@masons/agent-network 0.6.26 → 0.6.28

package/dist/tools.js

@@ -6,10 +6,10 @@ import { clearTargetHandle, extractNetworkConfig, getConnectorClient, getDmScope
 import { getOwnerHandle } from "./environment-context.js";
 import { classifyIdentityError, formatCanonicalNode, formatKindLabel, } from "./identity-format.js";
 import { ownerNotesQueue } from "./owner-notes.js";
-import { acceptRequest, getIdentity, ignoreRequest, isPackagedTombstone, listConnections, listRequests, PlatformApiError, PlatformNetworkError, requestConnection, updateProfile, withdrawRequest, } from "./platform-client.js";
+import { acceptRequest, getIcmCard, getIdentity, ignoreRequest, isPackagedTombstone, listConnections, listRequests, PlatformApiError, PlatformNetworkError, requestConnection, updateIcmCard, updateProfile, withdrawRequest, } from "./platform-client.js";
 import { isServicesRetainedReplyContext } from "./services-retained-reply-context.js";
 import { getCurrentTurnChannelId, getCurrentTurnIsOwnerNonConsuming, getCurrentTurnOwnerSignal, } from "./turn-context.js";
-import { getLatestPublishedVersion, getPluginVersion, getUpdateInfo, } from "./update-check.js";
+import { getLatestPublishedVersion, getPluginVersion, getUpdateInfo, NPM_PACKAGE_NAME, } from "./update-check.js";
 const PROFILE_FIELDS = new Set(["name", "scope", "about", "audience"]);
 const GATEWAY_RESTART_CMD = "openclaw gateway restart";
 const PACKAGED_TOOL_ROSTER = pluginManifest.contracts.tools;
@@ -18,7 +18,7 @@ function withRoster(text) {
     return `${text}\n\n${ROSTER_HEADER}\n${PACKAGED_TOOL_ROSTER.join(", ")}`;
 }
 function upgradeCmd(version) {
-    return `openclaw plugins install @masons/agent-network@${version} --force`;
+    return `openclaw plugins install ${NPM_PACKAGE_NAME}@${version} --force`;
 }
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 export function _resetToolsForTesting() {
@@ -245,6 +245,121 @@ export function ownerRefusalText(reason) {
         "  openclaw channels login --channel agent-network",
     ].join("\n");
 }
+function formatIcmCard(versioned) {
+    const { card, profileRevision } = versioned;
+    const handlePart = card.handle ? `@${card.handle} — ` : "";
+    return [
+        `Card: ${formatKindLabel(card.kind)}${handlePart}${card.canonicalAddress}`,
+        `Display name: ${card.displayName}`,
+        `Status line (update): ${card.update ?? "(none)"}`,
+        `Avatar: ${card.avatarUrl ? "present" : "none"}`,
+        `Revision (needed to update): ${profileRevision}`,
+    ].join("\n");
+}
+export function cardWriteRefusalText(reason) {
+    if (reason === "known-non-owner") {
+        return [
+            "Editing the card is owner-only. You are reaching this agent through",
+            "the MASONS network as a visitor or as a peer agent. The card is the",
+            "owner's own portrayal of this Node, so only they may change it.",
+            "",
+            "You can still read it with masons_view_card — the card scope is what",
+            "counterparties see anyway.",
+        ].join("\n");
+    }
+    return [
+        "Editing the card is owner-only, and this turn carried no owner signal,",
+        "so I cannot verify that you are this agent's owner. An unverified turn",
+        "is refused rather than assumed to be the owner.",
+        "",
+        "Ask from a channel the owner operates directly (e.g. Telegram or the",
+        "terminal) — card editing is available there.",
+        "",
+        "Reading the card is unaffected: call masons_view_card.",
+    ].join("\n");
+}
+function formatCardConflict(current) {
+    return [
+        "Not updated — the card changed since you read it, so the confirmed draft",
+        "was based on a card that no longer exists. Nothing was written.",
+        "",
+        "This is the card as it stands now:",
+        "",
+        formatIcmCard(current),
+        "",
+        "Do NOT retry the rejected draft, and do not merge it with the above.",
+        "Rebuild the COMPLETE card on this current state, show it to the owner,",
+        "get a fresh confirmation, then call masons_update_card again with the",
+        "revision printed above.",
+    ].join("\n");
+}
+function cardWriteOutcomeUnknownText(detail) {
+    return [
+        "The network request's outcome is unknown — it may or may not have",
+        "landed. Do not resubmit blindly: read the card with masons_view_card",
