@fased/fased 0.1.61 → 0.1.64

package/dist/config/cache-utils.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/config/cache-utils.ts
 function resolveCacheTtlMs(params) {
@@ -16,7 +16,7 @@ function isCacheEnabled(ttlMs) {
 }
 function getFileMtimeMs(filePath) {
 	try {
-		return fs.statSync(filePath).mtimeMs;
+		return syncFs.statSync(filePath).mtimeMs;
 	} catch {
 		return undefined;
 	}

package/dist/config/config.js

@@ -4,9 +4,9 @@ import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConf
 import { MODEL_APIS } from "./types.models.js";
 import { FasedAgentSchema } from "./zod-schema.js";
 import { validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins } from "./validation.js";
-import { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, writeConfigFile } from "./io.js";
+import { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, updateConfigFile, writeConfigFile } from "./io.js";
 import { migrateLegacyConfig } from "./legacy-migrate.js";
 import { TOOLS_BY_SENDER_KEY_TYPES, parseToolsBySenderTypedKey } from "./types.tools.js";
 import "./types.js";
 
-export { CONFIG_PATH, DEFAULT_GATEWAY_PORT, DEFAULT_SECRET_PROVIDER_ALIAS, FasedAgentSchema, MODEL_APIS, STATE_DIR, TOOLS_BY_SENDER_KEY_TYPES, applyConfigOverrides, assertSecretInputResolved, clearConfigCache, clearRuntimeConfigSnapshot, coerceSecretRef, createConfigIO, getConfigOverrides, getRuntimeConfigSnapshot, isNixMode, isSecretRef, loadConfig, migrateLegacyConfig, parseConfigJson5, parseEnvTemplateSecretRef, parseToolsBySenderTypedKey, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resetConfigOverrides, resolveCanonicalConfigPath, resolveConfigPath, resolveConfigPathCandidate, resolveConfigSnapshotHash, resolveDefaultConfigCandidates, resolveGatewayLockDir, resolveGatewayPort, resolveIsNixMode, resolveLegacyStateDir, resolveLegacyStateDirs, resolveNewStateDir, resolveOAuthDir, resolveOAuthPath, resolveStateDir, setConfigOverride, setRuntimeConfigSnapshot, unsetConfigOverride, validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins, writeConfigFile };
+export { CONFIG_PATH, DEFAULT_GATEWAY_PORT, DEFAULT_SECRET_PROVIDER_ALIAS, FasedAgentSchema, MODEL_APIS, STATE_DIR, TOOLS_BY_SENDER_KEY_TYPES, applyConfigOverrides, assertSecretInputResolved, clearConfigCache, clearRuntimeConfigSnapshot, coerceSecretRef, createConfigIO, getConfigOverrides, getRuntimeConfigSnapshot, isNixMode, isSecretRef, loadConfig, migrateLegacyConfig, parseConfigJson5, parseEnvTemplateSecretRef, parseToolsBySenderTypedKey, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resetConfigOverrides, resolveCanonicalConfigPath, resolveConfigPath, resolveConfigPathCandidate, resolveConfigSnapshotHash, resolveDefaultConfigCandidates, resolveGatewayLockDir, resolveGatewayPort, resolveIsNixMode, resolveLegacyStateDir, resolveLegacyStateDirs, resolveNewStateDir, resolveOAuthDir, resolveOAuthPath, resolveStateDir, setConfigOverride, setRuntimeConfigSnapshot, unsetConfigOverride, updateConfigFile, validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins, writeConfigFile };

package/dist/config/includes.js

@@ -4,7 +4,7 @@ import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 import { canUseBoundaryFileOpen, openBoundaryFileSync } from "../infra/boundary-file-read.js";
 import { isPathInside } from "../security/scan-paths.js";
 import "./prototype-keys.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import JSON5 from "json5";
 
