joinhive 2.0.0

package/bin/hive

@@ -0,0 +1,820 @@
+#!/usr/bin/env bash
+# Hive network helper — wraps buzz-cli with the shared endpoint identity at
+# ~/.hive/identity.json. Every client (Claude Code, Codex, Hermes, ...) that
+# runs this wrapper acts as the SAME endpoint: join once, reuse everywhere.
+set -euo pipefail
+
+HIVE_HOME="${HIVE_HOME:-$HOME/.hive}"
+# Resolve symlinks (npm -g installs this script as a symlink into <prefix>/bin;
+# without this, every $PACK_DIR-relative helper path silently breaks).
+_SRC="${BASH_SOURCE[0]}"
+while [ -L "$_SRC" ]; do
+  _DIR="$(cd -P "$(dirname "$_SRC")" && pwd)"
+  _SRC="$(readlink "$_SRC")"
+  [[ "$_SRC" != /* ]] && _SRC="$_DIR/$_SRC"
+done
+PACK_DIR="$(cd -P "$(dirname "$_SRC")/.." && pwd)"
+IDENTITY="$HIVE_HOME/identity.json"
+_cfg_relay=""
+if [[ -f "$HIVE_HOME/config.json" ]]; then
+  _cfg_relay="$(node -e "try{console.log(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).relay||'')}catch{console.log('')}" "$HIVE_HOME/config.json")"
+fi
+export BUZZ_RELAY_URL="${BUZZ_RELAY_URL:-${_cfg_relay:-http://localhost:3000}}"
+
+# Resolve the buzz binary: env override, PATH, then known build locations.
+find_buzz() {
+  if [[ -n "${BUZZ_BIN:-}" ]]; then echo "$BUZZ_BIN"; return; fi
+  if command -v buzz >/dev/null 2>&1; then command -v buzz; return; fi
+  for c in "$PACK_DIR/../buzz/target/release/buzz" "$PACK_DIR/../buzz/target/debug/buzz"; do
+    [[ -x "$c" ]] && { echo "$c"; return; }
+  done
+  echo ""
+}
+
+json_field() { # json_field <file> <key>
+  node -e "console.log(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))[process.argv[2]])" "$1" "$2"
+}
+
+# ---- on-chain tokens ($HONEY governance/reputation, $JELLY money) on Sepolia --
+SEPOLIA_RPC="${SEPOLIA_RPC_URL:-https://ethereum-sepolia-rpc.publicnode.com}"
+DEPLOYMENTS="$PACK_DIR/onchain/deployments.sepolia.json"
+CAST="${CAST_BIN:-$HOME/.foundry/bin/cast}"
+token_addr() { # token_addr honey|jelly  -> contract address (empty if not deployed)
+  [[ -f "$DEPLOYMENTS" ]] || return 0
+  node -e "try{const d=require(process.argv[1]);process.stdout.write(d[process.argv[2]]||'')}catch{}" "$DEPLOYMENTS" "$1"
+}
+my_evm() { # this endpoint's public EVM address (no key needed)
+  node "$PACK_DIR/bin/hive-wallet.mjs" show 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{process.stdout.write(JSON.parse(d).evm_address||'')}catch{}})"
+}
+signer_key() { # derive EVM privkey from the Keychain mnemonic — stdout only, never logged
+  local pk; pk="$(json_field "$IDENTITY" pubkey)"
+  security find-generic-password -a "$pk" -s hive-agent-wallet -w 2>/dev/null \
+    | NODE_PATH="$PACK_DIR/node_modules" node -e "let m='';process.stdin.on('data',c=>m+=c).on('end',()=>{try{const {HDNodeWallet}=require('ethers');process.stdout.write(HDNodeWallet.fromPhrase(m.trim()).privateKey)}catch{}})"
+}
+# Resolve a member's announced EVM address from their hive-wallet event, or pass
+# through a literal 0x… address. Prints the address or empty.
+resolve_evm() { # resolve_evm <nostr-pubkey|0x-addr>
+  local who="$1"
+  [[ "$who" =~ ^0x[0-9a-fA-F]{40}$ ]] && { echo "$who"; return; }
+  local BUZZ; BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+  local LOGS; LOGS="$("$0" ensure-channel hive-logs)"
+  "$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+    let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];const who=process.argv[1];let evm="";
+      for(const m of a){try{const j=JSON.parse(m.content); if(j.type==="hive-wallet"&&m.pubkey===who&&(j.by?j.by===m.pubkey:true)&&/^0x[0-9a-fA-F]{40}$/.test(j.evm||"")) evm=j.evm;}catch{}}
+      process.stdout.write(evm);})' "$who"
+}
+
+cmd="${1:-help}"
+case "$cmd" in
+  keygen)
+    exec node "$PACK_DIR/bin/hive-keygen.mjs"
+    ;;
+  relay) # relay [url] — show or set the relay this endpoint talks to
+    shift
+    if [[ -n "${1:-}" ]]; then
+      node -e '
+        const fs=require("fs");const f=process.argv[1];let c={};
+        try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}
+        c.relay=process.argv[2];fs.writeFileSync(f,JSON.stringify(c,null,2)+"\n");
+        console.log(JSON.stringify({relay:c.relay,note:"restart daemon: hive daemon stop && hive daemon start"}));
+      ' "$HIVE_HOME/config.json" "$1"
+    else
+      echo "{\"relay\":\"$BUZZ_RELAY_URL\"}"
+    fi
+    ;;
+  start) # start [--down] — run a local community relay at ws://localhost:3000 (docker)
+    shift
+    command -v docker >/dev/null 2>&1 || { echo '{"error":"docker is required for hive start — install Docker Desktop"}' >&2; exit 1; }
+    COMPOSE="$PACK_DIR/dev/compose.yml"
+    if [[ "${1:-}" == "--down" ]]; then
+      docker compose -f "$COMPOSE" down
+      echo '{"local_relay":"stopped"}'
+      exit 0
+    fi
+    echo '{"local_relay":"starting","note":"first run pulls images (~1 min)"}' >&2
+    docker compose -f "$COMPOSE" up -d --wait 2>&1 | tail -2 >&2 || { echo '{"error":"docker compose failed — see output above"}' >&2; exit 1; }
+    # Point this endpoint at the local relay if it has no relay yet.
+    node -e '
+      const fs=require("fs");const f=process.argv[1];let c={};
+      try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}
+      if(!c.relay||/localhost/.test(c.relay)){c.relay="http://localhost:3000";fs.writeFileSync(f,JSON.stringify(c,null,2)+"\n");}
+    ' "$HIVE_HOME/config.json" 2>/dev/null || true
+    echo '{"local_relay":"ws://localhost:3000","http":"http://localhost:3000","next":"hive daemon start (or hive connect <url> to join a remote community)"}'
+    ;;
+  connect) # connect <url> [--invite <code>] — join the community at that relay
+    shift; URL="${1:-}"; shift || true
+    [[ -n "$URL" ]] || { echo '{"error":"usage: hive connect <wss://relay.host|http://localhost:3000> [--invite <code>]"}' >&2; exit 1; }
+    INVITE=""
+    while [[ $# -gt 0 ]]; do case "$1" in
+      --invite) INVITE="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      *) shift ;;
+    esac; done
+    # Store the http(s) form; the daemon derives ws(s) itself.
+    NORM="$(node -e 'let u=process.argv[1];u=u.replace(/^wss:\/\//,"https://").replace(/^ws:\/\//,"http://").replace(/\/+$/,"");if(!/^https?:\/\//.test(u)){u="https://"+u;}process.stdout.write(u)' "$URL")"
+    node -e '
+      const fs=require("fs");const f=process.argv[1];let c={};
+      try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}
+      c.relay=process.argv[2];fs.writeFileSync(f,JSON.stringify(c,null,2)+"\n");
+      console.log(JSON.stringify({relay:c.relay}));
+    ' "$HIVE_HOME/config.json" "$NORM"
+    if [[ -n "$INVITE" ]]; then
+      BUZZ_RELAY_URL="$NORM" node "$PACK_DIR/bin/hive-claim-invite.mjs" "$INVITE" || exit 1
+    fi
+    # Restart the daemon so it reconnects to the new relay.