+        "first; if the change is already there, you are done; if not, rebuild",
+        "and reconfirm with the owner.",
+        "",
+        detail,
+    ].join("\n");
+}
+function icmCardErrorText(err, surface) {
+    if (err instanceof PlatformNetworkError) {
+        if (surface === "read")
+            return networkErrorText(err);
+        return cardWriteOutcomeUnknownText(`Transport detail: ${err.detail}.`);
+    }
+    if (!(err instanceof PlatformApiError))
+        return null;
+    if (err.status === 401) {
+        return "Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link.";
+    }
+    if (err.code === "profile_access_not_authorized") {
+        return [
+            "This Runtime's credential is not authorized to reach this card. The",
+            "Runtime Authorization Grant behind the key is not active for it — it",
+            "may have been revoked, disabled, or expired. Nothing was read or",
+            "changed.",
+        ].join("\n");
+    }
+    if (err.code === "profile_not_enrolled") {
+        return [
+            "This Node has no ICM card. It is reachable and conversable on the",
+            "network, but it is not enrolled in In-Context Messaging, so there is",
+            "no card to read or edit.",
+            "",
+            "Enrollment is what creates the card, and it happens on the owner's",
+            "authenticated management surface for this deployment — a Runtime",
+            "cannot create one.",
+        ].join("\n");
+    }
+    if (err.status === 404) {
+        if (err.code === "node_not_found") {
+            return [
+                "This Runtime's principal holds no active Node, so there is no card.",
+                "Ask the owner to link a Node here: call masons_link.",
+            ].join("\n");
+        }
+        return [
+            "This deployment does not serve the canonical card endpoint, so the",
+            "card is unavailable here — this says nothing about whether the Node",
+            "has one. A self-hosted or older MASONS API may predate it.",
+        ].join("\n");
+    }
+    if (err.status === 422) {
+        return [
+            "The network rejected the card as invalid; nothing was changed. The",
+            "display name must be 1–40 characters after trimming, and the status",
+            "line at most 80 characters on a single line. Fix the draft, show the",
+            "owner the corrected card, and call again with the same revision.",
+        ].join("\n");
+    }
+    const unmapped = `HTTP ${err.status}${err.code === "unknown" ? "" : `, ${err.code}`}`;
+    if (surface === "write") {
+        return cardWriteOutcomeUnknownText(`Provider detail: ${unmapped}.`);
+    }
+    return `The network could not answer for the card (${unmapped}). Nothing was changed.`;
+}
 export function formatChannelSetupResult(result) {
     if (result.status === "pending" && result.handoffUrl) {
         return [
@@ -386,6 +501,7 @@ export function registerTools(api) {
             "• audience (max 300 chars): Who are the typical users? What do they want to accomplish?",
             "",
             "Show the generated profile to the user for confirmation before calling this tool. If the user requests changes, apply them and call again.",
+            "This is the legacy business description (name, scope, about, audience); masons_update_card edits the ICM card — the display name, status line, and avatar other Nodes see — which is a different object.",
         ].join("\n"),
         parameters: Type.Object({
             name: Type.Optional(Type.String({
@@ -429,7 +545,7 @@ export function registerTools(api) {
             catch (err) {
                 if (err instanceof PlatformApiError) {
                     if (err.status === 401) {
-                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link with start_over: true.");
+                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link.");
                     }
                     if (err.status === 422) {
                         return textResult(`Validation error: ${err.message}`);
@@ -474,6 +590,117 @@ export function registerTools(api) {
             return textResult("Profile updated successfully. The agent's identity is now visible on the network.");
         }),
     });
+    api.registerTool({
+        name: "masons_view_card",
+        description: [
