@fased/fased 0.1.68 → 0.1.69

package/dist/plugin-sdk/{config-schema-DjU_uD-6.js → config-schema-BiBOUW89.js}

@@ -49,7 +49,7 @@ import { c as normalizeExtraMemoryPaths, s as listMemoryFiles } from "./internal
 import { i as resolveQmdScopeDenial } from "./qmd-scope-CdX34VCV.js";
 import { _ as estimateBase64DecodedBytes, a as jsonResult, d as readStringParam, f as sanitizeContentBlocksImages, g as canonicalizeBase64, h as resolveImageSanitizationLimits, i as imageResultFromFile, l as readStringArrayParam, m as sanitizeToolResultImages, n as createActionGate, p as sanitizeImageBlocks, r as imageResult, s as readNumberParam, u as readStringOrNumberParam } from "./common-HCcXU-NR.js";
 import { S as isCommandFlagEnabled, _ as normalizeElevatedLevel, a as listChatCommands, b as normalizeVerboseLevel, g as shouldHandleTextCommands, i as isCommandEnabled, l as maybeResolveTextAlias, m as resolveNativeCommandName, o as listChatCommandsForConfig, u as normalizeCommandBody, v as normalizeReasoningLevel, w as isRestartEnabled, x as resolveResponseUsageMode, y as normalizeUsageDisplay } from "./commands-registry-G5KXSi_y.js";
-import { A as fetchJson$1, B as DEFAULT_BROWSER_EVALUATE_ENABLED, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, F as stopChromeExtensionRelayServer, G as isLoopbackHost, H as DEFAULT_FASED_BROWSER_ENABLED, I as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH, J as resolveClientIp, K as isSecureWebSocketUrl, L as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS, O as withBrowserNavigationPolicy, P as ensureChromeExtensionRelayServer, R as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as InvalidBrowserNavigationUrlError, U as DEFAULT_FASED_BROWSER_PROFILE_NAME, V as DEFAULT_FASED_BROWSER_COLOR, W as isLoopbackAddress, X as rawDataToString, Y as resolveForwardedClientIp, _ as stopFasedAgentChrome, a as DEFAULT_TRACE_DIR, b as captureScreenshot, d as normalizeBrowserFormField, g as resolveFasedAgentUserDataDir, h as launchFasedAgentChrome, i as DEFAULT_DOWNLOAD_DIR, j as fetchOk, k as appendCdpPath, l as resolveWritablePathWithinRoot, m as isChromeReachable, o as DEFAULT_UPLOAD_DIR, p as isChromeCdpReady, q as isTrustedProxyAddress, r as loadReadability, s as resolveExistingPathsWithinRoot, t as loadLinkedom, v as resolveBrowserExecutableForPlatform, w as snapshotAria, x as createTargetViaCdp, y as resolveLsofCommandSync, z as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME } from "./runtime-dependency-nup8niQL.js";
+import { A as fetchJson$1, B as DEFAULT_BROWSER_EVALUATE_ENABLED, C as normalizeCdpWsUrl, D as assertBrowserNavigationResultAllowed, E as assertBrowserNavigationAllowed, F as stopChromeExtensionRelayServer, G as isLoopbackHost, H as DEFAULT_FASED_BROWSER_ENABLED, I as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH, J as resolveClientIp, K as isSecureWebSocketUrl, L as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS, O as withBrowserNavigationPolicy, P as ensureChromeExtensionRelayServer, R as DEFAULT_AI_SNAPSHOT_MAX_CHARS, T as InvalidBrowserNavigationUrlError, U as DEFAULT_FASED_BROWSER_PROFILE_NAME, V as DEFAULT_FASED_BROWSER_COLOR, W as isLoopbackAddress, X as rawDataToString, Y as resolveForwardedClientIp, _ as stopFasedAgentChrome, a as DEFAULT_TRACE_DIR, b as captureScreenshot, d as normalizeBrowserFormField, g as resolveFasedAgentUserDataDir, h as launchFasedAgentChrome, i as DEFAULT_DOWNLOAD_DIR, j as fetchOk, k as appendCdpPath, l as resolveWritablePathWithinRoot, m as isChromeReachable, o as DEFAULT_UPLOAD_DIR, p as isChromeCdpReady, q as isTrustedProxyAddress, r as loadReadability, s as resolveExistingPathsWithinRoot, t as loadLinkedom, v as resolveBrowserExecutableForPlatform, w as snapshotAria, x as createTargetViaCdp, y as resolveLsofCommandSync, z as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME } from "./runtime-dependency-DczkvPxn.js";
 import { t as PATH_ALIAS_POLICIES } from "./path-alias-guards-DjgDArrp.js";
 import { a as writeFileWithinRoot, n as openFileWithinRoot, r as readFileWithinRoot, t as SafeOpenError } from "./fs-safe-g4g7GT02.js";
