arc402-cli 0.2.0

package/src/commands/hire.ts

@@ -0,0 +1,200 @@
+import { Command } from "commander";
+import { ServiceAgreementClient, SessionManager } from "@arc402/sdk";
+import { ethers } from "ethers";
+import { getUsdcAddress, loadConfig } from "../config";
+import { requireSigner } from "../client";
+import { hashFile, hashString } from "../utils/hash";
+import { parseDuration } from "../utils/time";
+import { printSenderInfo, executeContractWriteViaWallet } from "../wallet-router";
+import { SERVICE_AGREEMENT_ABI } from "../abis";
+
+const sessionManager = new SessionManager();
+
+export function registerHireCommand(program: Command): void {
+  program
+    .command("hire")
+    .description("Create the on-chain commitment after off-chain negotiation")
+    .requiredOption("--agent <address>")
+    .requiredOption("--task <description>")
+    .requiredOption("--service-type <type>")
+    .option("--max <amount>", "Max price in wei (e.g. 1000000000000000) or ETH (e.g. 0.001eth) or USDC (e.g. 1USDC). Required unless --session is provided.")
+    .option("--deadline <duration>", "Deadline as duration (1h, 30m, 7d) or absolute ISO date (2026-04-01). Required unless --session is provided.")
+    .option("--token <token>", "eth or usdc", "eth")
+    .option("--deliverable-spec <filepath>")
+    .option("--session <sessionId>", "Load agreed price and deadline from a completed negotiation session")
+    .option("--json")
+    .action(async (opts) => {
+      const config = loadConfig();
+      if (!config.serviceAgreementAddress) throw new Error("serviceAgreementAddress missing in config");
+      const { signer, address } = await requireSigner(config);
+      const client = new ServiceAgreementClient(config.serviceAgreementAddress, signer);
+
+      let maxAmount: string;
+      let deadlineArg: string;
+      let transcriptHash: string | undefined;
+
+      if (opts.session) {
+        const session = sessionManager.load(opts.session);
+        if (session.state !== "ACCEPTED") throw new Error(`Session ${opts.session} is not in ACCEPTED state (state: ${session.state})`);
+        if (!session.agreedPrice || !session.agreedDeadline) throw new Error(`Session ${opts.session} is missing agreedPrice or agreedDeadline`);
+        maxAmount = session.agreedPrice;
+        deadlineArg = session.agreedDeadline;
+        transcriptHash = session.transcriptHash;
+      } else {
+        if (!opts.max) throw new Error("--max is required when --session is not provided. Examples: 0.001eth, 1000000000000000 (wei), 1USDC");
+        if (!opts.deadline) throw new Error("--deadline is required when --session is not provided. Examples: 1h, 30m, 7d, 2026-04-01");
+        maxAmount = opts.max;
+        deadlineArg = opts.deadline;
+      }
+
+      // Normalise --max: strip trailing 'eth' or 'USDC' suffix and convert to correct unit
+      const useUsdc = String(opts.token).toLowerCase() === "usdc";
+      const ethSuffix = /^(\d+(?:\.\d+)?)eth$/i.exec(maxAmount);
+      const usdcSuffix = /^(\d+(?:\.\d+)?)usdc$/i.exec(maxAmount);
+      if (ethSuffix) maxAmount = String(BigInt(Math.round(parseFloat(ethSuffix[1]) * 1e18)));
+      else if (usdcSuffix) maxAmount = usdcSuffix[1]; // keep decimal for USDC path
+      const token = useUsdc ? getUsdcAddress(config) : ethers.ZeroAddress;
+      let price: bigint;
+      try {
+        price = useUsdc ? BigInt(Math.round(Number(maxAmount) * 1_000_000)) : BigInt(maxAmount);
+      } catch {
+        throw new Error(`Invalid --max value "${opts.max}". Use wei (1000000000000000), ETH (0.001eth), or USDC (1USDC)`);
+      }
+      if (price <= 0n) throw new Error(`--max must be greater than zero`);
+
+      // Pre-flight: check client !== provider (J2-03)
+      if (address.toLowerCase() === opts.agent.toLowerCase()) {
+        console.error("Cannot hire yourself: client and provider addresses are the same.");
+        process.exit(1);
+      }
+
+      // Pre-flight: check provider is registered in AgentRegistry (J2-02)
