atris 3.72.4 → 3.73.0

package/README.md

@@ -343,6 +343,8 @@ atris business record atris/reports/2026-04-12-operator-recap.md --outcome mixed
 | `atris loop` | Refresh wiki health, stale/orphan signals, and next ingest candidates |
 | `atris wiki` | Full wiki namespace: ingest, query, lint, search, log, and loop |
 | `atris receipt` | Save evidence from an agent run |
+| `atris pay` | Pay another Atris account in credits (100 credits = $1); `history`, `show`, `accept`, `cancel` |
+| `atris trust` | See an account's trust and the friends you share; `vouch` or `unvouch` for someone |
 | `atris experiments` | Run small experiments and compare results |
 | `atris computer card` | Show or write the local owner/computer card |
 | `atris release` | Draft or publish a version bump, tag, GitHub release, and launch post |
@@ -367,7 +369,7 @@ atris business record atris/reports/2026-04-12-operator-recap.md --outcome mixed
 - `atris activate` loads the current wiki status so the next session starts with project memory, not just tasks
 - `atris member` keeps team-member identity and learning local-first: `MEMBER.md` is the role contract, `goals.json` is the machine-readable goal/experiment state, `goals.md` is the human readout, and `logs/YYYY-MM-DD.md` records what happened. Use `atris member goal`, `tick`, `status`, `block`, and `review <name> <experiment-id> --accept --proof "..." --value 1..5` to test whether a member is making useful progress or needs the operator/orchestrator.
 - `atris codex-goal` is the read-only bridge for native Codex `/goal`: `status` inspects the live goal database, while the legacy `reset` command now refuses every mutation. Active tasks continue in place; completed tasks retain their final goal, and new work or recurring monitors use a new dedicated Codex task.
-- `atris task` keeps durable local task state and append-only events for agents; `atris/TODO.md` is just a regenerated readable board. Run the loop with `atris task new`, `delegate "..." --to <owner>`, `next`, `say`, and `ready <id> --proof "..."`; human approval is `atris task accept <id>` (moves to Done, awards Career XP) or `revise <id> --note "..."`. Final task transitions also append the general daily log and, when a real `atris/team/<member>/MEMBER.md` matches the task owner, that member's daily log. Add `--json` for headless agents, `atris task serve` for the local board, and `atris task show <ref>` / `events --all` for the full ledger. Commands accept semantic refs (`OBL-18`), full IDs, or any unique prefix. In cloud business workspaces, Supabase `tasks` is the source of truth and Swarlo the live claim layer.
+- `atris task` keeps durable local task state and append-only events for agents; `atris/TODO.md` is just a regenerated readable board. Run the loop with `atris task new`, `delegate "..." --to <owner>`, `next`, `say`, and `ready <id> --proof "..."`; human approval is `atris task accept <id>` (moves to Done, awards Career XP) or `revise <id> --note "..."`. Final task transitions also append the general daily log and, when a real `atris/team/<member>/MEMBER.md` matches the task owner, that member's daily log. Add `--json` for headless agents, `atris task serve` for the local board, and `atris task show <ref>` / `events --all` for the full ledger. The board prints a private link with a fresh token on each run and listens only on 127.0.0.1. Open that full link in the browser; API clients send its token in `x-atris-token` and use `application/json` for changes. Browser changes must come from the board's own origin. Commands accept semantic refs (`OBL-18`), full IDs, or any unique prefix. In cloud business workspaces, Supabase `tasks` is the source of truth and Swarlo the live claim layer.
 - `atris mission` is the durable autonomy layer: start with an owner, verifier, runner, and stop condition; record bounded work with `mission tick`; close with `mission complete` only after proof. Runners include `manual`, `claude`, `atris2`, and `codex_goal`.
 - `atris pulse` is the OS-cron heartbeat for overnight self-improvement. Use `atris pulse status`, `tick`, `run`, `install --cadence "<cron>" --days 7 --verify "npm test" --model claude-opus-5-5`, and `uninstall`.
 - `atris experiments` runs small test packs in `atris/experiments/`

package/atris/skills/commerce/SKILL.md

@@ -9,9 +9,11 @@ tags:
 
