@dfm-fi/agent 0.2.2059 → 0.2.2084

package/README.md

@@ -86,7 +86,7 @@ running. Write tools also require `DFM_AGENT_WRITE_ENABLED=true`.
 | `report_bug` | support | Send a bug report to the DFM team. Moves no funds. |
 | `onboard` | onboarding | Headless agent: runs the steps below in order, stops at the first missing one and prints the funding step. |
 | `create_identity_wallet` | onboarding | The agent's own Solana identity keypair (SIWS sign-in); reused if present, never a second. |
-| `set_profile` | onboarding | Display name, @username, bio, avatar. No image file? A deterministic default avatar is generated. |
+| `set_profile` | onboarding | Display name, bio, avatar (no DFM @username; the only @ is a linked X). No image file? A deterministic default avatar is generated. |
 | `create_app_wallet` | onboarding | An app wallet owned by the agent's local P-256 key. |
 | `create_api_key` | onboarding | Mint a `dfm_` key (read-only unless `DFM_ALLOW_WRITE_KEY_MINT=1`), stored 0600, never shown in chat. |
 | `launch_vault` | write | Launch a fund (2–10 assets, weights sum to 10,000 bps). |

package/dist/api-client.d.ts

@@ -78,7 +78,7 @@ export declare class DfmApiClient {
      * null. The session wallet must equal `user` (or be the vault admin), else 403.
      * Returns `null` when the user has no open escrow.
      */
-    getZapV2Status(vaultAddress: string, user: string): Promise<ZapV2Status | null>;
+    getZapV2Status(vaultAddress: string, user: string, escrowSlot?: number): Promise<ZapV2Status | null>;
     /**
      * `GET /portfolio` (auth) — the API reads the wallet from the JWT; there is NO
      * portfolio-by-arbitrary-address endpoint. So this returns the SESSION
@@ -287,7 +287,7 @@ export declare class DfmApiClient {
         expirySecs?: number;
     }): Promise<ZapV2PrepareResponse>;
     /** `POST /vaults/:address/zap-in-v2/close/prepare` — CPI mint_in_kind_v2. */
-    prepareZapInCloseV2(vaultAddress: string): Promise<ZapV2PrepareResponse>;
+    prepareZapInCloseV2(vaultAddress: string, escrowSlot?: number): Promise<ZapV2PrepareResponse>;
     /**
      * `POST /tx/submit` (#18) — hand a SIGNED prepared tx back to the backend so
      * its premium RPC broadcasts it. Used when no client RPC is configured (the
@@ -305,13 +305,13 @@ export declare class DfmApiClient {
         expirySecs?: number;
     }): Promise<ZapV2PrepareResponse>;
     /** `POST /vaults/:address/zap-out-v2/close/prepare` — exit fee, pay net USDC. */
-    prepareZapOutCloseV2(vaultAddress: string): Promise<ZapV2PrepareResponse>;
+    prepareZapOutCloseV2(vaultAddress: string, escrowSlot?: number): Promise<ZapV2PrepareResponse>;
     /**
      * `POST /vaults/:address/zap-v2/cancel/prepare` — return the escrow's current
      * USDC + per-asset balances to the test wallet as-is (no swaps, no oracle),
      * then close it. 404 server-side when no escrow is open. Single v0 tx.
      */
-    prepareZapCancelV2(vaultAddress: string): Promise<ZapV2SingleTxResponse>;
+    prepareZapCancelV2(vaultAddress: string, escrowSlot?: number): Promise<ZapV2SingleTxResponse>;
     /**
      * `POST /vaults/:address/zap-v2/update-envelope/prepare` — LOOSEN the pinned
      * per-leg floors + slippage (and optionally extend expiry) so a stalled escrow

