@fased/fased 0.1.62 → 0.1.64

package/dist/config/config.js

@@ -4,9 +4,9 @@ import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConf
 import { MODEL_APIS } from "./types.models.js";
 import { FasedAgentSchema } from "./zod-schema.js";
 import { validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins } from "./validation.js";
-import { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, writeConfigFile } from "./io.js";
+import { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, updateConfigFile, writeConfigFile } from "./io.js";
 import { migrateLegacyConfig } from "./legacy-migrate.js";
 import { TOOLS_BY_SENDER_KEY_TYPES, parseToolsBySenderTypedKey } from "./types.tools.js";
 import "./types.js";
 
-export { CONFIG_PATH, DEFAULT_GATEWAY_PORT, DEFAULT_SECRET_PROVIDER_ALIAS, FasedAgentSchema, MODEL_APIS, STATE_DIR, TOOLS_BY_SENDER_KEY_TYPES, applyConfigOverrides, assertSecretInputResolved, clearConfigCache, clearRuntimeConfigSnapshot, coerceSecretRef, createConfigIO, getConfigOverrides, getRuntimeConfigSnapshot, isNixMode, isSecretRef, loadConfig, migrateLegacyConfig, parseConfigJson5, parseEnvTemplateSecretRef, parseToolsBySenderTypedKey, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resetConfigOverrides, resolveCanonicalConfigPath, resolveConfigPath, resolveConfigPathCandidate, resolveConfigSnapshotHash, resolveDefaultConfigCandidates, resolveGatewayLockDir, resolveGatewayPort, resolveIsNixMode, resolveLegacyStateDir, resolveLegacyStateDirs, resolveNewStateDir, resolveOAuthDir, resolveOAuthPath, resolveStateDir, setConfigOverride, setRuntimeConfigSnapshot, unsetConfigOverride, validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins, writeConfigFile };
+export { CONFIG_PATH, DEFAULT_GATEWAY_PORT, DEFAULT_SECRET_PROVIDER_ALIAS, FasedAgentSchema, MODEL_APIS, STATE_DIR, TOOLS_BY_SENDER_KEY_TYPES, applyConfigOverrides, assertSecretInputResolved, clearConfigCache, clearRuntimeConfigSnapshot, coerceSecretRef, createConfigIO, getConfigOverrides, getRuntimeConfigSnapshot, isNixMode, isSecretRef, loadConfig, migrateLegacyConfig, parseConfigJson5, parseEnvTemplateSecretRef, parseToolsBySenderTypedKey, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resetConfigOverrides, resolveCanonicalConfigPath, resolveConfigPath, resolveConfigPathCandidate, resolveConfigSnapshotHash, resolveDefaultConfigCandidates, resolveGatewayLockDir, resolveGatewayPort, resolveIsNixMode, resolveLegacyStateDir, resolveLegacyStateDirs, resolveNewStateDir, resolveOAuthDir, resolveOAuthPath, resolveStateDir, setConfigOverride, setRuntimeConfigSnapshot, unsetConfigOverride, updateConfigFile, validateConfigObject, validateConfigObjectRaw, validateConfigObjectRawWithPlugins, validateConfigObjectWithPlugins, writeConfigFile };

