joinhive 2.0.1 → 2.1.0

package/bin/hive-join.mjs

@@ -1,34 +1,46 @@
 #!/usr/bin/env node
-// hive-join — full member onboarding, from community link to live bee.
+// hive-join — full member onboarding: one command → live bee → Buzz UI.
 //
-//   hive join --invite <code> --server https://api.<domain> [--export chat.zip] [--name sid]
+//   npx joinhive join --invite <code>                  (primary path)
+//   hive join --invite <code> [--server https://api.<domain>]
 //
 // What happens where (the privacy contract):
 //   LAPTOP: identity keys, the shared wallet mnemonic (Apple Keychain), your
 //           LLM API key (login Keychain, for the sync watcher), and the
 //           profile distillation — RAW CHAT HISTORY NEVER LEAVES.
-//   UPLOADED: the distilled profile + a nacl.box-sealed {wallet_mnemonic,
-//           llm_api_key} that only the bee-host can open (your bee needs the
-//           key to think and the wallet to transact 24/7 — your decision #9).
-// Every step is idempotent: re-running resumes wherever it stopped.
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import { execFileSync, spawnSync } from 'node:child_process';
+//   UPLOADED: the distilled profile (shown to you first) + a nacl.box-sealed
+//           {wallet_mnemonic, llm_api_key?} only the bee-host can open.
+//
+// Echo-first: you can join WITHOUT an LLM key — your bee is born in echo mode
+// (alive, visible, silent) and `hive key set` switches its brain on later.
+// Every step is idempotent: re-running the same command resumes.
+//
+// Flags: --name --provider --model-extract --model-compute --export <zip>
+//        --yes (skip confirmations) --no-watcher --redistill
+// Headless: --provider … with HIVE_LLM_KEY set, --skip-key (echo-first,
+// brainless until `hive key set`), or --provider echo (test seam: answers).
+import { readFileSync, writeFileSync, existsSync, mkdirSync, cpSync, symlinkSync, rmSync, appendFileSync } from 'node:fs';
+import { execFileSync, spawnSync, spawn } from 'node:child_process';
 import { homedir, platform, userInfo } from 'node:os';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { createInterface } from 'node:readline/promises';
 import nacl from 'tweetnacl';
 import { finalizeEvent } from 'nostr-tools/pure';
 import { signedFetch } from '../shared/nip98.mjs';
 import { computeAuthTag } from '../shared/nip-oa.mjs';
 import { createEngine } from '../daemon/engines/index.mjs';
-import { OPENAI_COMPAT_BASES, MODEL_TIERS } from '../shared/config-schema.mjs';
+import { OPENAI_COMPAT_BASES, MODEL_TIERS, DEFAULTS } from '../shared/config-schema.mjs';
+import { EV, tryJson } from '../shared/events.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
+import { select, ask, confirm, pause, spinner, checkpoints } from '../shared/prompt.mjs';
 
 const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
 const HIVE_HOME = process.env.HIVE_HOME || join(homedir(), '.hive');
 const args = process.argv.slice(2);
 const flag = (n) => { const i = args.indexOf(`--${n}`); return i >= 0 ? args[i + 1] : null; };
+const has = (n) => args.includes(`--${n}`);
 const say = (...a) => console.log('🐝', ...a);
+const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const die = (msg) => { console.error('❌', msg); process.exit(1); };
 const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
 const node = (script, argv = [], opts = {}) => {
@@ -36,13 +48,71 @@ const node = (script, argv = [], opts = {}) => {
   return { code: r.status, out: (r.stdout || '') + (r.status !== 0 ? (r.stderr || '') : '') };
 };
 
+// The flagship community. Invite links can point anywhere via --server.
+const DEFAULT_SERVER = 'https://bee-host-production.up.railway.app';
 const INVITE = flag('invite');
-const SERVER = (flag('server') || '').replace(/\/+$/, '');
-if (!INVITE || !SERVER) die('usage: hive join --invite <code> --server https://api.<domain> [--export <claude-export.zip>] [--name <you>]');
+const SERVER = (flag('server') || DEFAULT_SERVER).replace(/\/+$/, '');
+if (!INVITE) die('usage: npx joinhive join --invite <code> [--server https://api.<domain>]');
 