+      const agentRegistryAddress = config.agentRegistryV2Address ?? config.agentRegistryAddress;
+      if (agentRegistryAddress) {
+        const arProvider = new ethers.JsonRpcProvider(config.rpcUrl);
+        const arCheck = new ethers.Contract(
+          agentRegistryAddress,
+          ["function isRegistered(address wallet) external view returns (bool)"],
+          arProvider,
+        );
+        let isRegistered = true;
+        try {
+          isRegistered = await arCheck.isRegistered(opts.agent);
+        } catch { /* assume registered if read fails */ }
+        if (!isRegistered) {
+          console.error(`Provider ${opts.agent} is not registered in AgentRegistry.`);
+          console.error(`Verify the agent address is correct, or check the registry at ${agentRegistryAddress}.`);
+          process.exit(1);
+        }
+      }
+
+      // Pre-flight: check token is allowed on this ServiceAgreement (J2-01)
+      if (useUsdc) {
+        const saProvider = new ethers.JsonRpcProvider(config.rpcUrl);
+        const saCheck = new ethers.Contract(
+          config.serviceAgreementAddress,
+          ["function allowedTokens(address) external view returns (bool)"],
+          saProvider,
+        );
+        let isAllowed = false;
+        try {
+          isAllowed = await saCheck.allowedTokens(token);
+        } catch { isAllowed = true; /* assume allowed if read fails */ }
+        if (!isAllowed) {
+          console.error(`Token ${token} is not allowed on this ServiceAgreement.`);
+          console.error(`Only the SA owner can allowlist tokens via:`);
+          console.error(`  cast send ${config.serviceAgreementAddress} "allowToken(address)" ${token}`);
+          console.error(`For ETH payments, use --token eth`);
+          process.exit(1);
+        }
+      }
+
+      // Use spec hash as deliverables hash; if transcript exists, incorporate it
+      const baseHash = opts.deliverableSpec ? hashFile(opts.deliverableSpec) : hashString(opts.task);
+      const deliverablesHash = transcriptHash
+        ? (ethers.keccak256(ethers.toUtf8Bytes(baseHash + transcriptHash)) as `0x${string}`)
+        : baseHash;
+
+      // Parse deadline: if it looks like an ISO date, convert to seconds from now
+      let deadlineSeconds: number;
+      const isoMatch = deadlineArg.match(/^\d{4}-\d{2}-\d{2}/);
+      if (isoMatch) {
+        const target = Math.floor(new Date(deadlineArg).getTime() / 1000);
+        deadlineSeconds = target - Math.floor(Date.now() / 1000);
+        if (deadlineSeconds <= 0) throw new Error(`Deadline ${deadlineArg} is in the past`);
+      } else {
+        deadlineSeconds = parseDuration(deadlineArg);
+      }
+
+      printSenderInfo(config);
+
+      let agreementId: bigint;
+
+      if (config.walletContractAddress) {
+        // Smart wallet path — wallet handles per-tx USDC approval via maxApprovalAmount
+        const tx = await executeContractWriteViaWallet(
+          config.walletContractAddress,
+          signer,
+          config.serviceAgreementAddress,
+          SERVICE_AGREEMENT_ABI,
+          "propose",
+          [opts.agent, opts.serviceType, opts.task, price, token, deadlineSeconds, deliverablesHash],
+          useUsdc ? 0n : price,   // ETH value forwarded to SA; 0 for USDC agreements
+          useUsdc ? token : ethers.ZeroAddress,  // approvalToken for USDC
+          useUsdc ? price : 0n,   // maxApprovalAmount for USDC
+        );
+        const receipt = await tx.wait();
+        const saInterface = new ethers.Interface(SERVICE_AGREEMENT_ABI);
+        let found = false;
+        for (const log of receipt!.logs) {
+          if (log.address.toLowerCase() === config.serviceAgreementAddress.toLowerCase()) {
+            try {
+              const parsed = saInterface.parseLog(log);
+              if (parsed?.name === "AgreementProposed") {
+                agreementId = parsed.args[0] as bigint;
+                found = true;
+                break;
