@sherwoodagent/cli 0.74.3 → 0.76.0

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   checkApiKeyValid,
   listModels,
   provisionApiKey
-} from "./chunk-BD4ZV7FQ.js";
+} from "./chunk-RGFA732Z.js";
 import {
   approveDepositor,
   deposit,
@@ -38,8 +38,8 @@ import {
   removeDepositor,
   setAgentFeeBps,
   setVaultAddress
-} from "./chunk-YADJ5YWY.js";
-import "./chunk-3ZOWP3VO.js";
+} from "./chunk-M7CGUYUX.js";
+import "./chunk-MEMYGZWQ.js";
 import {
   applySlippage,
   assetDecimalsForSymbol,
@@ -50,7 +50,7 @@ import {
   getMultiHopQuote,
   getQuote,
   resolveToken
-} from "./chunk-4LKU7ASB.js";
+} from "./chunk-TI64P5R4.js";
 import {
   createApproval,
   createJoinRequest,
@@ -61,20 +61,20 @@ import {
   queryJoinRequests,
   revokeJoinRequest,
   stripReferrerPrefix
-} from "./chunk-O65AC2YS.js";
+} from "./chunk-WCX7DKLQ.js";
 import {
   createFund,
   getActiveFunds,
   getFund,
   subdomainExists,
   updateMetadata
-} from "./chunk-K3EYEJMT.js";
+} from "./chunk-WGXZ623D.js";
 import {
   resolveFund,
   resolveVaultFund,
   searchFundAcrossChains,
   setTextRecord
-} from "./chunk-6UEQUVTQ.js";
+} from "./chunk-TN7J5LXW.js";
 import {
   PROPOSAL_STATE,
   PROPOSAL_STATES,
@@ -108,7 +108,7 @@ import {
   setVotingPeriod,
   settleProposal,
   vote
-} from "./chunk-EW6FTUOL.js";
+} from "./chunk-EVTDWMXQ.js";
 import {
   AERODROME,
   AGENT_REGISTRY,
@@ -118,7 +118,7 @@ import {
   TOKENS,
   UNISWAP,
   VENICE
-} from "./chunk-UINMHN6S.js";
+} from "./chunk-I6X6NL65.js";
 import {
   GAS_UNITS,
   estimateGasCushion,
@@ -129,7 +129,7 @@ import {
   sendTxWithRetry,
   waitForReceipt,
   writeContractWithRetry
-} from "./chunk-2OHX3O55.js";
+} from "./chunk-FP5DZCOM.js";
 import {
   DEFAULT_NETWORK,
   VALID_NETWORKS,
@@ -141,7 +141,7 @@ import {
   isTestnet,
   setNetwork,
   withNetwork
-} from "./chunk-LHVSS27T.js";
+} from "./chunk-LSVCF24W.js";
 import {
   addFund,
   cacheGroupId,
@@ -149,10 +149,13 @@ import {
   getCachedGroupId,
   getChainContracts,
   getFunds,
+  getIdentityChainId,
+  getIdentityProvider,
   getNotifyTo,
   getPrimaryFund,
   getUniswapApiKey,
   getVeniceApiKey,
+  getVirtualsIdentity,
   loadConfig,
   requirePrivateKey,
   setAgentId,
@@ -163,8 +166,9 @@ import {
   setPrimaryFund,
   setPrivateKey,
   setUniswapApiKey,
-  setVeniceApiKey
-} from "./chunk-6MV4ESXM.js";
+  setVeniceApiKey,
+  setVirtualsIdentity
+} from "./chunk-3TZIOAPH.js";
 import {
   BASE_STRATEGY_ABI,
   ERC20_ABI,
@@ -185,7 +189,7 @@ import {
 import { config as loadDotenv } from "dotenv";
 import { createRequire } from "module";
 import { Command, Option } from "commander";
-import { parseUnits as parseUnits8, formatUnits as formatUnits7, isAddress as isAddress9 } from "viem";
+import { parseUnits as parseUnits8, formatUnits as formatUnits7, isAddress as isAddress10 } from "viem";
 import chalk16 from "chalk";
 import ora9 from "ora";
 import { input, confirm, select } from "@inquirer/prompts";
@@ -2432,7 +2436,7 @@ function registerStrategyTemplateCommands(strategy2) {
         process.exit(1);
       }
       if (!opts.agent) opts.agent = proposer;
-      const { parseDuration: parseDuration3, getGovernorOf: getGovernorOf2 } = await import("./governor-NHXBIFFB.js");
+      const { parseDuration: parseDuration3, getGovernorOf: getGovernorOf2 } = await import("./governor-7KETSN47.js");
       const strategyDuration2 = parseDuration3(opts.duration);
       const chainId = getChain().id;
       try {
@@ -2658,9 +2662,9 @@ function registerStrategyTemplateCommands(strategy2) {
       console.error(chalk.red("Missing --name or --duration. Use --write-calls to skip proposal submission."));
       process.exit(1);
     }
-    const { propose: propose2 } = await import("./governor-NHXBIFFB.js");
+    const { propose: propose2 } = await import("./governor-7KETSN47.js");
     const { pinJSON } = await import("./ipfs-RWSTXTZM.js");
-    const { parseDuration: parseDuration2 } = await import("./governor-NHXBIFFB.js");
+    const { parseDuration: parseDuration2 } = await import("./governor-7KETSN47.js");
     const strategyDuration = parseDuration2(opts.duration);
     const metaSpinner = ora("Pinning metadata to IPFS...").start();
     let metadataURI;
@@ -2683,7 +2687,7 @@ function registerStrategyTemplateCommands(strategy2) {
       process.exit(1);
     }
     try {
-      const { getAgentFeeBps: getAgentFeeBps2 } = await import("./vault-45POYGLN.js");
+      const { getAgentFeeBps: getAgentFeeBps2 } = await import("./vault-5YYTHS5W.js");
       const feeBps = await getAgentFeeBps2(vault);
       console.log(
         chalk.yellow(
@@ -2771,7 +2775,7 @@ function registerStrategyTemplateCommands(strategy2) {
       let prices = [];
       let priceSource = null;
       try {
-        const { getTokenPricesInAsset } = await import("./price-QSVIM6QY.js");