-const rl = createInterface({ input: process.stdin, output: process.stdout });
+// ---- npx self-install -------------------------------------------------------
+// `npx joinhive …` runs from npm's _npx cache, which npm garbage-collects —
+// anything durable pointed there (the launchd watcher plist, the PATH shim)
+// dies silently later. So the first npx run copies the pack to ~/.hive-pack
+// (the same canonical home the curl installer uses) and re-execs from there.
+// If anything about the copy fails we keep going from the cache, minus the
+// watcher.
+let watcherUnsafe = false;
+const vgte = (a, b) => { // "2.1.0" >= "2.0.1"
+  const pa = String(a).split('.').map(Number); const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) { if ((pa[i] || 0) > (pb[i] || 0)) return true; if ((pa[i] || 0) < (pb[i] || 0)) return false; }
+  return true;
+};
+const installShim = (dest) => {
+  mkdirSync(join(homedir(), '.hive', 'bin'), { recursive: true });
+  const shim = join(homedir(), '.hive', 'bin', 'hive');
+  try { rmSync(shim, { force: true }); } catch {}
+  symlinkSync(join(dest, 'bin', 'hive'), shim);
+  for (const rc of [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')]) {
+    try {
+      if (existsSync(rc) && !readFileSync(rc, 'utf8').includes('.hive/bin')) {
+        appendFileSync(rc, '\nexport PATH="$HOME/.hive/bin:$PATH"\n');
+      }
+    } catch {}
+  }
+};
+const selfInstall = () => {
+  if (process.env.HIVE_NO_SELF_INSTALL) return;
+  const DEST = join(homedir(), '.hive-pack');
+  if (resolve(PACK_DIR) === resolve(DEST)) return;
+  const fromNpx = PACK_DIR.split(sep).includes('_npx') || process.env.npm_command === 'exec';
+  if (!fromNpx) return;
+  try {
+    const mine = loadJson(join(PACK_DIR, 'package.json'), {}).version || '0.0.0';
+    const theirs = loadJson(join(DEST, 'package.json'), {}).version;
+    if (!(theirs && vgte(theirs, mine))) {
+      say(`installing the hive pack to ~/.hive-pack (v${mine}) — npx cache dirs get garbage-collected …`);
+      cpSync(PACK_DIR, DEST, {
+        recursive: true, force: true,
+        filter: (src) => !/\/(node_modules|\.git)(\/|$)/.test(src) && !/\/onchain\/(lib|out|cache)(\/|$)/.test(src),
+      });
+      const inst = spawnSync('npm', ['install', '--omit=dev', '--silent', '--no-fund', '--no-audit'], { cwd: DEST, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
+      if (inst.status !== 0) throw new Error(`npm install: ${String(inst.stderr).slice(0, 160)}`);
+    }
+    installShim(DEST);
+    const r = spawnSync(process.execPath, [join(DEST, 'bin', 'hive-join.mjs'), ...args], {
+      stdio: 'inherit', env: { ...process.env, HIVE_NO_SELF_INSTALL: '1' },
+    });
+    process.exit(r.status ?? 0);
+  } catch (e) {
+    say(`⚠️ self-install skipped (${String(e.message).slice(0, 120)}) — continuing from the npx cache without the auto-sync watcher`);
+    watcherUnsafe = true;
+  }
+};
+selfInstall();
 
 const main = async () => {
+  const joinStart = Math.floor(Date.now() / 1000);
+
   // 0. Server hello: provisioning box key + the community's relay URL.
   say(`checking in with ${SERVER} …`);
   let hello;
@@ -51,13 +121,17 @@ const main = async () => {
   if (!hello.box_pub || !hello.relay) die('server did not return a provisioning key');
   const RELAY = hello.relay;
 
-  // 1. Identity (idempotent).
+  // 1. Identity (idempotent) — needed before the name check can tell
+  //    "taken by someone else" from "mine, resuming".
   const kg = node('bin/hive-keygen.mjs');
   if (kg.code !== 0) die(`keygen failed: ${kg.out.slice(0, 200)}`);
   const identity = loadJson(join(HIVE_HOME, 'identity.json'), null) || die('identity missing after keygen');
   say(`your key: ${identity.pubkey.slice(0, 12)}…`);
 