 # Commerce: buy or trade through Atris
 
-You can quote and ask. Only the human can pay. Every dollar leaves only after
-the person acts themselves: a tap in their Link app, a payment page they
-fill in, or a text from their own phone.
+You can quote and ask. For anything bought in the real world, only the human
+pays: every dollar leaves only after the person acts themselves, a tap in
+their Link app, a payment page they fill in, or a text from their own phone.
+The one exception is credits moving between Atris accounts (see "Pay another Atris
+account in credits" below), which an agent key with the `pay` scope may send.
 
 ## Get a key
 
@@ -118,3 +120,22 @@ curl -s "$API/transactions?since=2026-09-01&kinds=ticket,shop,trade&limit=50" -H
 Each transaction: `id, kind, when, what, amount_cents, currency, state, counterparty, receipt_url`.
 `sources` says which ledgers loaded; if one says `failed`, the list is partial. Say so.
 The CLI prints that as "Partial list: could not load ...".
+
+## Pay another Atris account in credits
+
+Credits move between Atris accounts, not cards. 100 credits = $1.
+
+```bash
+atris trust @nora                 # trust score, friends you share
+atris pay @nora 500 for the logo  # -> Paid @nora 500 credits ($5.00). Settled.
+atris pay history
+atris pay accept <id>             # take a payment someone sent you
+atris pay cancel <id>             # cancel one that is still waiting
+atris trust vouch @nora           # vouch = follow
+```
+
+- Some payments wait for the receiver to accept. The CLI prints the id; check it with `atris pay show <id>`.
+- Every payment carries a request id, and the CLI retries once with the same id after a dropped connection, so it never pays twice.
+- An agent key needs the `pay` scope to send, accept, or cancel.
+- A refusal (not enough credits, over the daily limit, blocked) prints in plain words. Tell the person; do not retry.
+- Add `--json` for the raw receipt.

package/bin/atris.js

@@ -758,6 +758,8 @@ function showHelpAll() {
   console.log('  topup      - Buy credits and print a Stripe checkout URL');
   console.log('  buy        - Quote a purchase or stock order; the person approves before anything is charged');
   console.log('  transactions - List what you bought, paid in fees, traded, or sent');
+  console.log('  pay        - Pay another Atris account in credits; history, accept, cancel');
+  console.log('  trust      - See an account\'s trust; vouch or unvouch for someone');
   console.log('  hire       - Hire an agent in one step: name, job, inbox, allowance, nightly work loop');
   console.log('  hires      - Morning check-in: one line per hire (mail, spend, last run)');
   console.log('  mail       - Your agents\' own inboxes: list, read, send (not Gmail)');
@@ -3498,6 +3500,14 @@ if (command === 'guide') {
   require('../commands/social').inviteCommand()
     .then(() => process.exit(0))
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'pay') {
+  require('../commands/pay').payCommand()
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'trust') {
+  require('../commands/trust').trustCommand()
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else {
   console.log(`Unknown command: ${command}`);
   console.log('Run "atris help" to see available commands');