+        const { getTokenPricesInAsset } = await import("./price-LAQSXN7M.js");
         prices = await getTokenPricesInAsset({
           tokens: allocations.map((a, i) => ({
             token: a.token,
@@ -3201,7 +3205,7 @@ function registerVeniceCommands(program2) {
       console.log(chalk2.dim(`  Key: ${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`));
       console.log(chalk2.dim("  Saved to ~/.sherwood/config.json"));
       try {
-        const { createVeniceProvisionAttestation, getEasScanUrl: getEasScanUrl2 } = await import("./eas-XWQYAUEM.js");
+        const { createVeniceProvisionAttestation, getEasScanUrl: getEasScanUrl2 } = await import("./eas-4RIW3IS4.js");
         const { uid } = await createVeniceProvisionAttestation(account.address);
         if (uid !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
           console.log(chalk2.dim(`  Attested: ${getEasScanUrl2(uid)}`));
@@ -3557,10 +3561,10 @@ ${opts.prompt}`;
         console.log(chalk2.dim(`Model: ${result.model} | Tokens: ${result.usage.promptTokens} in, ${result.usage.completionTokens} out, ${result.usage.totalTokens} total`));
       }
       try {
-        const { createVeniceInferenceAttestation, getEasScanUrl: getEasScanUrl2 } = await import("./eas-XWQYAUEM.js");
+        const { createVeniceInferenceAttestation, getEasScanUrl: getEasScanUrl2 } = await import("./eas-4RIW3IS4.js");
         const { keccak256: keccak2563, toHex, isAddress: isAddr } = await import("viem");
-        const { getChainContracts: getChainContracts2 } = await import("./config-7HU4X7EK.js");
-        const { getChain: getActiveChain } = await import("./network-WU2QC3L4.js");
+        const { getChainContracts: getChainContracts2 } = await import("./config-ZGFS4I7K.js");
+        const { getChain: getActiveChain } = await import("./network-UP2X5XDW.js");
         const vaultRecipient = opts.vault && isAddr(opts.vault) ? opts.vault : getChainContracts2(getActiveChain().id).vault;
         const promptHash = keccak2563(toHex(userContent)).slice(0, 18);
         const { uid } = await createVeniceInferenceAttestation(
@@ -3858,9 +3862,194 @@ function registerAllowanceCommands(program2) {
 }
 
 // src/commands/identity.ts
+import { generatePrivateKey } from "viem/accounts";
 import chalk4 from "chalk";
 import ora4 from "ora";
 import { SDK } from "agent0-sdk";
+
+// src/lib/virtuals.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { createPublicClient, http, recoverMessageAddress, isAddress as isAddress5 } from "viem";
+import { base, baseSepolia } from "viem/chains";
+var execFileAsync = promisify(execFile);
+var BINDING_VERSION = "v1";
+function buildBindingMessage(sherwoodEoa, issuingChainId, tokenId) {
+  return `sherwood-identity-link:${BINDING_VERSION}:${sherwoodEoa.toLowerCase()}:${issuingChainId}:${tokenId}`;
+}
+async function verifyBinding(params) {
+  try {
+    const recovered = await recoverMessageAddress({
+      message: buildBindingMessage(params.sherwoodEoa, params.issuingChainId, params.tokenId),
+      signature: params.signature
+    });
+    return recovered.toLowerCase() === params.virtualsWallet.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+var robinhoodChain = {
+  id: 4663,
+  name: "Robinhood Chain",
+  nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+  rpcUrls: { default: { http: ["https://rpc.mainnet.chain.robinhood.com"] } },
+  blockExplorers: {
+    default: {
+      name: "Robinhood Chain Explorer",
+      url: "https://explorer.mainnet.chain.robinhood.com"
+    }
+  }
+};
+var DEFAULT_ISSUING_CHAIN_ID = robinhoodChain.id;
+var ISSUING_CHAINS = {
+  [robinhoodChain.id]: {
+    chain: robinhoodChain,
+    identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432"
+  },
+  [base.id]: {
+    chain: base,
+    identityRegistry: "0x8004A169FB4a3325136EB29fA0ceB6D2e539a432"
+  },
+  [baseSepolia.id]: {
+    chain: baseSepolia,
+    identityRegistry: "0x8004A818BFB912233c491871b3d84c89A494BD9e"
+  }
+};
+var OWNER_OF_ABI = [
+  {
+    name: "ownerOf",
+    type: "function",
+    stateMutability: "view",
+    inputs: [{ name: "tokenId", type: "uint256" }],
+    outputs: [{ name: "", type: "address" }]
+  }
+];
+var ISSUING_RPC_ENV = {
+  [robinhoodChain.id]: "ROBINHOOD_RPC_URL",
+  [base.id]: "BASE_RPC_URL",
+  [baseSepolia.id]: "BASE_SEPOLIA_RPC_URL"
+};
+async function ownerOfOnIssuingChain(issuingChainId, tokenId) {
+  const issuing = ISSUING_CHAINS[issuingChainId];
+  if (!issuing) {
+    throw new Error(
+      `Unsupported issuing chain ${issuingChainId}. Supported: ${Object.keys(ISSUING_CHAINS).join(", ")}`
+    );
+  }
+  const rpcOverride = process.env[ISSUING_RPC_ENV[issuingChainId]];
+  const client = createPublicClient({ chain: issuing.chain, transport: http(rpcOverride) });
+  return client.readContract({