+              }
+            } catch { /* skip unparseable logs */ }
+          }
+        }
+        if (!found) throw new Error("AgreementProposed event not found in transaction receipt");
+      } else {
+        // EOA path — existing behaviour
+        if (useUsdc) {
+          const usdc = new ethers.Contract(
+            token,
+            ["function approve(address spender,uint256 amount) external returns (bool)", "function allowance(address owner,address spender) external view returns (uint256)"],
+            signer
+          );
+          const allowance = await usdc.allowance(address, config.serviceAgreementAddress);
+          if (allowance < price) await (await usdc.approve(config.serviceAgreementAddress, price)).wait();
+        }
+
+        const result = await client.propose({
+          provider: opts.agent,
+          serviceType: opts.serviceType,
+          description: opts.task,
+          price,
+          token,
+          deadline: deadlineSeconds,
+          deliverablesHash,
+        });
+        agreementId = result.agreementId;
+      }
+
+      if (opts.session) {
+        sessionManager.setOnChainId(opts.session, agreementId!.toString());
+      }
+
+      if (opts.json) {
+        const output: Record<string, unknown> = { agreementId: agreementId!.toString(), deliverablesHash };
+        if (transcriptHash) output.transcriptHash = transcriptHash;
+        if (opts.session) output.sessionId = opts.session;
+        return console.log(JSON.stringify(output, null, 2));
+      }
+
+      console.log(`agreementId=${agreementId!} deliverablesHash=${deliverablesHash}`);
+      if (transcriptHash) console.log(`transcriptHash=${transcriptHash}`);
+    });
+}

package/src/commands/migrate.ts

@@ -0,0 +1,175 @@
+import { Command } from "commander";
+import { ethers } from "ethers";
+import { loadConfig } from "../config";
+import { getClient, requireSigner } from "../client";
+
+const MIGRATION_REGISTRY_ABI = [
+  "function registerMigration(address oldWallet, address newWallet) external",
+  "function resolveActiveWallet(address wallet) external view returns (address)",
+  "function getLineage(address wallet) external view returns (address[])",
+  "function migratedTo(address wallet) external view returns (address)",
+  "function migratedFrom(address wallet) external view returns (address)",
+  "event MigrationRegistered(address indexed oldWallet, address indexed newWallet, address indexed owner, uint256 migratedAt, uint256 scoreAtMigration, uint256 appliedDecay)",
+] as const;
+
+export function registerMigrateCommands(program: Command): void {
+  const migrate = program
+    .command("migrate")
+    .description("Wallet migration — register, query status, or print lineage history")
+    .argument("[oldWallet]", "old wallet address (required for registration)")
+    .argument("[newWallet]", "new wallet address (required for registration)")
+    .option("--json")
+    .action(async (oldWallet, newWallet, opts) => {
+      if (!oldWallet || !newWallet) {
+        console.error("Usage: arc402 migrate <oldWallet> <newWallet>");
+        console.error("Both wallets must share the same registered owner address.");
+        process.exit(1);
+      }
+
+      const config = loadConfig();
+      if (!config.migrationRegistryAddress) {
+        console.error("migrationRegistryAddress not configured. Run `arc402 config set migrationRegistryAddress <address>`.");
+        process.exit(1);
+      }
+
+      const { signer } = await requireSigner(config);
+      const contract = new ethers.Contract(config.migrationRegistryAddress, MIGRATION_REGISTRY_ABI, signer);
+
+      const tx = await contract.registerMigration(oldWallet, newWallet);
+      const receipt = await tx.wait();
+
+      const payload = {
+        oldWallet,
+        newWallet,
+        txHash: receipt.hash,
+      };
+      if (opts.json) return console.log(JSON.stringify(payload, null, 2));
+      console.log(`migration registered`);
