brainchain-worker 0.18.3 → 0.19.0

package/dist/chain.js

@@ -1,5 +1,5 @@
 import { isIP } from "node:net";
-import { BaseError, ContractFunctionRevertedError, createPublicClient, createWalletClient, encodeFunctionData, http, HttpRequestError, InsufficientFundsError, keccak256, parseAbi, parseEventLogs, RpcRequestError, TimeoutError, toBytes, WaitForTransactionReceiptTimeoutError, } from "viem";
+import { BaseError, ContractFunctionRevertedError, createPublicClient, createWalletClient, encodeAbiParameters, encodeFunctionData, http, HttpRequestError, InsufficientFundsError, keccak256, parseAbi, parseEventLogs, RpcRequestError, slice, TimeoutError, toBytes, WaitForTransactionReceiptTimeoutError, } from "viem";
 import { erc20Errors, taskBoardAbi, transferErrors, workerStakingAbi } from "./abi.js";
 import { chainOf, parentChainOf } from "./network.js";
 import { memoryStore } from "./state.js";
@@ -18,8 +18,10 @@ export const bondsAbi = [
         "event Proposed(uint256 indexed id, address indexed proposer, address indexed target, bytes data, uint128 bond, string uri)",
         "event Settled(uint256 indexed id, uint256 indexed decisionId, bool adopted)",
         "function propose(address target, bytes data, string uri) returns (uint256)",
-        "function get(uint256 id) view returns ((address proposer, uint128 bond, uint64 createdAt, uint8 state, bytes32 subject))",
+        "function get(uint256 id) view returns ((address proposer, uint128 bond, uint64 createdAt, uint8 state, bytes32 subject, uint64 deadline, uint16 thresholdBps))",
         "function bond() view returns (uint128)",
+        "function openProposal(bytes32 subject) view returns (uint256)",
+        "error AlreadyProposed(uint256 id)",
     ]),
     ...erc20Errors,
     ...transferErrors,
@@ -28,6 +30,9 @@ export const executorAbi = parseAbi([
     "event Queued(uint256 indexed changeId, uint256 indexed decisionId, address indexed target, bytes data, uint64 eta)",
     "function getChange(uint256 changeId) view returns ((address target, bytes data, uint64 eta, bool executed, bool vetoed))",
     "function timelock() view returns (uint64)",
+    "function changeSubject(address target, bytes data) view returns (bytes32)",
+    "function vetoed(address target, bytes4 selector) view returns (bool)",
+    "function vetoedCall(bytes32) view returns (bool)",
 ]);
 /** The appeal terms of a task on set 3.5.0 and later; earlier boards have no appeals and no Ruled or Appealed status. */
 export const appealAbi = parseAbi([
@@ -59,6 +64,25 @@ export function workerId(account) {
 export function applicationData(account) {
     return encodeFunctionData({ abi: taskBoardAbi, functionName: "setWorkerAllowed", args: [account, true] });
 }
+/** Whether the guardian's veto shuts a call. A set 3.4.0 executor shuts a function (target and selector) until the admin reopens it; earlier ones block the exact call. */
+export async function callVetoed(client, executor, target, data) {
+    try {
+        return await client.readContract({ address: executor, abi: executorAbi, functionName: "vetoed", args: [target, slice(data, 0, 4)] });
+    }
+    catch {
+        return client.readContract({
+            address: executor,
+            abi: executorAbi,
+            functionName: "vetoedCall",
+            args: [keccak256(encodeAbiParameters([{ type: "address" }, { type: "bytes" }], [target, data]))],
+        });
+    }
+}
+/** The open proposal for this exact call, from any wallet, or 0n: the bond contract takes one at a time. */
+export async function openProposalOf(client, network, target, data) {
+    const subject = await client.readContract({ address: network.contracts.executor, abi: executorAbi, functionName: "changeSubject", args: [target, data] });
+    return client.readContract({ address: network.contracts.bonds, abi: bondsAbi, functionName: "openProposal", args: [subject] });
+}
 /** The contract error a call reverted with, when the ABI knows it. */
 function revertOf(error) {
     const revert = error instanceof BaseError ? error.walk((e) => e instanceof ContractFunctionRevertedError) : null;
@@ -119,6 +143,7 @@ function excerpt(details, url) {
     for (const part of secretParts(url))
         line = line.replaceAll(part, "…");
     line = line
+        .replace(/\b(Basic|Bearer)\s+[\w+/=.~-]+/gi, "$1 …")
         .replace(/\s+/g, " ")
         .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
         .trim();
@@ -151,6 +176,19 @@ async function checkReply(response, url) {
     if (!(Array.isArray(value) ? value.every(isReply) : isReply(value)))
         throw new NotRpcError(excerpt(text, url));
 }
+/**
+ * Whether BRAINCHAIN_RPC_URL holds anything but a host. viem leaves a URL's user
+ * and password out of what it reports, so they cannot be masked once an answer
+ * echoes them, and an echo can take any form: with such a URL, no answer's text
+ * is printed.
