@elisym/cli 0.32.0 → 0.33.0

package/dist/index.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env -S node --no-deprecation
 import { ReadableStream } from 'node:stream/web';
-import { readFileSync, existsSync, readdirSync, statSync, renameSync, chmodSync, mkdirSync, writeFileSync, appendFileSync, unlinkSync, rmdirSync, realpathSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync, realpathSync, renameSync, chmodSync, mkdirSync, writeFileSync, unlinkSync, appendFileSync, rmdirSync } from 'node:fs';
 import { dirname, join, resolve, basename, extname, relative, sep } from 'node:path';
-import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, deleteControlCharacters, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, flattenForComparison, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, excerptUntrusted, isScriptBillingExhaustedError, excerptUntrustedTail, scriptOutput, isScriptExecutionError, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, isLlmHealthError, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, clipToCodeUnits, PROVIDER_REFUSED_PREFIX, PROVIDER_FAILED_MESSAGE, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
-import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, readMediaCache, loadPoliciesFromDir, ensureGitignoreHasIrohEntry, ensureGitignoreHasX402Entries, ensureGitignoreHasSessionsEntry, ensureGitignoreHasDelegationNoncesEntry, readAgentPublic, lookupCachedUrl, newCacheEntry, writeMediaCache } from '@elisym/sdk/agent-store';
+import { DEFAULTS, SolanaPaymentStrategy, validateAgentName, RELAYS, ElisymIdentity, splAssetsForNetwork, formatSol, formatAssetAmount, deleteControlCharacters, signerFromSecretKeyBase58, resolveUsdcAsset, ElisymClient, KIND_EXTERNAL_IDENTITIES, POLICY_D_TAG_PREFIX, KIND_LONG_FORM_ARTICLE, jobRequestKind, DEFAULT_KIND_OFFSET, toDTag, createBlossomTransport, generateSolanaWallet, verifyAgentIdentities, getProtocolConfig, getProtocolProgramId, calculateProtocolFee, LIMITS, makeCensor, DEFAULT_REDACT_PATHS, flattenForComparison, POLICY_T_TAG, SESSION_ID_REGEX, createSlidingWindowLimiter, excerptUntrusted, isScriptBillingExhaustedError, excerptUntrustedTail, scriptOutput, isScriptExecutionError, utf8ByteLength, readAcceptedTransports, resolveDelegationAsset, MAX_PROOF_TTL_SECS, PROOF_CLOCK_SKEW_SECS, verifyDelegationAuthProof, deriveOwnerDelegationAta, getDelegation, buildDelegatedTransfer, buildSignedPull, sendConfirmToTerminal, parseDelegatedPayment, confirmPullToTerminal, isDefinitelyUnpaid, decodeJobPayload, isLlmHealthError, BoundedSet, KIND_JOB_FEEDBACK, encodeSecretKeyBase58, GITHUB_USERNAME_REGEX, X_USERNAME_REGEX, normalizeNip05Identifier, splitNip05Identifier, clipToCodeUnits, degenerateReference, PROVIDER_REFUSED_PREFIX, PROVIDER_FAILED_MESSAGE, NATIVE_SOL, GIST_ID_REGEX, TWEET_ID_REGEX } from '@elisym/sdk';
+import { ElisymYamlSchema, resolveInHome, resolveInProject, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, listAgents, loadAgent, writeYaml, agentPaths, ensureGitignoreHasX402Entries, readMediaCache, ensureGitignoreHasPrivateStateEntries, loadPoliciesFromDir, ensureGitignoreHasDelegationNoncesEntry, ensureGitignoreHasIrohEntry, ensureGitignoreHasSessionsEntry, readAgentPublic, isBlockingNodeSync, AgentNameSchema, lookupCachedUrl, newCacheEntry, isBlockingNode, writeMediaCache } from '@elisym/sdk/agent-store';
 import { isAddress, createSolanaRpc, address, signature } from '@solana/kit';
 import { generateSecretKey, getPublicKey, nip19, verifyEvent } from 'nostr-tools';
 import YAML2 from 'yaml';
 import { Command } from 'commander';
-import { mkdir, writeFile, mkdtemp, rm, readFile, rename, stat } from 'node:fs/promises';
-import { parseSkillMd, validateSkillFrontmatter, isHostScratchError, isScriptRefusalError, startsWithRefusalHint, HostScratchError, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
+import { parseSkillMd, validateSkillFrontmatter, isHostScratchError, isScriptRefusalError, startsWithRefusalHint, HostScratchError, DEFAULT_X402_MAX_INPUT_BYTES, resolveInsidePathReal, DEFAULT_SCRIPT_TIMEOUT_MS, loadSkillsFromDir, OnchainCallSkill, DynamicScriptSkill as DynamicScriptSkill$1, StaticScriptSkill as StaticScriptSkill$1, StaticFileSkill as StaticFileSkill$1, ScriptSkill as ScriptSkill$1 } from '@elisym/sdk/skills';
+import { mkdtemp, writeFile, rm, readFile, mkdir, chmod, rename, readdir, stat } from 'node:fs/promises';
 import chalk from 'chalk';
 import Decimal from 'decimal.js-light';
 import { decodePaymentRequiredHeader } from '@x402/core/http';
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { LlmHealthMonitor, startLlmRecovery, createFreeLlmLimiterSet, FREE_LLM_GLOBAL_KEY, freeLlmCustomerKey } from '@elisym/sdk/llm-health';
 import { createIrohTransport } from '@elisym/sdk/node';
 import { lookup } from 'node:dns/promises';
@@ -1553,6 +1553,129 @@ function formatSplBalanceValue(asset, balance) {
 async function fetchUsdcBalance(rpc, owner, network) {
   return fetchSplBalance(rpc, owner, resolveUsdcAsset(network));
 }
+async function findSharedPayoutNeighbors(cwd, ownDir, network, payoutAddress) {
+  let ownReal;
+  try {
+    ownReal = realpathSync(ownDir);
+  } catch {
+    return [];
+  }
+  const listed = await listAgents(cwd);
+  const candidates = [];
+  for (const agent of listed) {
+    candidates.push({ name: agent.name, dir: agent.dir, source: agent.source });
+    if (agent.shadowsGlobal) {
+      const homeDir = resolveInHome(agent.name);
+      if (homeDir !== null) {
+        candidates.push({ name: agent.name, dir: homeDir, source: "home" });
+      }
+    }
+  }
+  const neighbors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    if (!AgentNameSchema.safeParse(candidate.name).success) {
+      continue;
+    }
+    let candidateReal;
+    try {
+      candidateReal = realpathSync(candidate.dir);
+    } catch {
+      continue;
+    }
+    if (candidateReal === ownReal || seen.has(candidateReal)) {
+      continue;
+    }
+    seen.add(candidateReal);
+    let neighborAddress;
+    let neighborNetwork;
+    try {
+      const { yaml } = await readAgentPublic({
+        name: candidate.name,
+        dir: candidate.dir,
+        source: candidate.source,
+        shadowsGlobal: false
+      });
+      const solana = yaml.payments.find((entry) => entry.chain === "solana");
+      neighborAddress = solana?.address;
+      neighborNetwork = solana?.network;
+    } catch {
+      continue;
+    }
+    if (neighborAddress !== payoutAddress || neighborNetwork !== network) {
+      continue;
+    }
+    const paid = await neighborPaidState(candidate.dir, network);
+    if (paid === false) {
+      continue;
+    }
+    neighbors.push({
+      name: candidate.name,
+      // Sanitized, and newlines collapsed SEPARATELY: the sanitizer deletes
+      // every C0/C1 control except tab and newline, and a newline in a POSIX
+      // path is legal - left alone it would break the banner across lines. Two
+      // different defenses, and neither substitutes for the other: the name is
+      // checked by a pattern that admits nothing the sanitizer touches, while
+      // the path carries an operator's project root that nobody validates.