package/dist/api-client.js

@@ -219,10 +219,13 @@ export class DfmApiClient {
      * null. The session wallet must equal `user` (or be the vault admin), else 403.
      * Returns `null` when the user has no open escrow.
      */
-    async getZapV2Status(vaultAddress, user) {
+    async getZapV2Status(vaultAddress, user, escrowSlot) {
         requireBase58(vaultAddress, 'vault address');
         requireBase58(user, 'user wallet');
-        return this.authRequest(`/vaults/${vaultAddress}/zap-v2/status/${user}`);
+        // A wallet can hold up to 8 escrows per fund; without a slot the API
+        // returns the oldest open one.
+        const q = escrowSlot === undefined ? '' : `?slot=${escrowSlot}`;
+        return this.authRequest(`/vaults/${vaultAddress}/zap-v2/status/${user}${q}`);
     }
     /**
      * `GET /portfolio` (auth) — the API reads the wallet from the JWT; there is NO
@@ -490,9 +493,9 @@ export class DfmApiClient {
         return this.authRequest(`/vaults/${vaultAddress}/zap-in-v2/open/prepare`, { method: 'POST', body: JSON.stringify({ usdcAmount: usdcAmountRaw, ...opts }) });
     }
     /** `POST /vaults/:address/zap-in-v2/close/prepare` — CPI mint_in_kind_v2. */
-    async prepareZapInCloseV2(vaultAddress) {
+    async prepareZapInCloseV2(vaultAddress, escrowSlot) {
         requireBase58(vaultAddress, 'vault address');
-        return this.authRequest(`/vaults/${vaultAddress}/zap-in-v2/close/prepare`, { method: 'POST', body: JSON.stringify({}) });
+        return this.authRequest(`/vaults/${vaultAddress}/zap-in-v2/close/prepare`, { method: 'POST', body: JSON.stringify(escrowSlot === undefined ? {} : { escrowSlot }) });
     }
     /**
      * `POST /tx/submit` (#18) — hand a SIGNED prepared tx back to the backend so
@@ -518,18 +521,18 @@ export class DfmApiClient {
         return this.authRequest(`/vaults/${vaultAddress}/zap-out-v2/open/prepare`, { method: 'POST', body: JSON.stringify({ shares: sharesRaw, ...opts }) });
     }
     /** `POST /vaults/:address/zap-out-v2/close/prepare` — exit fee, pay net USDC. */
-    async prepareZapOutCloseV2(vaultAddress) {
+    async prepareZapOutCloseV2(vaultAddress, escrowSlot) {
         requireBase58(vaultAddress, 'vault address');
-        return this.authRequest(`/vaults/${vaultAddress}/zap-out-v2/close/prepare`, { method: 'POST', body: JSON.stringify({}) });
+        return this.authRequest(`/vaults/${vaultAddress}/zap-out-v2/close/prepare`, { method: 'POST', body: JSON.stringify(escrowSlot === undefined ? {} : { escrowSlot }) });
     }
     /**
      * `POST /vaults/:address/zap-v2/cancel/prepare` — return the escrow's current
      * USDC + per-asset balances to the test wallet as-is (no swaps, no oracle),
      * then close it. 404 server-side when no escrow is open. Single v0 tx.
      */
-    async prepareZapCancelV2(vaultAddress) {
+    async prepareZapCancelV2(vaultAddress, escrowSlot) {
         requireBase58(vaultAddress, 'vault address');
-        return this.authRequest(`/vaults/${vaultAddress}/zap-v2/cancel/prepare`, { method: 'POST', body: JSON.stringify({}) });
+        return this.authRequest(`/vaults/${vaultAddress}/zap-v2/cancel/prepare`, { method: 'POST', body: JSON.stringify(escrowSlot === undefined ? {} : { escrowSlot }) });
     }
     /**
      * `POST /vaults/:address/zap-v2/update-envelope/prepare` — LOOSEN the pinned