@@ -130,7 +130,7 @@ var IncludeProcessor = class IncludeProcessor {
 			throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
 		}
 		try {
-			const real = fs.realpathSync(normalized);
+			const real = syncFs.realpathSync(normalized);
 			if (!isPathInside(this.rootRealDir, real)) {
 				throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
 			}
@@ -184,13 +184,13 @@ var IncludeProcessor = class IncludeProcessor {
 };
 function safeRealpath(target) {
 	try {
-		return fs.realpathSync(target);
+		return syncFs.realpathSync(target);
 	} catch {
 		return target;
 	}
 }
 function readConfigIncludeFileWithGuards(params) {
-	const ioFs = params.ioFs ?? fs;
+	const ioFs = params.ioFs ?? syncFs;
 	const maxBytes = params.maxBytes ?? MAX_INCLUDE_FILE_BYTES;
 	if (!canUseBoundaryFileOpen(ioFs)) {
 		return ioFs.readFileSync(params.resolvedPath, "utf-8");
@@ -217,7 +217,7 @@ function readConfigIncludeFileWithGuards(params) {
 	}
 }
 const defaultResolver = {
-	readFile: (p) => fs.readFileSync(p, "utf-8"),
+	readFile: (p) => syncFs.readFileSync(p, "utf-8"),
 	readFileWithGuards: ({ includePath, resolvedPath, rootRealDir }) => readConfigIncludeFileWithGuards({
 		includePath,
 		resolvedPath,

