@elisym/cli 0.24.0 → 0.25.0

package/dist/index.js

@@ -2,7 +2,7 @@
 import { ReadableStream } from 'node:stream/web';
 import { readFileSync, existsSync, readdirSync, statSync, renameSync, chmodSync, mkdirSync, writeFileSync, appendFileSync, unlinkSync, rmdirSync, realpathSync } from 'node:fs';
 import { dirname, join, resolve, basename, extname, relative, sep } from 'node:path';
-import { SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, formatSol, formatAssetAmount, USDC_SOLANA_DEVNET, signerFromSecretKeyBase58, ElisymClient, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, DEFAULTS, createBlossomTransport, generateSolanaWallet, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, utf8ByteLength, readAcceptedTransports, decodeJobPayload, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, NATIVE_SOL } from '@elisym/sdk';
+import { SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, formatSol, formatAssetAmount, USDC_SOLANA_DEVNET, signerFromSecretKeyBase58, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, DEFAULTS, createBlossomTransport, verifyAgentIdentities, generateSolanaWallet, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, utf8ByteLength, readAcceptedTransports, decodeJobPayload, BoundedSet, KIND_JOB_FEEDBACK, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, encodeSecretKeyBase58, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
 import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, readMediaCache, loadPoliciesFromDir, ensureGitignoreHasIrohEntry, ensureGitignoreHasX402Entries, ensureGitignoreHasSessionsEntry, lookupCachedUrl, newCacheEntry, writeMediaCache } from '@elisym/sdk/agent-store';
 import { isAddress, createSolanaRpc, address } from '@solana/kit';
 import { generateSecretKey, getPublicKey, nip19, verifyEvent } from 'nostr-tools';
@@ -52,9 +52,9 @@ function sleepWithSignal(ms, signal) {
     return Promise.reject(createAbortError());
   }
   if (!signal) {
-    return new Promise((resolve3) => setTimeout(resolve3, ms));
+    return new Promise((resolve4) => setTimeout(resolve4, ms));
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const cleanup = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
@@ -65,7 +65,7 @@ function sleepWithSignal(ms, signal) {
     };
     const timer = setTimeout(() => {
       cleanup();
-      resolve3();
+      resolve4();
     }, ms);
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -1442,6 +1442,538 @@ var init_init = __esm({
     init_llm();
   }
 });
+var IDENTITY_PLATFORMS = ["github", "x", "website"];
+var X_PROOF_URL_HOSTS = /* @__PURE__ */ new Set([
+  "x.com",
+  "www.x.com",
+  "mobile.x.com",
+  "twitter.com",
+  "www.twitter.com",
+  "mobile.twitter.com"
+]);
+function githubProofText(npub) {
+  return `Verifying that I control the following Nostr public key: ${npub}`;
+}
+function xProofText(npub) {
+  return `Verifying my account on nostr My Public Key: "${npub}"`;
+}
+function websiteNostrJson(local, pubkeyHex) {
+  return JSON.stringify({ names: { [local]: pubkeyHex } }, null, 2);
+}
+function parseIdentityPlatform(raw) {
+  const lowered = raw.trim().toLowerCase();
+  const match = IDENTITY_PLATFORMS.find((platform) => platform === lowered);
+  if (match === void 0) {
+    throw new Error(`Unknown platform "${raw}". Expected github, x, or website.`);
+  }
+  return match;
+}
+function parseGithubProofInput(raw) {
+  const trimmed = raw.trim();
+  const bareId = trimmed.toLowerCase();
+  if (GIST_ID_REGEX.test(bareId)) {
+    return { proofId: bareId };
+  }
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.hostname.toLowerCase() !== "gist.github.com") {
+    return null;
+  }
+  const segments = url.pathname.split("/").filter((segment) => segment.length > 0);
+  const [userSegment, gistSegment] = segments;
+  if (userSegment === void 0 || gistSegment === void 0) {
+    return null;
+  }
+  const username = userSegment.toLowerCase();
+  const gistId = gistSegment.toLowerCase();
+  if (!GITHUB_USERNAME_REGEX.test(username) || !GIST_ID_REGEX.test(gistId)) {
+    return null;
+  }
+  return { proofId: gistId, username };
+}
+function parseXProofInput(raw) {
+  const trimmed = raw.trim();
+  if (TWEET_ID_REGEX.test(trimmed)) {
+    return { proofId: trimmed };
+  }
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || !X_PROOF_URL_HOSTS.has(url.hostname.toLowerCase())) {
+    return null;
+  }
+  const segments = url.pathname.split("/").filter((segment) => segment.length > 0);
+  const [userSegment, statusLiteral, idSegment] = segments;
+  if (userSegment === void 0 || statusLiteral !== "status" || idSegment === void 0) {
+    return null;
+  }