 import { a as fetchRemoteMedia, d as readResponseWithLimit, i as MediaFetchError, l as getAgentScopedMediaLocalRoots, n as loadWebMedia, t as getDefaultLocalRoots, u as getDefaultMediaLocalRoots } from "./media-BAoaxCrt.js";
@@ -97,7 +97,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import readline from "node:readline";
 import { createJiti } from "jiti";
 import { Type } from "@sinclair/typebox";
-import WebSocket$1, { WebSocket } from "ws";
+import WebSocket, { WebSocket as WebSocket$1 } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 import net from "node:net";
 import { request } from "node:https";
@@ -12570,7 +12570,7 @@ var GatewayClient = class {
 				if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
 			});
 		}
-		this.ws = new WebSocket(url, wsOptions);
+		this.ws = new WebSocket$1(url, wsOptions);
 		this.ws.on("open", () => {
 			if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
 				const tlsError = this.validateTlsFingerprint();
@@ -12766,7 +12766,7 @@ var GatewayClient = class {
 		const connectChallengeTimeoutMs = typeof rawConnectDelayMs === "number" && Number.isFinite(rawConnectDelayMs) ? Math.max(250, Math.min(1e4, rawConnectDelayMs)) : 2e3;
 		if (this.connectTimer) clearTimeout(this.connectTimer);
 		this.connectTimer = setTimeout(() => {
-			if (this.connectSent || this.ws?.readyState !== WebSocket.OPEN) return;
+			if (this.connectSent || this.ws?.readyState !== WebSocket$1.OPEN) return;
 			this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway connect challenge timeout"));
 			this.ws?.close(1008, "connect challenge timeout");
 		}, connectChallengeTimeoutMs);
@@ -12808,7 +12808,7 @@ var GatewayClient = class {
 		return null;
 	}
 	async request(method, params, opts) {
-		if (!this.ws || this.ws.readyState !== WebSocket.OPEN) throw new Error("gateway not connected");
+		if (!this.ws || this.ws.readyState !== WebSocket$1.OPEN) throw new Error("gateway not connected");
 		const id = randomUUID();
 		const frame = {
 			type: "req",
@@ -14972,6 +14972,11 @@ const SAT_RUNTIME_ENV_KEYS = {
 	mintAddress: "FASED_SAT_MINT_ADDRESS",
 	mintProgramId: "FASED_SAT_MINT_PROGRAM_ID"
 };
+const SAT_RUNTIME_TRUST_ENV_KEYS = {
+	manifestPath: "FASED_SAT_RUNTIME_MANIFEST_PATH",
+	manifestSha256: "FASED_SAT_RUNTIME_MANIFEST_SHA256",
+	manifestSignaturePath: "FASED_SAT_RUNTIME_MANIFEST_SIGNATURE_PATH"
+};
 const MISSING_SAT_RUNTIME_IDS_MESSAGE = "SAT runtime IDs are not configured. Use Mining Sync after mainnet launch or set the complete SAT runtime env tuple for an explicit test network.";
 function readExplicitSatRuntimeIds(env) {
 	const programId = String(env[SAT_RUNTIME_ENV_KEYS.programId] ?? "").trim();
@@ -15233,24 +15238,43 @@ function readLocalIds(env) {
 function idsEqual(left, right) {
 	return Boolean(left && right && left.programId === right.programId && left.bondProgramId === right.bondProgramId && left.mintAddress === right.mintAddress && left.mintProgramId === right.mintProgramId);
 }
-function buildEnvFile(ids) {
+function buildEnvFile(ids, trust) {
 	return [
 		"# Managed by Fased Agent official SAT mainnet sync.",
 		`${SAT_RUNTIME_ENV_KEYS.programId}=${ids.programId}`,
 		`${SAT_RUNTIME_ENV_KEYS.bondProgramId}=${ids.bondProgramId}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintAddress}=${ids.mintAddress}`,
 		`${SAT_RUNTIME_ENV_KEYS.mintProgramId}=${ids.mintProgramId}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath}=${trust.manifestPath}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256}=${trust.manifestSha256}`,
+		`${SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath}=${trust.manifestSignaturePath}`,
 		""
 	].join("\n");
 }
-async function writeRuntimeIds(ids, env) {
+async function writeRuntimeIds(ids, env, trust) {
 	const runtimeFile = resolveWritableSatRuntimeDefaultsFile(env);
+	const manifestPath = `${runtimeFile}.manifest.json`;
+	const manifestSignaturePath = `${runtimeFile}.manifest.sig`;
 	await fs$1.mkdir(path.dirname(runtimeFile), { recursive: true });
-	await fs$1.writeFile(runtimeFile, buildEnvFile(ids), { mode: 384 });