package/dist/config/io.js

@@ -2,6 +2,8 @@ import { resolveRequiredHomeDir } from "../infra/home-dir.js";
 import { resolveConfigPath, resolveDefaultConfigCandidates, resolveStateDir } from "./paths.js";
 import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 import { VERSION } from "../version.js";
+import { withFileLock } from "../plugin-sdk/file-lock.js";
+import "../infra/file-lock.js";
 import { ensureOwnerDisplaySecret } from "../agents/owner-display.js";
 import { loadDotEnv } from "../infra/dotenv.js";
 import { loadShellEnvFallback, resolveShellEnvFallbackTimeoutMs, shouldDeferShellEnvFallback, shouldEnableShellEnvFallback } from "../infra/shell-env.js";
@@ -22,7 +24,7 @@ import { repairInstalledPluginAllowlist } from "./plugins-allowlist.js";
 import { applyConfigOverrides } from "./runtime-overrides.js";
 import { validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins } from "./validation.js";
 import { compareFasedAgentVersions } from "./version.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import JSON5 from "json5";
@@ -71,6 +73,36 @@ function pruneLegacyRemovedPlugins(cfg) {
 const OPEN_DM_POLICY_ALLOW_FROM_RE = /^(?<policyPath>[a-z0-9_.-]+)\s*=\s*"open"\s+requires\s+(?<allowPath>[a-z0-9_.-]+)(?:\s+\(or\s+[a-z0-9_.-]+\))?\s+to include "\*"$/i;
 const CONFIG_AUDIT_LOG_FILENAME = "config-audit.jsonl";
 const loggedInvalidConfigs = new Set();
+const CONFIG_WRITE_QUEUES = new Map();
+async function inConfigWriteQueue(configPath, fn) {
+	const previous = CONFIG_WRITE_QUEUES.get(configPath) ?? Promise.resolve();
+	let release;
+	const current = new Promise((resolve) => {
+		release = resolve;
+	});
+	CONFIG_WRITE_QUEUES.set(configPath, current);
+	await previous.catch(() => undefined);
+	try {
+		return await fn();
+	} finally {
+		release?.();
+		if (CONFIG_WRITE_QUEUES.get(configPath) === current) {
+			CONFIG_WRITE_QUEUES.delete(configPath);
+		}
+	}
+}
+async function withConfigWriteLock(configPath, fn) {
+	return await inConfigWriteQueue(configPath, async () => await withFileLock(configPath, {
+		retries: {
+			retries: 160,
+			factor: 1.08,
+			minTimeout: 10,
+			maxTimeout: 250,
+			randomize: true
+		},
+		stale: 12e4
+	}, fn));
+}
 function hashConfigRaw(raw) {
 	return crypto.createHash("sha256").update(raw ?? "").digest("hex");
 }
@@ -477,7 +509,7 @@ function resolveConfigPathForDeps(deps) {
 }
 function normalizeDeps(overrides = {}) {
 	return {
-		fs: overrides.fs ?? fs,
+		fs: overrides.fs ?? syncFs,
 		json5: overrides.json5 ?? JSON5,
 		env: overrides.env ?? process.env,
 		homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),
@@ -857,7 +889,7 @@ function createConfigIO(overrides = {}) {
 			}
 		};
 	}
-	async function writeConfigFile(cfg, options = {}) {
+	async function writeConfigFileUnlocked(cfg, options = {}) {
 		clearConfigCache();
 		let persistCandidate = cfg;
 		const { snapshot } = await readConfigFileSnapshotInternal();
@@ -1047,11 +1079,38 @@ function createConfigIO(overrides = {}) {
 			throw err;
 		}
 	}
+	async function writeConfigFile(cfg, options = {}) {
+		await withConfigWriteLock(configPath, async () => {
+			await writeConfigFileUnlocked(cfg, options);
+		});
+	}
+	async function updateConfigFile(mutator) {
+		return await withConfigWriteLock(configPath, async () => {
+			const read = await readConfigFileSnapshotInternal();
+			if (!read.snapshot.valid) {
+				throw new Error("Config update transaction refused an invalid config snapshot");
+			}
+			const decision = await mutator(structuredClone(read.snapshot.config), read.snapshot);
+			const shouldWrite = decision.write !== false;
+			if (shouldWrite) {
+				await writeConfigFileUnlocked(decision.config, {
+					envSnapshotForRestore: read.envSnapshotForRestore,
+					expectedConfigPath: configPath
+				});
+			}
+			return {
+				config: shouldWrite ? decision.config : read.snapshot.config,
+				result: decision.result,
+				written: shouldWrite
+			};
+		});
+	}
 	return {
 		configPath,
 		loadConfig,
 		readConfigFileSnapshot,
 		readConfigFileSnapshotForWrite,
+		updateConfigFile,
 		writeConfigFile
 	};
 }
@@ -1145,6 +1204,9 @@ async function writeConfigFile(cfg, options = {}) {
 		unsetPaths: options.unsetPaths
 	});
 }
+async function updateConfigFile(mutator) {
+	return await createConfigIO().updateConfigFile(mutator);
+}
 
 //#endregion
-export { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, writeConfigFile };
+export { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, updateConfigFile, writeConfigFile };

package/dist/config/paths.js

@@ -1,5 +1,5 @@
 import { expandHomePrefix, resolveRequiredHomeDir } from "../infra/home-dir.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -86,7 +86,7 @@ function resolveConfigPathCandidate(env = process.env, homedir = envHomedir(env)
 	const candidates = resolveDefaultConfigCandidates(env, homedir);
 	const existing = candidates.find((candidate) => {
 		try {
-			return fs.existsSync(candidate);
+			return syncFs.existsSync(candidate);
 		} catch {
 			return false;
 		}
@@ -108,7 +108,7 @@ function resolveConfigPath(env = process.env, stateDir = resolveStateDir(env, en
 	const candidates = [path.join(stateDir, CONFIG_FILENAME)];
 	const existing = candidates.find((candidate) => {
 		try {
-			return fs.existsSync(candidate);
+			return syncFs.existsSync(candidate);
 		} catch {
 			return false;
 		}