package/commands/gm.js

@@ -30,7 +30,7 @@ function showHelp() {
   console.log('       atris gm replay [--since 12h|2d|last-seen] [--speed N] [--plain] [--league]');
   console.log('       atris gm card <member> [--json]  one member\'s profile page');
   console.log('       atris gm target [--landed N] [--max-abandoned N] [--max-stuck N] [--clear]');
-  console.log('       atris gm phone [--port 7777] [--send]  decision cards on your phone');
+  console.log('       atris gm phone [--port 7777] [--send] [--new-link]  decision cards on your phone');
   console.log('       atris gm --json           machine-readable state');
   console.log('       atris gm --watch [--interval 10]');
   console.log('');
@@ -139,6 +139,7 @@ function showHelp() {
   console.log('  --interval <sec>  Watch polling interval. Defaults to 10.');
   console.log('  --port <n>        gm phone port. Defaults to 7777.');
   console.log('  --send            gm phone: text the link to your saved number.');
+  console.log('  --new-link        gm phone: make a new link; the old one stops working.');
   console.log('  --no-seed         Do not create a starter player mission.');
   console.log('  --json            Print machine-readable mode state.');
   console.log('  --help, -h        Show this help.');
@@ -1476,7 +1477,6 @@ function gmTargetCommand(args = []) {
 // Commands started from the phone keep running on their own after that.
 async function gmPhone(args = []) {
   const http = require('http');
-  const crypto = require('crypto');
   const phone = require('../lib/gm-phone');
   const { phonePage } = require('../lib/gm-phone-page');
   const gmTarget = require('../lib/gm-target');
@@ -1493,11 +1493,14 @@ async function gmPhone(args = []) {
   const addresses = [...new Set([lan, '127.0.0.1'].filter(Boolean))];
   // filled in once a port is open; the handler reads it on every request
   const hosts = [];
-  const token = crypto.randomBytes(32).toString('base64url');
   const stateDir = path.join(atrisHome(), 'state');
+  // the same link across restarts, until --new-link
+  const { token, reused } = phone.phoneToken(workspaceRoot, { stateDir, rotate: hasExactFlag(args, '--new-link') });
+  const rotated = hasExactFlag(args, '--new-link');
   const handler = phone.createPhoneHandler({
     workspaceRoot,
-    token,
+    // read on every request, so --new-link kills the old link in every running server
+    token: () => phone.readPhoneToken(workspaceRoot, { stateDir }),
     hosts,
     loadView: () => phone.loadPhoneView(workspaceRoot),
     runStep: phone.makeStepRunner({ cliPath: path.join(__dirname, '..', 'bin', 'atris.js'), cwd: workspaceRoot, logDir: path.join(stateDir, 'gm-phone-runs') }),
@@ -1515,6 +1518,10 @@ async function gmPhone(args = []) {
         log,
         // read the started bets' missions every 25 seconds, read-only
         pollMs: gmBet.JOB_POLL_MS,
+        // ask for the owner's own number, and its value once a week
+        scoreboard: true,
+        // the numbers a question card stands on, when no bet is being made to read them
+        readBundle: () => gmBet.readBundle(workspaceRoot, { ledgerFile: gmBet.ledgerPath(stateDir) }),
         // the roster's reviewer gets up to 16 minutes to read the finished work
         reviewCli: gmBet.makeCliRunner({ cliPath: path.join(__dirname, '..', 'bin', 'atris.js'), cwd: workspaceRoot, timeoutMs: 16 * 60 * 1000 }),
       });
@@ -1525,7 +1532,7 @@ async function gmPhone(args = []) {
     const opened = [];
     try {
       for (const address of addresses) {
-        const server = http.createServer((req, res) => { handler(req, res); });
+        const server = http.createServer((req, res) => { handler(req, res).catch(() => res.destroy()); });
         await new Promise((resolve, reject) => {
           server.once('error', reject);
           server.listen(port, address, resolve);
@@ -1573,7 +1580,9 @@ async function gmPhone(args = []) {
   }
   console.log(`  ${link}`);
   console.log('');
-  console.log('anyone with this link can act for you until you stop it. ctrl-c stops it.');
+  if (rotated) console.log('this is a new link. the old link is dead now, even in a phone page that is still open.');
+  else console.log(reused ? 'this is the same link as last time.' : 'this is a new link.');
+  console.log('anyone with this link can act for you while this runs. ctrl-c stops it. a new link: atris gm phone --new-link');
 