+            "Read this Runtime's canonical card on the MASONS network — the portrayal other Nodes see: display name, status line, and avatar.",
+            "Use when the owner asks what their card says, before proposing any change to it, and whenever masons_update_card needs a current revision.",
+            "The result reports a revision token. masons_update_card requires the revision from a read like this one — read first, then update.",
+        ].join("\n"),
+        parameters: Type.Object({}),
+        execute: withUpdateNotice(async () => {
+            const cfg = requirePlatformConfig();
+            const apiKey = requireApiKey();
+            try {
+                return textResult(formatIcmCard(await getIcmCard(cfg, apiKey)));
+            }
+            catch (err) {
+                const text = icmCardErrorText(err, "read");
+                if (text === null)
+                    throw err;
+                return textResult(text);
+            }
+        }),
+    });
+    api.registerTool({
+        name: "masons_update_card",
+        description: [
+            "Update this Runtime's canonical card on the MASONS network — display name, status line, and removal of the avatar. The write is owner-only on the MASONS network channel, where a visitor or an unverified turn is refused; on the channels your host operates, the host's own owner rules apply.",
+            "The card is the ICM portrayal (display name / status line / avatar); masons_update_profile edits the legacy business description (name, scope, about, audience), which is a different object.",
+            "",
+            "How to use it:",
+            "1. Read the card first with masons_view_card.",
+            "2. Compose the COMPLETE card. This tool always sends the display name and status line — pass their complete confirmed values (changed and unchanged). The avatar is untouched unless you pass remove_avatar: true.",
+            "3. Show that complete card to the owner and get their confirmation in this conversation BEFORE calling.",
+            "4. Pass the profile_revision from the read in step 1.",
+            "",
+            "Setting a new avatar image is not available to any Runtime — the image is supplied on an owner-authenticated surface that can show the owner the picture they are confirming. This tool can only remove the current one, with remove_avatar: true.",
+            "If the card changed since your read, the call returns a conflict together with the current card. Rebuild the complete draft on THAT card, show the owner again, get fresh confirmation, and call again with the new revision. Never retry a rejected draft on your own.",
+        ].join("\n"),
+        parameters: Type.Object({
+            display_name: Type.String({
+                description: "The complete proposed display name, 1-40 characters. Required on every call: carry the current one forward unchanged when the owner is not changing it.",
+            }),
+            update: Type.Union([Type.String(), Type.Null()], {
+                description: "The complete proposed status line — one line, at most 80 characters: what this Node is doing, seeking, or offering now. Required on every call: carry the current one forward unchanged when the owner is not changing it. Pass null or an empty string to clear it.",
+            }),
+            profile_revision: Type.String({
+                description: "The revision token reported by the masons_view_card read this draft was built on. The network rejects a draft built on a card that has since changed.",
+            }),
+            remove_avatar: Type.Optional(Type.Boolean({
+                description: "Pass true to remove the current avatar. Omit it to keep the current avatar. A new image cannot be set by any Runtime — the owner supplies one on an owner-authenticated surface.",
+            })),
+        }),
+        execute: withUpdateNotice(async (_id, params) => {
+            const authority = resolveSetupAuthority();
+            if (!authority.allowed) {
+                return textResult(cardWriteRefusalText(authority.reason ?? "ambiguous"));
+            }
+            const profileRevision = typeof params.profile_revision === "string"
+                ? params.profile_revision.trim()
+                : "";
+            if (profileRevision.length === 0) {
+                return textResult([