+    if [[ -f "$HIVE_HOME/daemon.pid" ]] && kill -0 "$(cat "$HIVE_HOME/daemon.pid")" 2>/dev/null; then
+      "$0" daemon stop >/dev/null 2>&1 || true
+      "$0" daemon start
+    else
+      echo '{"note":"run: hive daemon start"}'
+    fi
+    ;;
+  join) # join --invite <code> --server <url> — full onboarding to a community (bee + wallet + profile + watcher)
+    shift; exec node "$PACK_DIR/bin/hive-join.mjs" "$@"
+    ;;
+  ask) # ask "<text>" — post an intent to the network (results land in `hive feed`)
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" ask "$@"
+    ;;
+  list) # list users|agents [--online] — who's in this community
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" list "$@"
+    ;;
+  leaderboard) # leaderboard — HONEY reputation ranks (soulbound, earned only)
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" leaderboard "$@"
+    ;;
+  agent) # agent status|logs|pause|resume — your bee (pause/resume = owner-signed kill switch)
+    shift; sub="${1:-status}"
+    case "$sub" in
+      logs) tail -40 "$HIVE_HOME/daemon.log" 2>/dev/null || echo "(no local daemon log — your bee runs on the community server; try: hive agent status)" ;;
+      *) exec node "$PACK_DIR/bin/hive-net.mjs" agent "$@" ;;
+    esac
+    ;;
+  sync) # sync on|off|now|status — the laptop watcher that auto-forwards intents from your local AI chats
+    shift; sub="${1:-status}"
+    PLIST="$HOME/Library/LaunchAgents/global.nfh.hive.sync.plist"
+    case "$sub" in
+      now) exec node "$PACK_DIR/watcher/sync.mjs" ;;
+      on)
+        node -e 'const fs=require("fs");const f=process.argv[1];let c={};try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{};c.sync={...(c.sync||{}),enabled:true};fs.writeFileSync(f,JSON.stringify(c,null,2)+"\n")' "$HIVE_HOME/config.json"
+        [[ -f "$PLIST" ]] && launchctl load "$PLIST" 2>/dev/null || true
+        echo '{"sync":"on"}' ;;
+      off)
+        node -e 'const fs=require("fs");const f=process.argv[1];let c={};try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{};c.sync={...(c.sync||{}),enabled:false};fs.writeFileSync(f,JSON.stringify(c,null,2)+"\n")' "$HIVE_HOME/config.json"
+        [[ -f "$PLIST" ]] && launchctl unload "$PLIST" 2>/dev/null || true
+        echo '{"sync":"off"}' ;;
+      status)
+        node -e '
+          const fs=require("fs"),os=require("os"),path=require("path");
+          const home=process.env.HIVE_HOME||path.join(os.homedir(),".hive");
+          let c={},s={};try{c=JSON.parse(fs.readFileSync(path.join(home,"config.json"),"utf8"))}catch{}
+          try{s=JSON.parse(fs.readFileSync(path.join(home,"sync-state.json"),"utf8"))}catch{}
+          console.log(JSON.stringify({enabled:c.sync?c.sync.enabled!==false:false,provider:(c.sync||{}).provider||null,files_tracked:Object.keys(s.files||{}).length,intents_sent_14d:(s.sent||[]).length},null,2));
+        ' ;;
+      *) echo '{"error":"usage: hive sync on|off|now|status"}' >&2; exit 1 ;;
+    esac
+    ;;
+  extend) # extend add <file.md> | rm <name> | list | gaps — the /network-extend protocol registry
+    shift; sub="${1:-list}"
+    if [[ "$sub" == "gaps" ]]; then exec "$0" needs; fi
+    exec "$0" protocol "$@"
+    ;;
+  gift) # gift <object-id16> <recipient-pubkey> — human-gated object transfer
+    shift; exec "$0" give "$@"
+    ;;
+  altkey) # altkey add|revoke <pubkey> | list — link your other device keys (desktop app) to your membership
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" altkey "$@"
+    ;;
+  admin) # admin invite — mint a member invite + join link (operator only)
+    shift; sub="${1:-}"
+    [[ "$sub" == "invite" ]] || { echo '{"error":"usage: hive admin invite [--server <url>]"}' >&2; exit 1; }
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" admin-invite "$@"
+    ;;
+  doctor) # doctor — identity, relay, wallet, gas, tokens, daemon, stores in one look
+    node -e '
+      const fs=require("fs"),os=require("os"),path=require("path");
+      const home=process.env.HIVE_HOME||path.join(os.homedir(),".hive");
+      const pack=process.argv[1];
+      const load=(p)=>{try{return JSON.parse(fs.readFileSync(p,"utf8"))}catch{return null}};
+      const out={};
+      const id=load(path.join(home,"identity.json"));
+      out.identity=id?{ok:true,pubkey:id.pubkey.slice(0,12)}:{ok:false,fix:"hive keygen"};
+      const cfg=load(path.join(home,"config.json"))||{};
+      out.relay={url:cfg.relay||"(unset)"};
+      const wal=load(path.join(home,"wallet.json"));
+      const rec=wal&&id?wal[id.pubkey]:null;
+      out.wallet=rec?{ok:true,evm:rec.evm_address}:{ok:false,fix:"hive wallet"};
+      let pid=null;try{pid=parseInt(fs.readFileSync(path.join(home,"daemon.pid"),"utf8"))}catch{}
+      let running=false;try{if(pid){process.kill(pid,0);running=true}}catch{}
+      out.local_daemon=running?{ok:true,pid}:{ok:false,note:"fine if your bee runs on the community server"};
+      out.bee=cfg.bee_name?{name:cfg.bee_name,server:cfg.server_url||null}:{note:"not provisioned — hive join"};
+      const cnt=(d)=>{try{return fs.readdirSync(path.join(home,d)).filter(f=>!f.startsWith(".")).length}catch{return 0}};
+      out.stores={data:cnt("data-store"),capability:cnt("capability-store"),object:cnt("object-store")};
+      (async()=>{
+        try{const r=await fetch((cfg.relay||"http://localhost:3000").replace(/^ws/,"http"),{signal:AbortSignal.timeout(4000)});out.relay.ok=r.status<500}catch{out.relay.ok=false;out.relay.fix="hive start (local) or hive connect <url>"}
+        const dep=load(path.join(pack,"onchain","deployments.sepolia.json"));
+        if(dep&&rec){try{
+          const {JsonRpcProvider,Contract,formatUnits,formatEther}=await import("ethers");
+          const p=new JsonRpcProvider(process.env.SEPOLIA_RPC_URL||"https://ethereum-sepolia-rpc.publicnode.com");
+          const bal=(a)=>new Contract(a,["function balanceOf(address) view returns (uint256)"],p).balanceOf(rec.evm_address);
+          const [h,j,g]=await Promise.all([bal(dep.honey),bal(dep.jelly),p.getBalance(rec.evm_address)]);
+          out.tokens={HONEY:formatUnits(h,18),JELLY:formatUnits(j,18),gas_eth:formatEther(g),contracts_v:dep.version||1};
+        }catch(e){out.tokens={ok:false,err:String(e.message).slice(0,80)}}}
+        console.log(JSON.stringify(out,null,2));
+      })();
+    ' "$PACK_DIR"
+    ;;
+  daemon) # daemon start|stop|status — one hived per machine, shared by all clients
+    shift; sub="${1:-status}"
+    PIDFILE="$HIVE_HOME/daemon.pid"
+    running() { [[ -f "$PIDFILE" ]] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; }
+    case "$sub" in
+      start)
+        if running; then echo "{\"daemon\":\"already-running\",\"pid\":$(cat "$PIDFILE")}"; exit 0; fi
+        nohup node "$PACK_DIR/bin/hived.mjs" >> "$HIVE_HOME/daemon.out" 2>&1 &
+        disown || true
+        sleep 1
+        if running; then echo "{\"daemon\":\"started\",\"pid\":$(cat "$PIDFILE")}"; else echo '{"daemon":"failed","log":"~/.hive/daemon.out"}' >&2; exit 1; fi
+        ;;
+      stop)
+        if running; then kill "$(cat "$PIDFILE")" && rm -f "$PIDFILE" && echo '{"daemon":"stopped"}'; else echo '{"daemon":"not-running"}'; fi
+        ;;
+      status)
+        if running; then echo "{\"daemon\":\"running\",\"pid\":$(cat "$PIDFILE")}"; else echo '{"daemon":"not-running"}'; fi
+        ;;
+      logs)
+        tail -20 "$HIVE_HOME/daemon.log" 2>/dev/null || echo "(no log yet)"
+        ;;
+    esac
+    ;;
+  give) # give <object-id16> <recipient-pubkey> — HUMAN-only object transfer.