+ */
+function rpcHoldsSecret() {
+    const value = process.env.BRAINCHAIN_RPC_URL?.trim();
+    if (!value || !URL.canParse(value))
+        return false;
+    const { username, password, pathname, search } = new URL(value);
+    return Boolean(username || password || search || pathname.length > 1);
+}
 /** A request that failed, named by the RPC's host and the status it answered with. */
 function requestFailure(request) {
     const host = hostOf(request.url);
@@ -166,7 +204,14 @@ function requestFailure(request) {
     // A proxy or CDN in front of the RPC answers an outage or a rate limit with its own page.
     if (details.startsWith("<"))
         return `${host} answered ${status} with a web page${status === 404 || status === 405 ? ", not as an RPC" : ""}`;
-    return `${host} answered ${status}${details ? ` (${details})` : ""}`;
+    return `${host} answered ${status}${details && !rpcHoldsSecret() ? ` (${details})` : ""}`;
+}
+/** A JSON-RPC error, in the RPC's own words: viem's line for an error code is generic and can send the reader after the wrong thing. */
+function rpcRefusal(answer) {
+    const host = hostOf(answer.url);
+    if (rpcHoldsSecret())
+        return `${host} refused the request (JSON-RPC error ${answer.code})`;
+    return `${host} refused the request: ${excerpt(answer.details, answer.url)}`;
 }
 const SHORT_OF_GAS = "The wallet holds too little ETH to pay for this transaction's gas, so it was not sent. `brainchain-worker status` shows what it holds";
 /** Whether a send failed because the wallet cannot cover its gas: the RPC's gas estimate says so as a revert, and the send itself as insufficient funds. */
@@ -199,6 +244,7 @@ const PLAIN = {
     ERC20InsufficientAllowance: "the wallet has not approved enough of the token for the contract to take",
     ERC20InsufficientBalance: "the wallet holds too little of the token",
     Locked: "the stake is still locked",
+    AlreadyProposed: "that exact call already has an open proposal, and the contract takes one at a time",
 };
 /** One readable line for an error. It names the RPC by host only: its URL can hold an API key. */
 export function reason(error) {
@@ -211,8 +257,11 @@ export function reason(error) {
     if (request instanceof HttpRequestError || request instanceof RpcRequestError || request instanceof TimeoutError)
         return requestFailure(request);
     const name = revertOf(error)?.errorName;
-    if (name === undefined)
-        return error.shortMessage;
+    if (name === undefined) {
+        const answer = error.walk((e) => e instanceof RpcRequestError);
+        const reverted = error.walk((e) => e instanceof ContractFunctionRevertedError) instanceof ContractFunctionRevertedError;
+        return answer instanceof RpcRequestError && !reverted ? rpcRefusal(answer) : error.shortMessage;
+    }
     const plain = Object.hasOwn(PLAIN, name) ? PLAIN[name] : undefined;
     return plain ? `${error.shortMessage.replace(/\.$/, "")}: ${plain} (${name})` : `${error.shortMessage} (${name})`;
 }
@@ -389,8 +438,14 @@ export function createChain(network, account, store = memoryStore()) {
         },
         stakeTokens: (amount, price) => send({ address: staking, abi: workerStakingAbi, functionName: "stake", args: [amount, price] }),
         setPrice: (price) => send({ address: staking, abi: workerStakingAbi, functionName: "setPrice", args: [price] }),
-        requestUnstake: (amount) => send({ address: staking, abi: workerStakingAbi, functionName: "requestUnstake", args: [amount] }),
-        withdraw: () => send({ address: staking, abi: workerStakingAbi, functionName: "withdraw" }),
+        requestUnstake: (amount, at = staking) => send({ address: at, abi: workerStakingAbi, functionName: "requestUnstake", args: [amount] }),
+        withdraw: (at = staking) => send({ address: at, abi: workerStakingAbi, functionName: "withdraw" }),
+        /** Stake left on earlier sets' contracts, which this set's reads do not see. */
+        async retiredStakes() {
+            const sets = network.retired ?? [];
+            const stakes = await Promise.all(sets.map((s) => client.readContract({ address: s.staking, abi: workerStakingAbi, functionName: "get", args: [account.address] })));
+            return sets.flatMap((s, i) => (stakes[i].staked > 0n || stakes[i].unstaking > 0n ? [{ ...s, w: stakes[i] }] : []));
+        },
         /**
          * Whether this wallet owns the ERC-8004 agent `agentId` on the parent chain or is
          * its registered wallet; undefined when the registry could not be read.
