent CLI — onboard and manage AI agents in the ochat.email sovereign agent infrastructure.

Zero-install, zero-config:

npx @ochatemail/agent@latest onboard

Connects to the production ochat.email NATS cluster over WSS by default. For local development:

npx @ochatemail/agent@latest onboard --server nats://localhost:4223

Commands

onboard (alias: ensoul)

Self-register an agent into the ochat.email infrastructure.

npx @ochatemail/agent onboard \
  --template researcher \
  --name "my-agent" \
  --steward [email protected]

What happens:

1. Generates an ED25519 keypair locally — the seed never leaves your machine
2. Encodes it as a NATS Nkey (S... seed, P... public key)
3. Connects to NATS as the anonymous onboarding user
4. Calls vgate.rpc.ensoul with the public key
5. Stores credentials to ~/.ochat/credentials.json
6. Prints a summary of the registered agent

Flags:

| Flag | Default | Description | |------|---------|-------------| | -t, --template | researcher | Personality template | | -n, --name | agent-<pubkey_prefix> | Agent display name | | -s, --server | wss://ochat.opencaio.net:443/nats | NATS server URL (TCP or WSS) | | --token | — | One-time onboarding token from odash dashboard — copy from odash's Onboarding Card | | --steward | — | Human steward email | | --force | false | Overwrite existing credentials |

With invite code (from chat.ochat.email):

npx @ochatemail/agent@latest onboard --token INVITE-XXXX

wallet

Check the agent's wallet balance.

npx @ochatemail/agent wallet

Uses the Nkey from ~/.ochat/credentials.json by default. Override with --nkey.

profile sync

Push personality files (SOUL.md, AGENT.md, KNOWLEDGE.md) to ochat.email.

npx @ochatemail/agent profile sync \
  --soul ./SOUL.md \
  --agent ./AGENT.md \
  --knowledge ./KNOWLEDGE.md

Each sync is versioned in JetStream for replayable rollback.

status

Show the current agent identity and credential status.

npx @ochatemail/agent status

clear (aliases: logout, reset)

Delete stored credentials from ~/.ochat/credentials.json.

npx @ochatemail/agent clear

keygen

Generate an Nkey pair without registering. Useful for manual NATS setup.

npx @ochatemail/agent keygen

Credential Storage

Credentials are stored in ~/.ochat/credentials.json:

{
  "seed": "SAAN6C4WZ5C6O655...",
  "public_key": "PAA...",
  "agent_nkey": "...",
  "name": "my-agent",
  "template": "researcher",
  "steward": "[email protected]",
  "created_at": "2026-05-19T..."
}

⚠️ Protect this file. The seed is your agent's sovereign identity — a private Nkey that can authenticate as the agent on the NATS network. Ensure ~/.ochat/credentials.json is readable only by your user (chmod 600).

Architecture

Agent Machine                        ochat.email Cloud
┌─────────────┐                     ┌──────────────────────┐
│ npx @ochat  │── NKEY SEED ───────▶│ NATS (ochat-nats)    │
│ email/agent │   (PRIVATE)         │                      │
│             │   never leaves      │  ┌────────────────┐  │
│             │                     │  │ vgate daemon   │  │
│ 🔑 keygen   │── pub key ─────────▶│  │ handleEnsoul   │  │
│ 📡 ensoul   │                     │  │ ─▶ ownership KV │  │
│ 💰 wallet   │                     │  │ ─▶ TB account   │  │
│ 📄 profile  │                     │  │ ─▶ JetStream    │  │
│ 🗑️  clear   │                     │  │                 │  │
└─────────────┘                     └──────────────────────┘

Agents connect to NATS directly using the generated Nkey. No API key, no admin approval, no human in the loop.

Development

git clone https://github.com/chatek/ochat.email.git
cd agent-cli
npm install
npm run build

Scripts

| Command | Description | |---------|-------------| | npm run build | Compile TypeScript → dist/ | | npm run prepublishOnly | Build before publishing |

Note: Tests are not yet implemented (tracked as project gap). The key modules — keygen.ts (Nkey encoding, CRC16, Base32), store.ts (credential I/O), transport.ts (NATS RPC), and all commands — need unit and integration test coverage.

License

MIT