package/dist/config/sat-runtime-ids.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/config/sat-runtime-ids.ts
@@ -63,7 +63,7 @@ function resolveSatRuntimeDefaultsFile(env = process.env) {
 		path.resolve(import.meta.dirname, "..", "..", "..", "config", "sat-runtime.env")
 	];
 	for (const candidate of candidates) {
-		if (candidate && fs.existsSync(candidate)) {
+		if (candidate && syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}
@@ -82,7 +82,7 @@ function loadSatRuntimeDefaults(env = process.env) {
 	if (!file) {
 		return null;
 	}
-	const parsed = parseEnvFile(fs.readFileSync(file, "utf8"));
+	const parsed = parseEnvFile(syncFs.readFileSync(file, "utf8"));
 	if (!parsed.programId || !parsed.bondProgramId || !parsed.mintAddress || !parsed.mintProgramId) {
 		return null;
 	}

package/dist/config/schema.help.js

@@ -178,6 +178,7 @@ const FIELD_HELP_BASE = {
 	"agents.defaults.memorySearch.remote.baseUrl": "Custom base URL for remote embeddings (OpenAI-compatible proxies or Gemini overrides).",
 	"agents.defaults.memorySearch.remote.apiKey": "Custom API key for the remote embedding provider.",
 	"agents.defaults.memorySearch.remote.headers": "Extra headers for remote embeddings (merged; remote overrides OpenAI headers).",
+	"agents.defaults.memorySearch.remote.allowSessionContent": "Explicitly allow sanitized session transcript text to leave this host for remote embedding. Default: false.",
 	"agents.defaults.memorySearch.remote.batch.enabled": "Enable batch API for memory embeddings (OpenAI/Gemini; default: true).",
 	"agents.defaults.memorySearch.remote.batch.wait": "Wait for batch completion when indexing (default: true).",
 	"agents.defaults.memorySearch.remote.batch.concurrency": "Max concurrent embedding batch jobs for memory indexing (default: 2).",
@@ -219,15 +220,15 @@ const FIELD_HELP_BASE = {
 	"memory.qmd.limits.timeoutMs": "Per-query timeout for QMD searches (default: 4000).",
 	"memory.qmd.scope": "Session/channel scope for QMD recall (same syntax as session.sendPolicy; default: direct-only). Use match.rawKeyPrefix to match full agent-prefixed session keys.",
 	wallet: "Wallet subsystem configuration.",
-	"wallet.provider.id": "Wallet backend provider id for the current self-hosted runtime (\"local-socket-signer\" preferred; \"embedded-keystore\" legacy). Hosted provider ids are CLI/admin-only compatibility plumbing.",
+	"wallet.provider.id": "Wallet backend provider id. Local, WSL2, macOS, and Hosting use \"local-socket-signer\"; Wallet Standard and Turnkey remain supported. Legacy \"embedded-keystore\" values are migration-only and fail closed.",
 	"wallet.execution.mode": "Wallet send execution mode (\"manual\" queues approvals; \"autonomous\" executes immediately when policy allows).",
 	"wallet.approvalAuth.mode": "Approval auth mode for sensitive wallet actions (\"none\" or \"webauthn\").",
 	"wallet.approvalAuth.challengeTtlSeconds": "Wallet WebAuthn challenge TTL in seconds (default: 300).",
 	"wallet.approvalAuth.grantTtlSeconds": "Wallet approval grant TTL in seconds (default: 120).",
-	"wallet.keystore.enabled": "Enable embedded encrypted keystore provider for local self-hosted signing.",
-	"wallet.keystore.path": "Path to encrypted embedded keystore file (defaults under wallet state dir).",
-	"wallet.keystore.chainSupport": "Enabled chains for embedded keystore. Normal Fased wallet setup is Solana-first.",
-	"wallet.keystore.autoLockSeconds": "Optional idle auto-lock timeout for embedded keystore.",
+	"wallet.keystore.enabled": "Retired legacy field. Embedded keystores are migration-only and fail closed.",
+	"wallet.keystore.path": "Retired legacy path retained only so the native signer migration can be performed explicitly.",
+	"wallet.keystore.chainSupport": "Retired legacy field; production wallet keys are signer/provider-owned.",
+	"wallet.keystore.autoLockSeconds": "Retired legacy embedded-keystore field.",
 	"wallet.runtime.enabled": "Enable wallet runtime compatibility settings (provider-agnostic replacement for legacy wallet runtime config).",
 	"wallet.runtime.mode": "Wallet runtime mode (\"managed\" or \"external\").",
 	"wallet.runtime.runtime": "Wallet runtime source (\"external-docker\" or \"external-custom\").",
@@ -241,8 +242,8 @@ const FIELD_HELP_BASE = {
 	"wallet.runtime.install.enabled": "Whether onboarding/install flows should record wallet runtime install metadata.",
 	"wallet.runtime.install.version": "Installed wallet runtime version recorded by onboarding/install flows.",
 	"wallet.runtime.policy.directSigning": "Allow background/agent wallet execution from wallet tooling (must be paired with caps/allowlists). Manual reviewed sends are separate.",
-	"wallet.runtime.policy.capsEnabled": "Enable wallet spend cap enforcement. When false, role, custody, signer, allowlist, and audit gates still apply, but SOL/token cap comparisons are skipped.",
-	"wallet.runtime.policy.solana.allowPrograms": "Optional Solana program allowlist. For Agent market swaps this restricts inspected Jupiter DEX route programs; empty allows inspected routes.",
+	"wallet.runtime.policy.capsEnabled": "Enable wallet spend cap enforcement. When false, role, signer policy, allowlist, and audit gates still apply, but SOL/token cap comparisons are skipped.",
+	"wallet.runtime.policy.solana.allowPrograms": "Explicit Solana program/token allowlist. Empty denies program and token execution; Agent market swaps also require every inspected Jupiter route program.",
 	"wallet.runtime.policy.solana.tokenCaps": "Per-mint SPL token caps for token sends, token-input swaps, and token-input limit orders. Keys are mint addresses; values are base-unit maxPerTx/maxDaily strings.",
 	"wallet.runtime.policy.solana.maxPerTx": "Maximum Solana value allowed per transaction (base unit string; e.g. lamports).",
 	"wallet.runtime.policy.solana.maxDaily": "Maximum cumulative Solana value allowed per UTC day (base unit string).",

