feat: support auto agent initialization

[Mr-Lucky]

Summary

• Support automatic agent initialization in the CLI/config flow.
• Harden Hermes hook enforcement and update AgentGuard skill hook configuration.
• Improve subscribe cron gateway/RPC behavior and related feed cron handling.
• Move the auto-init changelog entry under Unreleased.

Commits

• 30f6400 feat: support auto agent initialization
• 6eb7041 docs: move auto init changelog to unreleased
• 9cf1676 fix: harden hermes hook enforcement
• d286c04 fix subscribe cron gateway rpc

Changed files

• CHANGELOG.md
• README.md
• skills/agentguard/SKILL.md
• skills/agentguard/hermes-hooks.yaml
• skills/agentguard/scripts/hermes-hook.js
• src/cli.ts
• src/config.ts
• src/feed/cron.ts
• src/tests/cli-init.test.ts
• src/tests/feed-cron.test.ts
• src/tests/smoke.test.ts

Testing

• Not run in this pass

[github-actions]

AgentGuard PR Review

I found two actionable issues in the patch.

1. severity: high — src/feed/cron.ts (WebSocket Gateway fallback changes in openClawGatewayRequest)

   • What can go wrong: The new WebSocket path is now the default for all Gateway RPC calls when options.url is unset, and the HTTP path is only used as a fallback. This can break existing installs that expose only the previously supported HTTP JSON-RPC endpoint on 127.0.0.1:18789/ without WebSocket upgrade support. In that case, agentguard subscribe --cron will now fail or depend on fallback heuristics instead of working directly.
   • Concrete fix: Keep HTTP JSON-RPC as the primary transport unless the caller explicitly requests WebSocket, or probe the Gateway protocol first and select the compatible transport deterministically. If WebSocket fallback is retained, make the fallback unconditional on any HTTP transport failure only after verifying the endpoint is really a Gateway and not another service.

2. severity: medium — src/feed/cron.ts / src/tests/feed-cron.test.ts (legacyGatewayParams only special-cases cron.add)

   • What can go wrong: The code now changes request shapes between transports: cron.add uses an object over WebSocket but an array over HTTP via legacyGatewayParams. Other Gateway methods are still sent unchanged. If any existing method expects array-wrapped params on the HTTP API or object params on the WebSocket API, the fallback can produce mismatched requests and silent cron installation failures.
   • Concrete fix: Centralize the Gateway RPC schema per method/transport and validate it before sending. At minimum, add explicit transport-aware parameter encoding for every Gateway method used here (cron.list, cron.add, cron.remove) and tests that assert the exact wire payload for both HTTP and WebSocket paths.