-  // 2. Join the community relay (config + invite claim).
+  // 2. Join the community relay AS YOURSELF (config + invite claim). The
+  //    server claims membership for the BEE key separately — without this
+  //    claim the OWNER can't publish anything (kind-30177, channel joins,
+  //    every future `hive ask`).
   const cfgPath = join(HIVE_HOME, 'config.json');
   const cfg = loadJson(cfgPath, {});
   cfg.relay = RELAY;
@@ -68,113 +142,237 @@ const main = async () => {
     if (claimJson.error === 'age_attestation_required') die('this community requires an age attestation — re-run with the CLI flag --age-confirmed via: hive claim-invite');
     // Open relay (dev/local) has no membership gate: if reads work without a
     // claim, continue. On a closed relay the probe 403s and this is fatal.
-    const { signedFetch: probeFetch } = await import('../shared/nip98.mjs');
-    const probe = await probeFetch(identity.privkey, 'POST', `${RELAY.replace(/^ws/, 'http')}/query`, [{ kinds: [39000], limit: 1 }]);
+    const probe = await signedFetch(identity.privkey, 'POST', `${RELAY.replace(/^ws/, 'http')}/query`, [{ kinds: [39000], limit: 1 }]);
     if (probe.status !== 200) die(`relay invite claim failed: ${claim.out.slice(0, 300)}`);
     say('relay has no membership gate (open/dev) — continuing without a claim');
   }
   say(`joined relay ${RELAY}`);
 
-  // 3. Shared wallet — mnemonic into the Apple Keychain, shown ONCE.
-  const w = node('bin/hive-wallet.mjs');
-  if (w.code !== 0) die(`wallet failed: ${w.out.slice(0, 200)}`);
-  const wallet = JSON.parse(w.out.trim().split('\n').pop());
-  say(`shared wallet: ${wallet.evm_address}`);
-  if (wallet.status === 'created') {
-    const exp = node('bin/hive-wallet.mjs', ['export']);
+  // 3. PROMPT 1 — the bee's name, availability-checked before any real work.
+  const defaultName = (flag('name') || cfg.owner_name || userInfo().username || 'member').toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 24);
+  let resuming = false;
+  const nameCheck = async (n) => {
+    if (!/^[a-z0-9][a-z0-9-]{1,23}$/.test(n)) return 'letters, digits, dashes — 2 to 24 chars';
     try {
-      const mn = JSON.parse(exp.out).mnemonic;
-      say('———— WRITE THIS DOWN (recovery phrase — shown once, stored in your Apple Keychain) ————');
-      console.log(`    ${mn}`);
-      say('————————————————————————————————————————————————————————————————————————');
-    } catch {}
-  }
+      const r = await fetch(`${SERVER}/api/bees/${n}/status`, { signal: AbortSignal.timeout(6000) });
+      if (r.status === 404) return true;
+      const st = await r.json().catch(() => ({}));
+      if (st.owner_pubkey && st.owner_pubkey !== identity.pubkey) return `"${n}.bee" already belongs to another member — pick a different name`;
+      resuming = !!st.owner_pubkey;
+      return true;
+    } catch { return true; } // network hiccup — provisioning still arbitrates (409)
+  };
+  const name = flag('name')
+    ? await (async () => { const v = await nameCheck(defaultName); if (v !== true) die(v); return defaultName; })()
+    : await ask({ prompt: "your bee's name", def: defaultName, validate: nameCheck });
+  if (resuming) say(`${name}.bee is already yours — resuming that provision`);
 