package/dist/config/schema.labels.js

@@ -194,6 +194,7 @@ const FIELD_LABELS_BASE = {
 	"agents.defaults.memorySearch.remote.baseUrl": "Remote Embedding Base URL",
 	"agents.defaults.memorySearch.remote.apiKey": "Remote Embedding API Key",
 	"agents.defaults.memorySearch.remote.headers": "Remote Embedding Headers",
+	"agents.defaults.memorySearch.remote.allowSessionContent": "Allow Session Content in Remote Embeddings",
 	"models.providers.*.request.allowPrivateNetwork": "Allow Private Model Network",
 	"agents.defaults.memorySearch.remote.batch.concurrency": "Remote Batch Concurrency",
 	"agents.defaults.memorySearch.model": "Memory Search Model",
@@ -249,10 +250,10 @@ const FIELD_LABELS_BASE = {
 	"wallet.approvalAuth.mode": "Wallet Approval Auth Mode",
 	"wallet.approvalAuth.challengeTtlSeconds": "Wallet Approval Challenge TTL (sec)",
 	"wallet.approvalAuth.grantTtlSeconds": "Wallet Approval Grant TTL (sec)",
-	"wallet.keystore.enabled": "Embedded Keystore Enabled",
-	"wallet.keystore.path": "Embedded Keystore Path",
-	"wallet.keystore.chainSupport": "Embedded Keystore Chains",
-	"wallet.keystore.autoLockSeconds": "Embedded Keystore Auto Lock (sec)",
+	"wallet.keystore.enabled": "Legacy Keystore (Retired)",
+	"wallet.keystore.path": "Legacy Keystore Migration Path",
+	"wallet.keystore.chainSupport": "Legacy Keystore Chains",
+	"wallet.keystore.autoLockSeconds": "Legacy Keystore Auto Lock (Retired)",
 	"wallet.runtime.enabled": "Wallet Runtime Enabled",
 	"wallet.runtime.mode": "Wallet Runtime Mode",
 	"wallet.runtime.runtime": "Wallet Runtime Kind",