   if (hasExactFlag(args, '--send')) {
     const autoland = require('../lib/autoland');
@@ -1594,6 +1603,8 @@ async function gmPhone(args = []) {
         server.close();
         if (typeof server.closeAllConnections === 'function') server.closeAllConnections();
       }
+      // the idea and question writers stop with the page; missions started from the phone keep going
+      require('../lib/gm-bet').stopWriters();
       const running = handler.actions.filter(a => a.status === 'running').length;
       console.log('');
       console.log(running ? `phone page stopped. ${running} started from the phone still running on their own.` : 'phone page stopped.');

package/commands/member.js

@@ -10725,34 +10725,44 @@ async function memberSteerOrDispatch(...rawArgs) {
 
 async function memberSteerOrDispatchWith({ pullTask = false } = {}, rawArgs = []) {
   if (hasFlag(rawArgs, '--help') || hasFlag(rawArgs, '-h')) {
-    console.log('Usage: atris member steer [member] "<direction>" [--dry-run] [--json]');
+    console.log('Usage: atris member steer [member] [--no-ignite] [--detach] [--dry-run] [--json] [--] "<direction>"');
     console.log('       atris member "<direction>" [--dry-run] [--json]');
     console.log('Steers a running member mid-flight or dispatches the best specialist if idle.');
+    console.log('  --no-ignite  only reach a live run; with nothing running, start nothing and exit 3');
+    console.log('  --detach     when it starts the member, run it in the background and return its pid');
+    console.log('  --           everything after it is the direction, never an option');
     return;
   }
   const root = process.cwd();
-  const asJson = hasFlag(rawArgs, '--json');
-  const dryRun = hasFlag(rawArgs, '--dry-run');
+  // everything after -- is the direction: words a person typed are never options
+  const cut = rawArgs.indexOf('--');
+  const optionArgs = cut >= 0 ? rawArgs.slice(0, cut) : rawArgs;
+  const directionArgs = cut >= 0 ? rawArgs.slice(cut + 1) : [];
+  const asJson = hasFlag(optionArgs, '--json');
+  const dryRun = hasFlag(optionArgs, '--dry-run');
+  const noIgnite = hasFlag(optionArgs, '--no-ignite');
+  const detach = hasFlag(optionArgs, '--detach');
   // Set by `member up`: run only a claimed task with a runnable check, never
   // the member's own goal text.
-  const needsCheck = pullTask && hasFlag(rawArgs, '--needs-check');
+  const needsCheck = pullTask && hasFlag(optionArgs, '--needs-check');
   const valueFlags = new Set(['--engine', '--model', '--verify', '--referee-engine', '--minutes', '--hours', '--max-ticks', '--from']);
   const positionals = [];
   const flagArgs = [];
-  for (let i = 0; i < rawArgs.length; i++) {
-    const token = String(rawArgs[i] || '');
+  for (let i = 0; i < optionArgs.length; i++) {
+    const token = String(optionArgs[i] || '');
     if (!token) continue;
     if (token.startsWith('-')) {
-      if (token === '--needs-check') continue;
+      if (token === '--needs-check' || token === '--no-ignite' || token === '--detach') continue;
       flagArgs.push(token);
-      if (valueFlags.has(token) && i + 1 < rawArgs.length) {
-        flagArgs.push(rawArgs[i + 1]);
+      if (valueFlags.has(token) && i + 1 < optionArgs.length) {
+        flagArgs.push(optionArgs[i + 1]);
         i++;
       }
       continue;
     }
     positionals.push(token);
   }
+  for (const token of directionArgs) if (String(token || '')) positionals.push(String(token));
 
