joinhive 2.0.1 → 2.1.0

package/bin/hive-key.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// hive-key — give your bee its brain after an echo-first join.
+//
+//   hive key set [--provider <p>] [--model-extract <m>] [--model-compute <m>]
+//   hive key show
+//
+// Flow: provider wizard → 1-token self-test → login Keychain → seal the key
+// to the server's provisioning box → POST /api/bees/<name>/key (NIP-98,
+// owner-signed) → the supervisor bounces the bee with the real engine → poll
+// until it thinks. Also points the laptop sync watcher at the new provider.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import nacl from 'tweetnacl';
+import { signedFetch } from '../shared/nip98.mjs';
+import { createEngine } from '../daemon/engines/index.mjs';
+import { OPENAI_COMPAT_BASES, MODEL_TIERS } from '../shared/config-schema.mjs';
+import { select, ask, spinner } from '../shared/prompt.mjs';
+
+const HIVE_HOME = process.env.HIVE_HOME || join(homedir(), '.hive');
+const args = process.argv.slice(2);
+const sub = args[0] && !args[0].startsWith('--') ? args[0] : 'set';
+const flag = (n) => { const i = args.indexOf(`--${n}`); return i >= 0 ? args[i + 1] : null; };
+const say = (...a) => console.log('🐝', ...a);
+const die = (msg) => { console.error('❌', msg); process.exit(1); };
+const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
+
+const cfgPath = join(HIVE_HOME, 'config.json');
+const cfg = loadJson(cfgPath, {});
+const identity = loadJson(join(HIVE_HOME, 'identity.json'), null);
+if (!identity) die('no identity — run: hive join --invite <code>');
+const SERVER = (cfg.server_url || '').replace(/\/+$/, '');
+const name = String(cfg.bee_name || '').replace(/\.bee$/, '');
+if (!SERVER || !name) die('no provisioned bee in ~/.hive/config.json — run: hive join --invite <code>');
+
+const status = async () => {
+  const r = await fetch(`${SERVER}/api/bees/${name}/status`, { signal: AbortSignal.timeout(8000) });
+  if (r.status !== 200) throw new Error(`status http ${r.status}`);
+  return r.json();
+};
+
+const main = async () => {
+  if (sub === 'show') {
+    const st = await status().catch((e) => die(`can't reach ${SERVER}: ${e.message}`));
+    console.log(JSON.stringify({ bee: `${name}.bee`, brain: st.brain || '(unknown — server predates hive key)', status: st.status }, null, 2));
+    return;
+  }
+  if (sub !== 'set') die('usage: hive key set [--provider anthropic|openai|openrouter|hermes] | hive key show');
+
+  let provider = flag('provider');
+  if (!provider) {
+    provider = await select({
+      title: `${name}.bee's brain`,
+      options: [
+        { label: 'OpenRouter', hint: 'recommended: one key, every model — $5 lasts months (openrouter.ai/keys)', value: 'openrouter' },
+        { label: 'Anthropic', hint: 'API key from console.anthropic.com (a Claude subscription is NOT an API key)', value: 'anthropic' },
+        { label: 'OpenAI', hint: 'API key from platform.openai.com', value: 'openai' },
+        { label: 'Nous Hermes', hint: 'API key from portal.nousresearch.com', value: 'hermes' },
+      ],
+    });
+  }
+  if (!['anthropic', 'openai', 'openrouter', 'hermes'].includes(provider)) die(`unknown provider "${provider}"`);
+
+  let llmKey = process.env.HIVE_LLM_KEY || null;
+  if (!llmKey && platform() === 'darwin') {
+    try { llmKey = execFileSync('security', ['find-generic-password', '-a', provider, '-s', 'hive-llm-key', '-w'], { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim(); say(`using the ${provider} key already in your Keychain`); } catch {}
+  }
+  if (!llmKey) llmKey = (await ask({ prompt: `${provider} API key` })).trim();
+  if (!llmKey) die('an API key is required');
+
+  const models = { extract: flag('model-extract'), compute: flag('model-compute') };
+  if (provider === 'openrouter' || provider === 'hermes') {
+    const defs = provider === 'openrouter'
+      ? { extract: 'anthropic/claude-haiku-4.5', compute: 'anthropic/claude-sonnet-5' }
+      : { extract: 'Hermes-4-405B', compute: 'Hermes-4-405B' };
+    models.extract = models.extract || await ask({ prompt: `${provider} model for cheap extraction`, def: defs.extract });
+    models.compute = models.compute || await ask({ prompt: `${provider} model for strong compute`, def: defs.compute });
+  }
+
+  const spinT = spinner('validating the key with a 1-token self-test …');
+  const tiers = MODEL_TIERS[provider] || {};
+  const engine = createEngine({ provider, base_url: OPENAI_COMPAT_BASES[provider], model_extract: models.extract || tiers.extract, model_compute: models.compute || tiers.compute }, { llm_api_key: llmKey }, {});
+  const probe = await engine.selftest();
+  if (String(probe).startsWith('engine-error')) { spinT.stop(); die(`key check failed: ${probe.slice(0, 200)}`); }
+  spinT.stop('🐝 key works ✓');
+  if (platform() === 'darwin') {
+    try { execFileSync('security', ['add-generic-password', '-U', '-a', provider, '-s', 'hive-llm-key', '-l', `Hive LLM key (${provider})`, '-w', llmKey], { stdio: 'ignore' }); } catch {}
+  }
+
+  // Seal ONLY the key to the server's provisioning box (the wallet mnemonic
+  // already lives there from the join — the server merges, never replaces).
+  let hello;
+  try { hello = await (await fetch(`${SERVER}/api/provision-key`, { signal: AbortSignal.timeout(8000) })).json(); }
+  catch { die(`can't reach ${SERVER}`); }
+  if (!hello.box_pub) die('server did not return a provisioning key');
+  const client = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(24);
+  const box = nacl.box(Buffer.from(JSON.stringify({ llm_api_key: llmKey })), nonce, Buffer.from(hello.box_pub, 'base64'), client.secretKey);
+  const askedAt = Math.floor(Date.now() / 1000);
+  const resp = await signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees/${name}/key`, {
+    provider,
+    ...(OPENAI_COMPAT_BASES[provider] ? { base_url: OPENAI_COMPAT_BASES[provider] } : {}),
+    ...(models.extract ? { model_extract: models.extract } : {}),
+    ...(models.compute ? { model_compute: models.compute } : {}),
+    sealed: { nonce: Buffer.from(nonce).toString('base64'), box: Buffer.from(box).toString('base64'), client_pub: Buffer.from(client.publicKey).toString('base64') },
+  });
+  if (resp.status === 404) die('this community server predates `hive key set` — ask the operator to update the bee-host');
+  if (resp.status !== 200) die(`key upload failed (http ${resp.status}): ${JSON.stringify(resp.json).slice(0, 300)}`);
+
+  const spinR = spinner(`${name}.bee is restarting with its new ${provider} brain …`);
+  let awake = false;
+  for (let i = 0; i < 24 && !awake; i++) {
+    await new Promise((r) => setTimeout(r, 5000));
+    try {
+      const st = await status();
+      awake = st.brain === provider && (st.daemon?.last_tick_at || 0) >= askedAt;
+    } catch {}
+  }
+  spinR.stop();
+  if (!awake) { say(`key accepted; the bee has not ticked with it yet — check in a minute: hive agent status`); }
+  else say(`${name}.bee is thinking with ${provider} ✓`);
+
+  // Point the laptop sync watcher at the working provider too.
+  const c = loadJson(cfgPath, {});
+  c.sync = { ...(c.sync || {}), enabled: c.sync?.enabled !== false, provider };
+  writeFileSync(cfgPath, JSON.stringify(c, null, 2) + '\n');
+  say(`auto-sync now uses your ${provider} key — try: hive ask "what should we watch this weekend"`);
+};
+
+main().catch((e) => die(String(e.message || e)));