+  const username = userSegment.toLowerCase();
+  if (!X_USERNAME_REGEX.test(username) || !TWEET_ID_REGEX.test(idSegment)) {
+    return null;
+  }
+  return { proofId: idSegment, username };
+}
+function buildIdentityClaimInputs(identities) {
+  const claims = [];
+  if (identities?.github !== void 0) {
+    claims.push({
+      platform: "github",
+      handle: identities.github.username,
+      proofId: identities.github.gist
+    });
+  }
+  if (identities?.x !== void 0) {
+    claims.push({ platform: "x", handle: identities.x.username, proofId: identities.x.tweet });
+  }
+  return claims;
+}
+function identitiesFromYaml(identities) {
+  const claims = [];
+  if (identities === void 0) {
+    return claims;
+  }
+  if (identities.github !== void 0) {
+    claims.push({
+      platform: "github",
+      handle: identities.github.username,
+      proofUrl: `https://gist.github.com/${encodeURIComponent(identities.github.username)}/${encodeURIComponent(identities.github.gist)}`
+    });
+  }
+  if (identities.x !== void 0) {
+    claims.push({
+      platform: "x",
+      handle: identities.x.username,
+      proofUrl: `https://x.com/${encodeURIComponent(identities.x.username)}/status/${encodeURIComponent(identities.x.tweet)}`
+    });
+  }
+  if (identities.website !== void 0) {
+    const identifier = normalizeNip05Identifier(identities.website);
+    if (identifier !== null) {
+      const { domain } = splitNip05Identifier(identifier);
+      claims.push({ platform: "website", handle: identifier, proofUrl: `https://${domain}` });
+    }
+  }
+  return claims;
+}
+async function createInquirerPrompter() {
+  const { default: inquirer } = await import('inquirer');
+  return {
+    async input(message) {
+      const { value } = await inquirer.prompt([{ type: "input", name: "value", message }]);
+      return String(value);
+    },
+    async confirm(message, defaultValue) {
+      const { value } = await inquirer.prompt([
+        { type: "confirm", name: "value", message, default: defaultValue }
+      ]);
+      return Boolean(value);
+    },
+    async select(message, choices) {
+      const { value } = await inquirer.prompt([{ type: "list", name: "value", message, choices }]);
+      return String(value);
+    }
+  };
+}
+function createDefaultPublisher(relays) {
+  const client = new ElisymClient({ relays });
+  return {
+    fetchExternalIdentityClaims: (pubkey) => client.discovery.fetchExternalIdentityClaims(pubkey),
+    publishExternalIdentities: (identity2, claims) => client.discovery.publishExternalIdentities(identity2, claims),
+    publishProfile: (identity2, name, about, picture, banner, nip05) => client.discovery.publishProfile(identity2, name, about, picture, banner, nip05),
+    close: () => client.close()
+  };
+}
+async function resolveAndLoadAgent(nameArg, cwd, prompter) {
+  let name = nameArg;
+  if (!name) {
+    const agents = await listAgents(cwd);
+    if (agents.length === 0) {
+      throw new Error("No agents found. Run `npx @elisym/cli init` first.");
+    }
+    name = await prompter.select(
+      "Select agent:",
+      agents.map((agent) => ({ name: `${agent.name} (${agent.source})`, value: agent.name }))
+    );
+  }
+  const passphrase = process.env.ELISYM_PASSPHRASE;
+  const loaded = await loadAgent(name, cwd, passphrase);
+  return { name, loaded };
+}
+function relaysFor(yaml) {
+  return yaml.relays.length > 0 ? yaml.relays : [...RELAYS];
+}
+async function resolvePreservedMediaUrl(configured, agentDir, cache, publishedUrl) {
+  if (!configured) {
+    return void 0;
+  }
+  if (/^https?:\/\//i.test(configured)) {
+    return configured;
+  }
+  const agentRoot = resolve(agentDir);
+  const candidate = resolve(agentRoot, configured);
+  const rel = relative(agentRoot, candidate);
+  if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep}`)) {
+    return publishedUrl;
+  }
+  const cached = await lookupCachedUrl(cache, configured, candidate);
+  return cached ?? publishedUrl;
+}
+async function republishAgentProfile(publisher, identity2, agentName, agentDir, yaml) {
+  let publishedProfile;
+  try {
+    const published = await publisher.fetchExternalIdentityClaims(identity2.publicKey);
+    publishedProfile = published.profile;
+  } catch {
+  }
+  const mediaCache = await readMediaCache(agentDir);
+  const picture = await resolvePreservedMediaUrl(
+    yaml.picture,
+    agentDir,
+    mediaCache,
+    publishedProfile?.picture
+  );
+  const banner = await resolvePreservedMediaUrl(
+    yaml.banner,
+    agentDir,
+    mediaCache,
+    publishedProfile?.banner
+  );
+  const unresolved = [];
+  if (yaml.picture && picture === void 0) {
+    unresolved.push("picture");