@@ -409,6 +464,10 @@ export function createChain(network, account, store = memoryStore()) {
             }
         },
         apply: (profileURI) => send({ address: bonds, abi: bondsAbi, functionName: "propose", args: [taskBoard, applicationData(account.address), profileURI] }),
+        /** Whether the guardian's veto shuts allowing a worker, which is what an application asks for. */
+        applicationVetoed: () => callVetoed(client, executor, taskBoard, applicationData(account.address)),
+        /** An open proposal to allow this worker, from any wallet, or 0n. */
+        openApplication: () => openProposalOf(client, network, taskBoard, applicationData(account.address)),
         /**
          * This worker's applications, newest last, with their state and the
          * decision that settled each, and the last change any of them queued.

package/dist/cli.js

@@ -8,7 +8,7 @@ import { brainchainTransport, createChain, faucetReopens, reason, requireChainId
 import { bond, bondClaim, bondStatus, createBondChain } from "./bond.js";
 import { assetOf, bridge, createBridgeChain } from "./bridge.js";
 import { createExitChain, exit as exitToParent } from "./exit.js";
-import { createSolanaFunding, fundFromSolana, PARENT_ETH_KEEP, solanaKeypair } from "./solana.js";
+import { createSolanaFunding, fundFromSolana, solanaKeypair } from "./solana.js";
 import { claim, createIncome } from "./claim.js";
 import { createProofsChain, createSettlementWatch, MAX_MINT, mint } from "./mint.js";
 import { chainOf, resolveNetwork } from "./network.js";
@@ -18,7 +18,7 @@ import { openStore, readWatched, writeWatched } from "./state.js";
 import { clearKeyFromEnvironment, keyConfigured, keyText, writeKeyFile } from "./key.js";
 import { createCreditChain, credit } from "./credit.js";
 import { appeal, createDisputeChain, dispute } from "./dispute.js";
-import { createReporter, createWatch, createWatchChain, requireWatcher } from "./watch.js";
+import { createReporter, createWatch, createWatchChain, outcome, requireWatcher } from "./watch.js";
 import { createWork, firstProgram, npxUnderSupervisor, programFound, shellCommand, stopLeftover, stopper, unseen, watchStarter } from "./work.js";
 /** How many of the latest decisions a first watch --once checks. */
 const FIRST_RUN_DECISIONS = 10n;
@@ -46,9 +46,13 @@ const COMMAND_USAGE = {
                                             place of the key.`,
     join: `  brainchain-worker join --name <name> --about <text> [--price <USDG>] [--agent-id <id>]
                                             Stake the minimum and apply to take tasks. The name is at
-                                            most 60 characters, the description at most 500. --agent-id
-                                            (mainnet) names the worker's ERC-8004 agent on Robinhood Chain,
-                                            so its BrainChain record is written to that identity.`,
+                                            most 60 characters and the description at most 500, counted
+                                            as UTF-16 units: two or more for an emoji. A worker that is
+                                            allowed or has an application waiting needs neither, and join
+                                            says so if given them: it stakes back up to the minimum.