+	await fs$1.writeFile(manifestPath, trust.rawManifest, { mode: 384 });
+	await fs$1.writeFile(manifestSignaturePath, `${trust.signature.trim()}\n`, { mode: 384 });
+	await fs$1.writeFile(runtimeFile, buildEnvFile(ids, {
+		manifestPath,
+		manifestSha256: trust.manifestSha256,
+		manifestSignaturePath
+	}), { mode: 384 });
+	await Promise.all([
+		fs$1.chmod(manifestPath, 384),
+		fs$1.chmod(manifestSignaturePath, 384),
+		fs$1.chmod(runtimeFile, 384)
+	]);
 	env[SAT_RUNTIME_ENV_KEYS.programId] = ids.programId;
 	env[SAT_RUNTIME_ENV_KEYS.bondProgramId] = ids.bondProgramId;
 	env[SAT_RUNTIME_ENV_KEYS.mintAddress] = ids.mintAddress;
 	env[SAT_RUNTIME_ENV_KEYS.mintProgramId] = ids.mintProgramId;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestPath] = manifestPath;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSha256] = trust.manifestSha256;
+	env[SAT_RUNTIME_TRUST_ENV_KEYS.manifestSignaturePath] = manifestSignaturePath;
 	return runtimeFile;
 }
 async function getSatMainnetSyncStatus(opts) {
@@ -15350,7 +15374,43 @@ async function syncSatMainnetRuntimeIds(opts) {
 		ok: false,
 		message: before.state === "not_live" ? "Satcoin mainnet is not live yet." : before.message || "SAT mainnet manifest is not ready to apply."
 	};
-	const runtimeFile = await writeRuntimeIds(before.officialIds, env);
+	const manifestUrl = opts?.manifestUrl?.trim() || resolveManifestUrl(env);
+	const rawManifest = await fetchText(manifestUrl, { required: true });
+	const manifestSha256 = parseSha256(await fetchText(`${manifestUrl}.sha256`, { required: true }));
+	const signature = await fetchText(`${manifestUrl}.sig`, { required: true });
+	if (!rawManifest || !manifestSha256 || !signature?.trim()) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "Verified SAT manifest artifacts could not be persisted for the native signer.",
+		error: "signed SAT runtime manifest, hash, or detached signature is missing"
+	};
+	const finalVerification = await verifyLiveManifest({
+		manifestUrl,
+		raw: rawManifest,
+		env
+	});
+	if (finalVerification.verification.hash !== "valid" || finalVerification.verification.signature !== "valid" || sha256Hex(rawManifest) !== manifestSha256) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "SAT manifest changed before signer runtime persistence.",
+		verification: finalVerification.verification,
+		trustKeySource: finalVerification.trustKeySource,
+		error: "signed SAT runtime manifest verification raced or failed"
+	};
+	if (!idsEqual(readOfficialIds(JSON.parse(rawManifest)), before.officialIds)) return {
+		...before,
+		ok: false,
+		state: "failed",
+		message: "SAT manifest IDs changed before signer runtime persistence.",
+		error: "signed SAT runtime ID tuple changed during sync"
+	};
+	const runtimeFile = await writeRuntimeIds(before.officialIds, env, {
+		rawManifest,
+		manifestSha256,
+		signature
+	});
 	const after = await getSatMainnetSyncStatus({
 		env,
 		manifestUrl: opts?.manifestUrl
@@ -16312,14 +16372,18 @@ const SignerPolicyAssetV2Schema = Type.Object({
 	asset: Type.String(),
 	destinations: Type.Array(Type.String()),
 	maxPerTx: Type.String(),
-	maxDaily: Type.String()
+	maxDaily: Type.String(),
+	reviewedDestinations: Type.Optional(Type.Boolean()),
+	typedSatDestinations: Type.Optional(Type.Boolean())
 }, { additionalProperties: false });
 const SignerPolicyInputV2Schema = Type.Object({
 	walletId: Type.Optional(Type.String()),
 	role: SignerWalletRoleSchema,
 	version: Type.Optional(Type.Integer({ minimum: 0 })),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.Optional(Type.String())
 }, { additionalProperties: false });
@@ -16327,8 +16391,10 @@ const LocalSocketSignerPolicyV2Schema = Type.Object({
 	walletId: Type.String(),
 	role: SignerWalletRoleSchema,
 	version: Type.Integer({ minimum: 1 }),
+	baselineVersion: Type.Optional(Type.Integer({ minimum: 1 })),
 	operations: Type.Array(Type.String()),
 	programs: Type.Array(Type.String()),
+	typedSatPrograms: Type.Optional(Type.Boolean()),
 	assets: Type.Array(SignerPolicyAssetV2Schema),
 	hash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" })
 }, { additionalProperties: false });