package/dist/config/io.js

@@ -2,6 +2,8 @@ import { resolveRequiredHomeDir } from "../infra/home-dir.js";
 import { resolveConfigPath, resolveDefaultConfigCandidates, resolveStateDir } from "./paths.js";
 import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 import { VERSION } from "../version.js";
+import { withFileLock } from "../plugin-sdk/file-lock.js";
+import "../infra/file-lock.js";
 import { ensureOwnerDisplaySecret } from "../agents/owner-display.js";
 import { loadDotEnv } from "../infra/dotenv.js";
 import { loadShellEnvFallback, resolveShellEnvFallbackTimeoutMs, shouldDeferShellEnvFallback, shouldEnableShellEnvFallback } from "../infra/shell-env.js";
@@ -71,6 +73,36 @@ function pruneLegacyRemovedPlugins(cfg) {
 const OPEN_DM_POLICY_ALLOW_FROM_RE = /^(?<policyPath>[a-z0-9_.-]+)\s*=\s*"open"\s+requires\s+(?<allowPath>[a-z0-9_.-]+)(?:\s+\(or\s+[a-z0-9_.-]+\))?\s+to include "\*"$/i;
 const CONFIG_AUDIT_LOG_FILENAME = "config-audit.jsonl";
 const loggedInvalidConfigs = new Set();
+const CONFIG_WRITE_QUEUES = new Map();
+async function inConfigWriteQueue(configPath, fn) {
+	const previous = CONFIG_WRITE_QUEUES.get(configPath) ?? Promise.resolve();
+	let release;
+	const current = new Promise((resolve) => {
+		release = resolve;
+	});
+	CONFIG_WRITE_QUEUES.set(configPath, current);
+	await previous.catch(() => undefined);
+	try {
+		return await fn();
+	} finally {
+		release?.();
+		if (CONFIG_WRITE_QUEUES.get(configPath) === current) {
+			CONFIG_WRITE_QUEUES.delete(configPath);
+		}
+	}
+}
+async function withConfigWriteLock(configPath, fn) {
+	return await inConfigWriteQueue(configPath, async () => await withFileLock(configPath, {
+		retries: {
+			retries: 160,
+			factor: 1.08,
+			minTimeout: 10,
+			maxTimeout: 250,
+			randomize: true
+		},
+		stale: 12e4
+	}, fn));
+}
 function hashConfigRaw(raw) {
 	return crypto.createHash("sha256").update(raw ?? "").digest("hex");
 }
@@ -857,7 +889,7 @@ function createConfigIO(overrides = {}) {
 			}
 		};
 	}
-	async function writeConfigFile(cfg, options = {}) {
+	async function writeConfigFileUnlocked(cfg, options = {}) {
 		clearConfigCache();
 		let persistCandidate = cfg;
 		const { snapshot } = await readConfigFileSnapshotInternal();
@@ -1047,11 +1079,38 @@ function createConfigIO(overrides = {}) {
 			throw err;
 		}
 	}
+	async function writeConfigFile(cfg, options = {}) {
+		await withConfigWriteLock(configPath, async () => {
+			await writeConfigFileUnlocked(cfg, options);
+		});
+	}
+	async function updateConfigFile(mutator) {
+		return await withConfigWriteLock(configPath, async () => {
+			const read = await readConfigFileSnapshotInternal();
+			if (!read.snapshot.valid) {
+				throw new Error("Config update transaction refused an invalid config snapshot");
+			}
+			const decision = await mutator(structuredClone(read.snapshot.config), read.snapshot);
+			const shouldWrite = decision.write !== false;
+			if (shouldWrite) {
+				await writeConfigFileUnlocked(decision.config, {
+					envSnapshotForRestore: read.envSnapshotForRestore,
+					expectedConfigPath: configPath
+				});
+			}
+			return {
+				config: shouldWrite ? decision.config : read.snapshot.config,
+				result: decision.result,
+				written: shouldWrite
+			};
+		});
+	}
 	return {
 		configPath,
 		loadConfig,
 		readConfigFileSnapshot,
 		readConfigFileSnapshotForWrite,
+		updateConfigFile,
 		writeConfigFile
 	};
 }
@@ -1145,6 +1204,9 @@ async function writeConfigFile(cfg, options = {}) {
 		unsetPaths: options.unsetPaths
 	});
 }
+async function updateConfigFile(mutator) {
+	return await createConfigIO().updateConfigFile(mutator);
+}
 
 //#endregion
-export { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, writeConfigFile };
+export { clearConfigCache, clearRuntimeConfigSnapshot, createConfigIO, getRuntimeConfigSnapshot, loadConfig, parseConfigJson5, readConfigFileSnapshot, readConfigFileSnapshotForWrite, resolveConfigSnapshotHash, setRuntimeConfigSnapshot, updateConfigFile, writeConfigFile };