+      // `\s+` would be wrong here - it would eat the legitimate double spaces
+      // and tabs a real path can carry, and the printed path would stop
+      // matching the one on disk.
+      dir: deleteControlCharacters(candidate.dir).replace(/\n+/g, " "),
+      paid
+    });
+  }
+  return neighbors;
+}
+async function neighborPaidState(neighborDir, network) {
+  const skillsDir = agentPaths(neighborDir).skills;
+  let entries;
+  try {
+    entries = readdirSync(skillsDir);
+  } catch (error) {
+    return error.code === "ENOENT" ? false : "unknown";
+  }
+  let denominator = 0;
+  let sawLess = false;
+  for (const entry of entries) {
+    const entryPath = join(skillsDir, entry);
+    try {
+      if (!statSync(entryPath).isDirectory()) {
+        continue;
+      }
+    } catch {
+      sawLess = true;
+      continue;
+    }
+    const skillMd = join(entryPath, "SKILL.md");
+    try {
+      if (isBlockingNodeSync(skillMd)) {
+        return "unknown";
+      }
+      readFileSync(skillMd, "utf-8");
+      denominator += 1;
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        sawLess = true;
+      }
+    }
+  }
+  let skills;
+  try {
+    skills = loadSkillsFromDir(skillsDir, {
+      network,
+      allowFreeSkills: true,
+      allowX402Skills: true,
+      logger: { warn: () => {
+      } }
+    });
+  } catch {
+    return "unknown";
+  }
+  if (skills.some((skill) => skill.priceSubunits > 0n)) {
+    return true;
+  }
+  return sawLess || skills.length < denominator ? "unknown" : false;
+}
 
 // src/x402/constants.ts
 var X402_SOLANA_DEVNET_CAIP2 = "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1";
@@ -1787,13 +1910,10 @@ function fail(message) {
 `);
   process.exit(1);
 }
+var CONTROL_CHARACTERS = /\p{Cc}/gu;
+var UNSEEN_CHARACTERS = /[\p{Cf}\p{Default_Ignorable_Code_Point}\uFFFD]/gu;
 function sanitizeUpstreamText(raw, maxLength) {
-  let withoutControls = "";
-  for (const char of raw) {
-    const code = char.codePointAt(0) ?? 0;
-    withoutControls += code < 32 || code === 127 ? " " : char;
-  }
-  return withoutControls.replace(/—/g, "-").replace(/\s+/g, " ").trim().slice(0, maxLength).trim();
+  return raw.normalize("NFKC").replace(CONTROL_CHARACTERS, " ").replace(UNSEEN_CHARACTERS, "").replace(/—/g, "-").replace(/\s+/g, " ").trim().slice(0, maxLength).trim();
 }
 function slugFromUrl(url) {
   const pathPart = url.pathname.replace(/\/+$/, "").split("/").filter(Boolean).pop() ?? "";
@@ -1892,6 +2012,12 @@ function scanExistingSkills(skillsDir, candidateDTag, url) {
       if (!statSync(join(skillsDir, entry)).isDirectory()) {
         continue;
       }
+      if (isBlockingNodeSync(skillMdPath)) {
+        console.warn(
+          `  ! Could not check ${skillMdPath} for a name collision: it is a pipe, socket or device, not a file`
+        );
+        continue;
+      }
       const { frontmatter } = parseSkillMd(readFileSync(skillMdPath, "utf-8"));
       if (typeof frontmatter.name !== "string") {
         continue;
@@ -1928,6 +2054,16 @@ function describeUnacceptableAccepts(probe, agentNetwork) {
   }
   return `no exact-scheme ${agentNetwork}-USDC requirement found (service accepts: ${networks.join(", ") || "nothing parseable"})`;
 }
+async function writeSkillMdRefusingBlockingNode(targetDir, content) {
+  await mkdir(targetDir, { recursive: true, mode: 448 });
+  await chmod(targetDir, 448).catch(() => void 0);
+  const skillMdPath = join(targetDir, "SKILL.md");
+  if (isBlockingNodeSync(skillMdPath)) {
+    throw new Error(`Refusing to write ${skillMdPath}: it is a pipe, socket or device, not a file`);
+  }
+  await writeFile(skillMdPath, content, "utf-8");
+  return skillMdPath;
+}
 async function cmdX402Add(url, agentName, options) {
   const cwd = process.cwd();
   const { default: inquirer } = await import('inquirer');
@@ -2242,8 +2378,7 @@ async function cmdX402Add(url, agentName, options) {
     allowFreeSkills: false,
     allowX402Skills: true
   });
-  await mkdir(targetDir, { recursive: true });
-  await writeFile(join(targetDir, "SKILL.md"), content, "utf-8");
+  await writeSkillMdRefusingBlockingNode(targetDir, content);
   await ensureGitignoreHasX402Entries(dirname(loaded.dir));
   console.log(`
   Wrote ${join(targetDir, "SKILL.md")}`);
@@ -3279,6 +3414,9 @@ async function probeRelays(relays, logger, timeoutMs = TCP_PROBE_TIMEOUT_MS) {
 }
 var LEDGER_DIR_MODE = 448;
 var LEDGER_FILE_MODE = 384;
+function isUsableSignature(value) {
+  return typeof value === "string" && value.length > 0;
+}
 var VALID_TRANSITIONS = {
   paid: ["executed", "failed"],
   executed: ["delivered", "failed"],
@@ -3286,6 +3424,30 @@ var VALID_TRANSITIONS = {
   failed: []
 };
 var MAX_DOUBLE_SETTLE_WARNINGS = 20;
+var STRANDED_TEMP_MIN_AGE_MS = 60 * 60 * 1e3;
+function sweepStrandedTemporaries(path) {
+  const legacyName = `${basename(path)}.tmp`;
+  const prefix = `${legacyName}.`;
+  const cutoff = Date.now() - STRANDED_TEMP_MIN_AGE_MS;
+  let names;
+  try {
+    names = readdirSync(dirname(path));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (name !== legacyName && !name.startsWith(prefix)) {
+      continue;
+    }
+    const candidate = join(dirname(path), name);
+    try {
+      if (statSync(candidate).mtimeMs < cutoff) {
+        unlinkSync(candidate);
+      }
+    } catch {
+    }
+  }
+}
 var JobLedger = class {
   entries = /* @__PURE__ */ new Map();
   /**
@@ -3303,8 +3465,14 @@ var JobLedger = class {
   constructor(ledgerPath) {
     this.path = ledgerPath;
     this.load();
+    sweepStrandedTemporaries(this.path);
   }
   load() {
+    if (isBlockingNodeSync(this.path)) {
+      throw new Error(
+        `Refusing to read the job ledger at ${this.path}: it is a pipe, socket or device, not a file. An empty ledger would drop the record of which transaction paid for which job.`
+      );
+    }
     try {
       const raw = readFileSync(this.path, "utf-8");
       const data = JSON.parse(raw);
@@ -3327,6 +3495,11 @@ var JobLedger = class {