package/dist/config/sessions/disk-budget.js

@@ -1,6 +1,6 @@
 import { isPrimarySessionTranscriptFileName, isSessionArchiveArtifactName } from "./artifacts.js";
 import { resolveSessionFilePath } from "./paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/config/sessions/disk-budget.ts
@@ -11,7 +11,7 @@ const NOOP_LOGGER = {
 function canonicalizePathForComparison(filePath) {
 	const resolved = path.resolve(filePath);
 	try {
-		return fs.realpathSync(resolved);
+		return syncFs.realpathSync(resolved);
 	} catch {
 		return resolved;
 	}
@@ -83,14 +83,14 @@ function resolveReferencedSessionTranscriptPaths(params) {
 	return referenced;
 }
 async function readSessionsDirFiles(sessionsDir) {
-	const dirEntries = await fs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
+	const dirEntries = await syncFs.promises.readdir(sessionsDir, { withFileTypes: true }).catch(() => []);
 	const files = [];
 	for (const dirent of dirEntries) {
 		if (!dirent.isFile()) {
 			continue;
 		}
 		const filePath = path.join(sessionsDir, dirent.name);
-		const stat = await fs.promises.stat(filePath).catch(() => null);
+		const stat = await syncFs.promises.stat(filePath).catch(() => null);
 		if (!stat?.isFile()) {
 			continue;
 		}
@@ -105,11 +105,11 @@ async function readSessionsDirFiles(sessionsDir) {
 	return files;
 }
 async function removeFileIfExists(filePath) {
-	const stat = await fs.promises.stat(filePath).catch(() => null);
+	const stat = await syncFs.promises.stat(filePath).catch(() => null);
 	if (!stat?.isFile()) {
 		return 0;
 	}
-	await fs.promises.rm(filePath, { force: true }).catch(() => undefined);
+	await syncFs.promises.rm(filePath, { force: true }).catch(() => undefined);
 	return stat.size;
 }
 async function removeFileForBudget(params) {

package/dist/config/sessions/paths.js

@@ -1,7 +1,7 @@
 import { expandHomePrefix, resolveRequiredHomeDir } from "../../infra/home-dir.js";
 import { resolveStateDir } from "../paths.js";
 import { DEFAULT_AGENT_ID, normalizeAgentId } from "../../routing/session-key.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -112,7 +112,7 @@ function resolveStructuralSessionFallbackPath(candidateAbsPath, expectedAgentId)
 }
 function safeRealpathSync(filePath) {
 	try {
-		return fs.realpathSync(filePath);
+		return syncFs.realpathSync(filePath);
 	} catch {
 		return undefined;
 	}