+                                            --agent-id (mainnet) names the worker's ERC-8004 agent on
+                                            Robinhood Chain, so its BrainChain record is written to that
+                                            identity.`,
     run: `  brainchain-worker run --exec "<command>" [--format prompt|json] [--timeout <minutes>] [--once] [--mint]
                                             Do every task Jev hires the worker for: the command reads the
                                             task on stdin and prints the deliverable on stdout, within
@@ -60,32 +64,49 @@ const COMMAND_USAGE = {
     price: `  brainchain-worker price <USDG>            Change your asking price per task.`,
     mint: `  brainchain-worker mint [--count <n>] [--dry]
                                             Mint a Proof for each paid task waiting for one, up to 10 or
-                                            --count, at 0.001 WETH each on Robinhood Chain. --dry sends nothing.`,
+                                            --count, at 0.001 WETH each on Robinhood Chain. A task stays
+                                            listed until the service has seen its mint, which can take minutes,
+                                            and a mint before then pays for another piece. --dry lists them and
+                                            sends nothing.`,
     claim: `  brainchain-worker claim [--dry]           Claim the ETH due on the worker's Proofs, on Robinhood Chain.
                                             --dry lists what is due and sends nothing.`,
     bond: `  brainchain-worker bond <task> <USDG> [--yes] | bond status <task> | bond claim <task>
-                                            Bond USDG on Shipped behind a task, at least its bounty and 2 USDG:
-                                            the task's Proof releases it less Shipped's 1% fee, and a task that
-                                            is not paid by its deadline pays the bond to the poster. Shows the
-                                            cost and asks before sending; --yes sends without asking. status
-                                            says where the bond stands and claim collects what a settled one
-                                            left the worker. Mainnet.`,
+                                            Bond USDG on Shipped behind a task Jev hired this worker for, at
+                                            least its bounty and 2 USDG. If the task is paid and its Proof
+                                            recorded by the bond's deadline, the task's plus 48 hours, the bond
+                                            comes back less Shipped's 1% fee; if not, it goes to the agent that
+                                            paid BrainChain's desk for the task, or to the poster for a task
+                                            posted on the board directly. Shows the cost and asks before
+                                            sending; --yes sends without asking. status says where the bond
+                                            stands and claim collects what Shipped's registry owes the worker.
+                                            Mainnet.`,
     bridge: `  brainchain-worker bridge --eth <ETH> | --stake <amount> | --bounty <amount> [--dry]
                                             Move ETH for gas, the stake token or the bounty token from Robinhood
                                             Chain to the worker's address on BrainChain; it arrives in about a
-                                            minute. --eth works on both networks, the tokens on mainnet. --dry
-                                            checks the balances and sends nothing.`,
+                                            minute. It takes one of the three at a time. --eth works on both
+                                            networks, the tokens on mainnet. --dry checks the balances and sends
+                                            nothing.`,
     exit: `  brainchain-worker exit [--amount <USDG>] [--to-solana <address>] [--dry]
-                                            Get the worker's USDG on BrainChain back within a minute, not the
-                                            bridge's seven days: the desk pays it on Robinhood Chain less a 0.5%
-                                            fee, or as USDC on Solana with --to-solana (mainnet). Without --amount,
-                                            the whole balance. --dry checks and sends nothing.`,
+                                            On testnet, get the worker's tUSDG on BrainChain back, usually within
+                                            a minute, not the bridge's seven days: the desk pays it on Robinhood
+                                            Chain testnet less a 0.5% fee, at least 0.01 tUSDG. Without --amount,
+                                            the whole balance. --dry checks and sends nothing. Fast exits are off
+                                            on mainnet, where exit says so and sends nothing. --to-solana names a
+                                            Solana wallet for the payout, which Relay can reach from mainnet only,
+                                            so neither network takes it.`,
     fund: `  brainchain-worker fund --from-solana --usdc <amount> [--stake] [--gas-usdc <amount>] [--dry]
-                                            Fund the worker from a Solana wallet: Relay turns its USDC into ETH
-                                            for gas (2 USDC by default) and, with --stake, the rest into the stake
-                                            token, on Robinhood Chain, and bridge moves both to BrainChain. Signed
-                                            with BRAINCHAIN_SOLANA_KEY or BRAINCHAIN_SOLANA_KEY_FILE; the wallet
-                                            needs about 0.002 SOL for fees. Mainnet.`,
+                                            Fund the worker from a Solana wallet. Relay turns --gas-usdc of its