         );
       }
     } catch (e) {
+      if (typeof e?.code === "string" && e.code !== "ENOENT") {
+        throw new Error(
+          `Refusing to start on a job ledger that cannot be read (${e.code}) at ${this.path}. An empty ledger would drop the record of which transaction paid for which job. Check the file's owner and mode (a ledger written under sudo needs a chown).`
+        );
+      }
       if (e?.code !== "ENOENT") {
         console.warn(`  ! Ledger load warning: ${e?.message ?? "unknown error"}`);
         try {
@@ -3343,10 +3516,18 @@ var JobLedger = class {
     const dir = dirname(this.path);
     mkdirSync(dir, { recursive: true, mode: LEDGER_DIR_MODE });
     const obj = Object.fromEntries(this.entries);
-    const tmp = this.path + ".tmp";
-    writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: LEDGER_FILE_MODE });
-    chmodSync(tmp, LEDGER_FILE_MODE);
-    renameSync(tmp, this.path);
+    const tmp = `${this.path}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: LEDGER_FILE_MODE });
+      chmodSync(tmp, LEDGER_FILE_MODE);
+      renameSync(tmp, this.path);
+    } catch (error) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      throw error;
+    }
   }
   recordPaid(entry) {
     if (this.entries.has(entry.job_id)) {
@@ -3414,7 +3595,7 @@ var JobLedger = class {
     let suppressed = 0;
     for (const entry of this.entries.values()) {
       const paymentSignature = entry.payment_signature;
-      if (typeof paymentSignature !== "string" || paymentSignature.length === 0) {
+      if (!isUsableSignature(paymentSignature)) {
         continue;
       }
       const owner = this.paymentSignatureOwners.get(paymentSignature);
@@ -3484,6 +3665,9 @@ var JobLedger = class {
    * this job - refusing the owner its own settlement until the next restart.
    */
   claimPaymentSignature(paymentSignature, jobId) {
+    if (!isUsableSignature(paymentSignature)) {
+      return "unknown-job";
+    }
     const entry = this.entries.get(jobId);
     if (entry === void 0) {
       return "unknown-job";
@@ -3603,7 +3787,7 @@ var JobLedger = class {
     for (const [id, entry] of this.entries) {
       if ((entry.status === "delivered" || entry.status === "failed") && entry.created_at < cutoff) {
         this.entries.delete(id);
-        if (typeof entry.payment_signature === "string" && entry.payment_signature.length > 0) {
+        if (isUsableSignature(entry.payment_signature)) {
           prunedSignatures.add(entry.payment_signature);
         }
         deleted += 1;
@@ -3651,8 +3835,14 @@ var UsedNonceStore = class {
     this.path = noncePath;
     this.maxEntries = maxEntries;
     this.load();
+    sweepStrandedTemporaries(this.path);
   }
   load() {
+    if (isBlockingNodeSync(this.path)) {
+      throw new Error(
+        `Refusing to read the nonce store at ${this.path}: it is a pipe, socket or device, not a file. An empty store would let a delegated pull be replayed.`
+      );
+    }
     try {
       const raw = readFileSync(this.path, "utf-8");
       const data = JSON.parse(raw);
@@ -3662,6 +3852,11 @@ var UsedNonceStore = class {
         }
       }
     } catch (e) {
+      if (typeof e?.code === "string" && e.code !== "ENOENT") {
+        throw new Error(
+          `Refusing to start on a nonce store that cannot be read (${e.code}) at ${this.path}. An empty store would let a delegated pull be replayed. Check the file's owner and mode (a store written under sudo needs a chown).`
+        );
+      }
       if (e?.code !== "ENOENT") {
         console.warn(`  ! Nonce store load warning: ${e?.message ?? "unknown error"}`);
         try {
@@ -3677,9 +3872,17 @@ var UsedNonceStore = class {
     const dir = dirname(this.path);
     mkdirSync(dir, { recursive: true, mode: LEDGER_DIR_MODE });
     const obj = Object.fromEntries(this.entries);
-    const tmp = this.path + ".tmp";
-    writeFileSync(tmp, JSON.stringify(obj), { mode: LEDGER_FILE_MODE });
-    renameSync(tmp, this.path);
+    const tmp = `${this.path}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      writeFileSync(tmp, JSON.stringify(obj), { mode: LEDGER_FILE_MODE });
+      renameSync(tmp, this.path);
+    } catch (error) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      throw error;
+    }
     chmodSync(this.path, LEDGER_FILE_MODE);
   }
   has(key) {
@@ -3863,6 +4066,43 @@ var MIME_BY_EXT = {
 function mimeFromPath(path) {
   return MIME_BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
+var IMAGE_EXTENSIONS = Object.keys(MIME_BY_EXT);
+function isImagePath(path) {
+  return Object.hasOwn(MIME_BY_EXT, extname(path).toLowerCase());
+}
+
+// src/rpc-redact.ts
+var PUBLIC_SOLANA_RPC_HOSTS = /* @__PURE__ */ new Set([
+  "api.devnet.solana.com",
+  "api.mainnet-beta.solana.com",
+  "api.testnet.solana.com"
+]);
+function stripRpcSecrets(raw) {
+  try {
+    const parsed = new URL(raw);
+    parsed.username = "";
+    parsed.password = "";
+    if (!PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname)) {
+      return `${parsed.protocol}//${parsed.host}/***`;
+    }
+    const marker = parsed.search.length > 0 ? "?***" : "";
+    parsed.search = "";
+    return `${parsed.toString()}${marker}`;
+  } catch {
+    return "[unparseable RPC URL]";
+  }
+}
+function isPublicSolanaRpcUrl(raw) {
+  try {
+    const parsed = new URL(raw);
+    return PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname) && !parsed.username && !parsed.password && !parsed.search && (parsed.pathname === "" || parsed.pathname === "/");
+  } catch {
+    return false;
+  }
+}
+function redactRpcUrlsInText(text) {
+  return text.replace(/https?:\/\/[^\s)'"]+/g, (url) => stripRpcSecrets(url));
+}
 var REFERENCE_SCAN_WINDOW = DEFAULTS.VERIFY_SIGNATURE_LIMIT;
 var REFERENCE_SCAN_LIST_ATTEMPTS = 3;
 var REFERENCE_SCAN_LIST_RETRY_DELAY_MS = 400;
@@ -4247,7 +4487,7 @@ var PaymentRecovery = class {
    * An error is never "the customer did not pay" - the caller keeps the job
    * recoverable.