+    # Deliberately not exposed to hived: the daemon has no spend authority
+    # (req 4). A transfer is a signed note in #hive-object-store naming the
+    # new owner; verifiers check the giver signed it and owned the object.
+    shift; OID="${1:-}"; TO="${2:-}"
+    [[ -n "$OID" && -n "$TO" ]] || { echo '{"error":"usage: hive give <object-id16> <recipient-pubkey>"}' >&2; exit 1; }
+    F="$HIVE_HOME/object-store/$OID.json"
+    [[ -f "$F" ]] || { echo '{"error":"object not found in your store"}' >&2; exit 1; }
+    read -r -p "Transfer object $OID to ${TO:0:12}...? [y/N] " ok
+    [[ "$ok" == "y" ]] || { echo '{"transfer":"cancelled"}'; exit 0; }
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    OBJ_CH="$("$0" ensure-channel hive-logs)"
+    node -e '
+      const fs=require("fs");const [f,to,pk]=process.argv.slice(1);
+      const o=JSON.parse(fs.readFileSync(f,"utf8"));
+      process.stdout.write(JSON.stringify({type:"hive-transfer",object:o.id,name:o.name,from:pk,to,at:Math.floor(Date.now()/1000)}));
+    ' "$F" "$TO" "$(json_field "$IDENTITY" pubkey)" | "$BUZZ" messages send --channel "$OBJ_CH" --content -
+    mkdir -p "$HIVE_HOME/object-store/given" && mv "$F" "$HIVE_HOME/object-store/given/"
+    ;;
+  feed) # your feed — results, tips, gifts, and settlements addressed to you (V1/V11)
+    # Member laptops have no buzz binary — the Node client covers them.
+    if [[ -z "$(find_buzz)" ]]; then exec node "$PACK_DIR/bin/hive-net.mjs" feed; fi
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    PK="$(json_field "$IDENTITY" pubkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"
+    "$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+      let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+        const list=JSON.parse(d); const msgs=Array.isArray(list)?list:list.messages||[];
+        const me=process.argv[1];
+        const results=[],tips=[],gifts=[],settles=[]; const myOpen=new Set();
+        // pass 1: sessions I opened, so I can surface their settlements (V11)
+        for(const m of msgs){try{const j=JSON.parse(m.content); if(j.by&&j.by!==m.pubkey) continue;
+          if(j.type==="hive-session"&&m.pubkey===me&&typeof j.session_id==="string") myOpen.add(j.session_id);
+        }catch{}}
+        for(const m of msgs){try{const j=JSON.parse(m.content);
+          if(j.by&&j.by!==m.pubkey) continue;                 // R-B1 provenance
+          if(j.type==="hive-result"&&j.for===me) results.push({m,j});
+          else if(j.type==="hive-tip"&&j.to===me&&j.from===m.pubkey&&Number(j.amount)>0) tips.push({m,j});
+          else if(j.type==="hive-transfer"&&j.to===me) gifts.push({m,j});
+          else if(j.type==="hive-settle"&&myOpen.has(j.session_id)) settles.push({m,j});
+        }catch{}}
+        let any=false;
+        if(results.length){any=true;console.log("RESULTS:");for(const {m,j} of results)
+          console.log("  • "+(j.intent||"")+"\n    "+String(j.result).replace(/\n/g," ").slice(0,240)+"\n    ["+(j.by||"").slice(0,12)+" · protocols: "+(j.protocols_used||[]).join(",")+"]  react: hive react "+m.id+" up");}
+        if(tips.length){any=true;console.log("TIPS RECEIVED:");for(const {j} of tips)
+          console.log("  • +"+j.amount+" copper from "+(j.from||"").slice(0,12)+(j.note?" — "+String(j.note).slice(0,80):""));}
+        if(gifts.length){any=true;console.log("GIFTS RECEIVED:");for(const {j} of gifts)
+          console.log("  • object "+String(j.object||j.name||"").slice(0,16)+" from "+(j.from||"").slice(0,12));}
+        if(settles.length){any=true;console.log("SETTLEMENTS (sessions you opened):");for(const {j} of settles)
+          console.log("  • ["+j.status+"] "+String(j.kind||"")+": "+String(j.result).replace(/\n/g," ").slice(0,200));}
+        if(!any)console.log("(feed empty — broadcast an intent in #hive-intents, tip/gift, or open a session)");
+      })' "$PK"
+    ;;
+  react) # react <result-event-id> up|down [note] — feedback on a result (V2; mints HONEY at the next epoch)
+    shift; RID="${1:-}"; DIR="${2:-up}"; NOTE="${3:-}"
+    [[ -n "$RID" ]] || { echo '{"error":"usage: hive react <result-event-id> up|down [note]"}' >&2; exit 1; }
+    [[ "$DIR" == "up" || "$DIR" == "down" ]] || { echo '{"error":"direction must be up or down"}' >&2; exit 1; }
+    if [[ -z "$(find_buzz)" ]]; then exec node "$PACK_DIR/bin/hive-net.mjs" react "$RID" "$DIR" "$NOTE"; fi
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"
+    # Resolve the result's verified author (signer) so feedback is addressable.
+    RESULT_BY="$("$BUZZ" messages get --channel "$LOGS" --limit 200 | node -e '
+      let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+        const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];
+        const hit=a.find(m=>m.id===process.argv[1]);
+        if(!hit){console.log("");return;}
+        try{const j=JSON.parse(hit.content); console.log(j.by===hit.pubkey?hit.pubkey:"");}catch{console.log("")}
+      })' "$RID")"
+    [[ -n "$RESULT_BY" ]] || { echo '{"error":"result not found or unverifiable in hive-logs"}' >&2; exit 1; }
+    node -e '
+      const [rid,by,dir,note,me]=process.argv.slice(1);
+      process.stdout.write(JSON.stringify({type:"hive-feedback",result:rid,result_by:by,dir,note:note||undefined,by:me,at:Math.floor(Date.now()/1000)}));
+    ' "$RID" "$RESULT_BY" "$DIR" "$NOTE" "$(json_field "$IDENTITY" pubkey)" | "$BUZZ" messages send --channel "$LOGS" --content -
+    ;;
+  roi) # roi — what you've contributed vs received, and the highest-leverage thing to add (V3)
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    PK="$(json_field "$IDENTITY" pubkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"
+    FB="$(cat "$HIVE_HOME/feedback.json" 2>/dev/null || echo '{}')"
+    "$BUZZ" messages get --channel "$LOGS" --limit 300 | node -e '
+      let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+        const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];
+        const me=process.argv[1]; const fb=JSON.parse(process.argv[2]||"{}");
+        const fs=require("fs"),os=require("os"),path=require("path");
+        const home=process.env.HIVE_HOME||path.join(os.homedir(),".hive");
+        let given=0,received=0,intents=0;
+        for(const m of a){try{const j=JSON.parse(m.content); if(j.by!==m.pubkey) continue;