+      console.log(`  old: ${oldWallet}`);
+      console.log(`  new: ${newWallet}`);
+      console.log(`  note: 10% trust score decay applied on migration`);
+      console.log(`  tx: ${receipt.hash}`);
+    });
+
+  // ─── migrate status <address> ──────────────────────────────────────────────
+
+  migrate
+    .command("status <address>")
+    .description("Show whether a wallet is in a migration lineage and its current active wallet")
+    .option("--json")
+    .action(async (address, opts) => {
+      const config = loadConfig();
+      if (!config.migrationRegistryAddress) {
+        console.error("migrationRegistryAddress not configured. Run `arc402 config set migrationRegistryAddress <address>`.");
+        process.exit(1);
+      }
+
+      const { provider } = await getClient(config);
+      const contract = new ethers.Contract(config.migrationRegistryAddress, MIGRATION_REGISTRY_ABI, provider);
+
+      const [activeWallet, migratedTo, migratedFrom] = await Promise.all([
+        contract.resolveActiveWallet(address),
+        contract.migratedTo(address),
+        contract.migratedFrom(address),
+      ]);
+
+      const isCurrent = activeWallet.toLowerCase() === address.toLowerCase();
+      const hasMigrated = migratedTo !== ethers.ZeroAddress;
+      const wasSource = migratedFrom !== ethers.ZeroAddress;
+
+      const payload = {
+        address,
+        activeWallet,
+        isCurrent,
+        migratedTo: hasMigrated ? migratedTo : null,
+        migratedFrom: wasSource ? migratedFrom : null,
+      };
+      if (opts.json) return console.log(JSON.stringify(payload, null, 2));
+      console.log(`address=${address}`);
+      console.log(`  active wallet: ${activeWallet}`);
+      if (isCurrent) {
+        console.log(`  status: current (no further migration)`);
+      } else {
+        console.log(`  status: migrated — score queries resolve to ${activeWallet}`);
+      }
+      if (hasMigrated) console.log(`  migrated to:   ${migratedTo}`);
+      if (wasSource)   console.log(`  migrated from: ${migratedFrom}`);
+    });
+
+  // ─── migrate lineage <address> ────────────────────────────────────────────
+
+  migrate
+    .command("lineage <address>")
+    .description("Print full migration lineage history with timestamps")
+    .option("--json")
+    .action(async (address, opts) => {
+      const config = loadConfig();
+      if (!config.migrationRegistryAddress) {
+        console.error("migrationRegistryAddress not configured. Run `arc402 config set migrationRegistryAddress <address>`.");
+        process.exit(1);
+      }
+
+      const { provider } = await getClient(config);
+      const contract = new ethers.Contract(config.migrationRegistryAddress, MIGRATION_REGISTRY_ABI, provider);
+
+      const lineage: string[] = await contract.getLineage(address);
+
+      if (lineage.length === 0) {
+        const payload = { address, lineage: [], migrations: 0 };
+        if (opts.json) return console.log(JSON.stringify(payload, null, 2));
+        console.log(`address=${address}`);
+        console.log(`  no migration history`);
+        return;
+      }
+
+      // Fetch MigrationRegistered events for timestamps and decay info
+      interface MigrationEntry { step: number; from: string; to: string; timestamp: string | null; scoreAtMigration: string | null; decayBps: string | null }
+      const entries: MigrationEntry[] = [];
+
+      for (let i = 0; i < lineage.length - 1; i++) {
+        const from = lineage[i];
+        const to = lineage[i + 1];
+        let timestamp: string | null = null;
+        let scoreAtMigration: string | null = null;
+        let decayBps: string | null = null;
+
+        try {
+          const filter = contract.filters.MigrationRegistered(from, to);
+          const events = await contract.queryFilter(filter);
+          if (events.length > 0) {
+            const ev = events[0] as ethers.EventLog;
+            const block = await provider.getBlock(ev.blockNumber);