+  }
+  if (yaml.banner && banner === void 0) {
+    unresolved.push("banner");
+  }
+  if (unresolved.length > 0) {
+    throw new Error(
+      `${unresolved.join(" and ")} carry-over unavailable (no media cache entry and no currently-published URL - the relay read may have failed), so republishing kind 0 would wipe it from the profile`
+    );
+  }
+  await publisher.publishProfile(
+    identity2,
+    yaml.display_name ?? agentName,
+    yaml.description ?? "",
+    picture,
+    banner,
+    yaml.identities?.website
+  );
+}
+async function sweepStaleIdentityClaims(discovery, identity2) {
+  try {
+    const published = await discovery.fetchExternalIdentityClaims(identity2.publicKey);
+    const staleClaims = published.identities.filter((claim) => claim.platform !== "website");
+    if (staleClaims.length === 0) {
+      return false;
+    }
+    await discovery.publishExternalIdentities(identity2, []);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function promptGithubLink(loaded, npub, prompter) {
+  console.log(
+    "\n  1. Create a PUBLIC gist (https://gist.github.com/new) containing ONLY this\n     single line (the proof statement - a standard NIP-39 text that any\n     Nostr client can verify; do not paste these instructions):"
+  );
+  console.log(`
+     ${githubProofText(npub)}
+`);
+  console.log("  2. Paste the gist URL (or its id) below.\n");
+  const rawProof = await prompter.input("Gist URL or id:");
+  const parsed = parseGithubProofInput(rawProof);
+  if (parsed === null) {
+    throw new Error("Expected a gist URL (https://gist.github.com/<user>/<id>) or a hex gist id.");
+  }
+  let username = parsed.username;
+  if (username === void 0) {
+    const rawUsername = await prompter.input("GitHub username:");
+    username = rawUsername.trim().toLowerCase();
+  }
+  if (!GITHUB_USERNAME_REGEX.test(username)) {
+    throw new Error(`Invalid GitHub username: "${username}" (alphanumeric or hyphen, 1-39 chars).`);
+  }
+  return {
+    nextIdentities: {
+      ...loaded.yaml.identities,
+      github: { username, gist: parsed.proofId }
+    }
+  };
+}
+async function promptXLink(loaded, npub, prompter) {
+  console.log(
+    "\n  1. Post a tweet whose text is ONLY this line, including the double quotes\n     (the proof statement - a standard NIP-39 text; the account you post\n     from becomes the linked identity):"
+  );
+  console.log(`
+     ${xProofText(npub)}
+`);
+  console.log("  2. Paste the tweet URL (or its status id) below.\n");
+  const rawProof = await prompter.input("Tweet URL or id:");
+  const parsed = parseXProofInput(rawProof);
+  if (parsed === null) {
+    throw new Error(
+      "Expected a tweet URL (https://x.com/<user>/status/<id>) or a numeric status id."
+    );
+  }
+  let username = parsed.username;
+  if (username === void 0) {
+    const rawUsername = await prompter.input("X username (without @):");
+    username = rawUsername.trim().replace(/^@/, "").toLowerCase();
+  }
+  if (!X_USERNAME_REGEX.test(username)) {
+    throw new Error(`Invalid X username: "${username}" (alphanumeric or underscore, 1-15 chars).`);
+  }
+  return {
+    nextIdentities: {
+      ...loaded.yaml.identities,
+      x: { username, tweet: parsed.proofId }
+    }
+  };
+}
+async function promptWebsiteLink(loaded, pubkeyHex, prompter) {
+  const rawIdentifier = await prompter.input("NIP-05 identifier (name@domain or bare domain):");
+  const identifier = normalizeNip05Identifier(rawIdentifier.trim());
+  if (identifier === null) {
+    throw new Error(
+      `Invalid NIP-05 identifier: "${rawIdentifier.trim()}". Expected name@domain or a bare domain (ASCII hostname labels, no IP literals).`
+    );
+  }
+  const { local, domain } = splitNip05Identifier(identifier);
+  console.log(`
+  Serve this JSON at https://${domain}/.well-known/nostr.json :
+`);
+  for (const line of websiteNostrJson(local, pubkeyHex).split("\n")) {
+    console.log(`     ${line}`);
+  }
+  console.log(
+    `
+  It must answer https://${domain}/.well-known/nostr.json?name=${local} over https,`
+  );
+  console.log("  without redirects - NIP-05 forbids following them. The verifier consults only");
+  console.log(`  this exact host (no www/apex twin fallback), so the file must live at ${domain}.`);
+  console.log("  Sending `Access-Control-Allow-Origin: *` is recommended (NIP-05), so browser");
+  console.log("  clients can verify it too.\n");
+  const live = await prompter.confirm("Is the file deployed and reachable? Verify now", true);
+  if (!live) {
+    throw new Error(
+      "aborted - deploy the file, then re-run `npx @elisym/cli identity link website`. Nothing was written."