-  // 4. Your LLM provider + API key (your bee thinks with YOUR key).
-  const name = (flag('name') || cfg.owner_name || userInfo().username || 'member').toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 24);
-  let provider = flag('provider') || (['anthropic', 'openai', 'openrouter', 'hermes'].includes(cfg.provider) ? cfg.provider : null);
+  // 3. PROMPT 2 — the bee's brain. "Skip for now" is first on purpose: the
+  //    hardest ask of onboarding (go get an API key) comes AFTER the first
+  //    win, not before it.
+  let provider = flag('provider') || (process.env.HIVE_LLM_KEY && ['anthropic', 'openai', 'openrouter', 'hermes'].includes(cfg.provider) ? cfg.provider : null);
+  let awaitingKey = false;
+  if (has('skip-key')) { provider = 'echo'; awaitingKey = true; } // headless echo-first
   if (!provider) {
-    provider = (await rl.question('LLM provider for your bee [anthropic/openai/openrouter/hermes] (default anthropic): ')).trim().toLowerCase() || 'anthropic';
+    const pick = await select({
+      title: "your bee's brain",
+      options: [
+        { label: 'Skip for now — decide later', hint: 'your bee joins in echo mode; `hive key set` adds a brain in 60s', value: 'skip' },
+        { label: 'OpenRouter', hint: 'recommended: one key, every model — $5 lasts months (openrouter.ai/keys)', value: 'openrouter' },
+        { label: 'Anthropic', hint: 'API key from console.anthropic.com (a Claude subscription is NOT an API key)', value: 'anthropic' },
+        { label: 'OpenAI', hint: 'API key from platform.openai.com', value: 'openai' },
+        { label: 'Nous Hermes', hint: 'API key from portal.nousresearch.com', value: 'hermes' },
+      ],
+    });
+    if (pick === 'skip') { provider = 'echo'; awaitingKey = true; }
+    else provider = pick;
   }
   if (!['anthropic', 'openai', 'openrouter', 'hermes', 'echo'].includes(provider)) die(`unknown provider "${provider}"`);
+
   let llmKey = process.env.HIVE_LLM_KEY || null;
   let models = { extract: flag('model-extract'), compute: flag('model-compute') };
-  if (provider === 'echo') {
-    llmKey = 'echo'; // test seam: no key, no thinking, no spend — rehearsals/CI
-  } else {
+  if (provider === 'echo' && !awaitingKey) {
+    llmKey = 'echo'; // test seam (--provider echo): no key, no thinking, no spend — rehearsals/CI
+  } else if (provider !== 'echo') {
     if (!llmKey && platform() === 'darwin') {
       try { llmKey = execFileSync('security', ['find-generic-password', '-a', provider, '-s', 'hive-llm-key', '-w'], { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim(); say(`using the ${provider} key already in your Keychain`); } catch {}
     }
-    if (!llmKey) llmKey = (await rl.question(`${provider} API key (stored in your login Keychain, uploaded sealed for your bee): `)).trim();
-    if (!llmKey) die('an API key is required — your bee cannot think without one');
-    if ((provider === 'openrouter' || provider === 'hermes') && (!models.extract || !models.compute)) {
-      models.extract = models.extract || (await rl.question(`${provider} model id for cheap extraction: `)).trim();
-      models.compute = models.compute || (await rl.question(`${provider} model id for strong compute: `)).trim();
+    if (!llmKey) llmKey = (await ask({ prompt: `${provider} API key ${dim('(stored in your login Keychain, uploaded sealed for your bee)')}` })).trim();
+    if (!llmKey) die('an API key is required for that provider — or re-run and pick "Skip for now"');
+    if (provider === 'openrouter' || provider === 'hermes') {
+      // Sensible defaults instead of blank raw-model-ID prompts (Enter-Enter).
+      const defs = provider === 'openrouter'
+        ? { extract: 'anthropic/claude-haiku-4.5', compute: 'anthropic/claude-sonnet-5' }
+        : { extract: 'Hermes-4-405B', compute: 'Hermes-4-405B' };
+      models.extract = models.extract || await ask({ prompt: `${provider} model for cheap extraction`, def: defs.extract });
+      models.compute = models.compute || await ask({ prompt: `${provider} model for strong compute`, def: defs.compute });
     }
-    say('validating the key with a 1-token self-test …');
+    const spinKey = spinner('validating the key with a 1-token self-test …');
     const tiers = MODEL_TIERS[provider] || {};
     const engine = createEngine({ provider, base_url: OPENAI_COMPAT_BASES[provider], model_extract: models.extract || tiers.extract, model_compute: models.compute || tiers.compute }, { llm_api_key: llmKey }, {});
     const probe = await engine.selftest();
-    if (String(probe).startsWith('engine-error')) die(`key check failed: ${probe.slice(0, 200)}`);
-    say('key works ✓');
+    if (String(probe).startsWith('engine-error')) { spinKey.stop(); die(`key check failed: ${probe.slice(0, 200)}`); }
+    spinKey.stop('🐝 key works ✓');
     if (platform() === 'darwin') {
       try { execFileSync('security', ['add-generic-password', '-U', '-a', provider, '-s', 'hive-llm-key', '-l', `Hive LLM key (${provider})`, '-w', llmKey], { stdio: 'ignore' }); } catch {}
     }
   }
 