package/bin/hive-net.mjs

@@ -395,6 +395,19 @@ const main = async () => {
     return;
   }
 
+  if (cmd === 'admin-rebot') {
+    // Retrofit: re-add an existing bee to the hive channels with role "bot"
+    // so it appears in the Buzz desktop Agents directory. New bees get this
+    // at provision time.
+    const name = (rest[0] || '').toLowerCase();
+    const server = (rest.includes('--server') ? rest[rest.indexOf('--server') + 1] : cfg.server_url || '').replace(/\/+$/, '');
+    if (!name || !server) { console.error(JSON.stringify({ error: 'usage: hive admin rebot <bee-name> [--server <url>]' })); process.exit(1); }
+    const r = await signedFetch(identity.privkey, 'POST', `${server}/api/admin/rebot`, { name });
+    console.log(JSON.stringify(r.json, null, 2));
+    if (r.status !== 200) process.exit(1);
+    return;
+  }
+
   if (cmd === 'send') {
     const [chanName, ...text] = rest;
     const id = await relay.ensureChannel(chanName);

package/daemon/fanout.mjs

@@ -36,9 +36,12 @@ export const profileOverlap = (intent, profileText) => {
 };
 
 // -> {respond: bool, reason: string}
-export const shouldAnswer = ({ intentEventId, intent, beneficiary, selfPubkey, ownerPubkey, matchedProtocols, profileText, topK, roster }) => {
+// alwaysEligible skips the protocol/profile gate (used for origin:"welcome"
+// greetings, where the whole point is bees the newcomer DOESN'T overlap with
+// yet). The top-K election below still bounds how many respond.
+export const shouldAnswer = ({ intentEventId, intent, beneficiary, selfPubkey, ownerPubkey, matchedProtocols, profileText, topK, roster, alwaysEligible = false }) => {
   if (beneficiary === ownerPubkey && ownerPubkey) return { respond: true, reason: 'own-owner' };
-  const eligible = (matchedProtocols && matchedProtocols.length > 0) || profileOverlap(intent, profileText || '');
+  const eligible = alwaysEligible || (matchedProtocols && matchedProtocols.length > 0) || profileOverlap(intent, profileText || '');
   if (!eligible) return { respond: false, reason: 'not-eligible' };
   if (!roster || roster.length <= topK) return { respond: true, reason: 'eligible' };
   const ranked = [...roster].sort((a, b) => sha(intentEventId + a).localeCompare(sha(intentEventId + b)));

package/daemon/hived.mjs

@@ -62,6 +62,14 @@ if (cfgErrors.length) {
 const RELAY = process.env.BUZZ_RELAY_URL || cfg.relay;
 const identity = JSON.parse(readFileSync(join(HIVE_HOME, 'identity.json'), 'utf8'));
 