   let targetMember = null;
   let prompt = '';
@@ -10777,6 +10787,26 @@ async function memberSteerOrDispatchWith({ pullTask = false } = {}, rawArgs = []
   const goalPlane = memberGoalPlaneStatus(owner, paths);
   const missionMap = memberRunMissionMap(root);
   const missionSummary = memberMissionSummary(owner, missionMap, root);
+  // --no-ignite only reaches a live run: with nothing running it starts
+  // nothing and touches nothing, and says so
+  if (noIgnite && !missionSummary.live) {
+    const payload = { ok: false, action: 'member_not_running', member: owner };
+    printJsonOrText(payload, [`${owner} is not running, so nothing was sent or started.`], asJson);
+    process.exitCode = 3;
+    return payload;
+  }
+  // --detach answers before the background run starts, so the cheap checks
+  // run here first: a member that cannot run is refused with the plain reason
+  if (detach && !dryRun) {
+    const refusal = memberRefusalFor(targetMember, paths.memberFile)
+      || (resolveMemberEngineSeat(owner, root).engine_id ? '' : `no engine is set for ${owner}`);
+    if (refusal) {
+      const payload = { ok: false, action: 'member_run_not_started', member: owner, reason: refusal };
+      printJsonOrText(payload, [`${owner} did not start: ${refusal}`], asJson);
+      process.exitCode = 1;
+      return payload;
+    }
+  }
   // A human or odd-typed member never takes a task: it would be claimed and
   // then stranded when the run refuses the member.
   const pulled = pullTask && !prompt && !missionSummary.live_mission && !memberRefusalFor(targetMember, paths.memberFile)
@@ -10856,6 +10886,26 @@ async function memberSteerOrDispatchWith({ pullTask = false } = {}, rawArgs = []
     return payload;
   }
 
+  // --detach: the same steer runs in the background, so a caller with a
+  // short timeout gets started or not-started at once
+  if (detach && !dryRun) {
+    const { spawn } = require('child_process');
+    const childArgs = [...optionArgs.filter(a => a !== '--detach' && a !== '--json'), ...(cut >= 0 ? ['--', ...directionArgs] : [])];
+    let child;
+    try {
+      child = spawn(process.execPath, [process.argv[1], 'member', 'steer', ...childArgs], { cwd: root, detached: true, stdio: 'ignore', env: { ...process.env, ATRIS_SKIP_UPDATE_CHECK: '1' } });
+      child.unref();
+    } catch (error) {
+      const payload = { ok: false, action: 'member_run_not_started', member: owner, error: String(error.message || error) };
+      printJsonOrText(payload, [`${owner} did not start: ${payload.error}`], asJson);
+      process.exitCode = 1;
+      return payload;
+    }
+    const payload = { ok: true, action: 'member_run_detached', member: owner, pid: child.pid };
+    printJsonOrText(payload, [`${owner} started in the background (pid ${child.pid}).`], asJson);
+    return payload;
+  }
+
   const command = `atris member run ${owner} ${JSON.stringify(effectivePrompt)} --engine ${engineSeat.engine_id} --ignite`;
   if (dryRun) {
     const payload = {