+                                            USDC (2 by default, and never more than --usdc) into ETH on Robinhood
+                                            Chain. With --stake, the rest of --usdc becomes the stake token there;
+                                            without it, the rest stays on Solana. Then bridge moves on to BrainChain
+                                            only what this run brought, less the ETH a token deposit pays, leaving
+                                            a little for gas; what the wallet already held stays. A quote that would
+                                            cost more than 3% on the ETH or 5% on the stake token (or 0.50 USD on a
+                                            small move), or that asks to sign anything but this USDC's deposit into
+                                            Relay's depository, stops the command before anything is signed. Signed
+                                            with BRAINCHAIN_SOLANA_KEY or BRAINCHAIN_SOLANA_KEY_FILE, one or the
+                                            other; the wallet needs about 0.002 SOL for fees. --dry checks and sends
+                                            nothing. Mainnet.`,
     propose: `  brainchain-worker propose --target board|executor|registry --call <function> --args '<JSON array>'
                             --title <text> --rationale <text> [--current <text>] [--proposed <text>] [--dry]
                                             Bond the stake token and propose a change to BrainChain for Jev to
@@ -94,13 +115,18 @@ const COMMAND_USAGE = {
     proposal: `  brainchain-worker proposal <id>           Where a proposal stands: waiting, adopted and when it runs, or kept.`,
     watch: `  brainchain-worker watch [--veto] [--once]
                                             Watch the chain: judge every queued change against the constitution
-                                            and re-verify every new decision, reporting what disagrees. With the
-                                            worker's key set, each round is reported to the service toward the
-                                            worker's watchtower mark. --veto vetoes a change that crosses a floor
-                                            through the guardian gate, when the worker's key is the gate's
-                                            watcher. --once reads one round, checks the decisions added since
-                                            the last --once (the latest 10 on the first) and exits 1 on a finding
-                                            or a decision it could not check.`,
+                                            and re-verify every new decision, reporting what disagrees. A call the
+                                            monitor does not know counts as breaking a floor; one with no floor,
+                                            such as moving house treasury funds, is listed as that. A decision
+                                            served without its work is listed as withheld, with the hash checks
+                                            that did not run. A record that cannot be read holds the place until a
+                                            day after its decision's block time; past that it is a finding, reported
+                                            once, and the place moves on. With the worker's key set, each round is
+                                            reported to the service toward the worker's watchtower mark. --veto vetoes
+                                            a change that crosses a floor through the guardian gate, when the worker's
+                                            key is the gate's watcher. --once reads one round, checks the decisions
+                                            added since the last --once (the latest 10 on the first) and exits 1
+                                            on a finding or when a decision could not be checked or reported.`,
     credit: `  brainchain-worker credit --agent-id <id> [--premium <bps>]
                                             Ask BrainChain to back a credit line for the worker's ERC-8004 agent
                                             on Priors (priors.trade): signs Priors' consent with the agent owner's
@@ -111,9 +137,9 @@ const COMMAND_USAGE = {
                                             window. Jev rules on it; a confident ruling decides.`,
     appeal: `  brainchain-worker appeal <task>           Appeal the ruling on a task, when it went against the worker, within the
                                             appeal window, with the bond the task's terms fix (a quarter of the
-                                            bounty), claimed from the test USDG faucet when the wallet holds less.
-                                            Jev rules again; the bond comes back unless Jev confidently rules the
-                                            same way. Testnet only for now.`,
+                                            bounty); on testnet it is claimed from the test USDG faucet when the
+                                            wallet holds less. Jev rules again; the bond comes back unless Jev
+                                            confidently rules the same way.`,
     leave: `  brainchain-worker leave                   Start unstaking (3-day cooldown).`,
     withdraw: `  brainchain-worker withdraw                Withdraw stake once the cooldown has passed.`,
 };
@@ -133,12 +159,13 @@ Environment:
   BRAINCHAIN_RPC_URL      Overrides the network's RPC.
   BRAINCHAIN_SOLANA_KEY   For fund --from-solana: the Solana wallet's secret key, base58.
   BRAINCHAIN_SOLANA_KEY_FILE
-                          Or a Solana CLI keypair file holding it.
+                          Or a Solana CLI keypair file holding it, one or the other.
   BRAINCHAIN_SOLANA_RPC   Overrides the Solana RPC (https://api.mainnet-beta.solana.com).
   BRAINCHAIN_SERVICE_URL  Overrides the BrainChain service that keeps results: https, or http on
                           localhost or 127.0.0.1.