-  // 5. Distill the private profile LOCALLY (the only data that gets uploaded).
+  // 4. PROMPT 3 — memory. Local chat history is auto-detected; a claude.ai
+  //    export zip makes the profile much richer for people who mostly chat
+  //    in the app rather than the terminal.
+  let exportZip = flag('export');
+  const profilePath = join(HIVE_HOME, 'data-store', 'profile.md');
+  const hasProfile = existsSync(profilePath) && readFileSync(profilePath, 'utf8').trim().length > 50 && !has('redistill');
+  if (!exportZip && !hasProfile && !has('yes')) {
+    exportZip = await ask({
+      prompt: `claude.ai export zip for richer memory ${dim('(claude.ai → Settings → Export data; Enter to skip)')}`,
+      def: '',
+      validate: (v) => !v || existsSync(v) || 'no file at that path (Enter to skip)',
+    });
+  }
+
+  // 5. Shared wallet — mnemonic into the Apple Keychain, shown ONCE, and the
+  //    flow HALTS until the human says they wrote it down (PROMPT 4).
+  const w = node('bin/hive-wallet.mjs');
+  if (w.code !== 0) die(`wallet failed: ${w.out.slice(0, 200)}`);
+  const wallet = JSON.parse(w.out.trim().split('\n').pop());
+  say(`shared wallet: ${wallet.evm_address}`);
+  if (wallet.status === 'created') {
+    const exp = node('bin/hive-wallet.mjs', ['export']);
+    try {
+      const mn = JSON.parse(exp.out).mnemonic;
+      say('———— RECOVERY PHRASE (shown once; backed up in your Apple Keychain) ————');
+      console.log(`    ${mn}`);
+      say('————————————————————————————————————————————————————————————————————————');
+      if (!has('yes')) {
+        await pause({ prompt: '   write these 12 words down, then press Enter →' });
+        if (process.stdout.isTTY) process.stdout.write('\x1b[4A\x1b[0J');
+        say('recovery phrase acknowledged ✓ (it stays in your Keychain: hive wallet export)');
+      }
+    } catch {}
+  }
+
+  // 6. Distill the private profile LOCALLY (the only data that gets uploaded).
   //    An existing profile is PRESERVED (migrations, re-joins) — pass
   //    --redistill to rebuild it from scratch.
   mkdirSync(join(HIVE_HOME, 'data-store'), { recursive: true });
-  const profilePath = join(HIVE_HOME, 'data-store', 'profile.md');
-  if (existsSync(profilePath) && readFileSync(profilePath, 'utf8').trim().length > 50 && !args.includes('--redistill')) {
+  if (hasProfile) {
     say('using your existing profile (pass --redistill to rebuild it)');
   } else {
-    say('distilling your profile from local chat history (raw chats never leave this machine) …');
-    const distillArgs = ['--provider', provider, '--key', llmKey, '--out', profilePath];
-    if (flag('export')) distillArgs.push('--export', flag('export'));
+    const spinD = spinner('distilling your profile from local chat history — raw chats never leave this machine …');
+    // Echo/keyless joins go straight to the heuristic ladder (no LLM call).
+    const distillArgs = ['--out', profilePath];
+    if (provider !== 'echo' && llmKey && llmKey !== 'echo') distillArgs.push('--provider', provider, '--key', llmKey);
     if (models.extract) distillArgs.push('--model', models.extract);
-    const d = node('watcher/distill.mjs', distillArgs);
+    if (exportZip) distillArgs.push('--export', exportZip);
+    const d = await new Promise((resolveP) => {
+      const p = spawn(process.execPath, [join(PACK_DIR, 'watcher', 'distill.mjs'), ...distillArgs], { env: { ...process.env, HIVE_HOME } });
+      let out = ''; let err = '';
+      p.stdout.on('data', (c) => { out += c; });
+      p.stderr.on('data', (c) => {
+        err += c;
+        const m = String(c).match(/corpus: (\d+) user turns from ~(\d+) sessions/);
+        if (m) spinD.text(`distilling locally: ${m[1]} of your chat turns from ~${m[2]} sessions …`);
+      });
+      p.on('close', (code) => resolveP({ code, out: out + (code !== 0 ? err : '') }));
+      p.on('error', (e) => resolveP({ code: 1, out: String(e.message) }));
+    });
+    spinD.stop();
     if (d.code !== 0 || !existsSync(profilePath)) die(`distillation failed: ${d.out.slice(0, 300)}`);
   }
   const profile = readFileSync(profilePath, 'utf8');
-  say(`profile ready (${profile.length} chars) — review anytime: ~/.hive/data-store/profile.md`);
 