package/dist/mcp-server.js

@@ -419,15 +419,16 @@ server.registerTool('zap_status', {
     inputSchema: {
         vault: z.string().regex(BASE58, 'Invalid base58 vault address'),
         user: z.string().regex(BASE58, 'Invalid base58 user wallet').optional(),
+        escrowSlot: z.number().int().min(0).max(7).optional().describe('Escrow slot 0-7 (from zap_status). A wallet can hold several escrows per fund; omit for the oldest open one.'),
     },
     annotations: { readOnlyHint: true, openWorldHint: true },
-}, async ({ vault, user }) => {
+}, async ({ vault, user, escrowSlot }) => {
     try {
         const identity = await resolveWalletIdentity();
         const escrowOwner = resolveZapStatusWallet(identity, user);
         if (!escrowOwner)
             return errText('zap_status could not resolve this agent wallet');
-        const res = await api.getZapV2Status(vault, escrowOwner);
+        const res = await api.getZapV2Status(vault, escrowOwner, escrowSlot);
         return text(res ?? { escrow: null, note: 'No open zap-v2 escrow for this vault+user.' });
     }
     catch (e) {
@@ -643,7 +644,7 @@ server.registerTool('create_identity_wallet', {
 });
 server.registerTool('set_profile', {
     title: 'Set my DFM profile',
-    description: 'Set this agent\'s public DFM profile: displayName (required), optional @username and bio. The avatar is the ' +
+    description: 'Set this agent\'s public DFM profile: displayName (required) and optional bio; there is no DFM @username. The avatar is the ' +
         'image the OPERATOR put at DFM_AGENT_AVATAR_PATH or ~/.config/dfm/avatar.{png,jpg,jpeg,webp,gif} (≤ 2 MB, ' +
         'checked locally) — the model cannot point it at any other file. With no such file a deterministic default ' +
         'avatar (an identicon of the identity public key) is generated and uploaded, so no image is required; the ' +
@@ -651,16 +652,14 @@ server.registerTool('set_profile', {
         'the SIWS sign-in (identity wallet). Moves no funds.',
     inputSchema: {
         displayName: z.string().min(1).max(32),
-        username: z.string().regex(/^@?[a-zA-Z0-9_]{3,20}$/).optional().describe('@handle, 3-20 chars a-z 0-9 _'),
         bio: z.string().max(160).optional(),
         uploadAvatar: z.boolean().optional().describe('default true: upload the operator image, or the generated default when there is none'),
     },
     annotations: { readOnlyHint: false, idempotentHint: true, openWorldHint: true },
-}, async ({ displayName, username, bio, uploadAvatar }) => {
+}, async ({ displayName, bio, uploadAvatar }) => {
     try {
         const profile = await onboardApi.updateProfile({
             displayName,
-            ...(username ? { username: username.replace(/^@/, '') } : {}),
             ...(bio !== undefined ? { bio } : {}),
         });
         let avatar = { uploaded: false };
@@ -676,7 +675,7 @@ server.registerTool('set_profile', {
                     : {}),
             };
         }
-        return text({ profile: { displayName: profile.displayName, username: profile.username, bio: profile.bio }, avatar });
+        return text({ profile: { displayName: profile.displayName, bio: profile.bio }, avatar });
     }
     catch (e) {
         return errText(`set_profile failed: ${e.message}`);
@@ -1218,19 +1217,20 @@ server.registerTool('zap_v2_cancel', {
         'just want your funds back. Returns the held balances + the cancel signature.',
     inputSchema: {
         vault: z.string().regex(BASE58, 'Invalid base58 vault address'),
+        escrowSlot: z.number().int().min(0).max(7).optional().describe('Escrow slot 0-7 (from zap_status). A wallet can hold several escrows per fund; omit for the oldest open one.'),
         confirmPhrase: confirmPhraseField,
     },
     annotations: { title: 'DFM zap-v2 cancel', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
 }, 
 // REVIEW: real-money path — parent must review before enabling.
-async ({ vault, confirmPhrase }) => {
+async ({ vault, escrowSlot, confirmPhrase }) => {
     const gate = confirmGate('zap_v2_cancel', confirmPhrase);
     if (!gate.ok)
         return gate.result;
     const write = writeGate();
     if (!write.ok)
         return write.result;
-    return keylessWrite('zap_v2_cancel', { vault });
+    return keylessWrite('zap_v2_cancel', { vault, escrowSlot });
 });
 server.registerTool('zap_v2_update_envelope', {
     title: 'Loosen pinned floors on a stalled zap-v2 escrow',
@@ -1241,6 +1241,7 @@ server.registerTool('zap_v2_update_envelope', {
         'slippage and ≤1000 (onchain monotonic-loosening). Optionally extend expiry. ' +
         'Returns the exact loosening applied (old→new). If it still will not fill, cancel.',
     inputSchema: {
+        escrowSlot: z.number().int().min(0).max(7).optional().describe('Escrow slot 0-7 (from zap_status). A wallet can hold several escrows per fund; omit for the oldest open one.'),
         vault: z.string().regex(BASE58, 'Invalid base58 vault address'),
         loosenPct: z.number().min(0).max(50).optional(),
         newSlippageBps: z.number().int().min(0).max(1000).optional(),
@@ -1250,14 +1251,14 @@ server.registerTool('zap_v2_update_envelope', {
     annotations: { title: 'DFM zap-v2 update-envelope', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
 }, 
 // REVIEW: real-money path — parent must review before enabling.
-async ({ vault, loosenPct, newSlippageBps, extendSecs, confirmPhrase }) => {
+async ({ vault, loosenPct, newSlippageBps, extendSecs, escrowSlot, confirmPhrase }) => {
     const gate = confirmGate('zap_v2_update_envelope', confirmPhrase);
     if (!gate.ok)
         return gate.result;
     const write = writeGate();
     if (!write.ok)
         return write.result;
-    return keylessWrite('zap_v2_update_envelope', { vault, loosenPct, newSlippageBps, extendSecs });
+    return keylessWrite('zap_v2_update_envelope', { vault, loosenPct, newSlippageBps, extendSecs, escrowSlot });
 });
 // ─── WRITE TOOL: update_vault_assets (config-only, same semantics in both lanes) ─
 server.registerTool('update_vault_assets', {