    */
-  async listReferenceCandidates(reference, rpc, deadline) {
+  async listReferenceCandidates(reference, rpc, pastDeadline) {
     let lastMessage = "unknown error";
     let attempts = 0;
     for (let attempt = 0; attempt < REFERENCE_SCAN_LIST_ATTEMPTS; attempt++) {
@@ -4263,7 +4503,7 @@ var PaymentRecovery = class {
         };
       } catch (e) {
         lastMessage = e?.message ?? "unknown error";
-        if (Date.now() >= deadline) {
+        if (pastDeadline()) {
           break;
         }
         if (attempt < REFERENCE_SCAN_LIST_ATTEMPTS - 1) {
@@ -4303,7 +4543,9 @@ var PaymentRecovery = class {
    * the SDK default of 10 retries x 3s x a full window - over ten minutes for
    * one deferred entry.
    *
-   * TERMINAL ("none") REQUIRES ALL THREE, and the caller adds two more:
+   * TERMINAL ("none") REQUIRES ALL FOUR OF THESE, and the caller adds four more
+   * on top (they are counted as six in the docs, where 2-4 below are read as one
+   * condition - "nothing was skipped and nothing was left unverified"):
    *   1. the listing SUCCEEDED and came back SHORT of the window, so this is the
    *      reference's whole history rather than a truncated page. A flood that
    *      fills the window could be hiding the payment behind it, which is
@@ -4315,26 +4557,40 @@ var PaymentRecovery = class {
    *      evidence of non-payment;
    *   3. no candidate was SKIPPED for belonging to another job. A skip means
    *      something did touch this reference and we chose not to look at it, so
-   *      the scan saw less than the whole truth.
-   * The caller then requires the payment request's own expiry to have passed and
-   * a second consecutive sighting. Anything else is inconclusive: a false
-   * deferral costs latency, a false "unpaid" destroys the customer's money.
+   *      the scan saw less than the whole truth;
+   *   4. no candidate was SKIPPED for an unusable signature. Same reasoning as
+   *      3, with the node rather than the ledger as the reason we did not look:
+   *      a blanked signature is still a transaction on this reference.
+   * The caller then requires, in this order: that the job owns no settlement of
+   * its own, that the payment request's own expiry has passed, that the endpoint
+   * proved its cluster and that it serves address history, and - one level up,
+   * in `runtime.ts` - a second consecutive sighting. Anything else is
+   * inconclusive: a false deferral costs latency, a false "unpaid" destroys the
+   * customer's money.
    *
    * What "none" therefore means is narrow and honest: after the failed-on-chain
    * transactions are dropped, the reference's entire history is EMPTY - there
    * was nothing at all to look at.
    */
-  async verifyByReferenceScan(reference, rpc, jobId, deadline, verifySignature) {
-    const listed = await this.listReferenceCandidates(reference, rpc, deadline);
+  async verifyByReferenceScan(reference, rpc, jobId, pastDeadline, verifySignature) {
+    if (pastDeadline()) {
+      return { outcome: "inconclusive", error: "the reference scan ran out of time" };
+    }
+    const listed = await this.listReferenceCandidates(reference, rpc, pastDeadline);
     if ("error" in listed) {
       return { outcome: "inconclusive", error: listed.error };
     }
     let skippedConsumed = false;
+    let skippedUnusable = false;
     let unverifiableCandidate;
     for (const candidate of listed.signatures) {
-      if (Date.now() > deadline) {
+      if (pastDeadline()) {
         return { outcome: "inconclusive", error: "the reference scan ran out of time" };
       }
+      if (!isUsableSignature(candidate)) {
+        skippedUnusable = true;
+        continue;
+      }
       const owner = this.ledger.paymentSignatureOwner(candidate);
       if (owner !== void 0 && owner !== jobId) {
         skippedConsumed = true;
@@ -4346,6 +4602,9 @@ var PaymentRecovery = class {
       }
       unverifiableCandidate ??= verified.error ?? "no reason given";
     }
+    if (pastDeadline()) {
+      return { outcome: "inconclusive", error: "the reference scan ran out of time" };
+    }
     if (listed.windowFull) {
       return {
         outcome: "inconclusive",
@@ -4358,6 +4617,12 @@ var PaymentRecovery = class {
         error: "the reference carries a transaction another job already settled, so this scan did not see the whole picture"
       };
     }
+    if (skippedUnusable) {
+      return {
+        outcome: "inconclusive",
+        error: "the reference carries a transaction whose signature the node reported unusably, so this scan did not see the whole picture"
+      };
+    }
     if (unverifiableCandidate !== void 0) {
       return {
         outcome: "inconclusive",
@@ -4405,10 +4670,25 @@ var PaymentRecovery = class {
       );
       return "corrupt-state";
     }
-    const deadline = Date.now() + REFERENCE_SCAN_DEADLINE_MS;
+    let deadline;
     try {
       const rpc = createSolanaRpc(getRpcUrl(this.network));
       const protocolConfig = await this.fetchProtocolConfig();
+      deadline = Date.now() + REFERENCE_SCAN_DEADLINE_MS;
+      const pastDeadline = () => signal?.aborted === true || Date.now() >= deadline;
+      const degenerate = await degenerateReference(request, this.network, protocolConfig.treasury);
+      if (degenerate !== void 0) {
+        if (!isUsableSignature(entry.payment_signature)) {
+          log(
+            `[${shortId}] Recovery: the payment request's reference (${request.reference}) is an address the payment itself is computed from, so the transfer cannot be singled out by listing it. This is provider-side state, not a chain or customer problem.`
+          );
+          return "corrupt-state";
+        }
+        log(
+          `[${shortId}] Recovery: the reference (${request.reference}) is an address the payment is computed from, but this job already owns settlement ${entry.payment_signature} - deferring rather than failing it, in case this build's list grew past what the settlement was accepted under. Not listing the reference: it cannot single out a payment.`
+        );
+        return "deferred";
+      }
       const verify = async (txSignature2, retries) => {