 
 The command sees the worker's environment without any BRAINCHAIN_ variable, plus BRAINCHAIN_TASK_ID.
+run restarts itself in place at start on Node.js 22.15 or later, so its own environment holds no key either.
 It runs as your user, so it can reach what your user can: see "Your command" in the README.
 Unfinished work is kept in ~/.config/brainchain-worker/<address>.<network>.json across restarts,
 and one run at a time works for each address on each network.
@@ -260,19 +287,15 @@ async function needGas(chain, network) {
 export async function join(chain, network, values) {
     const name = values.get("name")?.trim() ?? "";
     const about = values.get("about")?.trim() ?? "";
-    if (!name)
-        throw new UsageError("--name is required, up to 60 characters");
+    // What the brain keeps, in UTF-16 units as a JavaScript string counts them: one for nearly all text, two or more for an emoji.
     if (name.length > 60)
-        throw new UsageError("--name is at most 60 characters");
+        throw new UsageError("--name is at most 60 characters, counted as UTF-16 units: one for nearly all text, two or more for an emoji");
     // A name that hides characters or turns text around can read as another, Jev's included.
     const nameHides = unseen(name);
     if (nameHides)
         throw new UsageError(`--name must be one line with no invisible or direction-changing characters, and it holds ${nameHides}`);
-    if (!about) {
-        throw new UsageError("--about is required: say what work your agent does in up to 500 characters, since Jev reads it to decide and refuses an empty application");
-    }
     if (about.length > 500)
-        throw new UsageError("--about is at most 500 characters");
+        throw new UsageError("--about is at most 500 characters, counted as UTF-16 units: one for nearly all text, two or more for an emoji");
     // A description may run over several lines.
     const aboutHides = unseen(about.replace(/[\t\n]/g, " "));
     if (aboutHides)
@@ -286,6 +309,21 @@ export async function join(chain, network, values) {
     const requested = values.has("price") ? price(values.get("price")) : undefined;
     const standing = await snapshot(chain);
     const { allowed, w, change, pending, open, applying, toStake } = standing;
+    // Only an application carries a name and a description, so a worker already allowed or waiting needs neither.
+    if (applying) {
+        if (!name)
+            throw new UsageError("--name is required, up to 60 characters");
+        if (!about)
+            throw new UsageError("--about is required: say what work your agent does in up to 500 characters, since Jev reads it to decide and refuses an empty application");
+        if (await chain.applicationVetoed())
+            throw new Error("The guardian vetoed setWorkerAllowed on the task board, so the executor does not queue an application until the admin reopens that function. Nothing was sent.");
+        const taken = await chain.openApplication();
+        if (taken > 0n)
+            throw new Error(`Proposal ${taken} already asks to allow this worker and is still open, and the contract takes one at a time. Nothing was sent. Follow it with \`npx brainchain-worker proposal ${taken}\`.`);
+    }
+    else if (name || about) {
+        console.log("This worker is past its application, so --name and --about are not used.");
+    }
     // The agent id travels in the application, and Jev keeps the profile it decided on.
     if (agentId !== undefined) {
         if (allowed || (change && pending) || open) {
@@ -366,7 +404,7 @@ export async function join(chain, network, values) {
         "the application with `npx brainchain-worker status`. New workers are offered house tasks first, which BrainChain pays for.");
 }
 async function status(chain, network) {
-    const [gas, gasPrice, sent, s, held, record, bountyBalance, stakeBalance, bond, faucet, now] = await Promise.all([
+    const [gas, gasPrice, sent, s, held, record, bountyBalance, stakeBalance, bond, faucet, now, oldStakes] = await Promise.all([
         chain.ethBalance(),
         chain.gasPrice(),
         chain.sent(),
@@ -379,12 +417,13 @@ async function status(chain, network) {
         // A stake token without a faucet, as on mainnet, leaves out what the faucet would give.