package/dist/onboarding-api.d.ts

@@ -32,7 +32,6 @@ export declare function onboardingApi(call: SessionFetch): {
     }>;
     updateProfile: (dto: {
         displayName: string;
-        username?: string;
         bio?: string;
     }) => Promise<Record<string, unknown>>;
     uploadAvatar: (bytes: Buffer, filename: string, mime: string) => Promise<Record<string, unknown>>;

package/dist/types.d.ts

@@ -71,6 +71,8 @@ export interface VaultDetailResponse {
  */
 export interface ZapV2Status {
     escrowPda: string;
+    /** Escrow slot 0..7 — a wallet can hold several escrows per fund. */
+    escrowSlot?: number;
     vault: string;
     user: string;
     mode: number;
@@ -111,6 +113,8 @@ export interface ZapV2PrepareResponse {
     lastValidBlockHeight: number;
     computeUnits: number;
     escrowPda: string;
+    /** Escrow slot (0..7) the tx acts on. */
+    escrowSlot?: number;
     /** zap-out OPEN additionally returns these (redeem economics). */
     minUsdcOut?: string;
     expectedUsdc?: string;

package/dist/zap-v2-flow.d.ts

@@ -44,7 +44,7 @@ export interface ZapFlowResult {
      * #61 — 'complete' = escrow closed/settled (shares minted / USDC paid).
      * 'pending' = the poll window elapsed but the escrow is STILL OPEN and
      * self-healing (the backend orchestrator keeps cranking) — this is NOT a
-     * failure; call the same tool again (same args) to RESUME polling to close.
+     * failure; call again with the escrow's `escrowSlot` to RESUME polling to close.
      */
     settlement: 'complete' | 'pending';
     openSignatures: string[];
@@ -75,6 +75,7 @@ export declare function runDeposit(config: AgentConfig, api: DfmApiClient, user:
     slippageBps?: number;
     expirySecs?: number;
     poll?: Partial<PollOptions>;
+    escrowSlot?: number;
 }): Promise<ZapFlowResult>;
 /**
  * Drive a full REDEEM (shares → basket → USDC). `sharesRaw` is 6-dp raw units.
@@ -84,6 +85,7 @@ export declare function runRedeem(config: AgentConfig, api: DfmApiClient, user:
     slippageBps?: number;
     expirySecs?: number;
     poll?: Partial<PollOptions>;
+    escrowSlot?: number;
 }): Promise<ZapFlowResult>;
 export {};
 //# sourceMappingURL=zap-v2-flow.d.ts.map