-  // 6. Seal {mnemonic, llm key} to the server's box key and provision the bee.
+  // 7. PROMPT 5 — the privacy promise, shown instead of claimed: this page is
+  //    the ONLY personal data that leaves the laptop, and the member sees it
+  //    before it goes.
+  const lines = profile.split('\n');
+  say(`profile ready (${profile.length} chars) — this one page is ALL that leaves your laptop:`);
+  console.log(dim(lines.slice(0, 15).map((l) => `    ${l}`).join('\n') + (lines.length > 15 ? `\n    … (${lines.length - 15} more lines — full file: ~/.hive/data-store/profile.md)` : '')));
+  if (!has('yes')) {
+    const okUp = await confirm({ prompt: 'upload this profile to power your bee?', def: true });
+    if (!okUp) die('no problem — edit ~/.hive/data-store/profile.md, then re-run this exact command (it resumes where it stopped)');
+  }
+
+  // 8. Seal secrets and provision — while the server walks its state machine
+  //    we stream its per-step progress instead of going silent.
   const mnemonic = (() => {
     try { return JSON.parse(node('bin/hive-wallet.mjs', ['export']).out).mnemonic; } catch { return null; }
   })();
   if (!mnemonic) die('could not read the wallet mnemonic back from the Keychain');
   const client = nacl.box.keyPair();
   const nonce = nacl.randomBytes(24);
-  const box = nacl.box(
-    Buffer.from(JSON.stringify({ wallet_mnemonic: mnemonic, llm_api_key: llmKey })),
-    nonce, Buffer.from(hello.box_pub, 'base64'), client.secretKey,
-  );
+  const sealedPayload = { wallet_mnemonic: mnemonic, ...(awaitingKey ? {} : { llm_api_key: llmKey }) };
+  const box = nacl.box(Buffer.from(JSON.stringify(sealedPayload)), nonce, Buffer.from(hello.box_pub, 'base64'), client.secretKey);
   say(`provisioning ${name}.bee on the community server …`);
   const body = {
     invite: INVITE, name, owner_pubkey: identity.pubkey, owner_name: name,
     evm_address: wallet.evm_address, provider,
+    ...(awaitingKey ? { awaiting_key: true } : {}),
     ...(OPENAI_COMPAT_BASES[provider] ? { base_url: OPENAI_COMPAT_BASES[provider] } : {}),
     ...(models.extract ? { model_extract: models.extract } : {}),
     ...(models.compute ? { model_compute: models.compute } : {}),
     sealed: { nonce: Buffer.from(nonce).toString('base64'), box: Buffer.from(box).toString('base64'), client_pub: Buffer.from(client.publicKey).toString('base64') },
     profile_md: profile,
   };
-  const resp = await signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees`, body);
-  if (resp.status !== 200) die(`provisioning failed (http ${resp.status}): ${JSON.stringify(resp.json).slice(0, 300)}`);
-  const beePubkey = resp.json.bee_pubkey;
+
+  const STEP_LABELS = [
+    { key: 'invite_checked', label: 'invite' },
+    { key: 'bee_key', label: 'bee key' },
+    { key: 'relay_membership', label: 'relay' },
+    { key: 'secrets_stored', label: 'secrets' },
+    { key: 'profile_written', label: 'profile' },
+    { key: 'grants_queued', label: '500 JELLY' },
+    { key: 'welcome_posted', label: 'welcome' },
+    { key: 'done', label: 'daemon' },
+  ];
+  const cp = checkpoints(STEP_LABELS);
+  let posted = null;
+  const postPromise = signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees`, body)
+    .then((r) => { posted = r; }).catch((e) => { posted = { status: 0, json: { error: String(e.message || e) } }; });
+
+  let st = null;
+  for (let i = 0; i < 200; i++) {
+    await new Promise((r) => setTimeout(r, 1200));
+    try {
+      const r = await fetch(`${SERVER}/api/bees/${name}/status`, { signal: AbortSignal.timeout(5000) });
+      if (r.status === 200) {
+        st = await r.json();
+        for (const { key } of STEP_LABELS) {
+          if (key === 'done') continue;
+          if (st.steps?.includes(key)) cp.set(key, 'done');
+        }
+        if (st.steps?.includes('done')) cp.set('done', st.status === 'ready' ? 'done' : 'active');
+        if (st.status === 'ready') break;
+      }
+    } catch {}
+    if (posted && posted.status !== 200) break;
+    // Laptop-side work happens below while the daemon wakes; bail out of the
+    // streaming loop once the state machine is done and only the heartbeat
+    // is pending — the final wait continues after NIP-OA + config.
+    if (st?.steps?.includes('done')) break;
+  }
+  await postPromise;
+  if (posted && posted.status !== 200) {
+    cp.stop();
+    const err = JSON.stringify(posted.json).slice(0, 300);
+    if (awaitingKey && /llm_api_key/.test(err)) die('this community server predates echo-first joins — re-run and pick a brain, or ask the operator to update the bee-host');
+    die(`provisioning failed (http ${posted.status}): ${err}`);
+  }
+  cp.stop();
+  const beePubkey = posted?.json?.bee_pubkey || st?.bee_pubkey;
   say(`${name}.bee exists: ${String(beePubkey).slice(0, 12)}…`);
 