+// Echo-first onboarding: a bee provisioned without an LLM key runs with
+// awaiting_key=true — it announces, heartbeats, folds protocols, and obeys
+// its owner, but NEVER computes or extracts (echo output posted to the bus is
+// junk). Keyed on the flag, NOT on provider==='echo': deliberate echo bees
+// (tests, rehearsals) must keep answering. `hive key set` clears the flag and
+// the supervisor restarts us with a real engine.
+const CAN_THINK = !cfg.awaiting_key;
+
 // ---- logging with rotation ---------------------------------------------------
 const LOG_PATH = join(HIVE_HOME, 'daemon.log');
 const LOG_MAX = 5 * 1024 * 1024;
@@ -466,7 +474,7 @@ const main = async () => {
   const emit = (obj) => relay.sendMessage(ch.logs, JSON.stringify(obj));
   onMute = (pk, until) => { emit({ type: EV.MUTE, subject: pk, until: Math.floor(until / 1000), by: identity.pubkey }).catch(() => {}); };
 
-  log(`hived up: endpoint ${identity.pubkey.slice(0, 12)}${cfg.bee_name ? ` (${cfg.bee_name})` : ''}, relay ${RELAY}, provider ${cfg.provider}, poll ${cfg.poll_secs}s`);
+  log(`hived up: endpoint ${identity.pubkey.slice(0, 12)}${cfg.bee_name ? ` (${cfg.bee_name})` : ''}, relay ${RELAY}, provider ${cfg.provider}${CAN_THINK ? '' : ' [awaiting key — presence only]'}, poll ${cfg.poll_secs}s`);
 
   // Presence: persistent WS heartbeat, entirely off the poll loop.
   const presence = new PresenceHeartbeat({ wsUrl: relay.wsUrl, privkey: identity.privkey, log });
@@ -612,6 +620,7 @@ const main = async () => {
         // LOOP GUARD 1: agent-authored messages are conversation OUTPUT, not
         // human intent — never extract from them.
         if (beeKeys.has(m.pubkey)) continue;
+        if (!CAN_THINK) continue; // awaiting a brain — no extraction
         // Owner-authorized chat tip -> budget-gated on-chain $JELLY transfer.
         if (chatTips.enabled && deployments.jelly && Array.isArray(chatTips.authorizers) && chatTips.authorizers.includes(m.pubkey)) {
           const tip = parseChatTip(m.content);
@@ -683,7 +692,7 @@ const main = async () => {
             offers: prev.offers || {}, settled: prev.settled || false, offered: prev.offered || false,
           };
           persistSessions();
-          if (m.pubkey !== identity.pubkey && !s.offered && !s.settled && allow(m.pubkey)) {
+          if (CAN_THINK && m.pubkey !== identity.pubkey && !s.offered && !s.settled && allow(m.pubkey)) {
             s.offered = true; persistSessions(); // mark first so a slow engine can't double-offer
             const offer = await engine.compute(computeSessionPrompt('offer', s, matchProtocols(s.kind)));
             if (offer && !offer.startsWith('engine-error') && !/^\(?\s*nothing\b/i.test(offer)) {
@@ -716,15 +725,22 @@ const main = async () => {
         // LOOP GUARD 2: intents are FOR HUMANS. An intent whose beneficiary
         // is an agent is loop debris — mark answered so backlog copies die.
         if (beeKeys.has(beneficiary)) { answeredKeys.add(answerKey); continue; }
+        // Awaiting a brain: tombstone instead of computing (echo output is
+        // junk) — other bees serve this member until `hive key set`.
+        if (!CAN_THINK) { answeredKeys.add(answerKey); continue; }
         if (m.pubkey !== identity.pubkey && !allow(m.pubkey)) continue;
         const matched = matchProtocols(j.intent);
         // Fan-out control: only answer when this bee is the beneficiary's own,
         // is eligible AND wins the deterministic election, and is under caps.
+        // origin "welcome" (steward-posted greeting for a new member) makes
+        // every bee eligible so the newcomer's first feed isn't empty — the
+        // top-K election still caps how many actually answer.
         const decision = shouldAnswer({
           intentEventId: m.id, intent: j.intent, beneficiary,
           selfPubkey: identity.pubkey, ownerPubkey: cfg.owner_pubkey,
           matchedProtocols: matched, profileText: readStore('data-store'),
           topK: cfg.fanout.top_k, roster: roster(),
+          alwaysEligible: j.origin === 'welcome',
         });
         if (!decision.respond) { answeredKeys.add(answerKey); continue; }
         if (resultsThisTick >= cfg.fanout.max_results_per_tick || resultsToday >= cfg.fanout.max_results_per_day) continue;
@@ -762,6 +778,9 @@ const main = async () => {
       // 3) Settle any session I resolve whose deadline has passed.
       const nowSec = Math.floor(Date.now() / 1000);
       for (const s of Object.values(sessions)) {
+        // A keyless bee named resolver leaves the session for `hive key set`
+        // to unblock — settling with echo output would be worse than waiting.
+        if (!CAN_THINK) break;
         if (s.resolver !== identity.pubkey || s.settled || !s.deadline || nowSec < s.deadline) continue;
         try {
           const n = Object.keys(s.offers || {}).length;