package/dist/zap-v2-flow.js

@@ -28,21 +28,22 @@ async function submitOpen(config, prepared, kind, api) {
     catch (e) {
         if (e instanceof BlockhashExpiredError) {
             throw new Error(`The ${kind} OPEN tx did not confirm before its blockhash expired. Check zap_status: ` +
-                `if an escrow now EXISTS, the open landed — poll it then close (re-run this ${kind} call ` +
-                `once an escrow is open will resume it); if NO escrow exists, nothing happened and it is ` +
+                `if an escrow now EXISTS in slot ${prepared.escrowSlot ?? 0}, the open landed — re-run this ${kind} ` +
+                `with escrowSlot=${prepared.escrowSlot ?? 0} to resume it; if NO escrow exists, nothing happened and it is ` +
                 `safe to re-run the ${kind}. Original: ${e.message}`);
         }
         // Backend broadcast the OPEN but it did NOT confirm inside the API window. The
         // open pulls funds + Anchor-`init`s the escrow, so it MAY still land — a blind
         // re-run could double-pull before the escrow becomes visible. Do NOT re-run
         // immediately: verify the broadcast signature on-chain first, THEN use
-        // zap_status (the deposit/redeem resume-guard keys off an existing escrow, so a
+        // zap_status (resume = re-run with the escrowSlot of this open, so a
         // re-run is only safe once that escrow is visible OR the open is confirmed dead).
         if (e instanceof BroadcastUnconfirmedError) {
             throw new Error(`The ${kind} OPEN tx ${e.signature} was broadcast but did NOT confirm in time — it may ` +
                 `still land. Do NOT blindly re-run (the open pulls funds + creates the escrow; a duplicate ` +
                 `could double-pull). First verify ${e.signature} onchain: if it LANDED, an escrow now ` +
-                `exists — re-run this ${kind} to resume (poll → close); if it truly DROPPED (sig not found), ` +
+                `exists — re-run this ${kind} with escrowSlot=${prepared.escrowSlot ?? 0} to resume (poll → close); ` +
+                `a re-run WITHOUT it opens a second ${kind}. If it truly DROPPED (sig not found), ` +
                 `it is safe to re-run the ${kind}. Original: ${e.message}`);
         }
         throw e;
@@ -110,12 +111,12 @@ async function closeWithRetry(config, api, prepareClose, confirmClosed, attempts
  * surface a resume-able `pending` instead of a misleading hard error (a redeem
  * that out-runs the poll window is still self-healing, not failed).
  */
-async function pollUntilReady(api, vault, user, poll) {
+async function pollUntilReady(api, vault, user, poll, escrowSlot) {
     const deadline = Date.now() + poll.timeoutSecs * 1000;
     let last = null;
     let sawOpen = false; // have we observed the escrow OPEN at least once this poll?
     while (Date.now() < deadline) {
-        last = await api.getZapV2Status(vault, user);
+        last = await api.getZapV2Status(vault, user, escrowSlot);
         if (!last) {
             // A null read is ambiguous: (a) the escrow SETTLED + closed (the backend
             // keeper finished it — the #61 success case), OR (b) a freshly-opened escrow
@@ -139,10 +140,13 @@ async function pollUntilReady(api, vault, user, poll) {
     return { ready: false, reason: 'timeout', status: last };
 }
 /** Build the non-fatal `pending` ZapFlowResult (#61) — escrow still open / self-healing. */
-function pendingResult(kind, vault, escrowPda, openSignatures, pr) {
+function pendingResult(kind, vault, escrowPda, openSignatures, pr, escrowSlot) {
     const legsFilled = pr.status?.legsFilled ?? 0;
     const legsTotal = pr.status?.legsTotal ?? 0;
     const verb = kind === 'redeem' ? 'redeem' : 'deposit';
+    // Without the slot a repeat call OPENS A NEW escrow (several per fund are
+    // allowed) — resuming this one needs it.
+    const again = `call ${verb} again with escrowSlot=${escrowSlot ?? 0}`;
     const why = pr.reason === 'gone'
         ? `The escrow is no longer open — most likely it SETTLED (the backend keeper closed it ` +
             `after cranking the legs) or was cancelled. Verify with get_portfolio / your balances ` +