         const verification = this.strategy.verifyPayment(rpc, request, protocolConfig, {
           txSignature: txSignature2,
@@ -4440,7 +4720,7 @@ var PaymentRecovery = class {
       };
       const ownSignature = entry.payment_signature;
       let txSignature;
-      if (ownSignature !== void 0) {
+      if (isUsableSignature(ownSignature) && !pastDeadline()) {
         const own = await verify(ownSignature, OWN_SETTLEMENT_VERIFY_RETRIES);
         if (own.verified) {
           txSignature = ownSignature;
@@ -4455,11 +4735,11 @@ var PaymentRecovery = class {
           reference,
           rpc,
           entry.job_id,
-          deadline,
+          pastDeadline,
           verify
         );
         if (scan.outcome === "none") {
-          if (ownSignature !== void 0) {
+          if (isUsableSignature(ownSignature)) {
             log(
               `[${shortId}] Recovery: the reference scan is empty, but this job already owns settlement ${ownSignature} - treating the empty scan as an RPC history gap, not as non-payment. Deferring.`
             );
@@ -4800,14 +5080,24 @@ var SessionStore = class {
     }
     const payload = lines.map((line) => JSON.stringify(line)).join("\n") + "\n";
     const path = this.sessionPath(customerId, sessionId);
+    if (isBlockingNodeSync(path)) {
+      this.log(`[sessions] session file is not a regular file; not recording this exchange`);
+      return;
+    }
     try {
-      appendFileSync(path, payload, { mode: FILE_MODE });
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        throw error;
+      try {
+        appendFileSync(path, payload, { mode: FILE_MODE });
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+        mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
+        appendFileSync(path, payload, { mode: FILE_MODE });
       }
-      mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
-      appendFileSync(path, payload, { mode: FILE_MODE });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      this.log(`[sessions] could not record this exchange (${reason}); delivering without it`);
+      return;
     }
     this.globalBytes += Buffer.byteLength(payload);
   }
@@ -4879,6 +5169,9 @@ var SessionStore = class {
     let raw;
     let size;
     try {
+      if (isBlockingNodeSync(path)) {
+        return null;
+      }
       size = statSync(path).size;
       raw = readFileSync(path, "utf-8");
     } catch {
@@ -4910,9 +5203,17 @@ var SessionStore = class {
     }
     if (torn) {
       const payload = lines.map((line) => JSON.stringify(line)).join("\n") + (lines.length > 0 ? "\n" : "");
-      const tempPath = `${path}.tmp`;
-      writeFileSync(tempPath, payload, { mode: FILE_MODE });
-      renameSync(tempPath, path);
+      const tempPath = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+      try {
+        writeFileSync(tempPath, payload, { mode: FILE_MODE });
+        renameSync(tempPath, path);
+      } catch (error) {
+        try {
+          unlinkSync(tempPath);
+        } catch {
+        }
+        throw error;
+      }
       this.globalBytes = Math.max(0, this.globalBytes - size + Buffer.byteLength(payload));
     }
     return lines;
@@ -4981,10 +5282,18 @@ var SessionStore = class {
     const payload = rewritten.map((line) => JSON.stringify(line)).join("\n") + "\n";
     const path = this.sessionPath(customerId, sessionId);
     const oldSize = existsSync(path) ? statSync(path).size : 0;
-    const tempPath = `${path}.tmp`;
+    const tempPath = `${path}.tmp.${randomBytes(6).toString("hex")}`;
     mkdirSync(join(this.root, customerId), { recursive: true, mode: DIR_MODE });
-    writeFileSync(tempPath, payload, { mode: FILE_MODE });
-    renameSync(tempPath, path);
+    try {
+      writeFileSync(tempPath, payload, { mode: FILE_MODE });
+      renameSync(tempPath, path);
+    } catch (error) {
+      try {
+        unlinkSync(tempPath);
+      } catch {
+      }
+      throw error;
+    }
     this.globalBytes = Math.max(0, this.globalBytes - oldSize + Buffer.byteLength(payload));
     return assembleReplay(rewritten, void 0);
   }
@@ -5121,7 +5430,7 @@ var SessionStore = class {
         continue;
       }
       for (const name of names) {
-        if (!name.includes(".corrupt.")) {
+        if (!name.includes(".corrupt.") && !name.includes(".tmp")) {
           continue;
         }
         const path = join(dir, name);
@@ -5287,6 +5596,15 @@ var X402PermanentError = class extends Error {
 };
 
 // src/runtime.ts
+var MAX_LOGGED_MIME_CHARS = 128;
+function ledgerAmount(subunits) {
+  if (subunits < 0n || subunits > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(
+      `Amount ${subunits.toString()} subunits cannot be recorded exactly: the ledger holds amounts as numbers, and this one is outside the range a number represents without rounding.`
+    );
+  }
+  return Number(subunits);
+}
 var payment = new SolanaPaymentStrategy();
 var LEDGER_GC_INTERVAL_MS = 60 * 60 * 1e3;
 var SIG_PATH_TIMEOUT_MS = 60 * 1e3;
@@ -5943,8 +6261,31 @@ var AgentRuntime = class {
     });
     return { feeBps: config.feeBps, treasury: config.treasury };
   }
+  /**
+   * The ONE way a line leaves this runtime for the operator.
+   *
+   * Every line is scrubbed of RPC credentials here, once, rather than at the
+   * call sites that happen to quote an error. Third-party RPC providers carry
+   * the API key in the URL, and an error reaching this file can quote that URL:
+   * `@solana/kit` does not put it in its own transport errors - measured across
+   * refused connections, DNS failures, 429, 401, a JSON-RPC error and a body
+   * that is not JSON - but for a JSON-RPC error it does not recognize it passes
+   * the SERVER's message through, and a proxy is free to write the request URL
+   * into that. `start.ts` already scrubbed the wallet error for this reason and
+   * nothing here did.
+   *
+   * One place because the call sites are many and grow: seven bound a logger
+   * of their own, and the payment path alone quotes an error in four. Nothing
+   * this runtime logs carries a URL of its own, so the scrub costs no
+   * diagnostic. The sink is `onLog`, which `start` fans out to the terminal and
+   * to the structured log - so both are covered by the one pass.