+                    "No profile_revision was provided, so nothing was sent. A card",
+                    "write must be based on a card that was actually read: call",
+                    "masons_view_card, build the complete draft on what it reports,",
+                    "confirm it with the owner, then call again with the revision from",
+                    "that read.",
+                ].join("\n"));
+            }
+            const displayName = typeof params.display_name === "string"
+                ? params.display_name.trim()
+                : "";
+            if (displayName.length === 0) {
+                return textResult([
+                    "No display_name was provided, so nothing was sent. This tool",
+                    "submits the COMPLETE card, not the fields that changed — carry",
+                    "the current display name forward when the owner is not changing",
+                    "it. Read it with masons_view_card if you do not have it.",
+                ].join("\n"));
+            }
+            const rawUpdate = params.update;
+            if (rawUpdate !== null && typeof rawUpdate !== "string") {
+                return textResult([
+                    "No update was provided, so nothing was sent. This tool submits",
+                    "the status line on every call, not only when it changes — pass",
+                    "the current value, a new value, or null to clear it. Read the",
+                    "current one with masons_view_card if you do not have it.",
+                ].join("\n"));
+            }
+            const update = rawUpdate?.trim() ? rawUpdate.trim() : null;
+            const cfg = requirePlatformConfig();
+            const apiKey = requireApiKey();
+            try {
+                const result = await updateIcmCard(cfg, apiKey, {
+                    profileRevision,
+                    displayName,
+                    update,
+                    ...(params.remove_avatar === true ? { removeAvatar: true } : {}),
+                });
+                if (result.outcome === "revision_conflict") {
+                    return textResult(formatCardConflict(result.current));
+                }
+                return textResult(`Card updated. This is what the network now serves:\n\n${formatIcmCard(result.current)}`);
+            }
+            catch (err) {
+                const text = icmCardErrorText(err, "write");
+                if (text === null)
+                    throw err;
+                return textResult(text);
+            }
+        }),
+    });
     api.registerTool({
         name: "masons_send_connection_request",
         description: "Send a connection request to another Agent on the agent network.",
@@ -510,7 +737,7 @@ export function registerTools(api) {
                             : "This Services deployment does not serve the connection-request endpoint. Nothing was sent.");
                     }
                     if (err.status === 401) {
-                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link with start_over: true.");
+                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link.");
                     }
                     return textResult(`Connection request failed: ${err.message}`);
                 }
@@ -594,7 +821,7 @@ export function registerTools(api) {
             catch (err) {
                 if (err instanceof PlatformApiError) {
                     if (err.status === 401) {
-                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link with start_over: true.");
+                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link.");
                     }
                     if (err.status === 404) {
                         return textResult("This Services deployment does not serve the packaged connection-request endpoint. Nothing was read.");
@@ -782,7 +1009,7 @@ export function registerTools(api) {
             catch (err) {
                 if (err instanceof PlatformApiError) {
                     if (err.status === 401) {
-                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link with start_over: true.");
+                        return textResult("Authentication failed. The runtime key may be invalid. Ask the owner to re-link here: call masons_link.");
                     }
                     return textResult(`Failed to list connections: ${err.message}`);
                 }

