feat: Autonomous agent commands — watch, scan-bounties, batch sell

Phase 0 — MCP compatibility fixes:
- Align Base mainnet contract to 0x69Aa385686AEdA505013a775ddE7A59d045cb30d
- Fix ECDH commit-reveal: commit against encrypted key when buyer pubkey known
- Add marketplace publishing to sell command
- Bridge MCP JSON key storage (~/.datafund/escrow-keys/) bidirectionally
- Extend CLIError with retryAfterSeconds, suggestedCommand, 10 new error codes
- Add HTTPS enforcement for API and RPC URLs

Phase 1 — New commands:
- `ade watch` — escrow automation daemon with NDJSON event protocol,
  three-tier spending limits, HMAC-SHA256 state integrity, PID-based locking
- `ade scan-bounties` — match local files to open bounties via keyword overlap,
  security filters for sensitive files, optional auto-respond mode
- `ade sell --dir` — batch sell files from directory with rate limiting,
  --skip-existing, --max-files, partial error reporting

Schema v1.1.0 with auth levels, credentials, protocols, error formats.
Version bumped to 0.2.0. 213 tests pass.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: plur9

package.json

@@ -1,11 +1,11 @@
 {
   "name": "ade",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "scripts": {
     "test": "bun test",
     "test:watch": "bun test --watch",
-    "test:unit": "bun test tests/errors.test.ts tests/format.test.ts tests/api.test.ts tests/routing.test.ts tests/help.test.ts tests/escrow-keys.test.ts tests/commands.test.ts tests/addresses.test.ts tests/secrets.test.ts tests/keychain/keychain.test.ts tests/update.test.ts tests/integration.test.ts",
+    "test:unit": "bun test tests/errors.test.ts tests/format.test.ts tests/api.test.ts tests/routing.test.ts tests/help.test.ts tests/escrow-keys.test.ts tests/commands.test.ts tests/addresses.test.ts tests/secrets.test.ts tests/keychain/keychain.test.ts tests/update.test.ts tests/integration.test.ts tests/watch.test.ts tests/scan.test.ts tests/batch-sell.test.ts",
     "test:chain": "bun test tests/chain-view.test.ts",
     "test:integration": "bun test tests/keychain/integration.test.ts",
     "review": "bun scripts/review.ts",

src/addresses.ts

@@ -42,7 +42,7 @@ export const CHAINS: Record<string, ChainConfig> = {
     explorer: 'https://basescan.org',
     defaultRpc: 'https://mainnet.base.org',
     contracts: {
-      dataEscrow: getAddress('0xDd4396d4F28d2b513175ae17dE11e56a898d19c3'),
+      dataEscrow: getAddress('0x69Aa385686AEdA505013a775ddE7A59d045cb30d'),
       ...ERC8004_MAINNET,
       usdc: getAddress('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'),
       usdt: getAddress('0xfde4C96c8593536E31F229EA8f37b2ADa2699bb2'),

src/api.ts

@@ -11,8 +11,25 @@ export function getBaseUrl(): string {
   return (process.env.SX_API || 'https://agents.datafund.io').trim()
 }
 
+function validateApiUrl(url: string): void {
+  try {
+    const parsed = new URL(url)
+    const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '::1'
+    if (parsed.protocol !== 'https:' && !isLocalhost) {
+      throw new CLIError('ERR_INVALID_ARGUMENT',
+        `API URL must use HTTPS: ${url}`,
+        'Set a secure URL: ade set SX_API https://agents.datafund.io')
+    }
+  } catch (err) {
+    if (err instanceof CLIError) throw err
+    throw new CLIError('ERR_INVALID_ARGUMENT', `Invalid API URL: ${url}`)
+  }
+}
+
 export async function apiFetch<T = unknown>(path: string, opts?: RequestInit): Promise<T> {
-  const url = `${getBaseUrl()}/api/v1${path}`
+  const baseUrl = getBaseUrl()
+  validateApiUrl(baseUrl)
+  const url = `${baseUrl}/api/v1${path}`
 
   let res: Response
   try {