+    );
+  }
+  return {
+    nextIdentities: {
+      ...loaded.yaml.identities,
+      website: identifier
+    }
+  };
+}
+function describeBrokenProof(platform, claim) {
+  switch (platform) {
+    case "github":
+      return `the gist at ${claim.proofUrl} is missing, belongs to another user, or does not contain the exact proof text with this agent's npub`;
+    case "x":
+      return `the tweet at ${claim.proofUrl} is deleted, belongs to another account, or does not contain the exact proof text with this agent's npub`;
+    case "website":
+      return `${claim.proofUrl}/.well-known/nostr.json does not map "${claim.handle}" to this agent's pubkey`;
+  }
+}
+async function cmdIdentityLink(platformArg, agentName, deps = {}) {
+  const platform = parseIdentityPlatform(platformArg);
+  const cwd = deps.cwd ?? process.cwd();
+  const prompter = deps.prompter ?? await createInquirerPrompter();
+  const verify = deps.verify ?? verifyAgentIdentities;
+  const { name, loaded } = await resolveAndLoadAgent(agentName, cwd, prompter);
+  const identity2 = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
+  console.log(`
+  Linking ${platform} to agent "${name}" (${identity2.npub}).`);
+  let prompted;
+  if (platform === "github") {
+    prompted = await promptGithubLink(loaded, identity2.npub, prompter);
+  } else if (platform === "x") {
+    prompted = await promptXLink(loaded, identity2.npub, prompter);
+  } else {
+    prompted = await promptWebsiteLink(loaded, identity2.publicKey, prompter);
+  }
+  const claim = identitiesFromYaml(prompted.nextIdentities).find(
+    (candidate) => candidate.platform === platform
+  );
+  if (claim === void 0) {
+    throw new Error("Internal: failed to build the identity claim from the prompt input.");
+  }
+  console.log("\n  Verifying the proof (live, cache bypassed)...");
+  const results = await verify(identity2.publicKey, [claim], { bypassCache: true });
+  const result = results[0];
+  if (result === void 0) {
+    throw new Error("Internal: the verifier returned no result.");
+  }
+  if (result.status === "broken") {
+    throw new Error(
+      `proof check failed: ${describeBrokenProof(platform, claim)}. Nothing was written.`
+    );
+  }
+  if (result.status === "unverifiable") {
+    console.warn(
+      "  ! Could not check the proof (network error, rate limit, or the proof is not reachable yet)."
+    );
+    console.warn("  ! This is neutral - the proof may be fine - but it was NOT verified.");
+    const proceed = await prompter.confirm(
+      "Link anyway (write elisym.yaml and publish the unverified claim)?",
+      false
+    );
+    if (!proceed) {
+      throw new Error("aborted - nothing was written.");
+    }
+  } else {
+    console.log("  Proof verified.");
+  }
+  const nextYaml = { ...loaded.yaml, identities: prompted.nextIdentities };
+  await writeYaml(loaded.dir, nextYaml);
+  console.log(`  Wrote identities.${platform} to elisym.yaml.`);
+  const createPublisher = deps.createPublisher ?? createDefaultPublisher;
+  const publisher = createPublisher(relaysFor(loaded.yaml));
+  try {
+    const claims = buildIdentityClaimInputs(prompted.nextIdentities);
+    try {
+      await publisher.publishExternalIdentities(identity2, claims);
+      console.log(`  Published identity claims (kind 10011, ${claims.length} tag(s)).`);
+      if (platform === "website") {
+        await republishAgentProfile(publisher, identity2, name, loaded.dir, nextYaml);
+        console.log("  Republished profile (kind 0) with nip05.");
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `linked locally, but publishing failed: ${message}. Run \`npx @elisym/cli start ${name}\` to publish, or re-run this command.`
+      );
+    }
+  } finally {
+    publisher.close();
+  }
+  console.log(`
+  Linked ${platform} to agent "${name}".
+`);
+}
+function removeIdentityEntry(identities, platform) {
+  const next = { ...identities };
+  delete next[platform];
+  const hasEntries = next.github !== void 0 || next.x !== void 0 || next.website !== void 0;
+  return hasEntries ? next : void 0;
+}
+async function cmdIdentityUnlink(platformArg, agentName, deps = {}) {
+  const platform = parseIdentityPlatform(platformArg);
+  const cwd = deps.cwd ?? process.cwd();
+  const prompter = deps.prompter ?? await createInquirerPrompter();
+  const { name, loaded } = await resolveAndLoadAgent(agentName, cwd, prompter);
+  const identity2 = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
+  const current = loaded.yaml.identities;
+  if (current === void 0 || current[platform] === void 0) {
+    console.log(`
+  ${platform} is not linked for agent "${name}" - nothing to unlink.
+`);
+    return;
+  }
+  const nextIdentities = removeIdentityEntry(current, platform);
+  const nextYaml = { ...loaded.yaml };
+  if (nextIdentities === void 0) {
+    delete nextYaml.identities;
+  } else {
+    nextYaml.identities = nextIdentities;
+  }
+  await writeYaml(loaded.dir, nextYaml);
+  console.log(`
+  Removed identities.${platform} from elisym.yaml.`);
+  const createPublisher = deps.createPublisher ?? createDefaultPublisher;
+  const publisher = createPublisher(relaysFor(loaded.yaml));
+  try {
+    const remaining = buildIdentityClaimInputs(nextIdentities);
+    try {
+      await publisher.publishExternalIdentities(identity2, remaining);
+      console.log(
+        `  Republished identity claims (kind 10011, ${remaining.length} tag(s) remaining).`
+      );
+      if (platform === "website") {
+        await republishAgentProfile(publisher, identity2, name, loaded.dir, nextYaml);
+        console.log("  Republished profile (kind 0) without nip05.");
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `unlinked locally, but publishing the retraction failed: ${message}. Run \`npx @elisym/cli start ${name}\` to propagate it.`
+      );
+    }
+  } finally {
+    publisher.close();
+  }
+  console.log(`
+  Unlinked ${platform} from agent "${name}".
