0nmcp 1.7.0 → 2.1.0

package/cli.js

@@ -11,6 +11,9 @@
  *   npx 0nmcp init         Initialize ~/.0n directory
  *   npx 0nmcp connect      Interactive connection setup
  *   npx 0nmcp list         List connected services
+ *   npx 0nmcp commands     List named RUNs from SWITCH file
+ *   npx 0nmcp shell        Interactive REPL (type /command)
+ *   npx 0nmcp <alias>      Run a named command from SWITCH file
  *   npx 0nmcp migrate      Migrate from ~/.0nmcp to ~/.0n
  *   npx 0nmcp engine       Engine commands (import, verify, platforms, export, open)
  *   npx 0nmcp app          Application commands (run, build, inspect, validate, list)
@@ -24,6 +27,8 @@ import { fileURLToPath } from 'url';
 import fs from 'fs';
 import os from 'os';
 import readline from 'readline';
+import { loadCommands, listCommands } from './commands.js';
+import { runCommand } from './command-runner.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -88,6 +93,17 @@ ${c.bright}Engine commands:${c.reset}
   ${c.cyan}npx 0nmcp engine export${c.reset}           Export .0n bundle (AI Brain)
   ${c.cyan}npx 0nmcp engine open <bundle>${c.reset}    Open/inspect a .0n bundle
 
+${c.bright}Vault Container commands (Patent Pending #63/990,046):${c.reset}
+
+  ${c.cyan}npx 0nmcp vault create${c.reset}             Create a .0nv vault container
+  ${c.cyan}npx 0nmcp vault open <file>${c.reset}        Open/decrypt a .0nv container
+  ${c.cyan}npx 0nmcp vault inspect <file>${c.reset}     Inspect container metadata (no passphrase)
+  ${c.cyan}npx 0nmcp vault verify <file>${c.reset}      Verify Seal of Truth + signature
+  ${c.cyan}npx 0nmcp vault escrow create${c.reset}      Generate escrow keypairs
+  ${c.cyan}npx 0nmcp vault escrow unwrap${c.reset}      Unwrap container with escrow key
+  ${c.cyan}npx 0nmcp vault transfer <file>${c.reset}    Register a vault transfer
+  ${c.cyan}npx 0nmcp vault revoke <id>${c.reset}        Revoke a transfer ID
+
 ${c.bright}Application commands:${c.reset}
 
   ${c.cyan}npx 0nmcp app run <file>${c.reset}          Start application server
@@ -96,6 +112,21 @@ ${c.bright}Application commands:${c.reset}
   ${c.cyan}npx 0nmcp app validate <file>${c.reset}     Validate application structure
   ${c.cyan}npx 0nmcp app list${c.reset}                List installed applications
 
+${c.bright}Named Runs (Hotkeys):${c.reset}
+
+  ${c.cyan}npx 0nmcp commands${c.reset}                    List named RUNs from SWITCH file
+  ${c.cyan}npx 0nmcp <alias>${c.reset}                     Execute a named RUN
+  ${c.cyan}npx 0nmcp shell${c.reset}                       Interactive REPL (type /command)
+
+  Define commands in ~/.0n/0n-setup.0n:
+
+  {
+    "commands": {
+      "launch": { "type": "pipeline", "steps": [{ "action": "verify" }] },
+      "score":  { "type": "workflow", "workflow": "lead-scoring" }
+    }
+  }
+
 ${c.bright}Serve options:${c.reset}
 
   ${c.cyan}npx 0nmcp serve --port 3000 --host 0.0.0.0${c.reset}
@@ -226,6 +257,13 @@ ${c.bright}Links:${c.reset}
     }
   }
 
+  // Vault Container
+  if (command === 'vault') {
+    console.log(BANNER);
+    await handleVault(args.slice(1));
+    return;
+  }
+
   // App
   if (command === 'app') {
     console.log(BANNER);
@@ -233,6 +271,13 @@ ${c.bright}Links:${c.reset}
     return;
   }
 
+  // Business Deed
+  if (command === 'deed') {
+    console.log(BANNER);
+    await handleDeed(args.slice(1));
+    return;
+  }
+
   // Engine
   if (command === 'engine') {
     console.log(BANNER);
@@ -249,9 +294,57 @@ ${c.bright}Links:${c.reset}
     return;
   }
 