+    address: issuing.identityRegistry,
+    abi: OWNER_OF_ABI,
+    functionName: "ownerOf",
+    args: [tokenId]
+  });
+}
+var VID_TAG_RE = /\s*\[vid:(v\d+):(\d+):(\d+):(0x[0-9a-fA-F]{40}):(self|0x[0-9a-fA-F]{130})\]\s*$/;
+function formatVidTag(tag) {
+  return `[vid:${BINDING_VERSION}:${tag.issuingChainId}:${tag.tokenId}:${tag.wallet.toLowerCase()}:${tag.signature}]`;
+}
+function appendVidTag(message, tag) {
+  return `${message} ${formatVidTag(tag)}`;
+}
+function parseVidTag(message) {
+  if (message.indexOf("[vid:") !== message.lastIndexOf("[vid:")) return null;
+  const match = message.match(VID_TAG_RE);
+  if (!match) return null;
+  if (!isAddress5(match[4])) return null;
+  return {
+    version: match[1],
+    issuingChainId: parseInt(match[2], 10),
+    tokenId: BigInt(match[3]),
+    wallet: match[4],
+    signature: match[5] === "self" ? "self" : match[5]
+  };
+}
+function stripVidTag(message) {
+  return message.replace(VID_TAG_RE, "");
+}
+async function verifyVidTag(tag, attester, ownerOf = ownerOfOnIssuingChain) {
+  let bindingOk;
+  if (tag.signature === "self") {
+    bindingOk = attester.toLowerCase() === tag.wallet.toLowerCase();
+  } else {
+    bindingOk = await verifyBinding({
+      sherwoodEoa: attester,
+      issuingChainId: tag.issuingChainId,
+      tokenId: tag.tokenId,
+      virtualsWallet: tag.wallet,
+      signature: tag.signature
+    });
+  }
+  if (!bindingOk) {
+    return { bindingOk: false, ownerOk: false, error: "binding failed \u2014 ownership check skipped" };
+  }
+  try {
+    const owner = await ownerOf(tag.issuingChainId, tag.tokenId);
+    return {
+      bindingOk,
+      ownerOk: owner.toLowerCase() === tag.wallet.toLowerCase(),
+      owner
+    };
+  } catch (err) {
+    return { bindingOk, ownerOk: false, error: err.message };
+  }
+}
+function makeOwnerOfCache() {
+  const cache = /* @__PURE__ */ new Map();
+  return (chainId, tokenId) => {
+    const key = `${chainId}:${tokenId}`;
+    let p = cache.get(key);
+    if (!p) {
+      p = ownerOfOnIssuingChain(chainId, tokenId);
+      p.catch(() => {
+      });
+      cache.set(key, p);
+    }
+    return p;
+  };
+}
+async function acpJson(args) {
+  try {
+    const { stdout } = await execFileAsync("acp", [...args, "--json"], {
+      timeout: 15e3
+    });
+    const start = stdout.indexOf("{");
+    if (start < 0) return null;
+    return JSON.parse(stdout.slice(start));
+  } catch {
+    return null;
+  }
+}
+async function detectAcp() {
+  try {
+    await execFileAsync("acp", ["--version"], { timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function acpWhoami() {
+  const json = await acpJson(["agent", "whoami"]);
+  if (!json) return null;
+  const agentId = json.agentId ?? json.id ?? json.agent?.id;
+  const name = json.name ?? json.agent?.name;
+  return {
+    agentId: agentId != null ? String(agentId) : void 0,
+    name: name != null ? String(name) : void 0
+  };
+}
+async function acpWalletAddress() {
+  const json = await acpJson(["wallet", "address"]);
+  if (!json) return null;
+  for (const key of ["address", "evmAddress", "evm", "wallet"]) {
+    const value = json[key];
+    if (typeof value === "string" && isAddress5(value)) return value;
+  }
+  return null;
+}
+
+// src/commands/identity.ts
 var IDENTITY_REGISTRY_ABI2 = [
   {
     name: "balanceOf",
@@ -3976,6 +4165,123 @@ function registerIdentityCommands(program2) {
       process.exit(1);
     }
   });
+  identity.command("link-virtuals").description("Link a Virtuals economyOS agent identity (ERC-8004 on Base) to this Sherwood install").option("--wallet <address>", "economyOS agent wallet (default: auto-detect via `acp wallet address`)").option("--agent-id <tokenId>", "ERC-8004 token ID on the issuing chain (default: resolve via Agent0 SDK)").option("--chain-id <id>", "Issuing chain ID (4663 = Robinhood Chain, 8453 = Base, 84532 = Base Sepolia)", String(DEFAULT_ISSUING_CHAIN_ID)).option("--binding-sig <hex>", "EIP-191 signature of the binding message by the economyOS wallet").action(async (opts) => {
+    const account = getAccount();
+    const issuingChainId = parseInt(opts.chainId, 10);
+    if (!ISSUING_CHAINS[issuingChainId]) {
+      console.error(chalk4.red(`Unsupported issuing chain ${opts.chainId}. Supported: ${Object.keys(ISSUING_CHAINS).join(", ")}`));
+      process.exit(1);
+    }
+    const spinner = ora4("Resolving economyOS agent...").start();
+    try {
+      let virtualsWallet = opts.wallet;
+      let virtualsAgentId;
+      if (await detectAcp()) {
+        const who = await acpWhoami();
+        virtualsAgentId = who?.agentId;
+        if (!virtualsWallet) {
+          virtualsWallet = await acpWalletAddress() ?? void 0;
+        }
+      }
+      if (!virtualsWallet) {
+        spinner.fail("Could not resolve the economyOS agent wallet");