package/commands/pay.js

@@ -0,0 +1,329 @@
+/**
+ * Pay commands for Atris CLI, send credits to another Atris account.
+ *
+ * Usage:
+ *   atris pay <to> <amount> [memo...]   Pay someone in credits (100 credits = $1)
+ *   atris pay history                   Your payments, newest first
+ *   atris pay show <id>                 One payment
+ *   atris pay accept <id>               Accept a payment someone sent you
+ *   atris pay cancel <id>               Cancel a payment that is still waiting
+ *
+ * <to> can be @handle, handle, a user id, or an email. A leading @ is
+ * stripped before it is sent. Every payment carries a request_id, so the one
+ * retry after a network error can never pay twice.
+ *
+ * Backend: POST /api/pay, GET /api/pay/history, GET /api/pay/{id},
+ * POST /api/pay/{id}/accept, POST /api/pay/{id}/cancel.
+ */
+
+const { randomUUID } = require('crypto');
+const { loadCredentials } = require('../utils/auth');
+const { apiRequestJson } = require('../utils/api');
+const { isHelpToken, argsWantHelp } = require('../lib/noninteractive');
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SUBCOMMANDS = new Set(['history', 'show', 'accept', 'cancel']);
+// Status 0 is a dropped connection; 502 and 504 mean a gateway lost the reply.
+// In all three the payment may or may not have landed, so retry once with the
+// same request_id and let the server dedupe.
+const RETRY_STATUS = new Set([0, 502, 504]);
+
+// Plain words for each error code, used when the server sends no message.
+const ERROR_TEXT = {
+  insufficient_credits: 'You do not have enough credits for this payment.',
+  over_payment_cap: 'That is more than one payment can be.',
+  over_daily_cap: 'You hit your daily payment limit. Try again tomorrow.',
+  blocked: 'You cannot pay this account.',
+  self_payment: 'You cannot pay yourself.',
+  payment_not_found: 'No payment with that id.',
+  not_pending: 'That payment is no longer waiting.',
+  already_settled: 'That payment already went through.',
+  request_id_reused: 'That request id was already used for a different payment.',
+  expired: 'That payment expired.',
+  payments_unavailable: 'Payments are down right now. Try again in a minute.',
+  ledger_unavailable: 'Payments are down right now. Try again in a minute.',
+  scope_required: 'This key cannot make payments.',
+  invalid_amount: 'The amount must be a whole number of credits above 0.',
+};
+
+const HINTS = {
+  insufficient_credits: 'Check your credits: atris balance · Buy more: atris topup',
+};
+
+function getToken() {
+  const creds = loadCredentials();
+  if (!creds || !creds.token) return null;
+  return creds.token;
+}
+
+function errorCode(res) {
+  const detail = res && res.data && res.data.detail;
+  if (detail && typeof detail === 'object') return detail.code || detail.error || null;
+  return null;
+}
+
+function apiErrorMessage(res, fallback) {
+  const data = res && res.data;
+  const detail = data && (data.detail || data.error);
+  if (typeof detail === 'string') return detail;
+  const code = errorCode(res);
+  if (detail && typeof detail.message === 'string' && detail.message) return detail.message;
+  if (detail && detail.error && typeof detail.error === 'object' && detail.error.message) return detail.error.message;
+  if (code && ERROR_TEXT[code]) return ERROR_TEXT[code];
+  if (res && res.status === 0) return 'Could not reach Atris. Check your connection and try again.';
+  return fallback;
+}
+
+function formatCredits(amount) {
+  const n = Number(amount) || 0;
+  return `${n} credits ($${(n / 100).toFixed(2)})`;
+}
+
+// "@nora" -> "nora". Emails and ids pass through untouched.
+function cleanTarget(raw) {
+  return String(raw == null ? '' : raw).trim().replace(/^@+/, '');
+}
+
+function targetLabel(raw) {
+  const clean = cleanTarget(raw);
+  if (!clean) return '';
+  if (clean.includes('@') || UUID_RE.test(clean)) return clean;
+  return `@${clean}`;
+}
+
+function parseAmount(raw) {