         network.buyStake ? undefined : chain.faucet().catch(() => undefined),
         chain.now(),
+        chain.retiredStakes(),
     ]);
     const { w, min } = s;
     const unstaking = w.unstaking > 0n ? `, ${stake(network, w.unstaking)} unstaking until ${when(w.unlocksAt)}` : "";
     console.log(`Worker ${chain.account} on ${network.name}
   Hireable  ${hireable(s, network, "status")}
-  Stake     ${stake(network, w.staked)} (minimum ${stake(network, min)})${unstaking}
+  Stake     ${stake(network, w.staked)} (minimum ${stake(network, min)})${unstaking}${oldStakes.map((o) => `\n  Old stake ${stake(network, o.w.staked + o.w.unstaking)} on set ${o.release}, which does not count here; leave and withdraw collect it`).join("")}
   Wallet    ${wallet(network, s, stakeBalance, bond, faucet, now)}
   Price     ${w.registered ? `${usdg(network, w.price)} per task` : "not set until you join"}
   Record    ${record.paid} paid, ${record.refunded} refunded, ${record.inFlight.length} in flight${held > 0 ? " (stake held until they settle)" : ""}${record.inFlight.map((f) => `\n            ${flightLine(f)}`).join("")}
@@ -584,6 +623,12 @@ export function watching(network, address, veto) {
         return `watching ${network.name} (read-only, no key)`;
     return `watching ${network.name} as ${address}${veto ? ", vetoing through the guardian gate" : ""}, reporting rounds to the service`;
 }
+/** `run` starts the worker's command in its own process group, which Windows does not have, and loses its output there. */
+export function requirePosix(platform) {
+    if (platform === "win32") {
+        throw new Error("run works on macOS and Linux. On Windows, run the worker inside WSL: https://learn.microsoft.com/windows/wsl/install. Every other command works on Windows as it is.");
+    }
+}
 export async function main(argv) {
     const [command, ...rest] = argv;
     if (command === undefined || command === "help" || command === "--help" || command === "-h") {
@@ -611,6 +656,8 @@ export async function main(argv) {
         return;
     }
     const { positional, values, switches } = parse(command, rest);
+    if (command === "run")
+        requirePosix(process.platform);
     const network = resolveNetwork(process.env);
     if (process.env.BRAINCHAIN_RPC_URL?.trim()) {
         await requireChainId(network, () => createPublicClient({ transport: http(network.rpc, { timeout: 10_000, retryCount: 0 }) }).getChainId());
@@ -657,6 +704,8 @@ export async function main(argv) {
         }
         if (!usdc)
             throw new UsageError("--usdc is required: how much USDC on Solana to use, such as --usdc 5");
+        if (gasUsdc && !switches.has("stake") && parseUnits(gasUsdc, 6) > parseUnits(usdc, 6))
+            throw new UsageError(`--gas-usdc ${gasUsdc} is more than --usdc ${usdc}, the most this command may spend`);
         if (network.id !== "mainnet" || !network.bridge)
             throw new Error("fund --from-solana is mainnet only: Relay connects Solana with Robinhood Chain mainnet, not the testnets");
         const worker = signer();
@@ -671,17 +720,9 @@ export async function main(argv) {
             ...(network.bridge.tokens?.stake ? { stakeToken: network.bridge.tokens.stake } : {}),
             dry: switches.has("dry"),
             log: console.log,
-            async bridgeOn(asset) {
-                if (asset === "eth") {
-                    const eth = await bridgeChain.parentEth();
-                    if (eth <= PARENT_ETH_KEEP)
-                        return console.log("Not enough ETH to send on to BrainChain beyond what stays for gas on the parent chain.");
-                    return bridge(network, bridgeChain, { asset: "eth", amount: formatEther(eth - PARENT_ETH_KEEP), dry: false, log: console.log });
-                }
-                const held = await bridgeChain.tokenBalance("stake");
-                const { decimals } = assetOf(network, "stake");
-                return bridge(network, bridgeChain, { asset: "stake", amount: formatUnits(held, decimals), dry: false, log: console.log });
-            },
+            parentEth: () => bridgeChain.parentEth(),
+            parentStake: () => bridgeChain.tokenBalance("stake"),
+            bridgeOn: (asset, amount) => bridge(network, bridgeChain, { asset, amount: formatUnits(amount, assetOf(network, asset).decimals), dry: false, log: console.log }),
         });
     }
     if (command === "credit") {
@@ -711,10 +752,7 @@ export async function main(argv) {
                 set: { key: "active", release: "", fromBlock: Number(network.fromBlock), board: taskBoard, log, executor },
                 briefs: new Map(),
             }, id);
-            const findings = report.checks.filter((c) => c.status === "fail" || c.status === "error").map((c) => `${c.name}: ${c.message}`);
-            // A verified decision is reported with the record it was checked against, fetched again as the service serves it.