+`);
+}
+function sameClaim(left, right) {
+  return left.platform === right.platform && left.handle.toLowerCase() === right.handle.toLowerCase() && left.proofUrl.toLowerCase() === right.proofUrl.toLowerCase();
+}
+function buildStatusRows(results, publishedClaims) {
+  return results.map((result) => ({
+    platform: result.identity.platform,
+    handle: result.identity.handle,
+    proofUrl: result.identity.proofUrl,
+    status: result.status,
+    published: publishedClaims === void 0 ? void 0 : publishedClaims.some((claim) => sameClaim(claim, result.identity))
+  }));
+}
+async function cmdIdentityStatus(agentName, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const prompter = deps.prompter ?? await createInquirerPrompter();
+  const verify = deps.verify ?? verifyAgentIdentities;
+  const { name, loaded } = await resolveAndLoadAgent(agentName, cwd, prompter);
+  const identity2 = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
+  const localClaims = identitiesFromYaml(loaded.yaml.identities);
+  const createPublisher = deps.createPublisher ?? createDefaultPublisher;
+  const publisher = createPublisher(relaysFor(loaded.yaml));
+  let published;
+  try {
+    published = await publisher.fetchExternalIdentityClaims(identity2.publicKey);
+  } catch {
+    console.warn("  ! Could not query the relays for published claims - drift check skipped.");
+  } finally {
+    publisher.close();
+  }
+  if (localClaims.length === 0) {
+    console.log(`
+  No identities linked in elisym.yaml for agent "${name}".`);
+    console.log("  Link one: npx @elisym/cli identity link <github|x|website>\n");
+    if (published !== void 0 && published.identities.length > 0) {
+      console.log(
+        `  ! The relays still hold published identity claims - run \`npx @elisym/cli start ${name}\` to retract them.
+`
+      );
+    }
+    return;
+  }
+  console.log(`
+  Verifying ${localClaims.length} proof(s) (live, cache bypassed)...
+`);
+  const results = await verify(identity2.publicKey, localClaims, { bypassCache: true });
+  const rows = buildStatusRows(results, published?.identities);
+  console.log(`  Identities for agent "${name}" (${identity2.npub}):
+`);
+  for (const row of rows) {
+    const displayHandle = row.handle.startsWith("_@") ? row.handle.slice(2) : row.handle;
+    console.log(`  ${row.platform.padEnd(8)} ${row.status.padEnd(13)} ${displayHandle}`);
+    console.log(`           proof: ${row.proofUrl}`);
+    if (row.published === false) {
+      console.log(
+        `           ! linked locally but not published - run \`npx @elisym/cli start ${name}\` to publish`
+      );
+    }
+  }
+  console.log();
+}
 
 // src/index.ts
 init_init();
@@ -1696,7 +2228,7 @@ function parseRelayUrl(url) {
   }
 }
 async function tcpProbe(host, port, timeoutMs) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const started = Date.now();
     const socket = new Socket();
     let settled = false;
@@ -1706,7 +2238,7 @@ async function tcpProbe(host, port, timeoutMs) {
       }
       settled = true;
       socket.destroy();
-      resolve3(result);
+      resolve4(result);
     };
     const timer = setTimeout(() => finish({ error: "timeout" }), timeoutMs);
     socket.once("connect", () => {
@@ -2203,8 +2735,8 @@ var SessionStore = class {
   }
   installLock(key) {
     let release;
-    const promise = new Promise((resolve3) => {
-      release = resolve3;
+    const promise = new Promise((resolve4) => {
+      release = resolve4;
     });
     const entry = { promise, release };
     this.locks.set(key, entry);
@@ -3008,7 +3540,7 @@ var PAID_GLOBAL_MAX_JOBS_PER_WINDOW = 2e3;
 var MAX_TRACKED_CUSTOMERS = 1e3;
 var GLOBAL_LIMITER_KEY = "__global__";
 var AgentRuntime = class {
-  constructor(transport, skills, skillCtx, config, ledger, callbacks = {}, healthMonitor, irohTransport, identity, blossomTransport, sessionStore) {
+  constructor(transport, skills, skillCtx, config, ledger, callbacks = {}, healthMonitor, irohTransport, identity2, blossomTransport, sessionStore) {
     this.transport = transport;
     this.skills = skills;
     this.skillCtx = skillCtx;
@@ -3017,7 +3549,7 @@ var AgentRuntime = class {
     this.callbacks = callbacks;
     this.healthMonitor = healthMonitor;
     this.irohTransport = irohTransport;
-    this.identity = identity;
+    this.identity = identity2;
     this.blossomTransport = blossomTransport;
     this.sessionStore = sessionStore;
     this.limit = pLimit(config.maxConcurrentJobs);
@@ -3410,8 +3942,8 @@ var AgentRuntime = class {
       });
     });
     log("Agent runtime started. Listening for jobs...");
-    await new Promise((resolve3) => {
-      this.abortController.signal.addEventListener("abort", () => resolve3(), { once: true });
+    await new Promise((resolve4) => {
+      this.abortController.signal.addEventListener("abort", () => resolve4(), { once: true });
       let shuttingDown = false;
       const onSignal = () => {
         if (shuttingDown) {
@@ -4055,7 +4587,7 @@ var AgentRuntime = class {
     let refOutcome;
     let result;
     try {
-      result = await new Promise((resolve3, reject) => {
+      result = await new Promise((resolve4, reject) => {
         let settled = false;
         let pending = 2;
         let lastResult = { verified: false };
@@ -4065,7 +4597,7 @@ var AgentRuntime = class {
           }
           settled = true;
           clearTimeout(deadline);
-          resolve3(verified);
+          resolve4(verified);
         };
         const lose = (verified, reason) => {
           if (settled) {
@@ -4077,7 +4609,7 @@ var AgentRuntime = class {
           if (pending === 0) {
             settled = true;
             clearTimeout(deadline);
-            resolve3(lastResult);
+            resolve4(lastResult);
           }
         };
         this.transport.waitForPaymentSignature(job.jobId, job.customerId, verifyAbort.signal, sigPathTimeoutMs).then(async (sig) => {
@@ -4130,7 +4662,7 @@ var AgentRuntime = class {
           }
           settled = true;
           log(`[${job.jobId.slice(0, 8)}] verify deadline (${deadlineMs}ms) hit`);
-          resolve3(lastResult);
+          resolve4(lastResult);
         }, deadlineMs);
         if (signal?.aborted) {
           settled = true;
@@ -5021,9 +5553,9 @@ function parseBidTag(value) {
 }
 var HEALTH_CHECK_IDLE_MS = 30 * 60 * 1e3;
 var NostrTransport = class {
-  constructor(client, identity, kindOffsets) {
+  constructor(client, identity2, kindOffsets) {
     this.client = client;
-    this.identity = identity;
+    this.identity = identity2;
     this.kindOffsets = kindOffsets;
   }
   sub = null;
@@ -5101,7 +5633,7 @@ var NostrTransport = class {
    * expiry window - without it this path waits forever on the relay.