+        console.error(chalk4.dim("  Install + authenticate the acp CLI (npm i -g @virtuals-protocol/acp-cli; acp configure)"));
+        console.error(chalk4.dim("  or pass --wallet <address> explicitly."));
+        process.exit(1);
+      }
+      let tokenId;
+      if (opts.agentId) {
+        tokenId = BigInt(opts.agentId);
+      } else {
+        spinner.text = `Searching ERC-8004 registry on chain ${issuingChainId} for ${virtualsWallet}...`;
+        const sdk = new SDK({
+          chainId: issuingChainId,
+          rpcUrl: ISSUING_CHAINS[issuingChainId].chain.rpcUrls.default.http[0],
+          privateKey: generatePrivateKey()
+        });
+        const results = await sdk.searchAgents({
+          walletAddress: virtualsWallet,
+          chains: [issuingChainId]
+        });
+        if (results.length === 0) {
+          spinner.fail(`No ERC-8004 registration found for ${virtualsWallet} on chain ${issuingChainId}`);
+          console.error(chalk4.dim("  Register first via the Virtuals CLI:"));
+          console.error(chalk4.dim(`    acp agent register-erc8004 --agent-id ${virtualsAgentId ?? "<id>"} --chain-id ${issuingChainId}`));
+          console.error(chalk4.dim("  Then re-run this command (or pass --agent-id <tokenId> directly)."));
+          process.exit(1);
+        }
+        if (results.length > 1) {
+          spinner.fail(`Wallet ${virtualsWallet} has ${results.length} ERC-8004 registrations on chain ${issuingChainId} \u2014 pick one explicitly`);
+          for (const a of results) {
+            const idStr2 = String(a.agentId);
+            const tid = idStr2.includes(":") ? idStr2.split(":")[1] : idStr2;
+            console.error(chalk4.dim(`    #${tid}  ${a.name || "(no name)"}`));
+          }
+          console.error(chalk4.green("  Re-run with: sherwood identity link-virtuals --agent-id <tokenId>"));
+          process.exit(1);
+        }
+        const idStr = String(results[0].agentId);
+        tokenId = BigInt(idStr.includes(":") ? idStr.split(":")[1] : idStr);
+      }
+      if (tokenId > BigInt(Number.MAX_SAFE_INTEGER)) {
+        spinner.fail(`Token ID ${tokenId} exceeds Number.MAX_SAFE_INTEGER \u2014 cannot be stored in config`);
+        process.exit(1);
+      }
+      spinner.text = `Verifying ownerOf(#${tokenId}) on chain ${issuingChainId}...`;
+      const owner = await ownerOfOnIssuingChain(issuingChainId, tokenId);
+      if (owner.toLowerCase() !== virtualsWallet.toLowerCase()) {
+        spinner.fail(`Agent #${tokenId} on chain ${issuingChainId} is owned by ${owner}, not ${virtualsWallet}`);
+        process.exit(1);
+      }
+      const self = virtualsWallet.toLowerCase() === account.address.toLowerCase();
+      const bindingMessage = buildBindingMessage(account.address, issuingChainId, tokenId);
+      let binding;
+      if (!self) {
+        if (!opts.bindingSig) {
+          spinner.fail("Binding signature required (economyOS wallet differs from your Sherwood wallet)");
+          console.error();
+          console.error(chalk4.bold("  Sign this exact message with the economyOS agent wallet:"));
+          console.error(chalk4.green(`    ${bindingMessage}`));
+          console.error();
+          console.error(chalk4.dim("  (e.g. via the acp CLI / app.virtuals.io wallet signing, EIP-191 personal_sign)"));
+          console.error(chalk4.dim("  Then re-run with --binding-sig <signature>."));
+          process.exit(1);
+        }
+        spinner.text = "Verifying binding signature...";
+        const ok = await verifyBinding({
+          sherwoodEoa: account.address,
+          issuingChainId,
+          tokenId,
+          virtualsWallet,
+          signature: opts.bindingSig
+        });
+        if (!ok) {
+          spinner.fail("Binding signature does not recover to the economyOS wallet");
+          console.error(chalk4.dim(`  Expected signer: ${virtualsWallet}`));
+          console.error(chalk4.dim(`  Signed message must be exactly: ${bindingMessage}`));
+          process.exit(1);
+        }
+        binding = { sig: opts.bindingSig, message: bindingMessage };
+      }
+      setVirtualsIdentity(Number(tokenId), issuingChainId, {
+        agentId: virtualsAgentId,
+        wallet: virtualsWallet,
+        binding
+      });
+      spinner.succeed(`Virtuals identity linked: agent #${tokenId} (chain ${issuingChainId})`);
+      console.log(chalk4.dim(`  economyOS wallet: ${virtualsWallet}`));
+      if (virtualsAgentId) console.log(chalk4.dim(`  Virtuals agent:   ${virtualsAgentId}`));
+      console.log(chalk4.dim(`  Sherwood wallet:  ${account.address}${self ? " (same as economyOS wallet \u2014 no binding needed)" : " (bound via signature)"}`));
+      console.log(chalk4.dim(`  Saved to          ~/.sherwood/config.json`));
+      console.log();