+            timestamp = block ? new Date(block.timestamp * 1000).toISOString() : null;
+            scoreAtMigration = ev.args[3]?.toString() ?? null;
+            decayBps = ev.args[4]?.toString() ?? null;
+          }
+        } catch {
+          // event query not critical — continue without timestamps
+        }
+
+        entries.push({ step: i + 1, from, to, timestamp, scoreAtMigration, decayBps });
+      }
+
+      const payload = {
+        address,
+        lineage,
+        migrations: entries.length,
+        history: entries,
+      };
+      if (opts.json) return console.log(JSON.stringify(payload, null, 2));
+
+      console.log(`address=${address}`);
+      console.log(`  lineage depth: ${lineage.length} wallet${lineage.length !== 1 ? "s" : ""}`);
+      console.log(`  migrations:    ${entries.length}`);
+      console.log();
+      lineage.forEach((addr, i) => {
+        const label = i === 0 ? " (origin)" : i === lineage.length - 1 ? " (current)" : "";
+        console.log(`  [${i}] ${addr}${label}`);
+        if (i < entries.length) {
+          const e = entries[i];
+          if (e.timestamp) console.log(`      migrated: ${e.timestamp}`);
+          if (e.scoreAtMigration) console.log(`      score at migration: ${e.scoreAtMigration} (decay: ${Number(e.decayBps) / 100}%)`);
+        }
+      });
+    });
+}

package/src/commands/negotiate.ts

@@ -0,0 +1,270 @@
+import { Command } from "commander";
+import { ethers } from "ethers";
+import {
+  createSignedProposal,
+  createSignedCounter,
+  createSignedAccept,
+  createSignedReject,
+  NegotiationGuard,
+  SessionManager,
+} from "@arc402/sdk";
+import { loadConfig } from "../config";
+import { requireSigner, getClient } from "../client";
+import { hashFile, hashString } from "../utils/hash";
+
+const sessionManager = new SessionManager();
+
+export function registerNegotiateCommands(program: Command): void {
+  const negotiate = program
+    .command("negotiate")
+    .description(
+      "Signed agent-to-agent negotiation. Every message is authenticated, " +
+      "sessions are tracked locally, transcripts are hashed and committed on-chain. " +
+      "This is the secure communication layer — not just payload generation."
+    );
+
+  // Session management — nest list/show under a single 'session' subcommand
+  const session = negotiate
+    .command("session")
+    .description("Manage local negotiation sessions");
+
+  session
+    .command("list")
+    .description("List all negotiation sessions")
+    .option("--json", "Machine-parseable output")
+    .action((opts) => {
+      const sessions = sessionManager.list();
+      if (opts.json) {
+        console.log(JSON.stringify(sessions));
+      } else {
+        sessions.forEach(s => {
+          console.log(`${s.sessionId.slice(0, 10)}...  ${s.state.padEnd(10)} ${s.initiator} ↔ ${s.responder}  msgs:${s.messages.length}`);
+        });
+      }
+    });
+
+  session
+    .command("show <sessionId>")
+    .description("Show full session including message history and transcript hash")
+    .option("--json", "Machine-parseable output")
+    .action((sessionId, opts) => {
+      const sess = sessionManager.load(sessionId);
+      if (opts.json) {
+        console.log(JSON.stringify(sess));
+      } else {
+        console.log(`Session: ${sess.sessionId}`);
+        console.log(`State: ${sess.state}`);
+        console.log(`Parties: ${sess.initiator} ↔ ${sess.responder}`);
+        console.log(`Messages: ${sess.messages.length}`);
+        if (sess.transcriptHash) console.log(`Transcript hash: ${sess.transcriptHash}`);
+        if (sess.onChainAgreementId) console.log(`On-chain agreement: ${sess.onChainAgreementId}`);
+        sess.messages.forEach((m, i) => console.log(`  ${i + 1}. ${m.type} from ${m.from.slice(0, 8)}...`));
+      }
+    });
+
+  // Signed propose (starts a new session)
+  negotiate
+    .command("propose")
+    .description("Send a signed PROPOSE. Creates a new negotiation session.")