    */
   waitForPaymentSignature(jobId, customerPubkey, signal, timeoutMs) {
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       let settled = false;
       const filter = {
         kinds: [KIND_JOB_FEEDBACK],
@@ -5120,7 +5652,7 @@ var NostrTransport = class {
         }
         signal.removeEventListener("abort", onAbort);
         sub.close();
-        resolve3(sig);
+        resolve4(sig);
       };
       const sub = this.client.pool.subscribe(filter, (event) => {
         if (settled) {
@@ -5214,7 +5746,7 @@ var NostrTransport = class {
 function startWatchdog(deps) {
   const {
     client,
-    identity,
+    identity: identity2,
     transport,
     onPing,
     log,
@@ -5225,7 +5757,7 @@ function startWatchdog(deps) {
     selfPingTimeoutMs = WATCHDOG_SELF_PING_TIMEOUT_MS,
     now = Date.now
   } = deps;
-  let pingSub = client.ping.subscribeToPings(identity, onPing);
+  let pingSub = client.ping.subscribeToPings(identity2, onPing);
   let stopped = false;
   let probeBusy = false;
   let selfPingBusy = false;
@@ -5234,7 +5766,7 @@ function startWatchdog(deps) {
   const resetPoolAndResubscribe = () => {
     transport.stop();
     client.pool.reset();
-    pingSub = client.ping.subscribeToPings(identity, onPing);
+    pingSub = client.ping.subscribeToPings(identity2, onPing);
     transport.restart();
   };
   const detectAndHandleSleep = () => {
@@ -5290,7 +5822,7 @@ function startWatchdog(deps) {
     }
     selfPingBusy = true;
     try {
-      const result = await client.ping.pingAgent(identity.publicKey, selfPingTimeoutMs);
+      const result = await client.ping.pingAgent(identity2.publicKey, selfPingTimeoutMs);
       if (stopped || result.online) {
         return;
       }
@@ -5778,18 +6310,18 @@ async function capChallengeResponse(response) {
   });
 }
 function abortableDelay(ms, signal) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     if (signal?.aborted) {
-      resolve3(false);
+      resolve4(false);
       return;
     }
     const onAbort = () => {
       clearTimeout(timer);
-      resolve3(false);
+      resolve4(false);
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve3(true);
+      resolve4(true);
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -6418,7 +6950,7 @@ async function cmdStart(nameArg, options = {}) {
     });
   }
   console.log("  Connecting to relays and publishing capabilities...");
-  const identity = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
+  const identity2 = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
   const relays = loaded.yaml.relays.length > 0 ? loaded.yaml.relays : [...RELAYS];
   const client = new ElisymClient({ relays });
   if (process.env.ELISYM_NET_DIAG === "1") {
@@ -6440,7 +6972,7 @@ async function cmdStart(nameArg, options = {}) {
     loaded.dir,
     mediaCache,
     client.blossom,
-    identity,
+    identity2,
     (updated) => mediaCacheDirty = mediaCacheDirty || updated
   );
   const bannerUrl = await resolveMediaField(
@@ -6448,7 +6980,7 @@ async function cmdStart(nameArg, options = {}) {
     loaded.dir,
     mediaCache,
     client.blossom,
-    identity,
+    identity2,
     (updated) => mediaCacheDirty = mediaCacheDirty || updated
   );
   for (const skill of allSkills) {
@@ -6465,7 +6997,7 @@ async function cmdStart(nameArg, options = {}) {
       skillRoot,
       mediaCache,
       client.blossom,
-      identity,
+      identity2,
       () => mediaCacheDirty = true
     );
     if (url) {
@@ -6478,11 +7010,12 @@ async function cmdStart(nameArg, options = {}) {
   let profilePublished = false;
   try {
     await client.discovery.publishProfile(
-      identity,
+      identity2,
       loaded.yaml.display_name ?? agentName,
       loaded.yaml.description ?? "",
       pictureUrl,
-      bannerUrl
+      bannerUrl,
+      loaded.yaml.identities?.website
     );
     profilePublished = true;
     logger.debug({ event: "publish_ack", kind: 0 }, "profile published");
@@ -6490,6 +7023,32 @@ async function cmdStart(nameArg, options = {}) {
     console.warn(`  ! Failed to publish profile: ${e.message}`);
     logger.warn({ event: "publish_failed", kind: 0, error: e.message }, "profile publish failed");
   }
+  if (loaded.yaml.identities !== void 0) {
+    const identityClaims = buildIdentityClaimInputs(loaded.yaml.identities);
+    try {
+      await client.discovery.publishExternalIdentities(identity2, identityClaims);
+      const summaryParts = identityClaims.map((claim) => `${claim.platform}:${claim.handle}`);