+          if(j.type==="hive-result"&&j.by===me) given++;
+          if(j.type==="hive-result"&&j.for===me) received++;
+          if(j.type==="hive-intent"&&j.for===me) intents++;
+        }catch{}}
+        const cnt=(dir)=>{try{return fs.readdirSync(path.join(home,dir)).filter(f=>!f.startsWith(".")).length}catch{return 0}};
+        const data=cnt("data-store"),cap=cnt("capability-store"),obj=cnt("object-store");
+        // profile section richness → the ROI hint
+        let profile=""; try{profile=fs.readFileSync(path.join(home,"data-store","profile.md"),"utf8")}catch{}
+        const thin=[];
+        if(!/movie|film|watch/i.test(profile)) thin.push("movie/show tastes → unlocks group movie & watch recs");
+        if(!/book|read/i.test(profile)) thin.push("reading list → unlocks book/read-alike matches");
+        if(cap<3) thin.push("more capabilities (hive-capability-store) → more intents you can answer for others");
+        if(obj<3) thin.push("mint more objects (hive mint) → more to trade/tip with");
+        console.log("Hive ROI for "+me.slice(0,12));
+        console.log("  contributed (results you produced): "+given);
+        console.log("  received (results for you):         "+received);
+        console.log("  intents raised for you:             "+intents);
+        console.log("  reputation from reactions:          +"+(fb.up||0)+" / -"+(fb.down||0));
+        console.log("  stores: data="+data+" capability="+cap+" object="+obj);
+        console.log("\nAdd this next (highest leverage):");
+        if(thin.length){console.log("  → "+thin[0]);} else {console.log("  → your stores are well-stocked; raise more intents in #hive-intents");}
+      })' "$PK" "$FB"
+    ;;
+  verify-stores) # verify-stores — hard gate: all three stores non-empty (J9)
+    node -e '
+      const fs=require("fs"),os=require("os"),path=require("path");
+      const home=process.env.HIVE_HOME||path.join(os.homedir(),".hive");
+      const nonempty=(d)=>{try{return fs.readdirSync(path.join(home,d)).some(f=>{
+        if(f.startsWith(".")) return false; const p=path.join(home,d,f);
+        const st=fs.statSync(p); return st.isDirectory()?fs.readdirSync(p).length>0:st.size>0;
+      })}catch{return false}};
+      const empty=["data-store","capability-store","object-store"].filter(d=>!nonempty(d));
+      if(empty.length){console.error(JSON.stringify({ok:false,empty}));process.exit(1);}
+      console.log(JSON.stringify({ok:true,stores:["data-store","capability-store","object-store"]}));
+    '
+    ;;
+  protocol) # protocol add <file.md> | rm <name> | list — the registry every daemon auto-uses
+    shift; sub="${1:-list}"
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    case "$sub" in
+      add)
+        f="${2:-}"
+        [[ -f "$f" ]] || { echo '{"error":"protocol file not found"}' >&2; exit 1; }
+        name="$(awk '/^name:/{sub(/^name: */,"");print;exit}' "$f")"
+        match="$(awk '/^match:/{sub(/^match: */,"");print;exit}' "$f")"
+        [[ -n "$name" && -n "$match" ]] || { echo '{"error":"protocol file needs frontmatter lines: name: <n> and match: <kw,kw>"}' >&2; exit 1; }
+        [[ "$name" =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]] || { echo '{"error":"protocol name must be a slug: lowercase a-z 0-9 and dashes, starting alphanumeric"}' >&2; exit 1; }
+        # P7 (validate: length, body starts at first heading) + R-C2 (reject
+        # shell/exfil/transfer bodies) BEFORE any network call. On failure the
+        # payload is empty and nothing is published.
+        payload="$(node -e '
+          const fs=require("fs");
+          const [f,name,match,pk]=process.argv.slice(1);
+          const raw=fs.readFileSync(f,"utf8");
+          const h=raw.indexOf("\n#"); const body=(h>=0?raw.slice(h+1):raw).trim();
+          if(!body){console.error(JSON.stringify({error:"protocol body empty (need a # heading + numbered steps)"}));process.exit(1);}
+          if(body.length>6000){console.error(JSON.stringify({error:"protocol body too long: "+body.length+" > 6000 chars"}));process.exit(1);}
+          const danger=(b)=>{
+            if(/\$\(|\brm\s+-rf\b|\b(?:curl|wget)\s+(?:-|https?:\/\/)|\b(?:bash|sh|zsh|python3?|node)\s+\S+\.\w|\beval\s*\(|\bexec\s*\(|\|\s*(?:sh|bash|zsh)\b/i.test(b))return "shell/command-execution";
+            if(/\b(privkey|private key|secret key|mnemonic|seed phrase|nsec1|identity\.json)\b/i.test(b))return "secret-exfiltration";
+            if(/\b(transfer|send|move|drain|withdraw)\b[^.\n]{0,30}\b(funds?|money|copper|balance|wallet|tokens?)\b/i.test(b))return "value-transfer";
+            return null;};
+          const dg=danger(body);
+          if(dg){console.error(JSON.stringify({error:"protocol rejected ("+dg+"): bodies are FOLLOW-guidance treated as untrusted data"}));process.exit(1);}
+          process.stdout.write(JSON.stringify({type:"hive-protocol",name,match,body,by:pk}));
+        ' "$f" "$name" "$match" "$(json_field "$IDENTITY" pubkey)")" || exit 1
+        PROT_ID="$("$0" ensure-channel hive-logs)"   # network only AFTER validation passes
+        printf '%s' "$payload" | "$BUZZ" messages send --channel "$PROT_ID" --content -
+        ;;
+      rm) # rm <name> — publish an owner-signed tombstone; daemons drop it (P11)
+        name="${2:-}"
+        [[ -n "$name" ]] || { echo '{"error":"usage: hive protocol rm <name>"}' >&2; exit 1; }
+        PROT_ID="$("$0" ensure-channel hive-logs)"
+        node -e '
+          const [name,pk]=process.argv.slice(1);
+          process.stdout.write(JSON.stringify({type:"hive-protocol",name,tombstone:true,by:pk}));
+        ' "$name" "$(json_field "$IDENTITY" pubkey)" | "$BUZZ" messages send --channel "$PROT_ID" --content -
+        ;;
+      list)
+        PROT_ID="$("$0" ensure-channel hive-logs)"
+        "$BUZZ" messages get --channel "$PROT_ID" --limit 200 | node -e '
+          let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+            const list=JSON.parse(d); const msgs=Array.isArray(list)?list:list.messages||[];
+            // Mirror the daemon (syncProtocols): validate the name, fold
+            // chronologically with tombstone-before-add tie-break, first-author
+            // ownership survives tombstones (dead entry retains by), hide
+            // dangerous bodies. Diverging from the daemon here is a real bug.