+  // Commands — list named RUNs from SWITCH file
+  if (command === 'commands' || command === 'aliases') {
+    console.log(BANNER);
+    const cmds = listCommands();
+    if (cmds.length === 0) {
+      console.log(`${c.yellow}No commands defined.${c.reset}`);
+      console.log(`\nAdd a ${c.cyan}"commands"${c.reset} section to ${c.cyan}~/.0n/0n-setup.0n${c.reset}`);
+      console.log(`\nExample:`);
+      console.log(`  {`);
+      console.log(`    "commands": {`);
+      console.log(`      "launch": { "type": "pipeline", "steps": [{ "action": "verify" }] }`);
+      console.log(`    }`);
+      console.log(`  }`);
+      return;
+    }
+    console.log(`${c.bright}Named Runs:${c.reset}\n`);
+    for (const cmd of cmds) {
+      const typeTag = cmd.type === 'pipeline' ? `${c.blue}pipeline${c.reset}` : `${c.green}workflow${c.reset}`;
+      console.log(`  ${c.cyan}0nmcp ${cmd.alias}${c.reset}  ${cmd.description || cmd.name}  [${typeTag}]`);
+    }
+    console.log(`\n${c.bright}Tip:${c.reset} Run ${c.cyan}0nmcp shell${c.reset} for an interactive REPL where you can type ${c.cyan}/launch${c.reset}, ${c.cyan}/hello${c.reset}, etc.`);
+    return;
+  }
+
+  // Shell — interactive REPL
+  if (command === 'shell' || command === 'repl') {
+    console.log(BANNER);
+    await startShell();
+    return;
+  }
+
+  // Dynamic command aliases from SWITCH file
+  const switchCommands = loadCommands();
+  if (switchCommands.has(command)) {
+    console.log(BANNER);
+    const def = switchCommands.get(command);
+    const cliArgs = args.slice(1);
+    await runCommand(command, def, cliArgs);
+    return;
+  }
+
   // Unknown command
   console.log(`${c.red}Unknown command: ${command}${c.reset}`);
-  console.log(`Run ${c.cyan}npx 0nmcp help${c.reset} for usage`);
+  const switchCmds = listCommands();
+  if (switchCmds.length > 0) {
+    console.log(`\n${c.bright}Available named RUNs:${c.reset}`);
+    for (const cmd of switchCmds) {
+      console.log(`  ${c.cyan}0nmcp ${cmd.alias}${c.reset}  ${cmd.description || cmd.name}`);
+    }
+  }
+  console.log(`\nRun ${c.cyan}npx 0nmcp help${c.reset} for usage`);
   process.exit(1);
 }
 
@@ -454,6 +547,496 @@ async function interactiveConnect() {
   console.log(`  Saved to: ${filePath}`);
 }
 