@@ -150,10 +154,10 @@ function pendingResult(kind, vault, escrowPda, openSignatures, pr) {
         : pr.reason === 'expired'
             ? `The escrow passed its expiry with ${legsFilled}/${legsTotal} legs filled. The backend ` +
                 `stall-recovery may STILL settle it automatically (it loosens floors + extends expiry) — ` +
-                `call ${verb} again (same args) to resume polling. If it stays stuck, use ` +
+                `${again} to resume polling. If it stays stuck, use ` +
                 `zap_v2_update_envelope (loosen floors) or zap_v2_cancel (recover holdings).`
             : `Still cranking: ${legsFilled}/${legsTotal} legs filled. The escrow is OPEN and ` +
-                `self-healing — this is NOT a failure. Call ${verb} again (same args) to RESUME polling ` +
+                `self-healing — this is NOT a failure. To RESUME polling, ${again} ` +
                 `to completion (consider a larger pollTimeoutSecs), or inspect with zap_status.`;
     return {
         ok: true,
@@ -175,49 +179,50 @@ function pendingResult(kind, vault, escrowPda, openSignatures, pr) {
  */
 export async function runDeposit(config, api, user, vault, usdcAmountRaw, opts) {
     const poll = { ...DEFAULT_POLL, ...(opts?.poll ?? {}) };
-    // 0. RESUME GUARD — if an escrow is ALREADY open for this (vault, user), don't
-    //    re-open (the escrow PDA is Anchor-`init` → a second open reverts, and we'd
-    //    risk double-pulling USDC). Resume it: poll → close. This makes the deposit
-    //    call idempotent against a prior open whose close never landed.
-    const existing = await api.getZapV2Status(vault, user);
+    // 0. RESUME only when asked: a wallet may hold several escrows per fund, so a
+    //    plain call always OPENS a new one. `opts.escrowSlot` resumes that escrow
+    //    (poll → close) — the idempotent retry after a pending/unconfirmed open.
+    const existing = opts?.escrowSlot === undefined ? null : await api.getZapV2Status(vault, user, opts.escrowSlot);
+    if (opts?.escrowSlot !== undefined && !existing) {
+        throw new Error(`No open escrow in slot ${opts.escrowSlot} for this vault+wallet — nothing to resume.`);
+    }
     let openSignatures = [];
     let escrowPda;
+    let escrowSlot = opts?.escrowSlot;
     // Set when resuming an open escrow whose pinned input amount differs from the
     // amount this call requested (the requested amount is NOT honored on resume).
     let resumedPinnedAmount = null;
     if (existing) {
         if (existing.mode !== 0) {
-            throw new Error(`An open REDEEM escrow already exists for this vault+wallet — cancel or finish it ` +
-                `(zap_v2_cancel / redeem) before depositing.`);
+            throw new Error(`Slot ${opts?.escrowSlot} holds a REDEEM escrow, not a deposit.`);
         }
         escrowPda = existing.escrowPda;
         // The existing escrow's input amount was PINNED at its open; resuming
         // completes THAT amount and ignores the `usdcAmountRaw` just requested.
-        // Surface the mismatch loudly so a caller acting on the requested size
-        // isn't misled into thinking a different amount was deposited.
         if (existing.inputAmount && existing.inputAmount !== usdcAmountRaw) {
             resumedPinnedAmount = existing.inputAmount;
         }
     }
     else {
-        // 1. OPEN — pull USDC into escrow, pin the plan.
+        // 1. OPEN — pull USDC into escrow, pin the plan (the API picks a free slot).
         const open = await api.prepareZapInOpenV2(vault, usdcAmountRaw, {
             slippageBps: opts?.slippageBps,
             expirySecs: opts?.expirySecs,
         });
+        escrowSlot = open.escrowSlot;
         openSignatures = await submitOpen(config, open, 'deposit', api);
         escrowPda = open.escrowPda;
     }
     // 2. POLL — wait for the backend orchestrator to crank every USDC→asset leg.
     //    #61: on timeout/expiry/auto-settle, return a resume-able `pending` rather
     //    than throwing — the escrow keeps self-healing.
-    const pr = await pollUntilReady(api, vault, user, poll);
+    const pr = await pollUntilReady(api, vault, user, poll, escrowSlot);
     if (!pr.ready)