+  const s = String(raw == null ? '' : raw).trim();
+  if (!/^\d{1,9}$/.test(s)) return null;
+  const n = parseInt(s, 10);
+  return n > 0 ? n : null;
+}
+
+function whenText(value) {
+  const s = String(value || '');
+  const m = s.match(/^(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2})/);
+  return m ? `${m[1]} ${m[2]}` : s;
+}
+
+function splitFlags(args) {
+  const list = Array.isArray(args) ? args : [];
+  return {
+    json: list.includes('--json'),
+    rest: list.filter((a) => a !== '--json'),
+  };
+}
+
+function createIo(io = {}) {
+  return {
+    request: io.request || apiRequestJson,
+    token: io.token !== undefined ? io.token : undefined,
+    log: io.log || console.log,
+    error: io.error || console.error,
+    newId: io.newId || randomUUID,
+  };
+}
+
+async function call(io, pathname, options = {}) {
+  const token = io.token !== undefined ? io.token : getToken();
+  if (!token) {
+    return { ok: false, status: 401, data: null, notLoggedIn: true };
+  }
+  return io.request(pathname, { ...options, token });
+}
+
+// Print the error in plain words and return the exit code.
+function reportError(io, res, fallback) {
+  if (res && res.notLoggedIn) {
+    io.error('Not logged in. Run: atris login');
+    return 1;
+  }
+  if (res && res.status === 401) {
+    io.error('Session expired. Run: atris login');
+    return 1;
+  }
+  io.error(apiErrorMessage(res, fallback));
+  const hint = HINTS[errorCode(res)];
+  if (hint) io.error(hint);
+  return 1;
+}
+
+function receiptLine(receipt, label) {
+  const r = receipt || {};
+  const amount = formatCredits(r.amount_credits);
+  const who = label || r.to || 'them';
+  switch (r.status) {
+    case 'settled':
+      return `Paid ${who} ${amount}. Settled.`;
+    case 'settling':
+      return `Paid ${who} ${amount}. Settling, it finishes on its own.`;
+    case 'pending':
+      return `Sent ${who} ${amount}. Waiting for them to accept. id ${r.id}`;
+    case 'refunded':
+      return `Payment to ${who} of ${amount} was refunded. id ${r.id}`;
+    case 'failed':
+      return `Payment to ${who} of ${amount} failed. id ${r.id}`;
+    default:
+      return `Payment to ${who} of ${amount}: ${r.status || 'unknown'}. id ${r.id}`;
+  }
+}
+
+async function send(io, args, json) {
+  const [rawTo, rawAmount, ...memoParts] = args;
+  const to = cleanTarget(rawTo);
+  if (!to || rawAmount === undefined) {
+    io.error('Usage: atris pay <to> <amount> [memo]');
+    return 2;
+  }
+  const amount = parseAmount(rawAmount);
+  if (amount === null) {
+    io.error(`"${rawAmount}" is not an amount. Use a whole number of credits (100 credits = $1).`);
+    io.error('Example: atris pay @nora 500 for the logo');
+    return 2;
+  }
+  const memo = memoParts.join(' ').trim();
+  const body = { to, amount_credits: amount, request_id: io.newId() };
+  if (memo) body.memo = memo;
+
+  // The API helper's own retry is off so this one retry is the only one, and
+  // it carries the same request_id.
+  const options = { method: 'POST', body, retries: 0 };
+  let res = await call(io, '/pay', options);
+  if (!res.notLoggedIn && RETRY_STATUS.has(res.status)) {
+    res = await call(io, '/pay', options);
+  }
+  if (!res.ok) return reportError(io, res, `Payment failed (${res.status})`);
+  const receipt = res.data || {};
+  if (json) {
+    io.log(JSON.stringify(receipt, null, 2));
+  } else {
+    io.log(receiptLine(receipt, targetLabel(rawTo)));
+  }
+  return receipt.status === 'failed' ? 1 : 0;
+}
+
+function historyRows(data) {
+  if (Array.isArray(data)) return data;
+  if (data && Array.isArray(data.payments)) return data.payments;
+  return [];
+}
+
+async function history(io, json) {
+  const res = await call(io, '/pay/history');
+  if (!res.ok) return reportError(io, res, `Could not load payments (${res.status})`);
+  const rows = historyRows(res.data);
+  if (json) {
+    io.log(JSON.stringify(rows, null, 2));
+    return 0;
+  }
+  if (rows.length === 0) {