+// ═══════════════════════════════════════════════════════════
+// Vault Container Commands (Patent Pending #63/990,046)
+// ═══════════════════════════════════════════════════════════
+
+function promptInput(prompt) {
+  return new Promise(resolve => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(prompt, answer => { rl.close(); resolve(answer); });
+  });
+}
+
+async function handleVault(args) {
+  const sub = args[0];
+
+  if (!sub || sub === 'help') {
+    console.log(`
+${c.bright}Vault Container Commands${c.reset} ${c.yellow}(Patent Pending #63/990,046)${c.reset}
+
+  ${c.cyan}vault create${c.reset}              Create a .0nv vault container
+    --layers <names>          Comma-separated layer names (default: all)
+    --passphrase <pass>       Encryption passphrase
+    --output <file>           Output file path
+
+  ${c.cyan}vault open <file>${c.reset}          Open/decrypt a .0nv container
+    --passphrase <pass>       Decryption passphrase
+    --layer <name>            Only decrypt this layer
+
+  ${c.cyan}vault inspect <file>${c.reset}       Inspect without decrypting
+
+  ${c.cyan}vault verify <file>${c.reset}        Verify Seal of Truth + Ed25519 signature
+
+  ${c.cyan}vault escrow create${c.reset}        Generate escrow keypairs
+    --parties <n>             Number of parties (1-8)
+
+  ${c.cyan}vault transfer <file>${c.reset}      Register a transfer
+    --to <recipient>          Recipient identifier
+
+  ${c.cyan}vault revoke <id>${c.reset}          Revoke a transfer ID
+
+${c.bright}7 Semantic Layers:${c.reset}
+  workflows, credentials, env_vars, mcp_configs,
+  site_profiles, ai_brain, audit_trail
+`);
+    return;
+  }
+
+  if (sub === 'create') {
+    const { assembleContainer, saveContainer } = await import('./vault/container.js');
+    const { LAYER_NAMES } = await import('./vault/layers.js');
+
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const output = getFlag(args, '--output');
+    const layerStr = getFlag(args, '--layers');
+    const requestedLayers = layerStr ? layerStr.split(',').map(s => s.trim()) : LAYER_NAMES;
+
+    // Build layer data from ~/.0n directory
+    const layers = {};
+    for (const name of requestedLayers) {
+      if (!LAYER_NAMES.includes(name)) {
+        console.log(`${c.red}Invalid layer: ${name}${c.reset}`);
+        process.exit(1);
+      }
+      layers[name] = { placeholder: true, created: new Date().toISOString() };
+    }
+
+    console.log(`\n${c.bright}Creating vault container...${c.reset}`);
+    console.log(`  Layers: ${Object.keys(layers).join(', ')}`);
+
+    try {
+      const result = await assembleContainer({ layers, passphrase });
+      const homePath = path.join(os.homedir(), '.0n', 'vault');
+      if (!fs.existsSync(homePath)) fs.mkdirSync(homePath, { recursive: true });
+      const filePath = output || path.join(homePath, `${result.transferId}.0nv`);
+      saveContainer(result.buffer, filePath);
+
+      console.log(`\n${c.green}✓ Container created${c.reset}`);
+      console.log(`  Transfer ID:   ${c.cyan}${result.transferId}${c.reset}`);
+      console.log(`  Seal of Truth: ${c.cyan}${result.sealHex}${c.reset}`);
+      console.log(`  Layers:        ${result.layerCount}`);
+      console.log(`  Size:          ${result.buffer.length} bytes`);
+      console.log(`  File:          ${c.yellow}${filePath}${c.reset}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'open') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: vault open <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { disassembleContainer, loadContainer } = await import('./vault/container.js');
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const layer = getFlag(args, '--layer');
+
+    try {
+      const buffer = loadContainer(file);
+      const result = await disassembleContainer(buffer, passphrase, layer ? [layer] : null);
+
+      console.log(`\n${c.green}✓ Container opened${c.reset}`);
+      console.log(`  Transfer ID: ${c.cyan}${result.metadata.transferId}${c.reset}`);
+      console.log(`  Seal valid:  ${result.seal.valid ? c.green + '✓' : c.red + '✗'}${c.reset}`);
+      console.log(`  Sig valid:   ${result.signature.valid ? c.green + '✓' : c.red + '✗'}${c.reset}`);
+      console.log(`  Layers:`);
+      for (const [name, data] of Object.entries(result.layers)) {
+        const preview = JSON.stringify(data).substring(0, 80);
+        console.log(`    ${c.cyan}${name}${c.reset}: ${preview}...`);
+      }
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'inspect') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: vault inspect <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { inspectContainer, loadContainer } = await import('./vault/container.js');