package/dist/config/schema.help.js

@@ -178,6 +178,7 @@ const FIELD_HELP_BASE = {
 	"agents.defaults.memorySearch.remote.baseUrl": "Custom base URL for remote embeddings (OpenAI-compatible proxies or Gemini overrides).",
 	"agents.defaults.memorySearch.remote.apiKey": "Custom API key for the remote embedding provider.",
 	"agents.defaults.memorySearch.remote.headers": "Extra headers for remote embeddings (merged; remote overrides OpenAI headers).",
+	"agents.defaults.memorySearch.remote.allowSessionContent": "Explicitly allow sanitized session transcript text to leave this host for remote embedding. Default: false.",
 	"agents.defaults.memorySearch.remote.batch.enabled": "Enable batch API for memory embeddings (OpenAI/Gemini; default: true).",
 	"agents.defaults.memorySearch.remote.batch.wait": "Wait for batch completion when indexing (default: true).",
 	"agents.defaults.memorySearch.remote.batch.concurrency": "Max concurrent embedding batch jobs for memory indexing (default: 2).",
@@ -219,15 +220,15 @@ const FIELD_HELP_BASE = {
 	"memory.qmd.limits.timeoutMs": "Per-query timeout for QMD searches (default: 4000).",
 	"memory.qmd.scope": "Session/channel scope for QMD recall (same syntax as session.sendPolicy; default: direct-only). Use match.rawKeyPrefix to match full agent-prefixed session keys.",
 	wallet: "Wallet subsystem configuration.",
-	"wallet.provider.id": "Wallet backend provider id for the current self-hosted runtime (\"local-socket-signer\" preferred; \"embedded-keystore\" legacy). Hosted provider ids are CLI/admin-only compatibility plumbing.",
+	"wallet.provider.id": "Wallet backend provider id. Local, WSL2, macOS, and Hosting use \"local-socket-signer\"; Wallet Standard and Turnkey remain supported. Legacy \"embedded-keystore\" values are migration-only and fail closed.",
 	"wallet.execution.mode": "Wallet send execution mode (\"manual\" queues approvals; \"autonomous\" executes immediately when policy allows).",
 	"wallet.approvalAuth.mode": "Approval auth mode for sensitive wallet actions (\"none\" or \"webauthn\").",
 	"wallet.approvalAuth.challengeTtlSeconds": "Wallet WebAuthn challenge TTL in seconds (default: 300).",
 	"wallet.approvalAuth.grantTtlSeconds": "Wallet approval grant TTL in seconds (default: 120).",
-	"wallet.keystore.enabled": "Enable embedded encrypted keystore provider for local self-hosted signing.",
-	"wallet.keystore.path": "Path to encrypted embedded keystore file (defaults under wallet state dir).",
-	"wallet.keystore.chainSupport": "Enabled chains for embedded keystore. Normal Fased wallet setup is Solana-first.",
-	"wallet.keystore.autoLockSeconds": "Optional idle auto-lock timeout for embedded keystore.",
+	"wallet.keystore.enabled": "Retired legacy field. Embedded keystores are migration-only and fail closed.",
+	"wallet.keystore.path": "Retired legacy path retained only so the native signer migration can be performed explicitly.",
+	"wallet.keystore.chainSupport": "Retired legacy field; production wallet keys are signer/provider-owned.",
+	"wallet.keystore.autoLockSeconds": "Retired legacy embedded-keystore field.",
 	"wallet.runtime.enabled": "Enable wallet runtime compatibility settings (provider-agnostic replacement for legacy wallet runtime config).",
 	"wallet.runtime.mode": "Wallet runtime mode (\"managed\" or \"external\").",
 	"wallet.runtime.runtime": "Wallet runtime source (\"external-docker\" or \"external-custom\").",
@@ -241,8 +242,8 @@ const FIELD_HELP_BASE = {
 	"wallet.runtime.install.enabled": "Whether onboarding/install flows should record wallet runtime install metadata.",
 	"wallet.runtime.install.version": "Installed wallet runtime version recorded by onboarding/install flows.",
 	"wallet.runtime.policy.directSigning": "Allow background/agent wallet execution from wallet tooling (must be paired with caps/allowlists). Manual reviewed sends are separate.",
-	"wallet.runtime.policy.capsEnabled": "Enable wallet spend cap enforcement. When false, role, custody, signer, allowlist, and audit gates still apply, but SOL/token cap comparisons are skipped.",
-	"wallet.runtime.policy.solana.allowPrograms": "Optional Solana program allowlist. For Agent market swaps this restricts inspected Jupiter DEX route programs; empty allows inspected routes.",
+	"wallet.runtime.policy.capsEnabled": "Enable wallet spend cap enforcement. When false, role, signer policy, allowlist, and audit gates still apply, but SOL/token cap comparisons are skipped.",
+	"wallet.runtime.policy.solana.allowPrograms": "Explicit Solana program/token allowlist. Empty denies program and token execution; Agent market swaps also require every inspected Jupiter route program.",
 	"wallet.runtime.policy.solana.tokenCaps": "Per-mint SPL token caps for token sends, token-input swaps, and token-input limit orders. Keys are mint addresses; values are base-unit maxPerTx/maxDaily strings.",
 	"wallet.runtime.policy.solana.maxPerTx": "Maximum Solana value allowed per transaction (base unit string; e.g. lamports).",
 	"wallet.runtime.policy.solana.maxDaily": "Maximum cumulative Solana value allowed per UTC day (base unit string).",