-  // 6b. Buzz Agents directory (NIP-OA): the OWNER key signs both halves of
+  // 8b. Buzz Agents directory (NIP-OA): the OWNER key signs both halves of
   //     the pairing right here — it never leaves this laptop.
   //     (a) kind-30177 managed-agent record (owner-authored, bee pubkey in
   //         the d tag), published straight to the relay: the relay requires
   //         event author == HTTP signer, so only this laptop can publish it.
   //     (b) the NIP-OA auth tag co-signature over the bee's pubkey, shipped
   //         to the server (it holds the bee key) so the bee's kind-0 profile
-  //         carries it. Together these make the bee show up under Agents in
-  //         the Buzz desktop app, cryptographically verified as YOURS.
+  //         carries it. Owner verification comes from this pair; the Agents
+  //         TAB listing additionally needs the bot-role channel membership
+  //         the server grants at provision (bot_role step).
   //     Best-effort: the bee works without it; a re-join retries both halves.
   if (/^[0-9a-f]{64}$/.test(String(beePubkey))) {
     try {
@@ -190,23 +388,34 @@ const main = async () => {
       const authTag = computeAuthTag(identity.privkey, beePubkey, '');
       const resp2 = await signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees`, { ...body, nip_oa_auth: authTag });
       if (resp2.status !== 200) throw new Error(`auth-tag delivery: http=${resp2.status} ${JSON.stringify(resp2.json).slice(0, 160)}`);
-      say(`registered in the Buzz Agents directory (owner-verified: ${name}.bee)`);
+      say(`Buzz Agents record published (owner-verified: ${name}.bee — visible in the app via hive buzz)`);
     } catch (e) {
       say(`⚠️ Buzz Agents registration incomplete (${String(e.message).slice(0, 160)}) — re-run this join to retry; the bee itself is unaffected`);
     }
   }
 
-  // 7. Remember the pairing locally + enable sync, and publish YOUR kind-0
-  //    profile so apps (Buzz desktop included) show your name, not a pubkey.
+  // 9. Remember the pairing locally (invite + server power `hive buzz` and
+  //    `hive key set` later), join the hive channels as YOURSELF (the Buzz
+  //    app only lists agents in channels you share with them), and publish
+  //    your kind-0 so apps show your name, not a pubkey.
   const cfg2 = loadJson(cfgPath, {});
-  Object.assign(cfg2, { owner_name: name, bee_name: `${name}.bee`, bee_pubkey: beePubkey, server_url: SERVER, sync: { enabled: true, provider } });
+  Object.assign(cfg2, {
+    owner_name: name, bee_name: `${name}.bee`, bee_pubkey: beePubkey,
+    server_url: SERVER, invite: INVITE,
+    sync: { enabled: true, provider },
+  });
   writeFileSync(cfgPath, JSON.stringify(cfg2, null, 2) + '\n');
+  try {
+    const me = new RelayClient({ relayUrl: RELAY, privkey: identity.privkey, log: () => {} });
+    for (const chName of Object.values(DEFAULTS.channels)) await me.ensureChannel(chName);
+  } catch (e) { say(`⚠️ channel self-join incomplete (${String(e.message).slice(0, 100)}) — hive buzz will fix this`); }
   const prof = node('bin/hive-net.mjs', ['set-name', name]);
   if (prof.code === 0) say(`your profile name is set: ${name}`);
 
-  // 8. Auto-sync watcher (launchd, macOS). --no-watcher skips it — used for
-  //    secondary endpoints on the same machine (one watcher per Mac).
-  if (platform() === 'darwin' && !args.includes('--no-watcher')) {
+  // 10. Auto-sync watcher (launchd, macOS). --no-watcher skips it — used for
+  //     secondary endpoints on the same machine (one watcher per Mac). Never
+  //     installed from an npx cache dir (npm may delete it under the plist).
+  if (platform() === 'darwin' && !has('no-watcher') && !watcherUnsafe) {
     try {
       const tmpl = readFileSync(join(PACK_DIR, 'watcher', 'global.nfh.hive.sync.plist.tmpl'), 'utf8')
         .replaceAll('__NODE__', process.execPath).replaceAll('__PACK__', PACK_DIR).replaceAll('__HOME__', homedir());
@@ -219,25 +428,67 @@ const main = async () => {
     } catch (e) { say(`watcher install skipped (${String(e.message).slice(0, 80)}) — run: hive sync now`); }
   }
 