+      console.log(chalk4.green("You can now create or join funds with this identity:"));
+      console.log(chalk4.dim(`  sherwood fund create --agent-id ${tokenId} --subdomain <name> --name <name>`));
+    } catch (err) {
+      spinner.fail("Failed to link Virtuals identity");
+      console.error(chalk4.red(formatContractError(err)));
+      process.exit(1);
+    }
+  });
   identity.command("find").description("Search ERC-8004 agents by wallet address or name (recover a lost agent ID)").option("--wallet <address>", "Filter by owner / wallet address").option("--name <text>", "Filter by agent name (exact or substring match, depending on registry)").option("--all-chains", "Search across all chains, not just the active one").action(async (opts) => {
     if (!opts.wallet && !opts.name) {
       console.error(chalk4.red("Pass --wallet <address> or --name <text> (or both)."));
@@ -4022,6 +4328,47 @@ function registerIdentityCommands(program2) {
   });
   identity.command("status").description("Show your agent identity status").action(async () => {
     const account = getAccount();
+    if (getIdentityProvider() === "virtuals") {
+      const virtuals = getVirtualsIdentity();
+      const savedId = getAgentId();
+      const issuingChainId = getIdentityChainId();
+      console.log();
+      console.log(chalk4.bold("Agent Identity (ERC-8004 via Virtuals economyOS)"));
+      console.log(chalk4.dim("\u2500".repeat(40)));
+      console.log(`  Sherwood wallet:  ${account.address}`);
+      console.log(`  economyOS wallet: ${virtuals?.wallet ?? chalk4.red("(missing)")}`);
+      if (virtuals?.agentId) console.log(`  Virtuals agent:   ${virtuals.agentId}`);
+      console.log(`  Issuing chain:    ${issuingChainId ?? chalk4.red("(missing)")}`);
+      console.log(`  Saved ID:         ${savedId != null ? `#${savedId}` : chalk4.red("(missing)")}`);
+      if (virtuals?.wallet && savedId != null && issuingChainId != null) {
+        const spinner2 = ora4("Re-verifying link...").start();
+        try {
+          const owner = await ownerOfOnIssuingChain(issuingChainId, BigInt(savedId));
+          const ownerOk = owner.toLowerCase() === virtuals.wallet.toLowerCase();
+          let bindingOk = virtuals.wallet.toLowerCase() === account.address.toLowerCase();
+          if (!bindingOk && virtuals.binding?.sig) {
+            bindingOk = await verifyBinding({
+              sherwoodEoa: account.address,
+              issuingChainId,
+              tokenId: BigInt(savedId),
+              virtualsWallet: virtuals.wallet,
+              signature: virtuals.binding.sig
+            });
+          }
+          spinner2.stop();
+          console.log(`  NFT ownership:    ${ownerOk ? chalk4.green("verified") : chalk4.red(`FAILED (owner is ${owner})`)}`);
+          console.log(`  Binding:          ${bindingOk ? chalk4.green("verified") : chalk4.red("FAILED")}`);
+          if (!ownerOk) {
+            console.log(chalk4.yellow("  The NFT moved since linking \u2014 re-run 'sherwood identity link-virtuals'."));
+          }
+        } catch (err) {
+          spinner2.warn("Could not re-verify against the issuing chain");
+          console.log(chalk4.dim(`  ${err.message}`));
+        }
+      }
+      console.log();
+      return;
+    }
     const registry = AGENT_REGISTRY().IDENTITY_REGISTRY;
     const client = getPublicClient();
     const spinner = ora4("Checking identity...").start();
@@ -4115,7 +4462,7 @@ function registerIdentityCommands(program2) {
 }
 
 // src/commands/proposal.ts
-import { isAddress as isAddress5, encodeFunctionData as encodeFunctionData10 } from "viem";
+import { isAddress as isAddress6, encodeFunctionData as encodeFunctionData10 } from "viem";
 import chalk6 from "chalk";
 import ora5 from "ora";
 import { readFileSync as readFileSync2 } from "fs";
@@ -4808,8 +5155,8 @@ function printSimulationResult(result, callType) {
 }
 async function sendSimulationAlert(subdomain, proposalId, vault, execResult, settleResult) {
   try {
-    const xmtp = await import("./xmtp-KH5I6GOL.js");
-    const { getAccount: getAccount2 } = await import("./client-C3C6IXAH.js");
+    const xmtp = await import("./xmtp-OZ5PJFCT.js");
+    const { getAccount: getAccount2 } = await import("./client-GRPJRISD.js");
     const group = await xmtp.getGroup("", subdomain);
     const allRisks = [...execResult.risks, ...settleResult?.risks ?? []];
     const criticals = allRisks.filter((r) => r.level === "critical");
@@ -4902,7 +5249,7 @@ function formatTimestamp(ts) {
 }
 function parseVaultOption(raw, spinner) {
   const vault = String(raw);
-  if (!isAddress5(vault)) {
+  if (!isAddress6(vault)) {
     if (spinner) spinner.fail(`Invalid vault address: ${vault}`);
     else console.error(chalk6.red(`Invalid vault address: ${vault}`));
     process.exit(1);
@@ -4956,7 +5303,7 @@ function registerProposalCommands(program2) {