+    io.log('No payments yet. Pay someone: atris pay @handle 500');
+    return 0;
+  }
+  io.log(`Payments (${rows.length}):`);
+  for (const r of rows) {
+    const incoming = r.direction === 'in';
+    const verb = incoming ? 'got' : 'sent';
+    const who = incoming ? `from ${r.from}` : `to ${r.to}`;
+    const memo = r.memo ? `  "${r.memo}"` : '';
+    io.log(`  ${whenText(r.created_at)}  ${verb} ${formatCredits(r.amount_credits)} ${who}  ${r.status}${memo}`);
+    io.log(`      id ${r.id}`);
+  }
+  return 0;
+}
+
+function printReceipt(io, r) {
+  io.log(`Payment ${r.id}`);
+  io.log(`  Status   ${r.status}`);
+  io.log(`  Amount   ${formatCredits(r.amount_credits)}`);
+  io.log(`  From     ${r.from}`);
+  io.log(`  To       ${r.to}`);
+  if (r.memo) io.log(`  Memo     ${r.memo}`);
+  if (r.created_at) io.log(`  Made     ${whenText(r.created_at)}`);
+  if (r.settled_at) io.log(`  Settled  ${whenText(r.settled_at)}`);
+  if (r.expires_at) io.log(`  Expires  ${whenText(r.expires_at)}`);
+}
+
+async function show(io, id, json) {
+  if (!id || isHelpToken(id)) {
+    io.error('Usage: atris pay show <id>');
+    return 2;
+  }
+  const res = await call(io, `/pay/${encodeURIComponent(id)}`);
+  if (!res.ok) return reportError(io, res, `Could not load that payment (${res.status})`);
+  const receipt = res.data || {};
+  if (json) io.log(JSON.stringify(receipt, null, 2));
+  else printReceipt(io, receipt);
+  return 0;
+}
+
+async function act(io, action, id, json) {
+  if (!id || isHelpToken(id)) {
+    io.error(`Usage: atris pay ${action} <id>`);
+    return 2;
+  }
+  const res = await call(io, `/pay/${encodeURIComponent(id)}/${action}`, { method: 'POST', retries: 0 });
+  if (!res.ok) return reportError(io, res, `Could not ${action} that payment (${res.status})`);
+  const r = res.data || {};
+  if (json) {
+    io.log(JSON.stringify(r, null, 2));
+    return 0;
+  }
+  const amount = formatCredits(r.amount_credits);
+  if (action === 'accept') {
+    io.log(r.status === 'settled' || r.status === 'settling'
+      ? `Accepted. ${amount} ${r.status === 'settling' ? 'are on the way' : 'are yours'}.`
+      : `Payment ${r.id} is ${r.status}.`);
+  } else {
+    io.log(r.status === 'refunded'
+      ? `Canceled. ${amount} went back to the sender.`
+      : `Payment ${r.id} is ${r.status}.`);
+  }
+  return 0;
+}
+
+function printHelp(log = console.log) {
+  log(`atris pay, send credits to another Atris account (100 credits = $1)
+
+  atris pay <to> <amount> [memo]   Pay someone, like: atris pay @nora 500 for the logo
+  atris pay history                Your payments, newest first
+  atris pay show <id>              One payment
+  atris pay accept <id>            Take a payment someone sent you
+  atris pay cancel <id>            Cancel a payment that is still waiting
+
+  <to> is @handle, a user id, or an email.
+  Some payments wait for the other person to accept. You get an id to check on it.
+  Add --json for the raw receipt.
+  See who you trust first: atris trust <handle>`);
+}
+
+async function payCommand(argv, ioOverrides) {
+  const io = createIo(ioOverrides);
+  const { json, rest } = splitFlags(argv || process.argv.slice(3));
+  const sub = rest[0];
+  if (sub === undefined || isHelpToken(sub)) {
+    printHelp(sub === undefined ? io.error : io.log);
+    return sub === undefined ? 2 : 0;
+  }
+  if (argsWantHelp(rest)) {
+    printHelp(io.log);
+    return 0;
+  }
+  // Subcommand words always win, so a typo never sends money. To pay someone
+  // whose handle is one of these words, write it with the @: atris pay @history 500.
+  if (SUBCOMMANDS.has(sub)) {
+    if (sub === 'history') return history(io, json);
+    if (sub === 'show') return show(io, rest[1], json);
+    return act(io, sub, rest[1], json);
+  }
+  return send(io, rest, json);
+}
+
+module.exports = {
+  payCommand,
+  apiErrorMessage,
+  formatCredits,
+  cleanTarget,
+  targetLabel,
+  createIo,
+  call,
+  reportError,
+};