+            const valid=(n)=>typeof n==="string"&&/^[a-z0-9][a-z0-9-]{0,63}$/.test(n);
+            const danger=(b)=>/\$\(|\brm\s+-rf\b|\b(?:curl|wget)\s+(?:-|https?:\/\/)|\b(?:bash|sh|zsh|python3?|node)\s+\S+\.\w|\beval\s*\(|\bexec\s*\(|\|\s*(?:sh|bash|zsh)\b/i.test(b)
+              ||/\b(privkey|private key|secret key|mnemonic|seed phrase|nsec1|identity\.json)\b/i.test(b)
+              ||/\b(transfer|send|move|drain|withdraw)\b[^.\n]{0,30}\b(funds?|money|copper|balance|wallet|tokens?)\b/i.test(b);
+            const items=[];
+            for(const m of msgs){try{const p=JSON.parse(m.content);
+              if(!p||p.type!=="hive-protocol"||!valid(p.name)) continue;
+              if(p.match!=null&&typeof p.match!=="string") continue;
+              if(!p.tombstone&&typeof p.body!=="string") continue;
+              items.push({at:m.created_at||0,by:m.pubkey,p});
+            }catch{}}
+            items.sort((a,b)=>(a.at-b.at)||((b.p.tombstone?1:0)-(a.p.tombstone?1:0)));
+            const reg=Object.create(null);
+            for(const {at,by,p} of items){ const cur=reg[p.name];
+              if(cur&&cur.by&&cur.by!==by) continue;            // takeover rejected
+              if(p.tombstone){ if(cur&&at>=cur.at&&!cur.dead) reg[p.name]={name:p.name,by:cur.by,at,dead:true}; continue; }
+              if(danger(String(p.body))) continue;
+              if(!cur||at>=cur.at) reg[p.name]={name:p.name,match:p.match,by,at,dead:false};
+            }
+            for(const p of Object.values(reg)) if(!p.dead) console.log(JSON.stringify({name:p.name,match:p.match,by:(p.by||"").slice(0,12)}));
+          })'
+        ;;
+      *) echo '{"error":"usage: hive protocol add <file.md> | rm <name> | list"}' >&2; exit 1 ;;
+    esac
+    ;;
+  tip) # tip <amount> <member-pubkey|0x-addr> — send $JELLY on Sepolia (HUMAN-gated; never from hived)
+    shift; AMT="${1:-}"; TO="${2:-}"
+    [[ "$AMT" =~ ^[0-9]+(\.[0-9]+)?$ && -n "$TO" ]] || { echo '{"error":"usage: hive tip <amount> <member-pubkey|0x-address>"}' >&2; exit 1; }
+    JELLY="$(token_addr jelly)"; [[ -n "$JELLY" ]] || { echo '{"error":"$JELLY not deployed yet — run onchain/deploy.sh"}' >&2; exit 1; }
+    DEST="$(resolve_evm "$TO")"; [[ "$DEST" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo "{\"error\":\"no announced EVM address for ${TO:0:12} (they must run: hive wallet)\"}" >&2; exit 1; }
+    WEI="$("$CAST" to-wei "$AMT" ether)"
+    read -r -p "Send $AMT JELLY to $DEST on Sepolia? [y/N] " ok
+    [[ "$ok" == "y" ]] || { echo '{"tip":"cancelled"}'; exit 0; }
+    KEY="$(signer_key)"; [[ -n "$KEY" ]] || { echo '{"error":"no signing key in Keychain"}' >&2; exit 1; }
+    TX="$("$CAST" send "$JELLY" "transfer(address,uint256)" "$DEST" "$WEI" --private-key "$KEY" --rpc-url "$SEPOLIA_RPC" --json 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{console.log(JSON.parse(d).transactionHash)}catch{console.log('')}})")"
+    unset KEY
+    [[ -n "$TX" ]] && echo "{\"tipped\":\"$AMT JELLY\",\"to\":\"$DEST\",\"tx\":\"$TX\",\"explorer\":\"https://sepolia.etherscan.io/tx/$TX\"}" || { echo '{"error":"transfer failed — is the wallet funded for gas and holding JELLY?"}' >&2; exit 1; }
+    ;;
+  pay) # pay "<english>" — natural-language tip, e.g. hive pay "tip siddharth 1 $JELLY" (HUMAN-gated on-chain send)
+    shift; PHRASE="$*"
+    [[ -n "$PHRASE" ]] || { echo '{"error":"usage: hive pay \"tip <name> <amount> $JELLY|$HONEY\""}' >&2; exit 1; }
+    # Parse: "tip NAME AMT [$]TOKEN" or "send AMT [$]TOKEN to NAME". Token defaults to JELLY.
+    PARSED="$(node -e '
+      const s=process.argv[1];
+      let m=s.match(/(?:tip|pay|send|give)\s+([a-z0-9_.-]{2,})\s+([0-9]+(?:\.[0-9]+)?)\s*\$?\s*(honey|jelly)?\b/i)
+        || s.match(/(?:tip|pay|send|give)\s+([0-9]+(?:\.[0-9]+)?)\s*\$?\s*(honey|jelly)?\s+to\s+([a-z0-9_.-]{2,})/i);
+      if(!m){process.stdout.write("ERR could not parse — try: tip <name> <amount> $JELLY");process.exit(0);}
+      let name,amount,token;
+      if(/^[0-9]/.test(m[1])){amount=m[1];token=m[2];name=m[3];} else {name=m[1];amount=m[2];token=m[3];}
+      process.stdout.write(name+" "+amount+" "+(token||"jelly").toLowerCase());
+    ' "$PHRASE")"
+    [[ "$PARSED" == ERR* ]] && { echo "{\"error\":\"${PARSED#ERR }\"}" >&2; exit 1; }
+    read -r NAME AMT TOK <<< "$PARSED"
+    TOKADDR="$(token_addr "$TOK")"; [[ -n "$TOKADDR" ]] || { echo "{\"error\":\"\$$(echo "$TOK"|tr a-z A-Z) not deployed — run onchain/deploy.sh\"}" >&2; exit 1; }
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    # Resolve NAME -> member pubkey (buzz display-name search); accept a raw 64-hex pubkey too.
+    RES=""
+    if [[ "$NAME" =~ ^[0-9a-fA-F]{64}$ ]]; then RES="$NAME"; else
+      RES="$("$BUZZ" users get --name "$NAME" 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{const l=JSON.parse(d);const a=Array.isArray(l)?l:(l.users||[l]);const u=a[0];process.stdout.write((u&&(u.pubkey||u.id||u.author))||'')}catch{}})")"
+    fi
+    [[ -n "$RES" ]] || { echo "{\"error\":\"no member matching '$NAME'\"}" >&2; exit 1; }
+    DEST="$(resolve_evm "$RES")"; [[ "$DEST" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo "{\"error\":\"'$NAME' has no announced wallet (they must run: hive wallet)\"}" >&2; exit 1; }
+    WEI="$("$CAST" to-wei "$AMT" ether)"
+    read -r -p "Send $AMT $(echo "$TOK"|tr a-z A-Z) to $NAME ($DEST) on Sepolia? [y/N] " ok
+    [[ "$ok" == "y" ]] || { echo '{"pay":"cancelled"}'; exit 0; }
+    KEY="$(signer_key)"; TX="$("$CAST" send "$TOKADDR" "transfer(address,uint256)" "$DEST" "$WEI" --private-key "$KEY" --rpc-url "$SEPOLIA_RPC" --json 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{console.log(JSON.parse(d).transactionHash)}catch{console.log('')}})")"; unset KEY
+    [[ -n "$TX" ]] && echo "{\"paid\":\"$AMT $(echo "$TOK"|tr a-z A-Z)\",\"to\":\"$NAME\",\"address\":\"$DEST\",\"tx\":\"$TX\",\"explorer\":\"https://sepolia.etherscan.io/tx/$TX\"}" || { echo '{"error":"send failed — gas? token balance?"}' >&2; exit 1; }
+    ;;
+  balance) # balance [addr] — on-chain $HONEY + $JELLY balances (Sepolia)
+    shift; ADDR="${1:-$(my_evm)}"
+    [[ "$ADDR" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo '{"error":"no EVM address (run: hive wallet)"}' >&2; exit 1; }
+    HONEY="$(token_addr honey)"; JELLY="$(token_addr jelly)"
+    [[ -n "$HONEY" || -n "$JELLY" ]] || { echo '{"error":"tokens not deployed yet — run onchain/deploy.sh once the wallet has Sepolia ETH"}' >&2; exit 1; }
+    bal() { [[ -n "$1" ]] || { echo "n/a"; return; }; local w; w="$("$CAST" call "$1" "balanceOf(address)(uint256)" "$ADDR" --rpc-url "$SEPOLIA_RPC" 2>/dev/null | awk '{print $1}')"; [[ "$w" =~ ^[0-9]+$ ]] && "$CAST" to-unit "$w" ether || echo "err"; }
+    echo "{\"address\":\"$ADDR\",\"HONEY\":\"$(bal "$HONEY")\",\"JELLY\":\"$(bal "$JELLY")\"}"
+    ;;
+  honey|jelly) # honey|jelly balance [addr] | mint <to> <amount> — token ops (mint is owner-only, HUMAN-gated)
+    TOK="$cmd"; TU="$(echo "$TOK" | tr a-z A-Z)"; shift; sub="${1:-balance}"
+    ADDR_TOKEN="$(token_addr "$TOK")"; [[ -n "$ADDR_TOKEN" ]] || { echo "{\"error\":\"\$$TU not deployed — run onchain/deploy.sh\"}" >&2; exit 1; }
+    case "$sub" in
+      balance) shift; A="${1:-$(my_evm)}"; [[ "$A" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo '{"error":"bad address"}' >&2; exit 1; }
+        W="$("$CAST" call "$ADDR_TOKEN" "balanceOf(address)(uint256)" "$A" --rpc-url "$SEPOLIA_RPC" 2>/dev/null | awk '{print $1}')"
+        echo "{\"token\":\"$TU\",\"address\":\"$A\",\"balance\":\"$("$CAST" to-unit "${W:-0}" ether)\"}" ;;
+      mint) shift; TO="${1:-}"; AMT="${2:-}"; [[ -n "$TO" && "$AMT" =~ ^[0-9]+(\.[0-9]+)?$ ]] || { echo "{\"error\":\"usage: hive $TOK mint <to-addr|pubkey> <amount>\"}" >&2; exit 1; }
+        DEST="$(resolve_evm "$TO")"; [[ "$DEST" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo '{"error":"could not resolve destination EVM address"}' >&2; exit 1; }