@@ -16514,10 +16580,13 @@ const SignerSolanaTransactionEnvelopeV2Schema = Type.Object({
 	}),
 	submission: Type.Literal("rpc")
 }, { additionalProperties: false });
-const SignerReviewAuthorizationV2Schema = Type.Object({
+const SignerReviewAuthorizationV2Schema = Type.Union([Type.Object({
 	type: Type.Literal("webauthn"),
 	proof: Type.Object({ proofId: Type.String({ minLength: 1 }) }, { additionalProperties: false })
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	type: Type.Literal("control-ui"),
+	proof: Type.Object({ proofId: Type.String({ pattern: "^[0-9a-f]{64}$" }) }, { additionalProperties: false })
+}, { additionalProperties: false })]);
 const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Type.Array(Type.Object({
 	orderId: Type.String({ minLength: 1 }),
 	orderState: Type.String({ minLength: 1 }),
@@ -16542,10 +16611,17 @@ const LocalSocketSignerJupiterTriggerHistoryV2Schema = Type.Object({ orders: Typ
 		program: Type.String({ minLength: 1 })
 	}, { additionalProperties: false }))
 }, { additionalProperties: false })) }, { additionalProperties: false });
-const SignerWalletPolicyCreateV2Schema = Type.Object({
+const SignerRoleBaselineV1Schema = Type.Object({
+	version: Type.Literal(1),
+	role: SignerWalletRoleSchema
+}, { additionalProperties: false });
+const SignerWalletPolicyCreateV2Schema = Type.Union([Type.Object({
 	expectedPolicyVersion: Type.Literal(0),
 	policy: SignerPolicyInputV2Schema
-}, { additionalProperties: false });
+}, { additionalProperties: false }), Type.Object({
+	expectedPolicyVersion: Type.Literal(0),
+	baseline: SignerRoleBaselineV1Schema
+}, { additionalProperties: false })]);
 const SignerOperationLookupV2Schema = Type.Object({ requestId: Type.String() }, { additionalProperties: false });
 const SignerSatLookupBindingRequestV2Schema = Type.Object({
 	cycleId: Type.String({ pattern: "^(0|[1-9][0-9]*)$" }),
@@ -16624,6 +16700,18 @@ const LocalSocketSignerRequestSchema = Type.Union([
 		op: Type.Literal("v2.wallet.get"),
 		walletId: Type.String()
 	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.wallet.readiness"),
+		walletId: Type.String()
+	}, { additionalProperties: false }),
+	Type.Object({
+		op: Type.Literal("v2.policy.activateBaseline"),
+		walletId: Type.String(),
+		request: Type.Object({
+			expectedPolicyVersion: Type.Integer({ minimum: 1 }),
+			baseline: SignerRoleBaselineV1Schema
+		}, { additionalProperties: false })
+	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.create"),
 		walletId: Type.String(),
@@ -16632,21 +16720,30 @@ const LocalSocketSignerRequestSchema = Type.Union([
 	Type.Object({
 		op: Type.Literal("v2.wallet.import"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.importLegacy"),
 		walletId: Type.String(),
-		request: Type.Object({
+		request: Type.Union([Type.Object({
 			expectedPolicyVersion: Type.Literal(0),
 			policy: SignerPolicyInputV2Schema,
 			path: Type.String(),
 			passphrasePath: Type.String()
-		}, { additionalProperties: false })
+		}, { additionalProperties: false }), Type.Object({
+			expectedPolicyVersion: Type.Literal(0),
+			baseline: SignerRoleBaselineV1Schema,
+			path: Type.String(),
+			passphrasePath: Type.String()
+		}, { additionalProperties: false })])
 	}, { additionalProperties: false }),
 	Type.Object({
 		op: Type.Literal("v2.wallet.reencrypt"),
@@ -16926,6 +17023,27 @@ const LocalSocketSignerWalletPolicyResultV2Schema = Type.Object({
 	wallet: LocalSocketSignerWalletV2Schema,
 	policy: LocalSocketSignerPolicyV2Schema
 }, { additionalProperties: false });
+const LocalSocketSignerWalletReadinessV2Schema = Type.Object({
+	walletId: Type.String({ minLength: 1 }),
+	publicKey: Type.String({ minLength: 1 }),
+	walletVersion: Type.Optional(Type.Integer({ minimum: 1 })),
+	role: SignerWalletRoleSchema,
+	baselineVersion: Type.Integer({ minimum: 0 }),
+	policyVersion: Type.Integer({ minimum: 1 }),
+	policyHash: Type.String({ pattern: "^sha256:[0-9a-f]{64}$" }),
+	networkVersion: Type.Integer({ minimum: 0 }),
+	networkHash: Type.Optional(Type.String({ pattern: "^hmac-sha256:[0-9a-f]{64}$" })),
+	keyReady: Type.Boolean(),