   proposal.command("create").description("Submit a strategy proposal").requiredOption("--vault <address>", "Vault address the proposal targets").requiredOption("--name <name>", "Strategy name").requiredOption("--description <text>", "Strategy rationale and risk summary").requiredOption("--duration <duration>", "Strategy duration (e.g. 7d, 24h, 3600)").requiredOption("--execute-calls <path>", "Path to JSON file with execute Call[] array").requiredOption("--settle-calls <path>", "Path to JSON file with settlement Call[] array").option("--strategy <address>", "Live-NAV strategy clone address (default: none \u2014 queue-only)").option("--metadata-uri <uri>", "Override \u2014 skip IPFS upload and use this URI directly").option("--simulate", "Simulate calls via Tenderly before submitting").option("--force", "Submit even if simulation fails (requires --simulate)").action(async (opts) => {
     try {
       const vault = opts.vault;
-      if (!isAddress5(vault)) {
+      if (!isAddress6(vault)) {
         console.error(chalk6.red(`Invalid vault address: ${opts.vault}`));
         process.exit(1);
       }
@@ -4966,7 +5313,7 @@ function registerProposalCommands(program2) {
       const ZERO_STRATEGY = "0x0000000000000000000000000000000000000000";
       let strategy2 = ZERO_STRATEGY;
       if (opts.strategy) {
-        if (!isAddress5(opts.strategy)) {
+        if (!isAddress6(opts.strategy)) {
           console.error(chalk6.red(`Invalid strategy address: ${opts.strategy}`));
           process.exit(1);
         }
@@ -5748,7 +6095,7 @@ function registerProposalCommands(program2) {
       let riskContext = {};
       let proposalId;
       if (opts.id) {
-        if (!opts.vault || !isAddress5(opts.vault)) {
+        if (!opts.vault || !isAddress6(opts.vault)) {
           console.error(chalk6.red("\n  \u2716 --vault is required when using --id (proposal IDs are per-vault)"));
           process.exit(1);
         }
@@ -5772,7 +6119,7 @@ function registerProposalCommands(program2) {
         console.log(DIM2(`
   Simulating proposal #${proposalId} on vault ${vault.slice(0, 10)}...`));
       } else if (opts.executeCalls) {
-        if (!opts.vault || !isAddress5(opts.vault)) {
+        if (!opts.vault || !isAddress6(opts.vault)) {
           console.error(chalk6.red("\n  \u2716 --vault is required when using --execute-calls"));
           process.exit(1);
         }
@@ -5815,7 +6162,7 @@ function registerProposalCommands(program2) {
 }
 
 // src/commands/queue.ts
-import { parseUnits as parseUnits5, formatUnits as formatUnits5, isAddress as isAddress6, parseEventLogs } from "viem";
+import { parseUnits as parseUnits5, formatUnits as formatUnits5, isAddress as isAddress7, parseEventLogs } from "viem";
 import chalk7 from "chalk";
 import ora6 from "ora";
 var WETH_ABI2 = [
@@ -5951,7 +6298,7 @@ var QUEUE_ABI = [
 ];
 var KIND_LABELS = ["Redeem", "Deposit"];
 function resolveVaultAddress(opt) {
-  if (!opt || !isAddress6(opt)) {
+  if (!opt || !isAddress7(opt)) {
     console.error(chalk7.red(`Invalid or missing --vault address: ${opt ?? "(none)"}`));
     process.exit(1);
   }
@@ -6204,7 +6551,7 @@ function registerQueueCommands(program2) {
 // src/commands/governor.ts
 import chalk8 from "chalk";
 import ora7 from "ora";
-import { isAddress as isAddress7 } from "viem";
+import { isAddress as isAddress8 } from "viem";
 var G3 = chalk8.green;
 var W3 = chalk8.white;
 var DIM3 = chalk8.gray;
@@ -6213,7 +6560,7 @@ var LABEL3 = chalk8.green.bold;
 var SEP3 = () => console.log(DIM3("\u2500".repeat(60)));
 function parseVaultArg(raw) {
   const vault = String(raw);
-  if (!isAddress7(vault)) {
+  if (!isAddress8(vault)) {
     console.error(chalk8.red(`Invalid vault address: ${vault}`));
     process.exit(1);
   }
@@ -6388,7 +6735,7 @@ function registerGovernorCommands(program2) {
 // src/commands/guardian-delegate.ts
 import chalk9 from "chalk";
 import ora8 from "ora";
-import { formatUnits as formatUnits6, isAddress as isAddress8, parseUnits as parseUnits6 } from "viem";
+import { formatUnits as formatUnits6, isAddress as isAddress9, parseUnits as parseUnits6 } from "viem";
 var G4 = chalk9.green;
 var W4 = chalk9.white;
 var DIM4 = chalk9.gray;
@@ -6470,7 +6817,7 @@ function registerGuardianCommands(program2) {
     const pc = getPublicClient();
     let target;
     if (addressArg) {
-      if (!isAddress8(addressArg)) {
+      if (!isAddress9(addressArg)) {
         console.error(chalk9.red("Invalid address"));
         process.exit(1);
       }
@@ -6588,7 +6935,7 @@ function registerGuardianCommands(program2) {
     }
   });
   guardian.command("delegate <delegate> <amount>").description("Delegate WOOD stake to a guardian. Amount in WOOD.").action(async (delegate, amountStr) => {
-    if (!isAddress8(delegate)) {