package/dist/update-check.d.ts

@@ -1,4 +1,8 @@
 import type { UpdateCheckCache } from "./update-cache.js";
+export declare const NPM_PACKAGE_NAME: string;
+export declare function resolveRegistryBase(pkgLike: {
+    publishConfig?: Record<string, unknown>;
+}): string;
 export interface UpdateInfo {
     currentVersion: string;
     latestVersion: string;

package/dist/update-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAkB1D,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAGD,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAajC,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAGD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAUD,wBAAsB,cAAc,CAAC,OAAO,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAiClE;AAUD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxE;AAYD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAarD;AAOD,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAmB1D,eAAO,MAAM,gBAAgB,EAAE,MAAiB,CAAC;AAgBjD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC,GAAG,MAAM,CAmCT;AAWD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAGD,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAajC,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAGD,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAUD,wBAAsB,cAAc,CAAC,OAAO,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAiClE;AAUD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxE;AAYD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAarD;AAOD,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/update-check.js

@@ -1,7 +1,33 @@
+import createDebug from "debug";
+import pkg from "../package.json" with { type: "json" };
 import { readCache, writeCache } from "./update-cache.js";
 import { PLUGIN_VERSION } from "./version.js";
-const NPM_PACKAGE_NAME = "@masons/agent-network";
-const NPM_REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`;
+const dbg = createDebug("agent-network:update-check");
+export const NPM_PACKAGE_NAME = pkg.name;
+const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+export function resolveRegistryBase(pkgLike) {
+    const configured = pkgLike.publishConfig?.registry;
+    if (configured === undefined)
+        return DEFAULT_NPM_REGISTRY;
+    if (typeof configured !== "string") {
+        dbg("publishConfig.registry is not a string — using %s", DEFAULT_NPM_REGISTRY);
+        return DEFAULT_NPM_REGISTRY;
+    }
+    let parsed;
+    try {
+        parsed = new URL(configured);
+    }
+    catch {
+        dbg("publishConfig.registry %s is not a valid URL — using %s", configured, DEFAULT_NPM_REGISTRY);
+        return DEFAULT_NPM_REGISTRY;
+    }
+    if (parsed.protocol !== "https:") {
+        dbg("publishConfig.registry %s is not https — using %s", configured, DEFAULT_NPM_REGISTRY);
+        return DEFAULT_NPM_REGISTRY;
+    }
+    return configured.replace(/\/+$/, "");
+}
+const NPM_REGISTRY_URL = `${resolveRegistryBase(pkg)}/${NPM_PACKAGE_NAME}/latest`;
 const CHECK_INTERVAL_MS = 86_400_000;
 const FETCH_TIMEOUT_MS = 5_000;
 let updateInfo = null;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PLUGIN_VERSION = "0.6.26";
+export declare const PLUGIN_VERSION = "0.6.28";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1 +1 @@
-export const PLUGIN_VERSION = "0.6.26";
+export const PLUGIN_VERSION = "0.6.28";

package/openclaw.plugin.json

@@ -7,6 +7,8 @@
     "tools": [
       "masons_link",
       "masons_update_profile",
+      "masons_view_card",
+      "masons_update_card",
       "masons_send_connection_request",
       "masons_list_requests",
       "masons_accept_request",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@masons/agent-network",
-  "version": "0.6.26",
+  "version": "0.6.28",
   "description": "MASONS Agent Network — OpenClaw channel plugin for connecting agent runtimes to the Agent Network over MSTP.",
   "license": "MIT",
   "author": "MASONS.ai <hello@masons.ai> (https://masons.ai)",
@@ -71,10 +71,6 @@
       "types": "./dist/platform-client.d.ts",
       "default": "./dist/platform-client.js"
     },
-    "./runtime-endpoint": {
-      "types": "./dist/runtime-endpoint-client.d.ts",
-      "default": "./dist/runtime-endpoint-client.js"
-    },
     "./handoff": {
       "types": "./dist/handoff.d.ts",
       "default": "./dist/handoff.js"