package/dist/config/schema.labels.js

@@ -194,6 +194,7 @@ const FIELD_LABELS_BASE = {
 	"agents.defaults.memorySearch.remote.baseUrl": "Remote Embedding Base URL",
 	"agents.defaults.memorySearch.remote.apiKey": "Remote Embedding API Key",
 	"agents.defaults.memorySearch.remote.headers": "Remote Embedding Headers",
+	"agents.defaults.memorySearch.remote.allowSessionContent": "Allow Session Content in Remote Embeddings",
 	"models.providers.*.request.allowPrivateNetwork": "Allow Private Model Network",
 	"agents.defaults.memorySearch.remote.batch.concurrency": "Remote Batch Concurrency",
 	"agents.defaults.memorySearch.model": "Memory Search Model",
@@ -249,10 +250,10 @@ const FIELD_LABELS_BASE = {
 	"wallet.approvalAuth.mode": "Wallet Approval Auth Mode",
 	"wallet.approvalAuth.challengeTtlSeconds": "Wallet Approval Challenge TTL (sec)",
 	"wallet.approvalAuth.grantTtlSeconds": "Wallet Approval Grant TTL (sec)",
-	"wallet.keystore.enabled": "Embedded Keystore Enabled",
-	"wallet.keystore.path": "Embedded Keystore Path",
-	"wallet.keystore.chainSupport": "Embedded Keystore Chains",
-	"wallet.keystore.autoLockSeconds": "Embedded Keystore Auto Lock (sec)",
+	"wallet.keystore.enabled": "Legacy Keystore (Retired)",
+	"wallet.keystore.path": "Legacy Keystore Migration Path",
+	"wallet.keystore.chainSupport": "Legacy Keystore Chains",
+	"wallet.keystore.autoLockSeconds": "Legacy Keystore Auto Lock (Retired)",
 	"wallet.runtime.enabled": "Wallet Runtime Enabled",
 	"wallet.runtime.mode": "Wallet Runtime Mode",
 	"wallet.runtime.runtime": "Wallet Runtime Kind",

package/dist/config/zod-schema.agent-runtime.js

@@ -458,6 +458,7 @@ const MemorySearchSchema = z.object({
 		baseUrl: z.string().optional(),
 		apiKey: z.string().optional().register(sensitive),
 		headers: z.record(z.string(), z.string()).optional(),
+		allowSessionContent: z.boolean().optional(),
 		batch: z.object({
 			enabled: z.boolean().optional(),
 			wait: z.boolean().optional(),

package/dist/config/zod-schema.js

@@ -522,6 +522,10 @@ const FederationMarketplaceOrderSchema = z.object({
 	sellerSyncError: z.string().optional(),
 	sellerSyncedAt: z.string().optional(),
 	sellerAcceptedAt: z.string().optional(),
+	peerNodeId: z.string().optional(),
+	peerRemoteOrderId: z.string().optional(),
+	peerRequestDigest: z.string().optional(),
+	peerDeliveryDigest: z.string().optional(),
 	serviceKind: z.string().optional(),
 	title: z.string().optional(),
 	pricing: FederationOfferPricingSchema,
@@ -555,6 +559,7 @@ const WalletSchema = z.object({
 		z.literal("local-socket-signer"),
 		z.literal("alchemy"),
 		z.literal("turnkey"),
+		z.literal("wallet-standard"),
 		z.literal("privy")
 	]).optional() }).strict().optional(),
 	execution: z.object({ mode: z.union([z.literal("manual"), z.literal("autonomous")]).optional() }).strict().optional(),