+    if (!isAddress9(delegate)) {
       console.error(chalk9.red("Invalid delegate address"));
       process.exit(1);
     }
@@ -6612,7 +6959,7 @@ function registerGuardianCommands(program2) {
     }
   });
   guardian.command("undelegate <delegate> <action>").description("Unstake-delegation flow: 'request' | 'cancel' | 'claim'").action(async (delegate, action) => {
-    if (!isAddress8(delegate)) {
+    if (!isAddress9(delegate)) {
       console.error(chalk9.red("Invalid delegate address"));
       process.exit(1);
     }
@@ -8646,13 +8993,13 @@ import { join as join4 } from "path";
 import { homedir as homedir4 } from "os";
 import { createHash as createHash2 } from "crypto";
 var DEFAULT_SWEEP_DIR = join4(homedir4(), ".sherwood", "grid", "sweeps");
-function expandSweep(sweep, base) {
+function expandSweep(sweep, base2) {
   const fields = ["leverage", "levelsPerSide", "atrMultiplier", "rebalanceDriftPct"];
   const valueLists = {
-    leverage: sweep.leverage && sweep.leverage.length > 0 ? sweep.leverage : [base.leverage],
-    levelsPerSide: sweep.levelsPerSide && sweep.levelsPerSide.length > 0 ? sweep.levelsPerSide : [base.levelsPerSide],
-    atrMultiplier: sweep.atrMultiplier && sweep.atrMultiplier.length > 0 ? sweep.atrMultiplier : [base.atrMultiplier],
-    rebalanceDriftPct: sweep.rebalanceDriftPct && sweep.rebalanceDriftPct.length > 0 ? sweep.rebalanceDriftPct : [base.rebalanceDriftPct]
+    leverage: sweep.leverage && sweep.leverage.length > 0 ? sweep.leverage : [base2.leverage],
+    levelsPerSide: sweep.levelsPerSide && sweep.levelsPerSide.length > 0 ? sweep.levelsPerSide : [base2.levelsPerSide],
+    atrMultiplier: sweep.atrMultiplier && sweep.atrMultiplier.length > 0 ? sweep.atrMultiplier : [base2.atrMultiplier],
+    rebalanceDriftPct: sweep.rebalanceDriftPct && sweep.rebalanceDriftPct.length > 0 ? sweep.rebalanceDriftPct : [base2.rebalanceDriftPct]
   };
   let combos = [{}];
   for (const field of fields) {
@@ -8691,13 +9038,13 @@ async function runSweep(opts) {
     tokenSplit = {};
     for (const t of opts.tokens) tokenSplit[t] = weight;
   }
-  const base = {
+  const base2 = {
     ...DEFAULT_GRID_CONFIG,
     ...opts.baseConfig,
     tokens: opts.tokens,
     tokenSplit
   };
-  const combos = expandSweep(opts.sweep, base);
+  const combos = expandSweep(opts.sweep, base2);
   if (combos.length === 0) throw new Error("sweep produced no combinations");
   const loader = new HistoricalDataLoader({ noCache: opts.noCache });
   if (opts.verbose !== false) {
@@ -8708,7 +9055,7 @@ async function runSweep(opts) {
   const runs = [];
   for (let i = 0; i < combos.length; i++) {
     const combo = combos[i];
-    const config = { ...base, ...combo };
+    const config = { ...base2, ...combo };
     const runOutPath = join4(sweepDir, `run-${i.toString().padStart(3, "0")}.json`);
     if (opts.verbose !== false) {
       process.stderr.write(`  [sweep] [${i + 1}/${combos.length}] ${JSON.stringify(combo)}
@@ -9246,9 +9593,9 @@ try {
 } catch {
 }
 var require2 = createRequire(import.meta.url);
-var CLI_VERSION = "0.74.3";
+var CLI_VERSION = "0.76.0";
 async function loadXmtp() {
-  return import("./xmtp-KH5I6GOL.js");
+  return import("./xmtp-OZ5PJFCT.js");
 }
 async function loadCron() {
   return import("./cron-QMLRWDJG.js");
@@ -9260,7 +9607,7 @@ var BOLD6 = chalk16.white.bold;
 var LABEL5 = chalk16.green.bold;
 var SEP6 = () => console.log(DIM6("\u2500".repeat(60)));
 function validateAddress(value, name) {
-  if (!isAddress9(value)) {
+  if (!isAddress10(value)) {
     console.error(chalk16.red(`Invalid ${name} address: ${value}`));
     process.exit(1);
   }
@@ -9849,7 +10196,7 @@ fund.command("add").description("Register an agent on a fund vault (creator only
     if (opts.agentId) {
       agentId = BigInt(opts.agentId);
     } else {
-      const { AGENT_REGISTRY: AGENT_REGISTRY2 } = await import("./addresses-OFFTM6NG.js");
+      const { AGENT_REGISTRY: AGENT_REGISTRY2 } = await import("./addresses-JJPQTF6S.js");
       const registry = AGENT_REGISTRY2().IDENTITY_REGISTRY;
       if (registry === "0x0000000000000000000000000000000000000000") {
         agentId = 0n;
@@ -9982,6 +10329,16 @@ fund.command("join").description("Request to join a fund (creates an EAS attesta
       }
       process.exit(1);
     }
+    let joinMessage = opts.message;
+    const virtualsIdentity = getVirtualsIdentity();
+    if (getIdentityProvider() === "virtuals" && virtualsIdentity) {
+      joinMessage = appendVidTag(joinMessage, {
+        issuingChainId: getIdentityChainId() ?? DEFAULT_ISSUING_CHAIN_ID,
+        tokenId: BigInt(agentId),
+        wallet: virtualsIdentity.wallet,
+        signature: virtualsIdentity.binding?.sig ?? "self"
+      });
+    }
     if (isCalldataOnly()) {
       const referrerAgentId2 = opts.ref ? parseInt(opts.ref, 10) : void 0;