+   */
+  get operatorLog() {
+    const sink = this.callbacks.onLog ?? console.log;
+    return (line) => sink(redactRpcUrlsInText(line));
+  }
   async run() {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     this.ledger.pruneOldEntries(LEDGER_RETENTION_MS);
     this.sessionStore?.init();
     this.reconcileUsedNonces();
@@ -6094,7 +6435,7 @@ var AgentRuntime = class {
       this.callbacks.onStop?.();
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
-      (this.callbacks.onLog ?? console.log)(`onStop error: ${msg}`);
+      this.operatorLog(`onStop error: ${msg}`);
     }
     this.abortController.abort();
     for (const controller of this.jobAbortControllers) {
@@ -6132,7 +6473,7 @@ var AgentRuntime = class {
       await this.executeJob(job, jobAbort.signal);
     } catch (raw) {
       const e = asHostScratchFailure(raw) ?? raw;
-      const log = this.callbacks.onLog ?? console.log;
+      const log = this.operatorLog;
       const operatorMessage = describeForOperator(e);
       log(`[${job.jobId.slice(0, 8)}] Error: ${operatorMessage}`);
       if (isHostScratchError(e)) {
@@ -6165,7 +6506,7 @@ var AgentRuntime = class {
   }
   /** Core job processing logic - payment, skill execution, result delivery. */
   async executeJob(job, signal) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     const inputBytes = utf8ByteLength(job.input);
     if (inputBytes > LIMITS.MAX_INPUT_LENGTH) {
       throw new Error(`Input too long: ${inputBytes} bytes (max ${LIMITS.MAX_INPUT_LENGTH})`);
@@ -6200,7 +6541,11 @@ var AgentRuntime = class {
       const attachmentOk = method === "POST" && job.attachment.mime.startsWith("text/") && job.attachment.size <= maxInputBytes;
       if (!attachmentOk) {
         log(
-          `[${job.jobId.slice(0, 8)}] Rejecting attachment on x402 skill (mime=${job.attachment.mime}, size=${job.attachment.size})`
+          // `mime` is the customer's string and its schema bounds only the
+          // length, so a newline in it forged whole log lines. Every other
+          // piece of untrusted text in this file already goes through the
+          // excerpt; this was the one that did not.
+          `[${job.jobId.slice(0, 8)}] Rejecting attachment on x402 skill (mime=${excerptUntrusted(job.attachment.mime, MAX_LOGGED_MIME_CHARS)}, size=${job.attachment.size})`
         );
         await this.transport.sendFeedback(job, {
           type: "error",
@@ -6253,7 +6598,7 @@ var AgentRuntime = class {
       if (delegatedPull === void 0) {
         return;
       }
-      netAmount = Number(delegatedPull.priceSubunits);
+      netAmount = ledgerAmount(delegatedPull.priceSubunits);
     } else if (jobPrice > 0) {
       const result = await this.collectPayment(job, jobPrice, jobAsset, signal);
       netAmount = result.netAmount;
@@ -6377,7 +6722,7 @@ var AgentRuntime = class {
           log
         );
         const outcome = await this.executeDelegatedPull(job, delegatedPull, log);
-        netAmount = Number(delegatedPull.chargedSubunits ?? delegatedPull.priceSubunits);
+        netAmount = ledgerAmount(delegatedPull.chargedSubunits ?? delegatedPull.priceSubunits);
         if (outcome === "dead") {
           this.ledger.markFailed(job.jobId);
           await this.transport.sendFeedback(job, {
@@ -6634,7 +6979,7 @@ var AgentRuntime = class {
       job.jobId,
       pull.signature,
       Number(pull.lastValidBlockHeight),
-      Number(amount)
+      ledgerAmount(amount)
     );
     ctx.pullSignature = pull.signature;
     const outcome = await sendConfirmToTerminal(ctx.rpc, pull, {});
@@ -6840,7 +7185,7 @@ var AgentRuntime = class {
    * rather than losing the customer's paid job.
    */
   async seedGuarded(jobId, kind, run) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     const started = Date.now();
     try {
       const seeded = await run();
@@ -6987,6 +7332,9 @@ var AgentRuntime = class {
       return void 0;
     }
     try {
+      if (await isBlockingNode(filePath)) {
+        return void 0;
+      }
       const bytes = await readFile(filePath);
       return await this.seedBlossomMember(bytes, recipientPubkey);
     } catch {
@@ -7157,7 +7505,7 @@ var AgentRuntime = class {
    * polls for on-chain confirmation. Aborts if signal fires.
    */
   async collectPayment(job, jobPrice, jobAsset, signal) {
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     if (!this.config.solanaAddress) {
       throw new Error("Solana address not configured");
     }
@@ -7229,7 +7577,7 @@ var AgentRuntime = class {
             return;
           }
           const txSignature = askedSignature ?? verified.txSignature;
-          if (txSignature === void 0) {
+          if (!isUsableSignature(txSignature)) {
             paymentRefusal = { consumedByOther: false, sentence: UNNAMED_SETTLEMENT_SENTENCE };
             lose({ verified: false }, `${pathLabel}: ${UNNAMED_SETTLEMENT_SENTENCE}`);
             return;
@@ -7398,7 +7746,7 @@ var AgentRuntime = class {
         (jobId) => this.ledger.getStatus(jobId) === "paid"
       );
     }
-    const log = this.callbacks.onLog ?? console.log;
+    const log = this.operatorLog;
     this.logDeferralSummary(log);
     if (pending.length === 0) {
       return;
@@ -8246,7 +8594,7 @@ function buildCliSkill(parsed, entryPath, scriptEnv, network) {
   }
   return skill;
 }
-function loadSkillsFromDir(skillsDir, options) {
+function loadSkillsFromDir2(skillsDir, options) {
   const skills = [];
   let entries;
   try {
@@ -8265,6 +8613,9 @@ function loadSkillsFromDir(skillsDir, options) {
     }
     const skillMdPath = join(entryPath, "SKILL.md");
     try {
+      if (isBlockingNodeSync(skillMdPath)) {
+        throw new Error("it is a pipe, socket or device, not a file");
+      }
       const content = readFileSync(skillMdPath, "utf-8");
       const { frontmatter, systemPrompt } = parseSkillMd(content);
       const parsed = validateSkillFrontmatter(frontmatter, systemPrompt, {
@@ -8612,6 +8963,9 @@ function startWatchdog(deps) {
     }
   };
 }
+var INDEX_FILE_MODE = 384;
+var REPAIR_HINT = "every bridged job is refused until that entry is corrected or removed by hand; removing it forgets what was already paid for that job";
+var STRANDED_TEMP_MIN_AGE_MS2 = 60 * 60 * 1e3;
 var X402_JOBS_FILE = ".x402-jobs.json";
 var X402_RESULTS_DIR = ".x402-results";
 function sanitizeJobId(jobId) {
@@ -8637,6 +8991,11 @@ var X402JobStore = class {
     return scheduled;
   }
   async load() {
+    if (await isBlockingNode(this.jobsPath)) {
+      throw new Error(
+        `Refusing to read ${this.jobsPath}: it is a pipe, socket or device, not a file`
+      );
+    }
     let raw;
     try {
       raw = await readFile(this.jobsPath, "utf-8");
@@ -8650,16 +9009,73 @@ var X402JobStore = class {
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       throw new Error(`x402 store ${this.jobsPath} is not a JSON object`);
     }
+    const isCount = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
+    for (const [jobId, record] of Object.entries(parsed)) {
+      if (record === null || typeof record !== "object" || Array.isArray(record)) {
+        throw new Error(
+          `x402 store ${this.jobsPath} holds a non-record at ${jobId} - ${REPAIR_HINT}`
+        );
+      }
+      const slot = record;
+      if (!isCount(slot.attempts) || !isCount(slot.created_at) || !isCount(slot.updated_at) || slot.signatures !== void 0 && !isCount(slot.signatures)) {
+        throw new Error(
+          `x402 store ${this.jobsPath} holds an unusable record at ${jobId} - ${REPAIR_HINT}`
+        );
+      }
+    }
     return parsed;
   }
   async save(file) {
-    const tempPath = `${this.jobsPath}.tmp`;
-    await writeFile(tempPath, JSON.stringify(file, null, 2), "utf-8");
-    await rename(tempPath, this.jobsPath);
+    const tempPath = `${this.jobsPath}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      await writeFile(tempPath, JSON.stringify(file, null, 2), {
+        encoding: "utf-8",
+        mode: INDEX_FILE_MODE
+      });
+      await chmod(tempPath, INDEX_FILE_MODE);
+      await rename(tempPath, this.jobsPath);
+    } catch (error) {
+      try {
+        await rm(tempPath, { force: true });
+      } catch {
+      }
+      throw error;
+    }
   }
   resultFilePath(jobId) {
     return join(this.resultsDir, sanitizeJobId(jobId));
   }
+  /** Remove `<result>.tmp.<hex>` leftovers for one job. Best effort. */
+  async sweepStrandedTemporaries(jobId) {
+    const prefix = `${sanitizeJobId(jobId)}.tmp.`;
+    try {
+      const entries = await readdir(this.resultsDir);
+      await Promise.all(
+        entries.filter((entry) => entry.startsWith(prefix)).map((entry) => this.removeIfStale(join(this.resultsDir, entry)))
+      );
+    } catch {
+    }
+  }
+  /**
+   * Remove a temporary only once it is too old to be a live writer's.