+      if (loaded.yaml.identities.website !== void 0) {
+        summaryParts.push(`website:${loaded.yaml.identities.website}`);
+      }
+      console.log(`  * Identities: ${summaryParts.join(", ") || "none"}`);
+      logger.debug(
+        { event: "publish_ack", kind: KIND_EXTERNAL_IDENTITIES, claims: identityClaims.length },
+        "identity claims published"
+      );
+    } catch (e) {
+      console.warn(`  ! Failed to publish identity claims: ${e.message}`);
+      logger.warn(
+        { event: "publish_failed", kind: KIND_EXTERNAL_IDENTITIES, error: e.message },
+        "identity claims publish failed"
+      );
+    }
+  } else {
+    const sweptIdentities = await sweepStaleIdentityClaims(client.discovery, identity2);
+    if (sweptIdentities) {
+      console.log("  Removed stale identity claims (no identities in elisym.yaml).");
+    }
+  }
   const policies = existsSync(paths.policies) ? loadPoliciesFromDir(paths.policies) : [];
   const localPolicyDTags = new Set(
     policies.map((policy) => `${POLICY_D_TAG_PREFIX}${policy.type}`)
@@ -6498,7 +7057,7 @@ async function cmdStart(nameArg, options = {}) {
     try {
       return await client.pool.querySync({
         kinds: [KIND_LONG_FORM_ARTICLE],
-        authors: [identity.publicKey],
+        authors: [identity2.publicKey],
         "#t": [POLICY_T_TAG]
       });
     } catch {
@@ -6525,7 +7084,7 @@ async function cmdStart(nameArg, options = {}) {
       continue;
     }
     try {
-      const { naddr } = await client.policies.publishPolicy(identity, policy);
+      const { naddr } = await client.policies.publishPolicy(identity2, policy);
       console.log(`  * Policy: ${policy.type}@${policy.version} -> ${naddr}`);
       logger.debug(
         { event: "publish_ack", kind: KIND_LONG_FORM_ARTICLE, policy: policy.type, naddr },
@@ -6557,7 +7116,7 @@ async function cmdStart(nameArg, options = {}) {
       continue;
     }
     try {
-      await client.policies.deletePolicy(identity, type);
+      await client.policies.deletePolicy(identity2, type);
       console.log(`  Removed stale policy: ${sanitizeForTerminal(type)}`);
     } catch {
     }
@@ -6620,7 +7179,7 @@ async function cmdStart(nameArg, options = {}) {
       continue;
     }
     try {
-      await client.discovery.publishCapability(identity, buildCard(skill), kinds);
+      await client.discovery.publishCapability(identity2, buildCard(skill), kinds);
       cardsPublished += 1;
       logger.debug(
         { event: "publish_ack", kind: 31990, skill: skill.name },
@@ -6637,7 +7196,7 @@ async function cmdStart(nameArg, options = {}) {
   try {
     const existingEvents = await client.pool.querySync({
       kinds: [31990],
-      authors: [identity.publicKey],
+      authors: [identity2.publicKey],
       "#t": ["elisym"]
     });
     const skillDTags = new Set(allSkills.map((s) => toDTag(s.name)));
@@ -6649,7 +7208,7 @@ async function cmdStart(nameArg, options = {}) {
       try {
         const card = JSON.parse(ev.content);
         if (card.name && toDTag(card.name) === dTag) {
-          await client.discovery.deleteCapability(identity, card.name);
+          await client.discovery.deleteCapability(identity2, card.name);
           console.log(`  Removed stale capability: ${sanitizeForTerminal(card.name)}`);
         }
       } catch {
@@ -6665,10 +7224,10 @@ async function cmdStart(nameArg, options = {}) {
     console.log(`  [debug] Relays: ${relays.length} configured (${relays.join(", ")})`);
   }
   const onPing = (senderPubkey, nonce) => {
-    client.ping.sendPong(identity, senderPubkey, nonce).catch(() => {
+    client.ping.sendPong(identity2, senderPubkey, nonce).catch(() => {
     });
   };
-  const transport = new NostrTransport(client, identity, [DEFAULT_KIND_OFFSET]);
+  const transport = new NostrTransport(client, identity2, [DEFAULT_KIND_OFFSET]);
   const ledger = new JobLedger(paths.jobs);
   const irohTransport = createIrohTransport({ storePath: join(loaded.dir, ".iroh") });
   await ensureGitignoreHasIrohEntry(dirname(loaded.dir));
@@ -6709,7 +7268,7 @@ async function cmdStart(nameArg, options = {}) {
   };
   const watchdog = startWatchdog({
     client,
-    identity,
+    identity: identity2,
     transport,
     onPing,
     log: diagLog,
@@ -6723,7 +7282,7 @@ async function cmdStart(nameArg, options = {}) {
     });
     diagLog("LLM health monitor armed (lazy recovery, 5min interval).");