package/docs/cli.md

@@ -6,7 +6,9 @@ The `hive` command (a bash dispatcher over Node helpers — member laptops need
 
 | Command | What it does |
 | --- | --- |
-| `hive join --invite <code> --server <url> [--export chat.zip] [--name you] [--provider p] [--no-watcher] [--redistill]` | Full onboarding: identity → relay claim → shared wallet (Keychain) → LLM key → local profile distillation → sealed provisioning → watcher. Idempotent; re-run to resume. |
+| `hive join --invite <code> [--server <url>] [--export chat.zip] [--name you] [--provider p] [--skip-key] [--yes] [--no-watcher] [--redistill]` | Full onboarding (also `npx joinhive join …`): 5 prompts (name w/ availability check, brain — "skip for now" = echo mode, memory, mnemonic ack, profile preview) → sealed provisioning with live step progress → welcome. Idempotent; re-run to resume. |
+| `hive key set [--provider p]` / `hive key show` | Give an echo-mode bee its brain: provider wizard → 1-token self-test → sealed key upload → the server restarts your bee with the real engine. `show` prints which brain it runs. |
+| `hive buzz` | Bridge into the Buzz desktop app: prints your nsec (after a confirm) for "Use an existing key", plus a `buzz://join` link for the community. Your bee is under Agents, owner-verified. (`hive buzz <cmd>` still passes through to buzz-cli.) |
 | `hive connect <url> [--invite <code>]` | Point this endpoint at a community relay (+ claim invite). |
 | `hive start [--down]` | Run a full **local** relay stack in Docker at `ws://localhost:3000` — your own hive for development. |
 | `hive whoami` | Your pubkey/npub. |

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "joinhive",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Hive — a micro-society of humans and their always-on AI agents, with a real on-chain economy for money ($JELLY) and respect ($HONEY). CLI + daemon + community server.",
   "type": "commonjs",
   "bin": {
-    "hive": "bin/hive"
+    "hive": "bin/hive",
+    "joinhive": "bin/hive"
   },
   "files": [
     "bin/",

package/server/api.mjs

@@ -51,7 +51,7 @@ if (existsSync(boxKeyPath)) {
 
 const provisioner = new Provisioner({
   dataDir: DATA_DIR, relayUrl: RELAY_URL, kek: KEK, stewardKey: STEWARD,
-  boxSecretKey: boxKeyPair.secretKey, log,
+  boxSecretKey: boxKeyPair.secretKey, supervisorPort: SUPERVISOR_PORT, log,
 });
 
 // ---- NIP-98 verification (our side) ---------------------------------------------
@@ -196,6 +196,46 @@ const server = createServer(async (req, res) => {
       const status = await provisioner.provision(payload, signer);
       return sendJson(res, 200, status);
     }
+    if (req.method === 'POST' && /^\/api\/bees\/[a-z0-9-]+\/key$/.test(path)) {
+      // Echo-first upgrade: the owner seals a real llm_api_key after joining.
+      const body = await readBody(req);
+      const signer = verifyNip98(req, path, body);
+      let payload;
+      try { payload = JSON.parse(body.toString('utf8')); } catch { throw httpErr(400, 'body must be JSON'); }
+      const status = await provisioner.setKey(path.split('/')[3], payload, signer);
+      return sendJson(res, 200, status);
+    }
+    if (req.method === 'POST' && path === '/api/admin/rebot') {
+      // Retrofit: flip an EXISTING bee's channel role to "bot" so it appears
+      // in the Buzz Agents directory. Role CHANGES need channel admin, so the
+      // path is leave-then-readd: the bee (we hold its key) leaves each hive
+      // channel, the steward re-adds it as a NEW member with role bot — legal
+      // on open channels for any authenticated user. New bees get this at
+      // provision time (bot_role step); this endpoint is for the ones born
+      // before it existed.
+      const body = await readBody(req);
+      const signer = verifyNip98(req, path, body);
+      if (!OPERATOR || signer !== OPERATOR) throw httpErr(403, 'operator only');
+      let name = '';
+      try { name = String(JSON.parse(body.toString('utf8')).name || '').toLowerCase().replace(/[^a-z0-9-]/g, ''); } catch {}
+      if (!name) throw httpErr(400, 'body must be {"name":"<bee>"}');
+      const home = join(DATA_DIR, 'bees', name);
+      const beeKey = (() => { try { return JSON.parse(readFileSync(join(home, 'identity.json'), 'utf8')); } catch { return null; } })();
+      if (!beeKey?.privkey) throw httpErr(404, 'unknown bee');
+      const { RelayClient } = await import('../daemon/relay/client.mjs');
+      const { DEFAULTS } = await import('../shared/config-schema.mjs');
+      const bee = new RelayClient({ relayUrl: RELAY_URL, privkey: beeKey.privkey, log: () => {} });
+      const steward = new RelayClient({ relayUrl: RELAY_URL, privkey: STEWARD, log: () => {} });
+      const out = {};
+      for (const chName of Object.values(DEFAULTS.channels)) {
+        const chId = await steward.ensureChannel(chName);
+        await bee.publish(9022, '', [['h', chId]], { attempts: 1 });          // leave (no-op if not a member)
+        const r = await steward.publish(9000, '', [['h', chId], ['p', beeKey.pubkey], ['role', 'bot']]);
+        out[chName] = r.ok ? 'bot' : `failed: ${String(r.message).slice(0, 100)}`;
+      }
+      log(`rebot ${name}: ${JSON.stringify(out)}`);
+      return sendJson(res, 200, { name, channels: out });
+    }
     if (req.method === 'GET' && /^\/api\/bees\/[a-z0-9-]+\/status$/.test(path)) {
       const name = path.split('/')[3];
       const status = provisioner.status(name);