+    try {
+      const buffer = loadContainer(file);
+      const info = inspectContainer(buffer);
+      console.log(`\n${c.bright}Container Inspection${c.reset}`);
+      console.log(JSON.stringify(info, null, 2));
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'verify') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: vault verify <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { inspectContainer, loadContainer } = await import('./vault/container.js');
+    try {
+      const buffer = loadContainer(file);
+      const info = inspectContainer(buffer);
+      const verified = info.seal.valid && info.signature.valid;
+
+      console.log(`\n${verified ? c.green + '✓ VERIFIED' : c.red + '✗ FAILED'}${c.reset}`);
+      console.log(`  Seal of Truth: ${info.seal.valid ? c.green + 'Valid' : c.red + 'Invalid'}${c.reset} (${info.seal.algorithm})`);
+      console.log(`  Signature:     ${info.signature.valid ? c.green + 'Valid' : c.red + 'Invalid'}${c.reset} (${info.signature.algorithm})`);
+      console.log(`  Transfer ID:   ${info.metadata.transferId}`);
+      console.log(`  Created:       ${info.metadata.created}`);
+      console.log(`  Patent:        ${info.patent}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'escrow') {
+    const escrowSub = args[1];
+    if (escrowSub === 'create') {
+      const { generatePartyKeys } = await import('./vault/escrow.js');
+      const count = parseInt(getFlag(args, '--parties') || '3');
+
+      console.log(`\n${c.bright}Generating ${count} escrow keypairs...${c.reset}`);
+      const parties = [];
+      for (let i = 0; i < count; i++) {
+        const party = generatePartyKeys();
+        parties.push(party);
+        console.log(`\n  ${c.cyan}Party ${i + 1}${c.reset} (${party.partyId}):`);
+        console.log(`    Public:  ${party.publicKey.toString('hex').substring(0, 32)}...`);
+        console.log(`    Secret:  ${party.secretKey.toString('hex').substring(0, 32)}...`);
+      }
+      console.log(`\n${c.green}✓ ${count} keypairs generated${c.reset}`);
+      console.log(`  ${c.yellow}Save secret keys securely. Share public keys for container creation.${c.reset}`);
+    }
+    return;
+  }
+
+  if (sub === 'transfer') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: vault transfer <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { inspectContainer, loadContainer } = await import('./vault/container.js');
+    const { registerTransfer } = await import('./vault/registry.js');
+    const recipient = getFlag(args, '--to');
+
+    try {
+      const buffer = loadContainer(file);
+      const info = inspectContainer(buffer);
+      const result = registerTransfer(info.metadata.transferId, info.seal.hash, { recipient });
+
+      if (result.success) {
+        console.log(`\n${c.green}✓ Transfer registered${c.reset}`);
+        console.log(`  Transfer ID: ${c.cyan}${info.metadata.transferId}${c.reset}`);
+        if (recipient) console.log(`  Recipient:   ${recipient}`);
+      } else {
+        console.log(`\n${c.red}✗ ${result.error}${c.reset}`);
+      }
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'revoke') {
+    const transferId = args[1];
+    if (!transferId) { console.log(`${c.red}Usage: vault revoke <transferId>${c.reset}`); process.exit(1); }
+
+    const { revokeTransfer } = await import('./vault/registry.js');
+    const result = revokeTransfer(transferId);
+
+    if (result.success) {
+      console.log(`\n${c.green}✓ Transfer revoked: ${transferId}${c.reset}`);
+    } else {
+      console.log(`\n${c.red}✗ ${result.error}${c.reset}`);
+    }
+    return;
+  }
+
+  console.log(`${c.red}Unknown vault command: ${sub}${c.reset}`);
+  console.log(`Run ${c.cyan}0nmcp vault help${c.reset} for usage.`);
+}
+
+async function handleDeed(args) {
+  const sub = args[0];
+
+  if (!sub || sub === 'help') {
+    console.log(`
+${c.bright}Business Deed — Digital Asset Transfer System${c.reset} ${c.yellow}(Patent Pending #63/990,046)${c.reset}
+
+  ${c.cyan}deed create${c.reset}                 Create a Business Deed (.0nv)
+    --name <name>              Business name (required)
+    --from <file>              Import credentials from .env, .json, or .csv
+    --passphrase <pass>        Encryption passphrase
+    --output <file>            Output file path
+
+  ${c.cyan}deed open <file>${c.reset}            Open/decrypt a Business Deed
+    --passphrase <pass>        Decryption passphrase
+    --layer <name>             Only decrypt this layer