+    .requiredOption("--to <address>")
+    .requiredOption("--service-type <type>")
+    .requiredOption("--price <amountWei>")
+    .option("--token <token>", "Token address", ethers.ZeroAddress)
+    .requiredOption("--deadline <iso>")
+    .requiredOption("--spec <text>")
+    .option("--spec-file <path>")
+    .option("--expires-in <seconds>", "Proposal TTL in seconds", "3600")
+    .option("--json", "Machine-parseable output")
+    .action(async (opts) => {
+      const config = loadConfig();
+      const { signer } = await requireSigner(config);
+      const myAddress = await signer.getAddress();
+      const specHash = opts.specFile ? hashFile(opts.specFile) : hashString(opts.spec);
+      const now = Math.floor(Date.now() / 1000);
+
+      const session = sessionManager.createSession(myAddress, opts.to);
+
+      const proposal = await createSignedProposal({
+        from: myAddress,
+        to: opts.to,
+        serviceType: opts.serviceType,
+        price: opts.price,
+        token: opts.token,
+        deadline: opts.deadline,
+        spec: opts.spec,
+        specHash,
+        expiresAt: now + parseInt(opts.expiresIn),
+        protocolVersion: "1.0.0",
+      } as Parameters<typeof createSignedProposal>[0], signer);
+
+      sessionManager.addMessage(session.sessionId, proposal);
+
+      if (opts.json) {
+        console.log(JSON.stringify({ sessionId: session.sessionId, message: proposal }));
+      } else {
+        console.log(`Session started: ${session.sessionId}`);
+        console.log(`Signed PROPOSE:`);
+        console.log(JSON.stringify(proposal, null, 2));
+      }
+    });
+
+  // Counter
+  negotiate
+    .command("counter <sessionId>")
+    .description("Send a signed COUNTER within an existing session.")
+    .requiredOption("--justification <text>")
+    .option("--price <amountWei>")
+    .option("--deadline <iso>")
+    .option("--json", "Machine-parseable output")
+    .action(async (sessionId, opts) => {
+      const config = loadConfig();
+      const { signer } = await requireSigner(config);
+      const myAddress = await signer.getAddress();
+      const session = sessionManager.load(sessionId);
+      const lastMessage = session.messages[session.messages.length - 1];
+      const refNonce = "nonce" in lastMessage ? lastMessage.nonce : (lastMessage as any).refNonce;
+
+      const counter = await createSignedCounter({
+        from: myAddress,
+        to: lastMessage.from === myAddress ? lastMessage.to : lastMessage.from,
+        refNonce,
+        justification: opts.justification,
+        price: opts.price,
+        deadline: opts.deadline,
+      }, signer);
+
+      sessionManager.addMessage(sessionId, counter);
+
+      if (opts.json) {
+        console.log(JSON.stringify(counter));
+      } else {
+        console.log(`Signed COUNTER added to session ${sessionId.slice(0, 10)}...`);
+        console.log(JSON.stringify(counter, null, 2));
+      }
+    });
+
+  // Accept — closes session, computes transcript hash
+  negotiate
+    .command("accept <sessionId>")
+    .description("Accept terms. Closes the session and computes transcript hash.")