-  // 9. Wait for the bee to come alive + grants to land.
-  say('waiting for your bee to wake up (engine self-test + genesis grants) …');
-  for (let i = 0; i < 30; i++) {
-    await new Promise((r) => setTimeout(r, 5000));
-    try {
-      const st = await (await fetch(`${SERVER}/api/bees/${name}/status`, { signal: AbortSignal.timeout(5000) })).json();
-      if (st.status === 'ready') {
-        say('———— YOU ARE IN ————');
-        say(`bee:     ${name}.bee (${String(beePubkey).slice(0, 12)}…)`);
-        say(`wallet:  ${wallet.evm_address} (shared: you + your bee)`);
-        if (st.grants?.jelly_tx) say(`grant:   500 JELLY — https://sepolia.etherscan.io/tx/${st.grants.jelly_tx}`);
-        say(`try:     hive ask "what should we watch this weekend"   ·   hive feed   ·   hive leaderboard`);
-        rl.close();
-        return;
-      }
-    } catch {}
+  // 11. Wait for the bee's first heartbeat, then catch its welcome. The
+  //     steward posted a welcome intent during provisioning; other bees'
+  //     replies are the newcomer's first feed.
+  let ready = st?.status === 'ready';
+  if (!ready) {
+    const spinUp = spinner(`waiting for ${name}.bee to wake up (engine self-test + genesis grants) …`);
+    for (let i = 0; i < 30 && !ready; i++) {
+      await new Promise((r) => setTimeout(r, 5000));
+      try {
+        const r = await fetch(`${SERVER}/api/bees/${name}/status`, { signal: AbortSignal.timeout(5000) });
+        if (r.status === 200) { st = await r.json(); ready = st.status === 'ready'; }
+      } catch {}
+    }
+    spinUp.stop();
+  }
+  if (!ready) {
+    say('provisioned, but the bee has not heartbeated yet — check later: hive agent status');
+    return;
   }
-  say('provisioned, but the bee has not heartbeated yet — check later: hive agent status');
-  rl.close();
+
+  say('———— YOU ARE IN ————');
+  say(`bee:     ${name}.bee (${String(beePubkey).slice(0, 12)}…)`);
+  say(`wallet:  ${wallet.evm_address} (shared: you + your bee)`);
+  if (st?.grants?.jelly_tx) say(`grant:   500 JELLY — https://sepolia.etherscan.io/tx/${st.grants.jelly_tx}`);
+  if (awaitingKey) say(`brain:   none yet — ${name}.bee is in echo mode (alive + visible, not thinking)`);
+
+  // Welcome tail: print the first replies addressed to the new member.
+  try {
+    const me = new RelayClient({ relayUrl: RELAY, privkey: identity.privkey, log: () => {} });
+    const logsId = await me.ensureChannel(DEFAULTS.channels.logs);
+    const spinW = spinner('the hive is saying hello …');
+    let greeted = 0;
+    const names = new Map();
+    for (let i = 0; i < 22 && greeted < 2; i++) {
+      await new Promise((r) => setTimeout(r, 4000));
+      const evts = await me.query([{ kinds: [9, 40002], '#h': [logsId], since: joinStart, limit: 200 }]) || [];
+      for (const e of evts.sort((a, b) => a.created_at - b.created_at)) {
+        const j = tryJson(e.content);
+        if (!j || j.type !== EV.RESULT || j.for !== identity.pubkey) continue;
+        if (j.by && j.by !== e.pubkey) continue;
+        if (names.has(e.id)) continue;
+        names.set(e.id, true);
+        if (greeted === 0) spinW.stop();
+        let who = `${e.pubkey.slice(0, 8)}…`;
+        try {
+          const p = await me.query([{ kinds: [0], authors: [e.pubkey], limit: 1 }]);
+          const meta = tryJson(p?.[0]?.content || '');
+          if (meta?.name) who = meta.name;
+        } catch {}
+        console.log(`\n💬 ${who}: ${String(j.result).slice(0, 400)}\n`);
+        greeted++;
+        if (greeted >= 2) break;
+      }
+    }
+    if (!greeted) spinW.stop('🐝 welcome replies are on their way — they land in: hive feed');
+  } catch {}
+
+  say('next steps:');
+  if (awaitingKey) say('  hive key set          # give your bee a real brain (60 seconds)');
+  say('  hive buzz             # open the community app — your bee is under Agents');
+  say(`  hive ask "what should we watch this weekend"   ·   hive feed   ·   hive leaderboard`);
 };
 
-main().catch((e) => { rl.close(); die(String(e.message || e)); });
+main().catch((e) => die(String(e.message || e)));