   }
-  const blossomTransport = createBlossomTransport({ blossom: client.blossom, identity });
+  const blossomTransport = createBlossomTransport({ blossom: client.blossom, identity: identity2 });
   const sessionStore = hasContextSkills ? new SessionStore(loaded.dir, diagLog) : void 0;
   if (sessionStore) {
     diagLog("Conversation sessions enabled (context: true skills present).");
@@ -6760,7 +7319,7 @@ async function cmdStart(nameArg, options = {}) {
     },
     healthMonitor,
     irohTransport,
-    identity,
+    identity2,
     blossomTransport,
     sessionStore
   );
@@ -6798,7 +7357,7 @@ function isPublicSolanaRpcUrl(raw) {
 function redactRpcUrlsInText(text) {
   return text.replace(/https?:\/\/[^\s)'"]+/g, (url) => stripRpcSecrets(url));
 }
-async function resolveMediaField(value, agentDir, cache, blossom, identity, onCacheUpdate) {
+async function resolveMediaField(value, agentDir, cache, blossom, identity2, onCacheUpdate) {
   if (!value) {
     return void 0;
   }
@@ -6816,7 +7375,7 @@ async function resolveMediaField(value, agentDir, cache, blossom, identity, onCa
     agentDir,
     cache,
     blossom,
-    identity,
+    identity2,
     () => onCacheUpdate(true)
   );
 }
@@ -6842,7 +7401,7 @@ function realpathInsideDir(absPath, rootDir) {
     return null;
   }
 }
-async function uploadOrReuse(cacheKey, absPath, containRoot, cache, blossom, identity, onCacheUpdate) {
+async function uploadOrReuse(cacheKey, absPath, containRoot, cache, blossom, identity2, onCacheUpdate) {
   const realPath = realpathInsideDir(absPath, containRoot);
   if (realPath === null) {
     console.warn(
@@ -6859,7 +7418,7 @@ async function uploadOrReuse(cacheKey, absPath, containRoot, cache, blossom, ide
     const data = readFileSync(realPath);
     const sha256 = createHash("sha256").update(data).digest("hex");
     const blob = new Blob([data], { type: mimeFromPath(absPath) });
-    const descriptor = await blossom.upload(identity, blob);
+    const descriptor = await blossom.upload(identity2, blob);
     cache[cacheKey] = newCacheEntry(descriptor.url, sha256);
     onCacheUpdate();
     console.log(`  Uploaded: ${descriptor.url}`);
@@ -7466,8 +8025,8 @@ program.command("list").description("List all agents (project-local and home-glo
     for (const agent of agents) {
       try {
         const loaded = await loadAgent(agent.name, cwd);
-        const identity = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
-        const npub = nip19.npubEncode(identity.publicKey);
+        const identity2 = ElisymIdentity.fromHex(loaded.secrets.nostr_secret_key);
+        const npub = nip19.npubEncode(identity2.publicKey);
         const solAddr = loaded.yaml.payments[0]?.address ? ` | Solana: ${loaded.yaml.payments[0].address}` : "";
         const shadow = agent.shadowsGlobal ? " [shadows global]" : "";
         console.log(`  ${agent.name} (${agent.source})${shadow} | ${npub}${solAddr}`);
@@ -7480,6 +8039,29 @@ program.command("list").description("List all agents (project-local and home-glo
   })
 );
 program.command("wallet [name]").description("Show wallet balance").action(safe(cmdWallet));
+var identity = program.command("identity").description("Link, verify, and unlink external identities (GitHub, X, website)");
+identity.command("link <platform> [agent]").description(
+  "Link a github|x|website identity: prints the NIP-39 proof template, verifies the proof live, writes elisym.yaml, and publishes the claim (kind 10011 / kind-0 nip05)"
+).action(
+  safe(async (platform, agent) => {
+    await cmdIdentityLink(platform, agent);
+    process.exit(0);
+  })
+);
+identity.command("status [agent]").description(
+  "List linked identities with live proof verification and published-claim drift check"
+).action(
+  safe(async (agent) => {
+    await cmdIdentityStatus(agent);
+    process.exit(0);
+  })
+);
+identity.command("unlink <platform> [agent]").description("Remove a github|x|website identity and retract the published claim").action(
+  safe(async (platform, agent) => {
+    await cmdIdentityUnlink(platform, agent);
+    process.exit(0);
+  })
+);
 var x402 = program.command("x402").description("Bridge x402-paid HTTP services into elisym skills");
 x402.command("add <url> [agent]").description("Generate a bridge skill from a live x402 endpoint (probes its 402 challenge)").option("--method <method>", "HTTP method for the upstream call: GET or POST (default POST)").option(
   "--query-param <name>",