+	policyReady: Type.Boolean(),
+	networkReady: Type.Boolean(),
+	operationLane: Type.Union([
+		Type.Literal("blocked"),
+		Type.Literal("agent-reviewed-and-autonomous"),
+		Type.Literal("mining-typed-sat"),
+		Type.Literal("vault-reviewed-only")
+	]),
+	ready: Type.Boolean()
+}, { additionalProperties: false });
 function isPositiveUnsignedInteger(value) {
 	return typeof value === "string" && /^[1-9][0-9]*$/.test(value);
 }
@@ -16956,9 +17074,11 @@ function validateLocalSocketSignerResult(op, result) {
 		case "v2.network.bootstrap": return Value.Check(LocalSocketSignerNetworkSummaryV2Schema, result);
 		case "v2.policy.get":
 		case "v2.policy.put":
-		case "v2.policy.tighten": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
+		case "v2.policy.tighten":
+		case "v2.policy.activateBaseline": return Value.Check(LocalSocketSignerPolicyV2Schema, result);
 		case "v2.wallet.get":
 		case "v2.wallet.reencrypt": return Value.Check(LocalSocketSignerWalletV2Schema, result);
+		case "v2.wallet.readiness": return Value.Check(LocalSocketSignerWalletReadinessV2Schema, result);
 		case "v2.wallet.create":
 		case "v2.wallet.import":
 		case "v2.wallet.importLegacy": return Value.Check(LocalSocketSignerWalletPolicyResultV2Schema, result);
@@ -16988,6 +17108,8 @@ const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
 	"atomicIdempotency",
 	"ambiguousBroadcastReconciliation",
 	"signerOwnedKeys",
+	"signerOwnedRoleBaselines",
+	"liveWalletReadiness",
 	"signerOwnedRPC",
 	"applicationNetworkBootstrap",
 	"typedSolanaTransactions",
@@ -17208,7 +17330,9 @@ const SIGNER_SOCKET_TIMEOUT_MS = {
 	"v2.policy.get": 5e3,
 	"v2.policy.put": 5e3,
 	"v2.policy.tighten": 5e3,
+	"v2.policy.activateBaseline": 1e4,
 	"v2.wallet.get": 5e3,
+	"v2.wallet.readiness": 5e3,
 	"v2.wallet.create": 1e4,
 	"v2.wallet.import": 2e4,
 	"v2.wallet.importLegacy": 3e4,
@@ -18004,21 +18128,23 @@ function upsertNamedWallet(params) {
 		updatedAt: now
 	};
 	registry.wallets = [...registry.wallets.filter((entry) => entry.id !== next.id), next].toSorted((a, b) => a.createdAt.localeCompare(b.createdAt));
-	if (!registry.defaultWalletId || !registry.wallets.some((wallet) => wallet.id === registry.defaultWalletId)) registry.defaultWalletId = resolveWalletUserRole(next) === "agent" ? next.id : void 0;
 	writeWalletProviderRegistry(registry, env);
 	return next;
 }
 function resolveWalletSelectionForAgent(params) {
 	const registry = readWalletProviderRegistry(params.env ?? process.env);
 	const directAgent = params.agentId?.trim();
-	const walletId = (directAgent ? registry.assignments[directAgent] : void 0) ?? registry.defaultWalletId;
+	const directWalletId = directAgent ? registry.assignments[directAgent] : void 0;
+	const skillWalletId = params.skillWalletId?.trim();
+	const walletId = skillWalletId ?? directWalletId ?? registry.defaultWalletId;
 	if (!walletId) return {};
 	const wallet = registry.wallets.find((entry) => entry.id === walletId);
 	if (!wallet) return {};
 	return {
 		walletId: wallet.id,
 		walletName: wallet.name,
-		providerId: wallet.providerId
+		providerId: wallet.providerId,
+		source: skillWalletId ? "skill" : directWalletId ? "agent" : "default"
 	};
 }
 function resolveWalletSelection(params) {
@@ -18062,11 +18188,12 @@ function resolveWalletSelection(params) {
 	}
 	const fallback = resolveWalletSelectionForAgent({
 		agentId: params.agentId,
+		skillWalletId: params.skillWalletId,
 		env
 	});
 	if (fallback.walletId || fallback.providerId) return {
 		...fallback,
-		source: "fallback"
+		source: fallback.source ?? "fallback"
 	};
 	return { source: "none" };
 }
@@ -23892,6 +24019,36 @@ function findRequest(file, requestId) {
 	return file.requests.find((request) => request.id === requestId.trim());
 }
 
+//#endregion
+//#region src/wallet/local-socket-signer-lifecycle.ts
+async function requireSignerOwnedProtocolV2(socketPath, requiredFeatures = []) {
+	const result = await callLocalSocketSigner(socketPath, { op: "v2.capabilities" });
+	const capabilities = result.capabilities;
+	const missing = [
+		"failClosedPolicies",
+		"policyHashes",
+		"signerOwnedKeys",