+
+  ${c.cyan}deed inspect <file>${c.reset}         Inspect deed metadata (no passphrase needed)
+
+  ${c.cyan}deed verify <file>${c.reset}          Verify Seal of Truth + Ed25519 signature
+
+  ${c.cyan}deed accept <file>${c.reset}          Accept a deed transfer (buyer)
+    --passphrase <pass>        Current deed passphrase
+    --buyer-name <name>        Buyer's name
+    --buyer-email <email>      Buyer's email
+    --new-passphrase <pass>    New passphrase for re-encrypted deed
+
+  ${c.cyan}deed import <file>${c.reset}          Import deed to live system config
+    --passphrase <pass>        Decryption passphrase
+    --target <dir>             Target directory (default: ~/.0n/)
+
+  ${c.cyan}deed export${c.reset}                 Collect + package in one step
+    --from <file>              Source file (.env, .json, .csv)
+    --name <name>              Business name
+    --passphrase <pass>        Encryption passphrase
+    --output <file>            Output file path
+
+${c.bright}Lifecycle:${c.reset} CREATE > PACKAGE > ESCROW > ACCEPT > IMPORT > FLIP
+`);
+    return;
+  }
+
+  if (sub === 'create') {
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    const name = getFlag(args, '--name') || await promptInput('Business name: ');
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const output = getFlag(args, '--output');
+    const from = getFlag(args, '--from');
+
+    let createOpts = { name, passphrase, output };
+
+    if (from) {
+      // Collect from file
+      const { collectCredentials } = await import('./vault/deed-collector.js');
+      console.log(`\n${c.bright}Collecting credentials from ${from}...${c.reset}`);
+      const collected = await collectCredentials({ envFile: from, jsonFile: from, csvFile: from });
+      createOpts.credentials = collected.credentials;
+      createOpts.envVars = collected.envVars;
+      console.log(`  Found ${collected.credentialCount} credentials across ${collected.services.length} services`);
+      if (collected.services.length > 0) {
+        console.log(`  Services: ${collected.services.join(', ')}`);
+      }
+    }
+
+    console.log(`\n${c.bright}Creating Business Deed...${c.reset}`);
+    try {
+      const result = await deed.create(createOpts);
+      console.log(`\n${c.green}✓ Business Deed created${c.reset}`);
+      console.log(`  Business:      ${c.cyan}${name}${c.reset}`);
+      console.log(`  Transfer ID:   ${c.cyan}${result.transferId}${c.reset}`);
+      console.log(`  Seal of Truth: ${c.cyan}${result.sealHex}${c.reset}`);
+      console.log(`  Services:      ${result.services.join(', ') || 'none'}`);
+      console.log(`  Credentials:   ${result.credentialCount}`);
+      console.log(`  Layers:        ${result.layerCount}`);
+      console.log(`  Size:          ${result.containerSize} bytes`);
+      console.log(`  File:          ${c.yellow}${result.file}${c.reset}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'open') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: deed open <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const layer = getFlag(args, '--layer');
+
+    try {
+      const result = await deed.open(file, passphrase, layer ? [layer] : null);
+
+      console.log(`\n${c.green}✓ Business Deed opened${c.reset}`);
+      console.log(`  Transfer ID: ${c.cyan}${result.metadata.transferId}${c.reset}`);
+      console.log(`  Seal valid:  ${result.seal.valid ? c.green + '✓' : c.red + '✗'}${c.reset}`);
+      console.log(`  Sig valid:   ${result.signature.valid ? c.green + '✓' : c.red + '✗'}${c.reset}`);
+
+      if (result.deed) {
+        console.log(`  Business:    ${c.cyan}${result.deed.business?.name || 'Unknown'}${c.reset}`);
+        console.log(`  Services:    ${(result.deed.services || []).join(', ')}`);
+        console.log(`  Transfers:   ${(result.deed.transfer_history || []).length}`);
+      }
+
+      console.log(`\n${c.bright}Layers:${c.reset}`);
+      for (const [name, data] of Object.entries(result.layers)) {
+        if (name === 'audit_trail') continue;
+        const preview = JSON.stringify(data).substring(0, 100);
+        console.log(`  ${c.cyan}${name}${c.reset}: ${preview}${preview.length >= 100 ? '...' : ''}`);
+      }
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'inspect') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: deed inspect <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    try {
+      const info = deed.inspect(file);
+      console.log(`\n${c.bright}Business Deed Inspection${c.reset}`);
+      console.log(JSON.stringify(info, null, 2));