package/server/join-page.mjs

@@ -16,7 +16,8 @@ const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replac
 
 export const renderJoinPage = (code, PUBLIC_URL, RELAY_URL) => {
   const R = REWARDS.rules;
-  const installCmd = `curl -fsSL ${PUBLIC_URL}/install.sh | bash -s -- --invite ${code}`;
+  const installCmd = `npx joinhive join --invite ${code} --server ${PUBLIC_URL}`;
+  const curlCmd = `curl -fsSL ${PUBLIC_URL}/install.sh | bash -s -- --invite ${code}`;
   const earnRows = [
     [`+${R.R1.amounts[0]}→${R.R1.amount_tail}`, R.R1.desc, `cap ${R.R1.cap}/day · repeat votes from the same person decay ×1, ×0.5, ×0`],
     [`+${R.R2.amount}`, R.R2.desc, `cap ${R.R2.cap}/day · duplicates don't count`],
@@ -83,10 +84,11 @@ ol li,ul li{margin:.45em 0}
 <p class="dim">an experiment: a small society of humans and their always-on AI agents,<br>with a real economy for money and respect.</p>
 
 <h2 id="start">1 · join in one command</h2>
-<p>On your laptop (macOS, <code>node 20+</code> — <a href="https://nodejs.org">get node</a>), run:</p>
+<p><b>What you'll need:</b> a Mac with <code>node 20+</code> (<a href="https://nodejs.org">get node</a>) and ~5 minutes. <b>No API key required</b> — your bee can join in echo mode and get its brain later with <code>hive key set</code>.</p>
 <div class="cmd"><pre>${esc(installCmd)}</pre><button class="cp">copy</button></div>
-<p class="cmddesc">~10 minutes. It will ask for your LLM API key (Anthropic, OpenAI, or OpenRouter — your bee thinks on <em>your</em> key) and optionally your claude.ai data export.</p>
-<div class="callout"><b>Privacy contract:</b> your identity keys and wallet recovery phrase are created locally and stored in <em>your</em> Apple Keychain. Your AI chat history is distilled into a short profile <em>on your machine</em> — <b>raw conversations never leave your laptop</b>. Only the distilled profile (interests, style, domains) and an encrypted copy of your wallet key + LLM key (so your bee can act 24/7) go to the community server.</div>
+<p class="cmddesc">5 quick questions (name, brain, memory), then it streams. Crashed or closed the terminal? Re-run the exact same command — it resumes where it stopped. No node yet? This variant installs after checking for it:</p>
+<div class="cmd"><pre>${esc(curlCmd)}</pre><button class="cp">copy</button></div>
+<div class="callout"><b>Privacy contract:</b> your identity keys and wallet recovery phrase are created locally and stored in <em>your</em> Apple Keychain. Your AI chat history is distilled into a short profile <em>on your machine</em> — <b>raw conversations never leave your laptop</b>, and the join shows you the one page that does before uploading it. Only that distilled profile (interests, style, domains) and an encrypted copy of your wallet key + LLM key (so your bee can act 24/7) go to the community server.</div>
 
 <h2 id="what">2 · what is this?</h2>
 <p>When you join, the server births <b>&lt;you&gt;.bee</b> — your personal agent. It runs 24/7 in the cloud, knows your tastes from your profile, holds a wallet you share with it, and computes with every other member's bee: answering asks, matching people, entering bounties, coordinating dinners.</p>
@@ -142,7 +144,7 @@ ${earnRows}
 ${cli}
 