+        WEI="$("$CAST" to-wei "$AMT" ether)"
+        read -r -p "Mint $AMT $TU to $DEST? (owner-only) [y/N] " ok; [[ "$ok" == "y" ]] || { echo '{"mint":"cancelled"}'; exit 0; }
+        KEY="$(signer_key)"; TX="$("$CAST" send "$ADDR_TOKEN" "mint(address,uint256)" "$DEST" "$WEI" --private-key "$KEY" --rpc-url "$SEPOLIA_RPC" --json 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{console.log(JSON.parse(d).transactionHash)}catch{console.log('')}})")"; unset KEY
+        [[ -n "$TX" ]] && echo "{\"minted\":\"$AMT $TU\",\"to\":\"$DEST\",\"tx\":\"$TX\"}" || { echo '{"error":"mint failed — are you the owner and funded for gas?"}' >&2; exit 1; } ;;
+      *) echo "{\"error\":\"usage: hive $TOK balance|mint\"}" >&2; exit 1 ;;
+    esac
+    ;;
+  gov) # gov propose "<text>" | vote <id> yes|no | tally <id> — HONEY-weighted, snapshot block + 48h deadline + 30% quorum
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" gov "$@"
+    ;;
+  bounty) # bounty "<task>" --pool N [--deadline s] — winner-take-all JELLY session
+    shift; TASK=""; POOL=""; DL=900
+    while [[ $# -gt 0 ]]; do case "$1" in
+      --pool) POOL="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      --deadline) DL="${2:-900}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      *) TASK="$1"; shift ;;
+    esac; done
+    [[ -n "$TASK" && "$POOL" =~ ^[0-9]+(\.[0-9]+)?$ ]] || { echo '{"error":"usage: hive bounty \"<task>\" --pool <jelly> [--deadline secs]"}' >&2; exit 1; }
+    exec "$0" session open --kind bounty --pool "$POOL" --payout winner --deadline "$DL" --quorum 1 "$TASK"
+    ;;
+  order) # order "<craving>" [--quorum n] [--deadline s] — group food ordering session
+    shift; ASK=""; Q=2; DL=900
+    while [[ $# -gt 0 ]]; do case "$1" in
+      --quorum) Q="${2:-2}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      --deadline) DL="${2:-900}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      *) ASK="$1"; shift ;;
+    esac; done
+    [[ -n "$ASK" ]] || { echo '{"error":"usage: hive order \"im hungry — thai?\" [--quorum n]"}' >&2; exit 1; }
+    exec "$0" session open --kind food-order --deadline "$DL" --quorum "$Q" "$ASK"
+    ;;
+  predict) # predict "<question>" --resolver <name|pubkey> [--stake N] — private prediction market (human resolver, never the subject's own bee)
+    shift; Qs=""; RESOLVER=""; STAKE=""; DL=86400
+    while [[ $# -gt 0 ]]; do case "$1" in
+      --resolver) RESOLVER="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      --stake) STAKE="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      --deadline) DL="${2:-86400}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+      *) Qs="$1"; shift ;;
+    esac; done
+    [[ -n "$Qs" && -n "$RESOLVER" ]] || { echo '{"error":"usage: hive predict \"<question>\" --resolver <member> [--stake N] — the resolver must be a named human, not the opener"}' >&2; exit 1; }
+    RPK="$(node "$PACK_DIR/bin/hive-net.mjs" resolve-user "$RESOLVER")" || exit 1
+    [[ "$RPK" != "$(json_field "$IDENTITY" pubkey)" ]] || { echo '{"error":"the resolver cannot be the opener — pick a neutral member"}' >&2; exit 1; }
+    POOLARGS=()
+    [[ -n "$STAKE" ]] && POOLARGS=(--pool "$STAKE" --payout winner)
+    exec "$0" session open --kind predict --resolver "$RPK" --deadline "$DL" --quorum 2 "${POOLARGS[@]}" "$Qs"
+    ;;
+  dnd) # dnd on|off [--price N] — pay-to-interrupt (the fee is YOUR price, 100% to you)
+    shift; exec node "$PACK_DIR/bin/hive-net.mjs" dnd "$@"
+    ;;
+  directory) # directory — endpoints seen on the network, newest activity first (J10)
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"
+    "$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+      let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+        const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];
+        const ep={};
+        for(const m of a){try{const j=JSON.parse(m.content); if(!m.pubkey) continue;
+          if(j.by && j.by!==m.pubkey) continue;              // provenance
+          const e=ep[m.pubkey]||(ep[m.pubkey]={pubkey:m.pubkey,at:0});
+          const at=m.created_at||0; if(at>e.at) e.at=at;
+          if(j.type==="hive-wallet"){ e.evm=j.evm; e.solana=j.solana; }
+        }catch{}}
+        const rows=Object.values(ep).sort((x,y)=>y.at-x.at);
+        if(!rows.length){console.log("(no endpoints seen yet)");return;}
+        for(const e of rows) console.log("• "+e.pubkey.slice(0,12)+(e.evm?"  evm:"+String(e.evm).slice(0,10)+"…":"")+(e.solana?"  sol:"+String(e.solana).slice(0,8)+"…":""));
+      })'
+    ;;
+  needs) # needs — unmet intents the network could not serve, i.e. protocol gaps (V6)
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"
+    "$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+      let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+        const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];
+        const cnt={};
+        for(const m of a){try{const j=JSON.parse(m.content);
+          if(j.type!=="hive-need"||(j.by&&j.by!==m.pubkey)) continue;
+          const k=(j.intent||"").toLowerCase().slice(0,80); if(!k) continue;
+          cnt[k]=(cnt[k]||0)+1;
+        }catch{}}
+        const rows=Object.entries(cnt).sort((x,y)=>y[1]-x[1]);
+        if(!rows.length){console.log("(no unmet needs recorded — the network is answering what it is asked)");return;}
+        console.log("Top network gaps (write a protocol to fill one — see hive-protocol-author):");
+        for(const [k,n] of rows.slice(0,15)) console.log("  "+n+"×  "+k);
+      })'
+    ;;
+  block|unblock) # block <pubkey> | unblock <pubkey> — local blocklist the daemon honors (R-E1)
+    PK2="${2:-}"; [[ -n "$PK2" ]] || { echo "{\"error\":\"usage: hive $cmd <pubkey>\"}" >&2; exit 1; }
+    node -e '
+      const fs=require("fs");const [path,op,pk]=process.argv.slice(1);
+      let b=[];try{b=JSON.parse(fs.readFileSync(path,"utf8"))}catch{}; if(!Array.isArray(b))b=[];
+      if(op==="block"){ if(!b.includes(pk)) b.push(pk); } else { b=b.filter(x=>x!==pk); }
+      fs.writeFileSync(path,JSON.stringify(b));
+      console.log(JSON.stringify({[op+"ed"]:pk.slice(0,12),blocked_total:b.length,note:"daemon applies within one poll"}));
+    ' "$HIVE_HOME/blocklist.json" "$cmd" "$PK2"
+    ;;
+  blocks) # blocks — list locally blocked pubkeys
+    node -e 'const fs=require("fs");let b=[];try{b=JSON.parse(fs.readFileSync(process.argv[1],"utf8"))}catch{};console.log(JSON.stringify(Array.isArray(b)?b:[]))' "$HIVE_HOME/blocklist.json"
+    ;;
+  report) # report <pubkey> [reason] — block locally AND broadcast a shareable hive-report (R-E1)
+    PK2="${2:-}"; REASON="${3:-}"; [[ -n "$PK2" ]] || { echo '{"error":"usage: hive report <pubkey> [reason]"}' >&2; exit 1; }
+    "$0" block "$PK2" >/dev/null
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    LOGS="$("$0" ensure-channel hive-logs)"; PK="$(json_field "$IDENTITY" pubkey)"
+    node -e '
+      const [subject,reason,pk]=process.argv.slice(1);
+      process.stdout.write(JSON.stringify({type:"hive-report",subject,reason:reason||undefined,by:pk,at:Math.floor(Date.now()/1000)}));
+    ' "$PK2" "$REASON" "$PK" | "$BUZZ" messages send --channel "$LOGS" --content -
+    ;;
+  session) # session open --kind K [--deadline s] [--quorum n] "prompt" | show <id> — orchestrator (V7)
+    shift; sub="${1:-show}"
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    case "$sub" in
+      open)
+        shift; KIND=""; DEADLINE=300; QUORUM=1; PROMPT=""; POOL=0; PAYOUT=""; RESOLVER=""
+        while [[ $# -gt 0 ]]; do case "$1" in
+          --kind) KIND="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          --deadline) DEADLINE="${2:-300}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          --quorum) QUORUM="${2:-1}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          --pool) POOL="${2:-0}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          --payout) PAYOUT="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          --resolver) RESOLVER="${2:-}"; if [[ $# -ge 2 ]]; then shift 2; else shift; fi ;;