+		"applicationNetworkBootstrap",
+		"atomicMultiAssetCaps",
+		"signerControlledNativeFeeCaps",
+		...requiredFeatures
+	].filter((feature) => !capabilities?.features.includes(feature));
+	if (result.ready !== true || capabilities?.protocol.current !== 2 || capabilities.protocol.min > 2 || capabilities.protocol.max < 2 || capabilities.nativeFeeReservationLamports !== LOCAL_SIGNER_NATIVE_FEE_RESERVATION_LAMPORTS_V2 || missing.length > 0) throw new Error(`fased-signerd does not provide the required signer-owned protocol-v2 capabilities${missing.length > 0 ? `: ${missing.join(", ")}` : ""}`);
+}
+async function readSignerOwnedWalletReadiness(params) {
+	await requireSignerOwnedProtocolV2(params.socketPath, ["liveWalletReadiness"]);
+	return await callLocalSocketSigner(params.socketPath, {
+		op: "v2.wallet.readiness",
+		walletId: params.walletId
+	});
+}
+
+//#endregion
+//#region src/wallet/native-signer-wallet-id.ts
+function normalizeNativeSignerWalletId(value) {
+	return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "") || "default";
+}
+
 //#endregion
 //#region src/wallet/wallet-approval-auth.ts
 function nowMs$1() {
@@ -24073,6 +24230,7 @@ async function readWalletStatusSnapshot(params) {
 	const statePaths = resolveWalletStatePaths(effectiveEnv);
 	const approvalAuth = readWalletApprovalAuthSnapshot(effectiveEnv, cfg);
 	const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const registeredWallets = params?.walletId ? providerRegistry.wallets.filter((wallet) => wallet.id === params.walletId) : providerRegistry.wallets;
 	let providerHealth = {
 		ok: false,
 		provider: providerId,
@@ -24120,6 +24278,55 @@ async function readWalletStatusSnapshot(params) {
 			summary: "Real-chain settlement depends on the configured wallet provider and RPC connectivity."
 		},
 		chains: resolved.chains,
+		wallets: await Promise.all(registeredWallets.map(async (wallet) => {
+			if (wallet.providerId !== "local-socket-signer") return {
+				id: wallet.id,
+				name: wallet.name,
+				providerId: wallet.providerId,
+				addresses: wallet.addresses,
+				readiness: {
+					keystore: Boolean(wallet.addresses?.solana),
+					rpc: serviceHealthy,
+					ready: serviceHealthy && Boolean(wallet.addresses?.solana)
+				}
+			};
+			const signerWalletId = (typeof wallet.metadata?.signerWalletId === "string" ? wallet.metadata.signerWalletId.trim() : "") || normalizeNativeSignerWalletId(wallet.id);
+			try {
+				const signer = await readSignerOwnedWalletReadiness({
+					socketPath: resolveLocalSignerSocketPath(effectiveEnv),
+					walletId: signerWalletId
+				});
+				const addressMatches = typeof wallet.addresses?.solana === "string" && wallet.addresses.solana === signer.publicKey;
+				const roleMatches = typeof wallet.metadata?.role === "string" && wallet.metadata.role === signer.role;
+				const ready = signer.ready && addressMatches && roleMatches;
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: signer.keyReady,
+						rpc: signer.networkReady,
+						ready,
+						...!ready && signer.ready ? { error: "registry address or immutable role does not match live signer state" } : {},
+						signer
+					}
+				};
+			} catch (error) {
+				return {
+					id: wallet.id,
+					name: wallet.name,
+					providerId: wallet.providerId,
+					addresses: wallet.addresses,
+					readiness: {
+						keystore: false,
+						rpc: false,
+						ready: false,
+						error: walletDiagnosticErrorMessage(error)
+					}
+				};
+			}
+		})),
 		service: {
 			host: resolved.service.host,
 			port: resolved.service.port,
@@ -28701,7 +28908,7 @@ function createOutboundSendDepsFromCliSource(deps) {
 function createDefaultDeps() {
 	return {
 		sendMessageWhatsApp: async (...args) => {
-			const { sendMessageWhatsApp } = await import("./web-BvjNyYBz.js");
+			const { sendMessageWhatsApp } = await import("./web-DGWi7i3B.js");
 			return await sendMessageWhatsApp(...args);
 		},
 		sendMessageTelegram: async (...args) => {
@@ -36709,7 +36916,7 @@ function isModuleNotFoundError(err) {
 }
 async function loadPwAiModule(mode) {
 	try {
-		return await import("./pw-ai-DJ_gTc4M.js");