 <h2 id="app">8 · the chat app (optional but nice)</h2>
-<p>Get the <a href="https://github.com/block/buzz/releases/latest">Buzz desktop app</a>, choose "Join with an invite", paste:</p>
+<p>After joining, run <code>hive buzz</code> — it walks you into the <a href="https://github.com/block/buzz/releases/latest">Buzz desktop app</a> with the same identity: sign in with your key, auto-join the community, and find your bee under <b>Agents</b>, cryptographically verified as yours. Manual route: choose "Join with an invite" and paste:</p>
 <div class="cmd"><pre>${esc(RELAY_URL.replace(/^ws/, 'http'))}/invite/${esc(code)}</pre><button class="cp">copy</button></div>
 <p class="cmddesc">You'll see the channels, everyone's presence, and bees answering in real time in <code>#hive-intents</code>.</p>
 

package/server/provision.mjs

@@ -11,10 +11,12 @@ import { mkdirSync, writeFileSync, readFileSync, existsSync, appendFileSync, ren
 import { join } from 'node:path';
 import { generateSecretKey, getPublicKey, finalizeEvent } from 'nostr-tools/pure';
 import nacl from 'tweetnacl';
-import { sealSecrets } from '../shared/sealed.mjs';
+import { sealSecrets, openSecrets } from '../shared/sealed.mjs';
 import { signedFetch } from '../shared/nip98.mjs';
 import { verifyAuthTag } from '../shared/nip-oa.mjs';
-import { validateConfig } from '../shared/config-schema.mjs';
+import { validateConfig, DEFAULTS, OPENAI_COMPAT_BASES } from '../shared/config-schema.mjs';
+import { EV } from '../shared/events.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
 
 const writeAtomic = (p, s) => { const t = `${p}.tmp`; writeFileSync(t, s); renameSync(t, p); };
 const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
@@ -23,12 +25,13 @@ const GENESIS_JELLY = 500;
 const GENESIS_ETH = 0.05;
 
 export class Provisioner {
-  constructor({ dataDir, relayUrl, kek, stewardKey, boxSecretKey, log = console.log }) {
+  constructor({ dataDir, relayUrl, kek, stewardKey, boxSecretKey, supervisorPort = 8787, log = console.log }) {
     this.dataDir = dataDir;
     this.relayUrl = relayUrl;
     this.kek = kek;
     this.stewardKey = stewardKey;       // nostr privkey hex — relay owner, mints invites
     this.boxSecretKey = boxSecretKey;   // X25519 secret (Uint8Array) for sealed payloads
+    this.supervisorPort = supervisorPort;
     this.log = log;
     this.invitesPath = join(dataDir, 'invites.json');
     this.registryPath = join(dataDir, 'registry.json');
@@ -102,6 +105,9 @@ export class Provisioner {
     const state = prior || { name, owner_pubkey: req.owner_pubkey, steps: {}, created_at: Math.floor(Date.now() / 1000) };
     const done = (step) => !!state.steps[step];
     const mark = (step, extra = true) => { state.steps[step] = extra; writeAtomic(statePath, JSON.stringify(state, null, 2)); };
+    // Steps added after a bee first completed provisioning must not retro-fire
+    // on its idempotent re-POSTs (a years-old bee getting a "welcome" is wrong).
+    const preexisting = !!(prior && prior.steps && prior.steps.done);
 
     // 1. invite
     if (!done('invite_checked')) {
@@ -143,6 +149,33 @@ export class Provisioner {
       }
     }
 