+    .requiredOption("--price <amountWei>")
+    .requiredOption("--deadline <iso>")
+    .option("--record", "Commit transcript hash on-chain alongside propose()")
+    .option("--json", "Machine-parseable output")
+    .action(async (sessionId, opts) => {
+      const config = loadConfig();
+      const { signer } = await requireSigner(config);
+      const myAddress = await signer.getAddress();
+      const session = sessionManager.load(sessionId);
+      const lastMessage = session.messages[session.messages.length - 1];
+      const refNonce = "nonce" in lastMessage ? lastMessage.nonce : (lastMessage as any).refNonce;
+
+      const accept = await createSignedAccept({
+        from: myAddress,
+        to: lastMessage.from === myAddress ? lastMessage.to : lastMessage.from,
+        refNonce,
+        agreedPrice: opts.price,
+        agreedDeadline: opts.deadline,
+      }, signer);
+
+      sessionManager.addMessage(sessionId, accept);
+      const updatedSession = sessionManager.load(sessionId);
+
+      if (opts.json) {
+        console.log(JSON.stringify({
+          sessionId,
+          transcriptHash: updatedSession.transcriptHash,
+          message: accept,
+        }));
+      } else {
+        console.log(`✓ Session ${sessionId.slice(0, 10)}... ACCEPTED`);
+        console.log(`✓ Transcript hash: ${updatedSession.transcriptHash}`);
+        if (opts.record) {
+          console.log(`\nTranscript hash is ready to commit on-chain.`);
+          console.log(`Run: arc402 hire --session ${sessionId} to propose() and record the transcript hash.`);
+        }
+      }
+    });
+
+  // Reject
+  negotiate
+    .command("reject <sessionId>")
+    .description("Reject and close session.")
+    .requiredOption("--reason <text>")
+    .option("--json", "Machine-parseable output")
+    .action(async (sessionId, opts) => {
+      const config = loadConfig();
+      const { signer } = await requireSigner(config);
+      const myAddress = await signer.getAddress();
+      const session = sessionManager.load(sessionId);
+      const lastMessage = session.messages[session.messages.length - 1];
+      const refNonce = "nonce" in lastMessage ? lastMessage.nonce : (lastMessage as any).refNonce;
+
+      const reject = await createSignedReject({
+        from: myAddress,
+        to: lastMessage.from === myAddress ? lastMessage.to : lastMessage.from,
+        reason: opts.reason,
+        refNonce,
+      }, signer);
+
+      sessionManager.addMessage(sessionId, reject);
+
+      if (opts.json) {
+        console.log(JSON.stringify(reject));
+      } else {
+        console.log(`✗ Session ${sessionId.slice(0, 10)}... REJECTED`);
+        console.log(`Reason: ${opts.reason}`);
+      }
+    });
+
+  // Verify an incoming message
+  negotiate
+    .command("verify")
+    .description("Verify an incoming signed negotiation message against AgentRegistry.")
+    .requiredOption("--message <json>", "Raw JSON string or @file.json")
+    .option("--json", "Machine-parseable output")
+    .action(async (opts) => {
+      const config = loadConfig();
+      if (!config.agentRegistryAddress) throw new Error("agentRegistryAddress not in config");
+      const { provider } = await getClient(config);
+
+      const guard = new NegotiationGuard({ agentRegistryAddress: config.agentRegistryAddress, runner: provider });
+
+      const rawJson = opts.message.startsWith("@")
+        ? require("fs").readFileSync(opts.message.slice(1), "utf8")
+        : opts.message;
+
+      const result = await guard.verify(rawJson);
+
+      if (opts.json) {
+        console.log(JSON.stringify(result));
+      } else if (result.valid) {
+        console.log(`✓ Valid — signer: ${result.recoveredSigner}`);
+      } else {
+        console.error(`✗ Invalid — ${result.error}`);
+        process.exit(1);
+      }
+    });
+
+  // Transcript subcommand
+  const transcript = negotiate.command("transcript").description("Transcript management for closed negotiation sessions");
+
+  transcript
+    .command("show <sessionId>")
+    .description("Show the transcript hash for a completed session")
+    .option("--json", "Machine-parseable output")
+    .action((sessionId, opts) => {
+      const session = sessionManager.load(sessionId);
+      if (!session.transcriptHash) {
+        console.error("Session not yet closed — no transcript hash");
+        process.exit(1);
+      }
+      if (opts.json) {
+        console.log(JSON.stringify({ sessionId, transcriptHash: session.transcriptHash, messageCount: session.messages.length }));
+      } else {
+        console.log(`Transcript hash: ${session.transcriptHash}`);
+        console.log(`Messages: ${session.messages.length}`);
+        console.log(`State: ${session.state}`);
+      }
+    });
+}