+		return await import("./pw-ai-DZYLDC-S.js");
 	} catch (err) {
 		if (mode === "soft") return null;
 		if (isModuleNotFoundError(err)) return null;
@@ -37103,11 +37310,11 @@ function createProfileContext(opts, profile) {
 		const userDataDir = resolveFasedAgentUserDataDir(profile.name);
 		const profileState = getProfileState();
 		if (await isHttpReachable(300) && !profileState.running) try {
-			await (await import("./pw-ai-DJ_gTc4M.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-DZYLDC-S.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (profileState.running) await stopRunningBrowser();
 		try {
-			await (await import("./pw-ai-DJ_gTc4M.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-DZYLDC-S.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (!fs.existsSync(userDataDir)) return {
 			moved: false,
@@ -49255,21 +49462,17 @@ function resolveWalletActionSelection(params) {
 			providerId: params.providerId,
 			env
 		});
-		else if (registry.defaultWalletId) {
-			const fallback = registry.wallets.find((entry) => entry.id === registry.defaultWalletId);
-			selection = fallback ? {
-				walletId: fallback.id,
-				walletName: fallback.name,
-				providerId: fallback.providerId,
-				source: "fallback"
-			} : { source: "none" };
-		} else selection = { source: "none" };
+		else selection = resolveWalletSelection({
+			agentId: params.agentId,
+			skillWalletId: params.skillWalletId,
+			env
+		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "wallet selection failed";
 		if (message.includes("ambiguous")) throw new WalletActionSelectionError("wallet_ambiguous", message);
 		throw new WalletActionSelectionError("wallet_not_found", message);
 	}
-	if (!selection.walletId) throw new WalletActionSelectionError("wallet_handle_required", "Agent wallet handle, walletId, or default Agent wallet required");
+	if (!selection.walletId) throw new WalletActionSelectionError("wallet_handle_required", "Select an Agent wallet: use an explicit wallet, skill override, Agent assignment, or Default Agent wallet fallback");
 	const wallet = registry.wallets.find((entry) => entry.id === selection.walletId);
 	if (!wallet) throw new WalletActionSelectionError("wallet_not_found", `wallet not found: ${selection.walletId}`);
 	if (params.providerId && wallet.providerId !== params.providerId) throw new WalletActionSelectionError("wallet_not_found", `wallet ${wallet.name} (${wallet.id}) belongs to provider ${wallet.providerId}, not ${params.providerId}`);
@@ -58906,11 +59109,13 @@ function createWalletActionTool(opts) {
 			const scheduled = action === "schedule_plan";
 			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
 			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : void 0;
 			const selection = resolveAgentWalletSelection({
 				config: cfg,
 				walletHandle,
 				walletId,
 				agentId: requesterAgentId ?? ownerAgentId ?? void 0,
+				skillWalletId,
 				env: process.env
 			});
 			const rpcUrl = resolveScopedRpcUrlForWallet({
@@ -59985,7 +60190,7 @@ function createWalletTool(opts) {
 	return {
 		label: "Wallet",
 		name: "wallet",
-		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions require an Agent wallet via walletHandle, structured walletId, or default Agent wallet. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
+		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions use explicit wallet, skill override, Agent assignment, then the optional Default Agent wallet fallback. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
 		parameters: WalletToolSchema,
 		execute: async (_toolCallId, args) => {
 			if (!access.ok) {
@@ -60009,6 +60214,9 @@ function createWalletTool(opts) {
 			const explicitWalletId = readStringParam(params, "walletId");
 			const selectedWalletId = (explicitWalletHandle ? parseWalletHandle(explicitWalletHandle) : void 0) ?? explicitWalletId;
 			const explicitWalletName = readStringParam(params, "walletName");
+			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
+			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : void 0;