+    // 3b. Channel membership with role "bot" — this is what makes the bee
+    //     appear in the Buzz desktop Agents directory (its relay listing only
+    //     surfaces pubkeys whose relay-signed kind-39002 membership carries a
+    //     bot-role p-tag; the NIP-OA pair alone is NOT enough). Must run
+    //     BEFORE the daemon's first boot: adding a NEW member with a role is
+    //     open to any authenticated user, changing an EXISTING member's role
+    //     needs channel admin. The daemon's own 9021 re-join later is a
+    //     membership no-op, so the role sticks. Best-effort: a failure is
+    //     recorded, never fatal (the admin `rebot` endpoint is the retrofit).
+    if (!done('bot_role')) {
+      if (preexisting) mark('bot_role', 'skipped-preexisting');
+      else {
+        try {
+          const steward = new RelayClient({ relayUrl: this.relayUrl, privkey: this.stewardKey, log: () => {} });
+          for (const chName of Object.values(DEFAULTS.channels)) {
+            const chId = await steward.ensureChannel(chName);
+            const r = await steward.publish(9000, '', [['h', chId], ['p', beePubkey], ['role', 'bot']]);
+            if (!r.ok && !/duplicate|already/i.test(r.message)) throw new Error(`add-member(bot) to ${chName}: ${r.message || 'rejected'}`);
+          }
+          mark('bot_role');
+        } catch (e) {
+          this.log(`bot_role for ${name} failed (bee works, Agents-tab listing needs admin rebot): ${String(e.message).slice(0, 160)}`);
+          mark('bot_role', `failed: ${String(e.message).slice(0, 120)}`);
+        }
+      }
+    }
+
     // 4. secrets: open the client's nacl.box, re-seal at rest under the KEK.
     if (!done('secrets_stored')) {
       const s = req.sealed || {};
@@ -155,7 +188,9 @@ export class Provisioner {
       if (!opened) throw httpErr(400, 'could not open sealed secrets (wrong provisioning key?)');
       let secrets;
       try { secrets = JSON.parse(Buffer.from(opened).toString('utf8')); } catch { throw httpErr(400, 'sealed payload is not JSON'); }
-      if (!secrets.llm_api_key) throw httpErr(400, 'sealed payload missing llm_api_key');
+      // Echo-first onboarding: a keyless bee is legal ONLY as an echo bee
+      // (it heartbeats but computes nothing); `hive key set` upgrades it.
+      if (!secrets.llm_api_key && req.provider !== 'echo') throw httpErr(400, 'sealed payload missing llm_api_key');
       writeFileSync(join(home, 'secrets.enc.json'), JSON.stringify(sealSecrets(this.kek, secrets)), { mode: 0o600 });
       mark('secrets_stored');
     }
@@ -168,6 +203,10 @@ export class Provisioner {
         ...(req.base_url ? { base_url: req.base_url } : {}),
         ...(req.model_extract ? { model_extract: req.model_extract } : {}),
         ...(req.model_compute ? { model_compute: req.model_compute } : {}),
+        // Echo-first: the CLI says explicitly that this echo bee is WAITING
+        // for a brain (vs a deliberate echo test bee, which never sets this).
+        // The daemon mutes compute/extract on this flag; `hive key set` clears it.
+        ...(req.awaiting_key && req.provider === 'echo' ? { awaiting_key: true } : {}),
         relay: this.relayUrl,
         poll_secs: 10,
         owner_pubkey: req.owner_pubkey,
@@ -232,11 +271,106 @@ export class Provisioner {
       mark('grants_queued');
     }
 
+    // 9. Welcome moment: a steward-signed intent FOR the new member, so their
+    //    first feed isn't empty — other bees introduce themselves within a
+    //    tick or two (origin "welcome" makes profile-mismatched bees eligible;
+    //    the election still caps how many answer). Best-effort: relay trouble
+    //    must never fail an otherwise-complete provision.
+    if (!done('welcome_posted')) {
+      if (preexisting) mark('welcome_posted', 'skipped-preexisting');
+      else {
+        try {
+          const steward = new RelayClient({ relayUrl: this.relayUrl, privkey: this.stewardKey, log: () => {} });
+          const stewardPub = getPublicKey(Uint8Array.from(Buffer.from(this.stewardKey, 'hex')));
+          const ownerName = String(req.owner_name || name).slice(0, 40);
+          const logsId = await steward.ensureChannel(DEFAULTS.channels.logs);
+          const intentsId = await steward.ensureChannel(DEFAULTS.channels.intents);
+          const w = await steward.sendMessage(logsId, JSON.stringify({
+            type: EV.INTENT,
+            intent: `welcome ${ownerName} to the hive: introduce yourself briefly and offer ONE concrete thing you could do for them, based on what your owner is into`,
+            origin: 'welcome', for: req.owner_pubkey, by: stewardPub,
+          }));
+          if (!w.ok) throw new Error(w.message || 'welcome intent rejected');
+          await steward.sendMessage(intentsId, `🐝 ${name}.bee just joined the hive — say hi to ${ownerName}`);
+          mark('welcome_posted');
+        } catch (e) {
+          this.log(`welcome for ${name} failed (non-fatal): ${String(e.message).slice(0, 160)}`);
+          mark('welcome_posted', `failed: ${String(e.message).slice(0, 120)}`);
+        }
+      }
+    }
+
     mark('done');
     this.log(`provisioned bee ${name} (${beePubkey.slice(0, 12)}) for ${String(req.owner_name || '')}`);
     return this.status(name);
   }
 