+   *
+   * The queue serializes writers inside ONE process, and there is meant to be
+   * one store per agent directory - but `sweepExpired` runs from the driver's
+   * constructor, so a second `elisym start` on the same directory sweeps while
+   * the first is mid-write. Same argument as the ledger's guard: two agents on
+   * one directory is unsupported, and a sweep is no place to make it worse.
+   */
+  async removeIfStale(path) {
+    try {
+      const info = await stat(path);
+      if (Date.now() - info.mtimeMs < STRANDED_TEMP_MIN_AGE_MS2) {
+        return;
+      }
+    } catch {
+      return;
+    }
+    await rm(path, { force: true }).catch(() => void 0);
+  }
   /**
    * Atomically claim one paid attempt: increment iff still under BOTH caps
    * (durable attempts and the monotonic signature count), and FLUSH before
@@ -8740,8 +9156,20 @@ var X402JobStore = class {
   /** Binary result: bytes hit disk BEFORE the record flush (crash-safe ordering). */
   async saveFileResult(jobId, mime, bytes) {
     const filePath = this.resultFilePath(jobId);
-    await mkdir(this.resultsDir, { recursive: true });
-    await writeFile(filePath, bytes);
+    await mkdir(this.resultsDir, { recursive: true, mode: 448 });
+    await chmod(this.resultsDir, 448).catch(() => {
+    });
+    const tempPath = `${filePath}.tmp.${randomBytes(6).toString("hex")}`;
+    try {
+      await writeFile(tempPath, bytes, { mode: 384 });
+      await rename(tempPath, filePath);
+    } catch (error) {
+      try {
+        await rm(tempPath, { force: true });
+      } catch {
+      }
+      throw error;
+    }
     await this.runExclusive(async () => {
       const file = await this.load();
       const now = Date.now();
@@ -8777,9 +9205,32 @@ var X402JobStore = class {
     }
     return { data: "", outputMime: result.mime, filePath };
   }
+  /**
+   * Remove fragments of the INDEX left by a crash between write and rename.
+   *
+   * Keyed by record id like the result sweep cannot be: the index has no job to
+   * expire with, so nothing would ever visit its fragments - the suffix is
+   * random, the name is not `.x402-jobs.json`, and `sweepStrandedTemporaries`
+   * walks the results directory only. What a fragment holds is which upstream
+   * calls this bridge has already paid for.
+   */
+  async sweepStrandedIndexTemporaries() {
+    const dir = dirname(this.jobsPath);
+    const legacyName = `${basename(this.jobsPath)}.tmp`;
+    const prefix = `${legacyName}.`;
+    try {
+      const entries = await readdir(dir);
+      await Promise.all(
+        entries.filter((entry) => entry === legacyName || entry.startsWith(prefix)).map((entry) => this.removeIfStale(join(dir, entry)))
+      );
+    } catch {
+    }
+  }
   /** Drop records (and their result files) older than the cache TTL. */
   async sweepExpired(now = Date.now()) {
     await this.runExclusive(async () => {
+      await this.sweepStrandedIndexTemporaries();
+      await chmod(this.jobsPath, INDEX_FILE_MODE).catch(() => void 0);
       const file = await this.load();
       let changed = false;
       for (const [jobId, record] of Object.entries(file)) {
@@ -8790,6 +9241,7 @@ var X402JobStore = class {
         changed = true;
         await rm(this.resultFilePath(jobId), { force: true }).catch(() => {
         });
+        await this.sweepStrandedTemporaries(jobId);
       }
       if (changed) {
         await this.save(file);
@@ -9456,7 +9908,7 @@ async function cmdStart(nameArg, options = {}) {
   const scriptEnv = buildScriptEnv(loaded.secrets);
   const paths = agentPaths(loaded.dir);
   const skillsDir = paths.skills;
-  const allSkills = loadSkillsFromDir(skillsDir, { network: walletNetwork, scriptEnv });
+  const allSkills = loadSkillsFromDir2(skillsDir, { network: walletNetwork, scriptEnv });
   if (allSkills.length === 0) {
     console.error(`  ! No skills found in ${skillsDir}
 `);
@@ -9479,6 +9931,31 @@ async function cmdStart(nameArg, options = {}) {
     );
     process.exit(1);
   }
+  if (hasPaid && solanaAddress) {
+    try {
+      const neighbors = await findSharedPayoutNeighbors(
+        cwd,
+        loaded.dir,
+        walletNetwork,
+        solanaAddress
+      );
+      for (const neighbor of neighbors) {
+        console.log(
+          `  ! WARNING: agent "${neighbor.name}" (${neighbor.dir}) ` + (neighbor.paid === "unknown" ? `shares this payout address on ${walletNetwork}, and its skills could not be read to tell whether any of them are paid.` : `is paid at the same address on ${walletNetwork}.`) + ` One transaction can then be counted for jobs of both agents, so a customer could be served twice for one transfer. See https://docs.elisym.network/protocol/payments for what the rail does and does not promise.`
+        );
+      }
+      if (neighbors.length > 0) {
+        console.log();
+      }
+    } catch (error) {
+      console.log(
+        `  ! Could not check whether another agent is paid at this address (${deleteControlCharacters(
+          error instanceof Error ? error.message : String(error)
+        )}). Starting anyway.`
+      );
+      console.log();
+    }
+  }
   const llmSkills = allSkills.filter((skill) => skill.mode === "llm");
   const scriptDepSkills = allSkills.filter(