package/dist/config/sessions/store.js

@@ -10,7 +10,7 @@ import { archiveSessionTranscripts, cleanupArchivedSessionTranscripts } from "..
 import { deliveryContextFromSession, mergeDeliveryContext, normalizeDeliveryContext, normalizeSessionDeliveryFields } from "../../utils/delivery-context.js";
 import { getFileMtimeMs, isCacheEnabled, resolveCacheTtlMs } from "../cache-utils.js";
 import { enforceSessionDiskBudget } from "./disk-budget.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 
@@ -155,7 +155,7 @@ function loadSessionStore(storePath, opts = {}) {
 	const retryBuf = maxReadAttempts > 1 ? new Int32Array(new SharedArrayBuffer(4)) : undefined;
 	for (let attempt = 0; attempt < maxReadAttempts; attempt++) {
 		try {
-			const raw = fs.readFileSync(storePath, "utf-8");
+			const raw = syncFs.readFileSync(storePath, "utf-8");
 			if (raw.length === 0 && attempt < maxReadAttempts - 1) {
 				Atomics.wait(retryBuf, 0, 0, 50);
 				continue;
@@ -406,7 +406,7 @@ function capEntryCount(store, overrideMax, opts = {}) {
 }
 async function getSessionFileSize(storePath) {
 	try {
-		const stat = await fs.promises.stat(storePath);
+		const stat = await syncFs.promises.stat(storePath);
 		return stat.size;
 	} catch {
 		return null;
@@ -428,7 +428,7 @@ async function rotateSessionFile(storePath, overrideBytes) {
 	}
 	const backupPath = `${storePath}.bak.${Date.now()}`;
 	try {
-		await fs.promises.rename(storePath, backupPath);
+		await syncFs.promises.rename(storePath, backupPath);
 		log.info("rotated session store file", {
 			backupPath: path.basename(backupPath),
 			sizeBytes: fileSize
@@ -439,13 +439,13 @@ async function rotateSessionFile(storePath, overrideBytes) {
 	try {
 		const dir = path.dirname(storePath);
 		const baseName = path.basename(storePath);
-		const files = await fs.promises.readdir(dir);
+		const files = await syncFs.promises.readdir(dir);
 		const backups = files.filter((f) => f.startsWith(`${baseName}.bak.`)).toSorted().toReversed();
 		const maxBackups = 3;
 		if (backups.length > maxBackups) {
 			const toDelete = backups.slice(maxBackups);
 			for (const old of toDelete) {
-				await fs.promises.unlink(path.join(dir, old)).catch(() => undefined);
+				await syncFs.promises.unlink(path.join(dir, old)).catch(() => undefined);
 			}
 			log.info("cleaned up old session store backups", { deleted: toDelete.length });
 		}
@@ -561,15 +561,15 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 			});
 		}
 	}
-	await fs.promises.mkdir(path.dirname(storePath), { recursive: true });
+	await syncFs.promises.mkdir(path.dirname(storePath), { recursive: true });
 	const json = JSON.stringify(store, null, 2);
 	if (process.platform === "win32") {
 		const tmp = `${storePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
 		try {
-			await fs.promises.writeFile(tmp, json, "utf-8");
+			await syncFs.promises.writeFile(tmp, json, "utf-8");
 			for (let i = 0; i < 5; i++) {
 				try {
-					await fs.promises.rename(tmp, storePath);
+					await syncFs.promises.rename(tmp, storePath);
 					break;
 				} catch {
 					if (i < 4) {
@@ -587,28 +587,28 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 			}
 			throw err;
 		} finally {
-			await fs.promises.rm(tmp, { force: true }).catch(() => undefined);
+			await syncFs.promises.rm(tmp, { force: true }).catch(() => undefined);
 		}
 		return;
 	}
 	const tmp = `${storePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
 	try {
-		await fs.promises.writeFile(tmp, json, {
+		await syncFs.promises.writeFile(tmp, json, {
 			mode: 384,
 			encoding: "utf-8"
 		});
-		await fs.promises.rename(tmp, storePath);
-		await fs.promises.chmod(storePath, 384);
+		await syncFs.promises.rename(tmp, storePath);
+		await syncFs.promises.chmod(storePath, 384);
 	} catch (err) {
 		const code = err && typeof err === "object" && "code" in err ? String(err.code) : null;
 		if (code === "ENOENT") {
 			try {
-				await fs.promises.mkdir(path.dirname(storePath), { recursive: true });
-				await fs.promises.writeFile(storePath, json, {
+				await syncFs.promises.mkdir(path.dirname(storePath), { recursive: true });
+				await syncFs.promises.writeFile(storePath, json, {
 					mode: 384,
 					encoding: "utf-8"
 				});
-				await fs.promises.chmod(storePath, 384);
+				await syncFs.promises.chmod(storePath, 384);
 			} catch (err2) {
 				const code2 = err2 && typeof err2 === "object" && "code" in err2 ? String(err2.code) : null;
 				if (code2 === "ENOENT") {
@@ -620,7 +620,7 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
 		}
 		throw err;
 	} finally {
-		await fs.promises.rm(tmp, { force: true });
+		await syncFs.promises.rm(tmp, { force: true });
 	}
 }
 async function saveSessionStore(storePath, store, opts) {