-            const record = findings.length === 0 && keyed && report.payloadURI ? await fetchRecord(report.payloadURI).catch(() => undefined) : undefined;
-            return { findings, ...(record ? { record } : {}) };
+            return outcome(report, keyed ? { refetch: fetchRecord } : {});
         };
         const chain = createWatchChain(network, account);
         const watch = createWatch({
@@ -747,9 +785,8 @@ export async function main(argv) {
         const id = positional[0];
         if (id === undefined || !/^\d{1,18}$/.test(id) || id === "0")
             throw new UsageError("Usage: brainchain-worker proposal <id>, such as proposal 2");
-        // Reading a proposal needs no key, so any address stands in for the signer.
-        const reader = keyConfigured() ? signer().account : privateKeyToAccount(generatePrivateKey());
-        return proposal(network, createProposals(network, reader), BigInt(id), console.log);
+        // Reading a proposal needs no key, so any address stands in for the signer, and a key that is set is never read.
+        return proposal(network, createProposals(network, privateKeyToAccount(generatePrivateKey())), BigInt(id), console.log);
     }
     const worker = signer();
     if (command === "dispute" || command === "appeal") {
@@ -795,6 +832,12 @@ export async function main(argv) {
         case "leave": {
             const w = await chain.stake();
             if (w.staked === 0n) {
+                const old = (await chain.retiredStakes()).find((o) => o.w.staked > 0n);
+                if (old) {
+                    await needGas(chain, network);
+                    await chain.requestUnstake(old.w.staked, old.staking);
+                    return console.log(`Unstaking ${stake(network, old.w.staked)} from set ${old.release}. Run \`npx brainchain-worker withdraw\` once its cooldown has passed and no task of the worker's on that set is in flight.`);
+                }
                 throw new Error(w.unstaking > 0n ? `Nothing left to unstake: ${stake(network, w.unstaking)} is already unstaking until ${when(w.unlocksAt)}.` : "Nothing is staked.");
             }
             await needGas(chain, network);
@@ -805,8 +848,16 @@ export async function main(argv) {
         }
         case "withdraw": {
             const [w, held, now] = await Promise.all([chain.stake(), chain.held(), chain.now()]);
-            if (w.unstaking === 0n)
-                throw new Error("Nothing is unstaking. Run leave first.");
+            if (w.unstaking === 0n) {
+                const old = (await chain.retiredStakes()).find((o) => o.w.unstaking > 0n);
+                if (!old)
+                    throw new Error("Nothing is unstaking. Run leave first.");
+                if (now < old.w.unlocksAt)
+                    throw new Error(`${stake(network, old.w.unstaking)} on set ${old.release} unlocks at ${when(old.w.unlocksAt)}. Withdraw after that.`);
+                await needGas(chain, network);
+                await chain.withdraw(old.staking);
+                return console.log(`Withdrew ${stake(network, old.w.unstaking)} from set ${old.release}.`);
+            }
             if (now < w.unlocksAt)
                 throw new Error(`${stake(network, w.unstaking)} unlocks at ${when(w.unlocksAt)}. Withdraw after that.`);
             if (held > 0)

package/dist/credit.js

@@ -1,4 +1,4 @@
-import { createPublicClient, http, parseAbi } from "viem";
+import { BaseError, ContractFunctionRevertedError, createPublicClient, http, parseAbi } from "viem";
 import { reason } from "./chain.js";
 import { parentChainOf } from "./network.js";
 export const CONSENT_TYPES = {
@@ -47,6 +47,9 @@ export async function credit(network, chain, options) {
         owner = await chain.ownerOf(agentId);
     }
     catch (error) {
+        // The registry reverts ownerOf for an id it never minted; anything else says nothing about the agent.
+        if (error instanceof BaseError && error.walk((e) => e instanceof ContractFunctionRevertedError))
+            throw new Error(`There is no ERC-8004 agent ${agentId} on Robinhood Chain.`);
         throw new Error(`ERC-8004 agent ${agentId} could not be read on Robinhood Chain: ${reason(error)}`);
     }
     if (owner.toLowerCase() !== chain.account.toLowerCase()) {