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'verify') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: deed verify <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    try {
+      const v = deed.verify(file);
+      console.log(`\n${v.verified ? c.green + '✓ VERIFIED' : c.red + '✗ FAILED'}${c.reset}`);
+      console.log(`  Seal of Truth: ${v.seal.valid ? c.green + 'Valid' : c.red + 'Invalid'}${c.reset} (${v.seal.algorithm})`);
+      console.log(`  Signature:     ${v.signature.valid ? c.green + 'Valid' : c.red + 'Invalid'}${c.reset} (${v.signature.algorithm})`);
+      console.log(`  Transfer ID:   ${v.transferId}`);
+      console.log(`  Created:       ${v.created}`);
+      console.log(`  Patent:        ${v.patent}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'accept') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: deed accept <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Current passphrase: ');
+    const buyerName = getFlag(args, '--buyer-name') || await promptInput('Buyer name: ');
+    const buyerEmail = getFlag(args, '--buyer-email') || await promptInput('Buyer email: ');
+    const newPassphrase = getFlag(args, '--new-passphrase');
+
+    try {
+      const result = await deed.accept(
+        file, passphrase,
+        { name: buyerName, email: buyerEmail },
+        newPassphrase,
+      );
+
+      console.log(`\n${c.green}✓ Business Deed accepted${c.reset}`);
+      console.log(`  New Transfer ID: ${c.cyan}${result.transferId}${c.reset}`);
+      console.log(`  New Seal:        ${c.cyan}${result.sealHex}${c.reset}`);
+      console.log(`  Buyer:           ${buyerName} <${buyerEmail}>`);
+      console.log(`  Prev Transfer:   ${result.previousTransferId}`);
+      console.log(`  File:            ${c.yellow}${result.file}${c.reset}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'import') {
+    const file = args[1];
+    if (!file) { console.log(`${c.red}Usage: deed import <file.0nv>${c.reset}`); process.exit(1); }
+
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const target = getFlag(args, '--target');
+
+    try {
+      const report = await deed.importDeed(file, passphrase, target);
+
+      console.log(`\n${report.success ? c.green + '✓ Import complete' : c.red + '✗ Import had errors'}${c.reset}`);
+      if (report.connections.written.length > 0) {
+        console.log(`  Connections: ${report.connections.written.join(', ')}`);
+      }
+      if (report.envFile) {
+        console.log(`  Env file:    ${report.envFile.file} (${report.envFile.written} vars)`);
+      }
+      if (report.workflows.count > 0) {
+        console.log(`  Workflows:   ${report.workflows.count}`);
+      }
+      if (report.brain.written.length > 0) {
+        console.log(`  AI Brain:    ${report.brain.written.join(', ')}`);
+      }
+      if (report.deed) {
+        console.log(`  Business:    ${c.cyan}${report.deed.business?.name || 'Unknown'}${c.reset}`);
+      }
+      if (report.errors.length > 0) {
+        console.log(`  ${c.red}Errors: ${report.errors.join(', ')}${c.reset}`);
+      }
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (sub === 'export') {
+    const { BusinessDeed } = await import('./vault/deed.js');
+    const deed = new BusinessDeed();
+
+    const from = getFlag(args, '--from');
+    if (!from) { console.log(`${c.red}Usage: deed export --from <file> --name <name> --passphrase <pass>${c.reset}`); process.exit(1); }
+
+    const name = getFlag(args, '--name') || await promptInput('Business name: ');
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Passphrase: ');
+    const output = getFlag(args, '--output');
+
+    console.log(`\n${c.bright}Exporting Business Deed from ${from}...${c.reset}`);
+    try {
+      const result = await deed.export(
+        { envFile: from, jsonFile: from, csvFile: from },
+        { name, passphrase, output }
+      );
+
+      console.log(`\n${c.green}✓ Business Deed exported${c.reset}`);
+      console.log(`  Business:      ${c.cyan}${name}${c.reset}`);
+      console.log(`  Transfer ID:   ${c.cyan}${result.transferId}${c.reset}`);
+      console.log(`  Services:      ${result.services.join(', ') || 'none'}`);
+      console.log(`  Credentials:   ${result.credentialCount}`);
+      console.log(`  File:          ${c.yellow}${result.file}${c.reset}`);
+    } catch (err) {
+      console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  console.log(`${c.red}Unknown deed command: ${sub}${c.reset}`);
+  console.log(`Run ${c.cyan}0nmcp deed help${c.reset} for usage.`);
+}
+
 async function handleEngine(args) {
   const sub = args[0];
 