       spinner.stop();
@@ -9992,7 +10349,7 @@ fund.command("join").description("Request to join a fund (creates an EAS attesta
             agentId: BigInt(agentId),
             vault: fund2.vault,
             creator: fund2.creator,
-            message: opts.message,
+            message: joinMessage,
             referrerAgentId: referrerAgentId2
           },
           getChain().id
@@ -10050,7 +10407,7 @@ fund.command("join").description("Request to join a fund (creates an EAS attesta
       BigInt(agentId),
       fund2.vault,
       fund2.creator,
-      opts.message,
+      joinMessage,
       referrerAgentId
     );
     try {
@@ -10137,16 +10494,26 @@ fund.command("requests").description("View pending join requests for a fund (cre
     console.log();
     console.log(LABEL5(`  \u25C6 Pending Join Requests (${requests.length})`));
     SEP6();
+    const ownerOfCached = makeOwnerOfCache();
     for (let i = 0; i < requests.length; i++) {
       const req = requests[i];
       const date = new Date(req.time * 1e3).toLocaleString();
       const referrer = parseReferrer(req.decoded.message);
-      const cleanMessage = stripReferrerPrefix(req.decoded.message);
+      const vid = parseVidTag(req.decoded.message);
+      const cleanMessage = stripReferrerPrefix(stripVidTag(req.decoded.message));
       console.log(W6(`  ${i + 1}. Agent #${req.decoded.agentId} ${DIM6(`(${req.attester})`)}`));
       console.log(DIM6(`     Message:     "${cleanMessage}"`));
       if (referrer !== null) {
         console.log(G6(`     Referred by: Agent #${referrer}`));
       }
+      if (vid) {
+        const v = await verifyVidTag(vid, req.attester, ownerOfCached);
+        const verified = v.bindingOk && v.ownerOk;
+        const badge = verified ? G6("\u2714 verified") : chalk16.red("\u2718 FAILED");
+        console.log(W6(`     Virtuals:    ${badge} ${DIM6(`(agent #${vid.tokenId} on chain ${vid.issuingChainId}, wallet ${vid.wallet})`)}`));
+        if (!v.bindingOk) console.log(chalk16.red(`       binding signature invalid \u2014 do not approve based on this identity`));
+        else if (!v.ownerOk) console.log(chalk16.red(`       NFT ownership check failed${v.owner ? ` (owner is ${v.owner})` : v.error ? ` (${v.error})` : ""}`));
+      }
       console.log(DIM6(`     Requested:   ${date}`));
       console.log(DIM6(`     Attestation: ${req.uid}`));
       console.log();
@@ -10542,7 +10909,7 @@ vaultCmd.command("redeem").description("Redeem vault shares for the underlying a
 `));
     process.exit(1);
   }
-  if (opts.receiver && !isAddress9(opts.receiver)) {
+  if (opts.receiver && !isAddress10(opts.receiver)) {
     console.error(chalk16.red(`
   \u2716 Invalid receiver address: ${opts.receiver}
 `));
@@ -10575,7 +10942,7 @@ vaultCmd.command("redeem").description("Redeem vault shares for the underlying a
 var strategy = program.command("strategy").description("Strategy templates \u2014 list, clone, propose");
 registerStrategyTemplateCommands(strategy);
 program.command("providers").description("List available providers (research + swap routing)").action(async () => {
-  const { listProviders } = await import("./providers-YOOQFBN2.js");
+  const { listProviders } = await import("./providers-2J6LL67W.js");
   for (const info of listProviders()) {
     console.log(`
 ${info.name} (${info.type})`);
@@ -10585,7 +10952,7 @@ ${info.name} (${info.type})`);
   }
 });
 try {
-  const { registerChatCommands } = await import("./chat-CXUU4AXK.js");
+  const { registerChatCommands } = await import("./chat-CO244AHH.js");
   registerChatCommands(program);
 } catch {
   program.command("chat <name> [action] [actionArgs...]").description("Fund chat (XMTP) \u2014 requires @xmtp/cli").action(() => {
@@ -10595,7 +10962,7 @@ try {
     process.exit(1);
   });
 }
-var { registerSessionCommands } = await import("./session-NLI6UFKB.js");
+var { registerSessionCommands } = await import("./session-JQ3IF3IV.js");
 registerSessionCommands(program);
 registerVeniceCommands(program);
 registerAllowanceCommands(program);
@@ -10604,11 +10971,11 @@ registerProposalCommands(program);
 registerQueueCommands(program);
 registerGovernorCommands(program);
 registerGuardianCommands(program);
-var { registerResearchCommands } = await import("./research-NQKYGTLY.js");
+var { registerResearchCommands } = await import("./research-FHQCSLTZ.js");
 registerResearchCommands(program);
-var { registerAgentCommands } = await import("./agent-B7V5L2ZL.js");
+var { registerAgentCommands } = await import("./agent-FYRYTKYM.js");
 registerAgentCommands(program);
-var { registerTradeCommands } = await import("./trade-6VYB6YJZ.js");
+var { registerTradeCommands } = await import("./trade-5EYPZN7M.js");
 registerTradeCommands(program);
 registerGridCommand(program);
 var configCmd = program.command("config");