package/dist/config/sessions/transcript.js

@@ -2,7 +2,7 @@ import { resolveDefaultSessionStorePath, resolveSessionTranscriptPathInDir } fro
 import { loadSessionStore } from "./store.js";
 import { emitSessionTranscriptUpdate } from "../../sessions/transcript-events.js";
 import { resolveAndPersistSessionFile } from "./session-file.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { CURRENT_SESSION_VERSION, SessionManager } from "@mariozechner/pi-coding-agent";
 
@@ -65,11 +65,11 @@ async function resolveSessionTranscriptFile(params) {
 	});
 }
 function ensureSessionTranscriptHeader(params) {
-	if (fs.existsSync(params.sessionFile)) {
+	if (syncFs.existsSync(params.sessionFile)) {
 		return { created: false };
 	}
 	try {
-		fs.mkdirSync(path.dirname(params.sessionFile), { recursive: true });
+		syncFs.mkdirSync(path.dirname(params.sessionFile), { recursive: true });
 		const header = {
 			type: "session",
 			version: CURRENT_SESSION_VERSION,
@@ -77,7 +77,7 @@ function ensureSessionTranscriptHeader(params) {
 			timestamp: new Date().toISOString(),
 			cwd: process.cwd()
 		};
-		fs.writeFileSync(params.sessionFile, `${JSON.stringify(header)}\n`, {
+		syncFs.writeFileSync(params.sessionFile, `${JSON.stringify(header)}\n`, {
 			encoding: "utf-8",
 			mode: 384
 		});

package/dist/config/talk.js

@@ -1,5 +1,5 @@
 import { coerceSecretRef } from "./types.secrets.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -254,7 +254,7 @@ function buildTalkConfigResponse(value) {
 	return Object.keys(payload).length > 0 ? payload : undefined;
 }
 function readTalkApiKeyFromProfile(deps = {}) {
-	const fsImpl = deps.fs ?? fs;
+	const fsImpl = deps.fs ?? syncFs;
 	const osImpl = deps.os ?? os;
 	const pathImpl = deps.path ?? path;
 	const home = osImpl.homedir();

package/dist/config/zod-schema.agent-runtime.js

@@ -458,6 +458,7 @@ const MemorySearchSchema = z.object({
 		baseUrl: z.string().optional(),
 		apiKey: z.string().optional().register(sensitive),
 		headers: z.record(z.string(), z.string()).optional(),
+		allowSessionContent: z.boolean().optional(),
 		batch: z.object({
 			enabled: z.boolean().optional(),
 			wait: z.boolean().optional(),

package/dist/config/zod-schema.js

@@ -522,6 +522,10 @@ const FederationMarketplaceOrderSchema = z.object({
 	sellerSyncError: z.string().optional(),
 	sellerSyncedAt: z.string().optional(),
 	sellerAcceptedAt: z.string().optional(),
+	peerNodeId: z.string().optional(),
+	peerRemoteOrderId: z.string().optional(),
+	peerRequestDigest: z.string().optional(),
+	peerDeliveryDigest: z.string().optional(),
 	serviceKind: z.string().optional(),
 	title: z.string().optional(),
 	pricing: FederationOfferPricingSchema,
@@ -555,6 +559,7 @@ const WalletSchema = z.object({
 		z.literal("local-socket-signer"),
 		z.literal("alchemy"),
 		z.literal("turnkey"),
+		z.literal("wallet-standard"),
 		z.literal("privy")
 	]).optional() }).strict().optional(),
 	execution: z.object({ mode: z.union([z.literal("manual"), z.literal("autonomous")]).optional() }).strict().optional(),