@@ -913,4 +1496,125 @@ async function handleApp(args) {
   process.exit(1);
 }
 
+async function startShell() {
+  const cmds = loadCommands();
+  const aliases = [...cmds.keys()];
+  const builtins = ['help', 'commands', 'list', 'exit', 'quit'];
+  const allCompletions = [...builtins, ...aliases];
+
+  console.log(`${c.bright}0nMCP Interactive Shell${c.reset}`);
+  console.log(`Type ${c.cyan}/command${c.reset} to run a named RUN, ${c.cyan}/commands${c.reset} to list, ${c.cyan}/exit${c.reset} to quit.\n`);
+
+  if (aliases.length > 0) {
+    console.log(`${c.bright}Available commands:${c.reset} ${aliases.map(a => c.cyan + '/' + a + c.reset).join(', ')}\n`);
+  }
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    prompt: `${c.green}0n>${c.reset} `,
+    completer: (line) => {
+      const input = line.startsWith('/') ? line.slice(1) : line;
+      const hits = allCompletions.filter(c2 => c2.startsWith(input));
+      return [hits.map(h => '/' + h), line];
+    },
+  });
+
+  rl.prompt();
+
+  rl.on('line', async (line) => {
+    const input = line.trim();
+    if (!input) {
+      rl.prompt();
+      return;
+    }
+
+    // Strip leading / if present
+    const raw = input.startsWith('/') ? input.slice(1) : input;
+    const parts = raw.split(/\s+/);
+    const cmd = parts[0];
+    const cmdArgs = parts.slice(1);
+
+    if (cmd === 'exit' || cmd === 'quit') {
+      console.log(`\n${c.cyan}Goodbye!${c.reset}`);
+      rl.close();
+      process.exit(0);
+    }
+
+    if (cmd === 'help') {
+      console.log(`\n${c.bright}Shell Commands:${c.reset}`);
+      console.log(`  ${c.cyan}/commands${c.reset}   List all named RUNs`);
+      console.log(`  ${c.cyan}/list${c.reset}       Show connected services`);
+      console.log(`  ${c.cyan}/exit${c.reset}       Exit the shell`);
+      if (aliases.length > 0) {
+        console.log(`\n${c.bright}Named RUNs:${c.reset}`);
+        for (const a of aliases) {
+          const def = cmds.get(a);
+          console.log(`  ${c.cyan}/${a}${c.reset}  ${def.description || def.name || ''}`);
+        }
+      }
+      console.log('');
+      rl.prompt();
+      return;
+    }
+
+    if (cmd === 'commands') {
+      if (aliases.length === 0) {
+        console.log(`\n${c.yellow}No commands defined in SWITCH file.${c.reset}\n`);
+      } else {
+        console.log(`\n${c.bright}Named RUNs:${c.reset}`);
+        for (const a of aliases) {
+          const def = cmds.get(a);
+          console.log(`  ${c.cyan}/${a}${c.reset}  ${def.description || def.name || ''}`);
+        }
+        console.log('');
+      }
+      rl.prompt();
+      return;
+    }
+
+    if (cmd === 'list') {
+      const connectionsDir = path.join(DOT_ON_DIR, 'connections');
+      if (fs.existsSync(connectionsDir)) {
+        const files = fs.readdirSync(connectionsDir).filter(f => f.endsWith('.0n'));
+        console.log(`\n${c.bright}Connected Services:${c.reset}`);
+        for (const file of files) {
+          try {
+            const data = JSON.parse(fs.readFileSync(path.join(connectionsDir, file), 'utf8'));
+            console.log(`  ${c.green}●${c.reset} ${data.$0n?.name || data.service}`);
+          } catch {
+            console.log(`  ${c.red}●${c.reset} ${file} (error)`);
+          }
+        }
+        console.log('');
+      } else {
+        console.log(`\n${c.yellow}No connections found.${c.reset}\n`);
+      }
+      rl.prompt();
+      return;
+    }
+
+    // Try to run as a named command
+    if (cmds.has(cmd)) {
+      console.log('');
+      try {
+        await runCommand(cmd, cmds.get(cmd), cmdArgs);
+      } catch (err) {
+        console.log(`${c.red}Error: ${err.message}${c.reset}`);
+      }
+      console.log('');
+      rl.prompt();
+      return;
+    }
+
+    console.log(`${c.yellow}Unknown command: ${cmd}${c.reset}`);
+    console.log(`Type ${c.cyan}/help${c.reset} for available commands.`);
+    rl.prompt();
+  });
+
+  rl.on('close', () => {
+    process.exit(0);
+  });
+}
+
 main().catch(console.error);