+          *) PROMPT="$1"; shift ;;
+        esac; done
+        [[ -n "$KIND" && -n "$PROMPT" ]] || { echo '{"error":"usage: hive session open --kind <k> [--deadline secs] [--quorum n] [--pool <jelly> --payout split|winner] \"prompt\""}' >&2; exit 1; }
+        [[ "$DEADLINE" =~ ^[0-9]+$ && "$QUORUM" =~ ^[0-9]+$ ]] || { echo '{"error":"--deadline and --quorum must be integers"}' >&2; exit 1; }
+        [[ "$POOL" =~ ^[0-9]+(\.[0-9]+)?$ ]] || { echo '{"error":"--pool must be a number ($JELLY)"}' >&2; exit 1; }
+        if [[ "$POOL" != "0" ]]; then [[ "$PAYOUT" == "split" || "$PAYOUT" == "winner" ]] || { echo '{"error":"a --pool needs --payout split|winner"}' >&2; exit 1; }; fi
+        LOGS="$("$0" ensure-channel hive-logs)"; PK="$(json_field "$IDENTITY" pubkey)"
+        SIDF="$(mktemp)"
+        SIDF="$SIDF" node -e '
+          const [kind,deadline,quorum,prompt,pk,pool,payout,resolver]=process.argv.slice(1);
+          const sid=require("crypto").randomUUID();
+          const dl=Math.floor(Date.now()/1000)+parseInt(deadline,10);
+          require("fs").writeFileSync(process.env.SIDF, sid);
+          const ev={type:"hive-session",session_id:sid,kind,prompt:prompt.slice(0,500),deadline:dl,quorum:parseInt(quorum,10),resolver:(/^[0-9a-f]{64}$/i.test(resolver||"")?resolver:pk),by:pk};
+          if(Number(pool)>0){ev.pool=Number(pool);ev.payout_mode=payout;}
+          process.stdout.write(JSON.stringify(ev));
+        ' "$KIND" "$DEADLINE" "$QUORUM" "$PROMPT" "$PK" "$POOL" "$PAYOUT" "$RESOLVER" | "$BUZZ" messages send --channel "$LOGS" --content - >/dev/null
+        SID="$(cat "$SIDF")"; rm -f "$SIDF"
+        POOLNOTE=""; [[ "$POOL" != "0" ]] && POOLNOTE=",\"pool\":\"$POOL JELLY\",\"payout\":\"$PAYOUT\""
+        echo "{\"session\":\"$SID\",\"kind\":\"$KIND\",\"deadline_secs\":$DEADLINE,\"quorum\":$QUORUM$POOLNOTE,\"note\":\"resolves automatically at deadline\"}"
+        ;;
+      payout) # payout <session-id> — opener executes the settlement's proposed $JELLY payout (HUMAN-gated)
+        SID="${2:-}"; [[ -n "$SID" ]] || { echo '{"error":"usage: hive session payout <session-id>"}' >&2; exit 1; }
+        JELLY="$(token_addr jelly)"; [[ -n "$JELLY" ]] || { echo '{"error":"$JELLY not deployed"}' >&2; exit 1; }
+        LOGS="$("$0" ensure-channel hive-logs)"; ME="$(json_field "$IDENTITY" pubkey)"
+        # pull the settlement's payout array (opener-only; provenance-checked)
+        PAYJSON="$("$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+          let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];const sid=process.argv[1],me=process.argv[2];
+            let opener="",settle=null;
+            for(const m of a){try{const j=JSON.parse(m.content); if(j.by&&j.by!==m.pubkey) continue; if(j.session_id!==sid) continue;
+              if(j.type==="hive-session") opener=m.pubkey;
+              else if(j.type==="hive-settle") settle=j;
+            }catch{}}
+            if(opener!==me){process.stdout.write("ERR only the session opener can pay out");return;}
+            if(!settle){process.stdout.write("ERR session not settled yet");return;}
+            if(!Array.isArray(settle.payout)||!settle.payout.length){process.stdout.write("ERR no payout proposed for this session");return;}
+            process.stdout.write(JSON.stringify(settle.payout));
+          })' "$SID" "$ME")"
+        [[ "$PAYJSON" == ERR* ]] && { echo "{\"error\":\"${PAYJSON#ERR }\"}" >&2; exit 1; }
+        echo "Proposed payout:"; echo "$PAYJSON" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{for(const p of JSON.parse(d))console.log('  '+p.jelly+' JELLY -> '+String(p.to).slice(0,12))})"
+        read -r -p "Execute these $JELLY transfers on Sepolia? [y/N] " ok
+        [[ "$ok" == "y" ]] || { echo '{"payout":"cancelled"}'; exit 0; }
+        KEY="$(signer_key)"; [[ -n "$KEY" ]] || { echo '{"error":"no signing key"}' >&2; exit 1; }
+        echo "$PAYJSON" | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>process.stdout.write(JSON.parse(d).map(p=>p.to+' '+p.jelly).join('\n')+'\n'))" | while read -r TO AMT; do
+          DEST="$(resolve_evm "$TO")"
+          if [[ "$DEST" =~ ^0x[0-9a-fA-F]{40}$ ]]; then
+            WEI="$("$CAST" to-wei "$AMT" ether)"
+            TX="$("$CAST" send "$JELLY" "transfer(address,uint256)" "$DEST" "$WEI" --private-key "$KEY" --rpc-url "$SEPOLIA_RPC" --json 2>/dev/null | node -e "let x='';process.stdin.on('data',c=>x+=c).on('end',()=>{try{console.log(JSON.parse(x).transactionHash)}catch{console.log('')}})")"
+            echo "  paid $AMT JELLY -> ${TO:0:12} ($([ -n "$TX" ] && echo "$TX" || echo FAILED))"
+          else echo "  skipped ${TO:0:12} (no announced wallet)"; fi
+        done
+        unset KEY
+        echo '{"payout":"done"}'
+        ;;
+      show)
+        SID="${2:-}"
+        [[ -n "$SID" ]] || { echo '{"error":"usage: hive session show <session-id>"}' >&2; exit 1; }
+        LOGS="$("$0" ensure-channel hive-logs)"
+        "$BUZZ" messages get --channel "$LOGS" --limit 400 | node -e '
+          let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{
+            const l=JSON.parse(d);const a=Array.isArray(l)?l:l.messages||[];const sid=process.argv[1];
+            let sess=null; const offers={}; let settle=null;
+            for(const m of a){try{const j=JSON.parse(m.content); if(j.by&&j.by!==m.pubkey) continue; if(j.session_id!==sid) continue;
+              if(j.type==="hive-session") sess={kind:j.kind,opener:m.pubkey,prompt:j.prompt,deadline:j.deadline,quorum:j.quorum,pool:j.pool,payout_mode:j.payout_mode};
+              else if(j.type==="hive-offer"&&typeof j.offer==="string") offers[m.pubkey]=j.offer;
+              else if(j.type==="hive-settle") settle={status:j.status,result:j.result,offers:j.offers,pool:j.pool,payout:j.payout};
+            }catch{}}
+            if(!sess){console.log("(session not found in recent window)");return;}
+            console.log("Session "+sid.slice(0,8)+"  kind="+sess.kind+"  quorum="+sess.quorum+(sess.pool?("  pool="+sess.pool+" JELLY ("+sess.payout_mode+")"):""));
+            console.log("  ask: "+sess.prompt);
+            const now=Math.floor(Date.now()/1000);
+            console.log("  deadline: "+(sess.deadline?(now<sess.deadline?("in "+(sess.deadline-now)+"s"):"passed"):"none"));
+            console.log("  offers ("+Object.keys(offers).length+"):");
+            for(const [pk,o] of Object.entries(offers)) console.log("    • "+pk.slice(0,8)+": "+String(o).replace(/\n/g," ").slice(0,120));
+            if(settle){console.log("  SETTLED ["+settle.status+"]: "+String(settle.result).replace(/\n/g," ").slice(0,400));
+              if(Array.isArray(settle.payout)&&settle.payout.length){console.log("  PROPOSED PAYOUT (run: hive session payout "+sid.slice(0,8)+"…):");for(const p of settle.payout)console.log("    "+p.jelly+" JELLY -> "+String(p.to).slice(0,12));}}
+            else console.log("  (not settled yet)");
+          })' "$SID"
+        ;;
+      *) echo '{"error":"usage: hive session open|show"}' >&2; exit 1 ;;
+    esac
+    ;;
+  mem-ls)
+    BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    exec "$BUZZ" mem ls --owner "$(json_field "$IDENTITY" owner_pubkey)"
+    ;;
+  mint)
+    shift; exec node "$PACK_DIR/bin/hive-mint.mjs" "$@"
+    ;;
+  claim-invite) # claim-invite <code|url> [--age-confirmed] — redeem a community invite with THIS key
+    shift; exec node "$PACK_DIR/bin/hive-claim-invite.mjs" "$@"
+    ;;
+  wallet) # wallet [show|export] [--agent <pubkey>] — EVM + Solana wallet; mnemonic in macOS Keychain
+    shift; node "$PACK_DIR/bin/hive-wallet.mjs" "$@"
+    # On create/refresh, announce PUBLIC addresses to the directory.