-        return pendingResult('deposit', vault, escrowPda, openSignatures, pr);
+        return pendingResult('deposit', vault, escrowPda, openSignatures, pr, escrowSlot);
     const ready = pr.status;
     // 3. CLOSE — mint_in_kind_v2, forward shares, close escrow. Retries on
     //    blockhash expiry (escrow stays READY between attempts).
-    const closeSignatures = await closeWithRetry(config, api, () => api.prepareZapInCloseV2(vault), async () => !(await api.getZapV2Status(vault, user)));
+    const closeSignatures = await closeWithRetry(config, api, () => api.prepareZapInCloseV2(vault, escrowSlot), async () => !(await api.getZapV2Status(vault, user, escrowSlot)));
     return {
         ok: true,
         vault,
@@ -242,19 +247,21 @@ export async function runDeposit(config, api, user, vault, usdcAmountRaw, opts)
  */
 export async function runRedeem(config, api, user, vault, sharesRaw, opts) {
     const poll = { ...DEFAULT_POLL, ...(opts?.poll ?? {}) };
-    // 0. RESUME GUARD — mirror the deposit path: if a redeem escrow is already
-    //    open, resume it rather than re-burning shares into a second escrow.
-    const existing = await api.getZapV2Status(vault, user);
+    // 0. RESUME only when asked (see runDeposit): a plain call opens a new escrow.
+    const existing = opts?.escrowSlot === undefined ? null : await api.getZapV2Status(vault, user, opts.escrowSlot);
+    if (opts?.escrowSlot !== undefined && !existing) {
+        throw new Error(`No open escrow in slot ${opts.escrowSlot} for this vault+wallet — nothing to resume.`);
+    }
     let openSignatures = [];
     let escrowPda;
+    let escrowSlot = opts?.escrowSlot;
     // Set when resuming an open escrow whose pinned share amount differs from
     // this call. The existing escrow wins; opening it already burned shares and
     // fixed `sharesIn`, so the new request cannot resize the in-flight redeem.
     let resumedPinnedShares = null;
     if (existing) {
         if (existing.mode !== 1) {
-            throw new Error(`An open DEPOSIT escrow already exists for this vault+wallet — finish or cancel it ` +
-                `(deposit / zap_v2_cancel) before redeeming.`);
+            throw new Error(`Slot ${opts?.escrowSlot} holds a DEPOSIT escrow, not a redeem.`);
         }
         escrowPda = existing.escrowPda;
         if (existing.sharesIn && existing.sharesIn !== sharesRaw) {
@@ -267,19 +274,20 @@ export async function runRedeem(config, api, user, vault, sharesRaw, opts) {
             slippageBps: opts?.slippageBps,
             expirySecs: opts?.expirySecs,
         });
+        escrowSlot = open.escrowSlot;
         openSignatures = await submitOpen(config, open, 'redeem', api);
         escrowPda = open.escrowPda;
     }
     // 2. POLL — wait for the orchestrator to crank every asset→USDC leg.
     //    #61: a slow/retrying leg (e.g. ORCA→USDC) can self-heal over many minutes;
     //    on timeout/expiry/auto-settle return a resume-able `pending`, not an error.
-    const pr = await pollUntilReady(api, vault, user, poll);
+    const pr = await pollUntilReady(api, vault, user, poll, escrowSlot);
     if (!pr.ready)
-        return pendingResult('redeem', vault, escrowPda, openSignatures, pr);
+        return pendingResult('redeem', vault, escrowPda, openSignatures, pr, escrowSlot);
     const ready = pr.status;
     // 3. CLOSE — apply exit fee, pay net USDC, close escrow. Retries on blockhash
     //    expiry (escrow stays READY between attempts).
-    const closeSignatures = await closeWithRetry(config, api, () => api.prepareZapOutCloseV2(vault), async () => !(await api.getZapV2Status(vault, user)));
+    const closeSignatures = await closeWithRetry(config, api, () => api.prepareZapOutCloseV2(vault, escrowSlot), async () => !(await api.getZapV2Status(vault, user, escrowSlot)));
     return {
         ok: true,
         vault,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dfm-fi/agent",
-  "version": "0.2.2059",
+  "version": "0.2.2084",
   "description": "DFM v2 MCP server — drive the full fund launch → deposit → redeem (+ manage) lifecycle from an AI agent against the live API.",
   "homepage": "https://app.dfm.finance/docs/agent",
   "mcpName": "io.github.DFM-Finance/dfm-agent",