     (skill) => skill.mode !== "llm" && skill.llmOverride?.provider && skill.llmOverride?.model
@@ -9663,6 +10140,7 @@ async function cmdStart(nameArg, options = {}) {
   const x402Skills = allSkills.filter((skill) => skill.mode === "x402");
   let x402InvariantBroken;
   if (x402Skills.length > 0) {
+    await ensureGitignoreHasX402Entries(dirname(loaded.dir));
     const solanaSecretKey = loaded.secrets.solana_secret_key;
     if (solanaSecretKey === void 0 || solanaSecretKey.length === 0) {
       x402InvariantBroken = "no solana_secret_key in .secrets.json";
@@ -9769,8 +10247,11 @@ async function cmdStart(nameArg, options = {}) {
     }
   }
   if (mediaCacheDirty) {
+    await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
     await writeMediaCache(loaded.dir, mediaCache);
   }
+  await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
+  const ledger = new JobLedger(paths.jobs);
   let profilePublished = false;
   try {
     await client.discovery.publishProfile(
@@ -9922,6 +10403,16 @@ async function cmdStart(nameArg, options = {}) {
       console.warn(`  ! Run \`npx @elisym/cli delegate-key ${loaded.name}\` to enable it.`);
     }
   }
+  if (delegateSigner !== void 0) {
+    await ensureGitignoreHasDelegationNoncesEntry(dirname(loaded.dir));
+  }
+  const nonceStore = delegateSigner !== void 0 ? new UsedNonceStore(join(loaded.dir, ".delegation-nonces.json")) : void 0;
+  await ensureGitignoreHasIrohEntry(dirname(loaded.dir));
+  await ensureGitignoreHasPrivateStateEntries(dirname(loaded.dir));
+  const hasContextSkills = registry.all().some((skill) => skill.context === true);
+  if (hasContextSkills) {
+    await ensureGitignoreHasSessionsEntry(dirname(loaded.dir));
+  }
   const buildCard = (skill) => buildCapabilityCard(skill, { walletNetwork, solanaAddress, delegatePubkey });
   function retiredModelKeyForSkill(skill) {
     if (skill.resolvedTriple) {
@@ -10011,16 +10502,7 @@ async function cmdStart(nameArg, options = {}) {
     });
   };
   const transport = new NostrTransport(client, identity2, [DEFAULT_KIND_OFFSET]);
-  const ledger = new JobLedger(paths.jobs);
   const irohTransport = createIrohTransport({ storePath: join(loaded.dir, ".iroh") });
-  await ensureGitignoreHasIrohEntry(dirname(loaded.dir));
-  if (x402Skills.length > 0) {
-    await ensureGitignoreHasX402Entries(dirname(loaded.dir));
-  }
-  const hasContextSkills = registry.all().some((skill) => skill.context === true);
-  if (hasContextSkills) {
-    await ensureGitignoreHasSessionsEntry(dirname(loaded.dir));
-  }
   const runtimeConfig = {
     paymentTimeoutSecs: DEFAULTS.PAYMENT_EXPIRY_SECS,
     maxConcurrentJobs: MAX_CONCURRENT_JOBS,
@@ -10035,10 +10517,6 @@ async function cmdStart(nameArg, options = {}) {
     // the payment key) to execute post-work pulls from customer delegations.
     delegateSigner
   };
-  const nonceStore = delegateSigner !== void 0 ? new UsedNonceStore(join(loaded.dir, ".delegation-nonces.json")) : void 0;
-  if (nonceStore !== void 0) {
-    await ensureGitignoreHasDelegationNoncesEntry(dirname(loaded.dir));
-  }
   const rpcUrlForLog = stripRpcSecrets(process.env.SOLANA_RPC_URL ?? getRpcUrl(walletNetwork));
   logger.debug(
     {
@@ -10188,37 +10666,6 @@ function buildScriptEnv(secrets) {
   }
   return scriptEnv;
 }
-var PUBLIC_SOLANA_RPC_HOSTS = /* @__PURE__ */ new Set([
-  "api.devnet.solana.com",
-  "api.mainnet-beta.solana.com",
-  "api.testnet.solana.com"
-]);
-function stripRpcSecrets(raw) {
-  try {
-    const parsed = new URL(raw);
-    parsed.username = "";
-    parsed.password = "";
-    if (!PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname)) {
-      return `${parsed.protocol}//${parsed.host}/***`;
-    }
-    const marker = parsed.search.length > 0 ? "?***" : "";
-    parsed.search = "";
-    return `${parsed.toString()}${marker}`;
-  } catch {
-    return "[unparseable RPC URL]";
-  }
-}
-function isPublicSolanaRpcUrl(raw) {
-  try {
-    const parsed = new URL(raw);
-    return PUBLIC_SOLANA_RPC_HOSTS.has(parsed.hostname) && !parsed.username && !parsed.password && !parsed.search && (parsed.pathname === "" || parsed.pathname === "/");
-  } catch {
-    return false;
-  }
-}
-function redactRpcUrlsInText(text) {
-  return text.replace(/https?:\/\/[^\s)'"]+/g, (url) => stripRpcSecrets(url));
-}
 async function resolveMediaField(value, agentDir, cache, blossom, identity2, onCacheUpdate) {
   if (!value) {
     return void 0;
@@ -10271,11 +10718,23 @@ async function uploadOrReuse(cacheKey, absPath, containRoot, cache, blossom, ide
     );
     return void 0;
   }
+  if (!isImagePath(realPath)) {
+    console.warn(
+      `  ! Skipping upload of ${basename(absPath)}: not an image (${IMAGE_EXTENSIONS.join(", ")}). Nothing else is published from an agent directory.`
+    );
+    return void 0;
+  }
   try {
     const cached = await lookupCachedUrl(cache, cacheKey, realPath);
     if (cached) {
       return cached;
     }
+    if (isBlockingNodeSync(realPath)) {
+      console.warn(
+        `  ! Skipping ${basename(realPath)}: it is a pipe, socket or device, not a file`
+      );
+      return void 0;
+    }
     console.log(`  Uploading ${basename(realPath)}...`);
     const data = readFileSync(realPath);
     const sha256 = createHash("sha256").update(data).digest("hex");