 			const walletSelection = riskyWalletAction ? resolveAgentWalletSelection({
 				config: cfg,
 				providerId: explicitProviderId,
@@ -60016,6 +60224,7 @@ function createWalletTool(opts) {
 				walletId: explicitWalletId,
 				walletName: explicitWalletName,
 				agentId: requesterAgentId ?? ownerAgentId ?? void 0,
+				skillWalletId,
 				env: process.env
 			}) : resolveWalletSelection({
 				providerId: explicitProviderId,
@@ -60232,10 +60441,9 @@ function createWalletTool(opts) {
 				walletName: walletSelection.walletName
 			};
 			if (chain === "solana" && payload.program) assertValidSolanaAddress(payload.program, "SPL mint address");
-			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
 			await enforceWalletSkillPolicy({
 				cfg,
-				permissions: readSkillWalletActionPermissions(cfg, requesterSkillId),
+				permissions,
 				requesterAgentId,
 				requesterSkillId,
 				action,
@@ -97359,7 +97567,7 @@ const signalMessageActions = {
 //#region src/channels/plugins/actions/telegram.ts
 const providerId = "telegram";
 async function loadTelegramActionHandler() {
-	const { handleTelegramAction } = await import("./telegram-actions-1X9A32Dn.js");
+	const { handleTelegramAction } = await import("./telegram-actions-Cewdga8H.js");
 	return handleTelegramAction;
 }
 function readTelegramSendParams(params) {
@@ -99769,7 +99977,7 @@ function buildPairingReply(params) {
 
 //#endregion
 //#region src/brand.ts
-const FASED_PRODUCT_VERSION = "0.1.68";
+const FASED_PRODUCT_VERSION = "0.1.69";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 
 //#endregion
@@ -103680,7 +103888,7 @@ const sendPollDiscordLazy = async (...args) => {
 	return sendPollDiscord(...args);
 };
 const monitorDiscordProviderLazy = async (...args) => {
-	const { monitorDiscordProvider } = await import("./monitor-DXIM16Hj.js");
+	const { monitorDiscordProvider } = await import("./monitor-xzVAPbg2.js");
 	return monitorDiscordProvider(...args);
 };
 const listSlackDirectoryGroupsLiveLazy = async (...args) => {
@@ -103708,7 +103916,7 @@ const sendMessageSlackLazy = async (...args) => {
 	return sendMessageSlack(...args);
 };
 const monitorSlackProviderLazy = async (...args) => {
-	const { monitorSlackProvider } = await import("./slack-B-nOOLM0.js");
+	const { monitorSlackProvider } = await import("./slack-CkIRVDUK.js");
 	return monitorSlackProvider(...args);
 };
 const handleSlackActionLazy = async (...args) => {
@@ -103728,7 +103936,7 @@ const sendPollTelegramLazy = async (...args) => {
 	return sendPollTelegram(...args);
 };
 const monitorTelegramProviderLazy = async (...args) => {
-	const { monitorTelegramProvider } = await import("./monitor-DUMMbG4h.js");
+	const { monitorTelegramProvider } = await import("./monitor-WXdn4mR-.js");
 	return monitorTelegramProvider(...args);
 };
 let webOutboundPromise = null;
@@ -103749,7 +103957,7 @@ function loadWebLoginQr() {
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-BvjNyYBz.js");
+	webChannelPromise ??= import("./web-DGWi7i3B.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {
@@ -114327,7 +114535,7 @@ function createOpenAIReasoningEffortWrapper(baseStreamFn, reasoningEffort) {
 function createCodexDefaultTransportWrapper(baseStreamFn) {
 	const underlying = baseStreamFn ?? streamSimple;
 	return (model, context, options) => {
-		if (typeof process !== "undefined" && process.versions?.node) globalThis.WebSocket = WebSocket$1;
+		if (typeof process !== "undefined" && process.versions?.node) globalThis.WebSocket = WebSocket;
 		return underlying(model, context, {
 			...options,
 			transport: options?.transport ?? "auto"

package/dist/plugin-sdk/device-pair.d.ts

@@ -1,3 +1,3 @@
-import { _ as FasedAgentPluginApi } from "./types-DtCOO_hW.js";
+import { _ as FasedAgentPluginApi } from "./types-BakzIzGN.js";
 import { a as listDevicePairing, i as approveDevicePairing, n as resolveTailnetHostWithRunner, r as resolveGatewayBindUrl, t as runPluginCommandWithTimeout } from "./run-command-i_W6EFb1.js";
 export { type FasedAgentPluginApi, approveDevicePairing, listDevicePairing, resolveGatewayBindUrl, resolveTailnetHostWithRunner, runPluginCommandWithTimeout };