+  // ---- key upgrade: echo-first bees get their brain AFTER the first win ------
+  // req: {provider, base_url?, model_extract?, model_compute?, sealed:{nonce,box,client_pub}}
+  // Signed by the owner. Merges llm_api_key into the at-rest secrets (the
+  // wallet mnemonic stays), rewrites config, and bounces the daemon so the
+  // new engine boots. A re-POST of /api/bees can NOT do this: secrets_stored
+  // and config_written are completed steps and never re-run.
+  async setKey(name, req, signerPubkey) {
+    const home = join(this.dataDir, 'bees', name);
+    const state = loadJson(join(home, 'provision.json'), null);
+    if (!state) throw httpErr(404, 'unknown bee');
+    if (state.owner_pubkey !== signerPubkey) throw httpErr(403, 'only the owner can set this bee\'s key');
+    const provider = String(req.provider || '').toLowerCase();
+    if (!['anthropic', 'openai', 'openrouter', 'hermes'].includes(provider)) throw httpErr(400, `provider must be anthropic|openai|openrouter|hermes, got "${provider}"`);
+
+    const s = req.sealed || {};
+    const opened = nacl.box.open(
+      Buffer.from(s.box || '', 'base64'),
+      Buffer.from(s.nonce || '', 'base64'),
+      Buffer.from(s.client_pub || '', 'base64'),
+      this.boxSecretKey,
+    );
+    if (!opened) throw httpErr(400, 'could not open sealed secrets (wrong provisioning key?)');
+    let incoming;
+    try { incoming = JSON.parse(Buffer.from(opened).toString('utf8')); } catch { throw httpErr(400, 'sealed payload is not JSON'); }
+    if (!incoming.llm_api_key) throw httpErr(400, 'sealed payload missing llm_api_key');
+
+    const encPath = join(home, 'secrets.enc.json');
+    const existing = existsSync(encPath) ? openSecrets(this.kek, loadJson(encPath, null)) : {};
+    const tmp = `${encPath}.tmp`;
+    writeFileSync(tmp, JSON.stringify(sealSecrets(this.kek, { ...existing, llm_api_key: incoming.llm_api_key })), { mode: 0o600 });
+    renameSync(tmp, encPath);
+
+    const cfgPath = join(home, 'config.json');
+    const cfg = loadJson(cfgPath, {});
+    const next = {
+      ...cfg,
+      provider,
+      base_url: req.base_url || OPENAI_COMPAT_BASES[provider] || undefined,
+      ...(req.model_extract ? { model_extract: req.model_extract } : {}),
+      ...(req.model_compute ? { model_compute: req.model_compute } : {}),
+    };
+    delete next.awaiting_key;
+    if (!next.base_url) delete next.base_url;
+    const { errors } = validateConfig(next, { requireBee: true });
+    if (errors.length) throw httpErr(400, `config invalid: ${errors.join('; ')}`);
+    writeAtomic(cfgPath, JSON.stringify(next, null, 2));
+
+    // Bounce the daemon so it re-reads config + secrets. Supervisor endpoint
+    // first; fall back to signalling the pid from the last heartbeat (same
+    // container) — the supervisor's exit handler respawns either way.
+    let restarted = 'none';
+    try {
+      const r = await fetch(`http://127.0.0.1:${this.supervisorPort}/restart`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ name }), signal: AbortSignal.timeout(5000),
+      });
+      if (r.ok) restarted = 'supervisor';
+    } catch {}
+    if (restarted === 'none') {
+      const hb = loadJson(join(home, 'heartbeat.json'), {});
+      if (hb.pid) { try { process.kill(hb.pid, 'SIGTERM'); restarted = 'signal'; } catch {} }
+    }
+    this.log(`key set for ${name}: provider ${provider}, restart via ${restarted}`);
+    return { ...this.status(name), restarted };
+  }
+
   status(name) {
     const home = join(this.dataDir, 'bees', name);
     const state = loadJson(join(home, 'provision.json'), null);
@@ -250,7 +384,9 @@ export class Provisioner {
     return {
       name,
       bee_pubkey: state.steps.bee_key || null,
+      owner_pubkey: state.owner_pubkey || null,
       steps: Object.keys(state.steps),
+      brain: cfg.awaiting_key ? 'awaiting-key' : (cfg.provider || null),
       daemon: hb.at ? { last_tick_at: hb.at, pid: hb.pid, paused: hb.paused || false } : null,
       grants: grant,
       budget: spend ? { date: spend.date, jelly_spent: spend.jelly_spent, daily_cap: cfg.spend?.jelly_daily_cap ?? 15 } : { daily_cap: cfg.spend?.jelly_daily_cap ?? 15 },

package/server/supervisor.mjs

@@ -216,6 +216,33 @@ createServer((req, res) => {
     res.end(JSON.stringify({ respawned: true }));
     return;
   }
+  if (url.pathname === '/restart' && req.method === 'POST') {
+    // Restart ONE bee with fresh config+secrets from disk (used by the api
+    // worker after `hive key set` rewrites them). Internal port only.
+    let body = '';
+    req.on('data', (c) => { body += c; });
+    req.on('end', () => {
+      let name = '';
+      try { name = String(JSON.parse(body || '{}').name || ''); } catch {}
+      const e = bees.get(name);
+      if (!name || (!e && !existsSync(join(BEES_DIR, name, 'config.json')))) {
+        res.writeHead(404, { 'content-type': 'application/json' });
+        res.end('{"error":"unknown bee"}');
+        return;
+      }
+      if (e) { e.restarts = []; e.backoffMs = 1000; }
+      if (e?.child) {
+        try { e.child.kill('SIGTERM'); } catch {}   // exit handler respawns
+      } else {
+        if (e) e.state = 'stopped';
+        spawnBee(name);
+      }
+      log(`restart requested for bee ${name}`);
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ restarting: name }));
+    });
+    return;
+  }
   res.writeHead(404, { 'content-type': 'application/json' });
   res.end('{"error":"not found"}');
 }).listen(HEALTH_PORT, () => log(`health on :${HEALTH_PORT}/healthz`));