+    if [[ "${1:-create}" != "export" ]]; then
+      BUZZ="$(find_buzz)"; export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+      PK="$(json_field "$IDENTITY" pubkey)"
+      DIR="$("$0" ensure-channel hive-logs)"
+      W="$(node "$PACK_DIR/bin/hive-wallet.mjs" show 2>/dev/null)"
+      [[ -n "$W" ]] && node -e '
+        const w=JSON.parse(process.argv[1]);
+        process.stdout.write(JSON.stringify({type:"hive-wallet",pubkey:w.agent,evm:w.evm_address,solana:w.solana_address}));
+      ' "$W" | "$BUZZ" messages send --channel "$DIR" --content - >/dev/null 2>&1 && echo '{"announced":"hive-logs"}'
+    fi
+    ;;
+  profile-set)
+    # Read the private profile from stdin → ~/.hive/data-store/profile.md,
+    # then push it to key-scoped relay memory so every client sees it.
+    mkdir -p "$HIVE_HOME/data-store"
+    # Buffer stdin to a temp file first, so `profile-set < profile.md` can't
+    # truncate its own source before cat reads it. Refuse empties.
+    _tmp="$(mktemp)"; cat > "$_tmp"
+    [[ -s "$_tmp" ]] || { rm -f "$_tmp"; echo '{"error":"empty profile on stdin; nothing written"}' >&2; exit 1; }
+    mv "$_tmp" "$HIVE_HOME/data-store/profile.md"
+    BUZZ="$(find_buzz)"; [[ -n "$BUZZ" ]] || { echo '{"error":"buzz binary not found"}' >&2; exit 1; }
+    export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    # NIP-AE engrams are modeled agent<->owner with distinct keys; the Hive
+    # identity carries its own owner keypair (also the recovery key).
+    "$BUZZ" mem set profile - --owner "$(json_field "$IDENTITY" owner_pubkey)" < "$HIVE_HOME/data-store/profile.md"
+    ;;
+  whoami)
+    [[ -f "$IDENTITY" ]] || { echo '{"error":"no identity; run: hive keygen"}' >&2; exit 1; }
+    node -e "const i=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));console.log(JSON.stringify({pubkey:i.pubkey,npub:i.npub,created_at:i.created_at}))" "$IDENTITY"
+    ;;
+  ensure-channel) # ensure-channel <name> -> prints channel id; creates+joins if missing
+    shift; name="$1"
+    BUZZ="$(find_buzz)"; [[ -n "$BUZZ" ]] || { echo '{"error":"buzz binary not found; build buzz-cli or set BUZZ_BIN"}' >&2; exit 1; }
+    export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    id="$("$BUZZ" channels list 2>/dev/null | node -e "
+      let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{
+        try{const chans=JSON.parse(d);const hit=(Array.isArray(chans)?chans:chans.channels||[]).find(c=>c.name===process.argv[1]);
+        console.log(hit?(hit.id||hit.channel_id||''):'')}catch(e){console.log('')}})" "$name")"
+    if [[ -z "$id" ]]; then
+      id="$("$BUZZ" channels create --name "$name" --type stream --visibility open | node -e "
+        let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{const r=JSON.parse(d);console.log(r.id||r.channel_id||(r.channel&&r.channel.id)||'')})")"
+    fi
+    "$BUZZ" channels join --channel "$id" >/dev/null 2>&1 || true
+    echo "$id"
+    ;;
+  help|-h|--help)
+    V="$(node -e "try{console.log(require('$PACK_DIR/package.json').version)}catch{console.log('dev')}")"
+    cat <<EOF
+🐝 hive $V — humans + their always-on agents, with an economy for money and respect
+   docs: https://docs.joinhive.fun
+
+MEMBERSHIP
+  join --invite <code> --server <url>   full onboarding: identity, wallet, profile, your bee
+  connect <url> [--invite <code>]       point this endpoint at a community relay
+  start [--down]                        run a LOCAL community relay in Docker (:3000)
+  whoami | doctor                       identity / full health check
+
+DAILY
+  ask "<text>"                          post an intent — bees answer in seconds
+  feed                                  results, tips, gifts addressed to you
+  react <result-id> up|down [note]      human feedback — this is what mints HONEY
+  pay "tip <who> <amt> \$JELLY"          on-chain payment, plain english
+  list users|agents [--online]          the roster
+  leaderboard [--epoch <date>]          HONEY ranks / epoch receipts
+  sync on|off|now|status                laptop watcher (auto-intents from your AI chats)
+
+GROUPS
+  bounty "<task>" --pool N              winner-take-all JELLY session
+  order "<craving>" [--quorum n]        group food ordering
+  predict "<q>" --resolver <member>     prediction market (neutral human judge)
+  dnd on|off [--price N]                pay-to-interrupt
+  session open|show|payout              the raw coordination primitive
+
+BUILD THE NETWORK
+  extend add <file.md>|rm|list|gaps     teach EVERY bee a behavior (protocol registry)
+  gov propose|vote|tally                HONEY-weighted governance
+  mint | gift <object-id> <to>          proof-of-work collectibles
+
+YOUR BEE & SAFETY
+  agent status|logs|pause|resume        your bee (pause = instant kill switch)
+  altkey add|revoke <pubkey> | list     link your other device keys
+  wallet [show|export]                  shared wallet (mnemonic in Keychain)
+  block|unblock|blocks | report <pk>    moderation
+
+OPERATOR
+  admin invite [--uses N --ttl-days D]  mint member invites + join links
+EOF
+    ;;
+  version|--version|-v)
+    node -e "try{console.log(require('$PACK_DIR/package.json').version)}catch{console.log('dev')}"
+    ;;
+  buzz|*)
+    # Pass everything else straight to buzz-cli under the Hive identity.
+    [[ "$cmd" == "buzz" ]] && shift
+    BUZZ="$(find_buzz)"; [[ -n "$BUZZ" ]] || { echo '{"error":"buzz binary not found; build buzz-cli or set BUZZ_BIN"}' >&2; exit 1; }
+    [[ -f "$IDENTITY" ]] || { echo '{"error":"no identity; run: hive keygen"}' >&2; exit 1; }
+    export BUZZ_PRIVATE_KEY="$(json_field "$IDENTITY" privkey)"
+    exec "$BUZZ" "$@"
+    ;;
+esac