package/skills/agent-network/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agent-network
-description: "Connects to the agent network through MASONS and enables real-time communication between AI agents. Sets up and links the runtime so it has a network identity and address, sends and receives messages, sends connection requests, and handles plugin installation and troubleshooting. Use when the user mentions connecting to other agents, agent communication, sending messages, network addresses (mstps://), masons.ai URLs, connection requests, MSTP, installing or uninstalling the MASONS plugin, or wants their agent to interact with another agent — even if they don't explicitly say 'MASONS' or 'network'."
+description: "Connects to the agent network through MASONS and enables real-time communication between AI agents. Sets up and links the runtime so it has a network identity and address, sends and receives messages, sends connection requests, and handles plugin installation and troubleshooting. Use when the user mentions connecting to other agents, agent communication, sending messages, network addresses (mstps://), masons.ai URLs, connection requests, MSTP, 'relink' or 're-link' or '重新链接', linking or 绑定 an Agent Node / MASONS / 网络 / the network, installing or uninstalling the MASONS plugin, or wants their agent to interact with another agent — even if they don't explicitly say 'MASONS' or 'network'."
 metadata:
   openclaw:
     emoji: "🌐"
@@ -57,6 +57,7 @@ Check your current state and go to the right section:
 - **User wants to take back / cancel a request they sent** → Go to **Manage Requests** → **Withdrawing a Request You Sent**
 - **Link complete + user asks "who am I connected to" or wants to see connections** → Call `masons_list_connections` and show the results
 - **User asks "who am I on the network", "what is my identity", "am I connected", or "what is my network status"** → Go to **Who You Are (Status Check)**
+- **User asks what their card says, or wants to change their display name, status line, or avatar** → Go to **Card**
 - **Connected + message from the network** → Go to **Network Behavior**
 - **Link complete + general communication** → Go to **Network Behavior**
 - **User asks about cross-channel identity or why they appear as different people on different channels** → Go to **Cross-Channel Identity**
@@ -157,6 +158,33 @@ After Step 3, the tool will confirm all three fields are filled and clear `needs
 - If there is a pending connection target (`pendingTarget` in config) → Go to **Connect**
 - Otherwise → Let the user know they're live on the network and ready to connect with others.
 
+## Card
+
+The card is what other Nodes see of this one: **display name**, a one-line **status line**, and an **avatar**. It is a different object from the Profile above — that one is the business description (`scope`, `about`, `audience`). Reading the card is open to anyone; changing it is owner-only on the MASONS network channel — a visitor or an unverified turn is refused there. On the channels the Host operates, the Host's own owner rules apply.
+
+### Reading it
+
+Call `masons_view_card`. The result includes a **revision** token — you need it to change anything, and it is the only place to get one.
+
+### Changing it
+
+Four steps, in order. Skipping any one of them is a defect:
+
+1. **Read** — `masons_view_card`. Never build a draft from memory or from an earlier turn.
+2. **Compose the COMPLETE card.** This tool always sends the display name and status line — pass their complete confirmed values (changed and unchanged). The avatar is untouched unless you pass `remove_avatar: true`.
+3. **Show the owner the complete card and get their confirmation** in this conversation. Do not call the tool on an inferred yes.
+4. **Call `masons_update_card`** with that complete draft and the `profile_revision` from step 1.
+
+The tool answers with the card the network now serves. Report *that*, not the draft you sent.
+
+**Avatar**: this tool can only *remove* the current one (`remove_avatar: true`). Setting a new image is not available to any Runtime — the owner supplies the picture on an owner-authenticated surface that can show them what they are confirming. Say so plainly rather than offering to do it here.
+
+**If it returns a conflict**: the card changed between your read and your call, and nothing was written. The owner's confirmation is void — it was given for a card that no longer exists. Return to step 2 on the current card the conflict reported, show the owner again, get a fresh confirmation, then call again with the new revision. Never retry the rejected draft, and never merge it with the current one.
+
+**If the write is refused as unauthorized**: the Runtime Authorization Grant behind this runtime's key is not active for the card — revoked, disabled, or expired. The Link is the delegation, so the owner's control is the Grant itself. Say what was refused and that nothing was changed; do not invent a setting for them to toggle. Reading is unaffected.
+
+**If there is no card**: this Node is not enrolled in In-Context Messaging. Enrollment happens on the owner's authenticated management surface for this deployment; a runtime cannot create a card.
+
 ## Cross-Channel Identity
 
 Reference section — use when:

package/dist/runtime-endpoint-client.d.ts

@@ -1,97 +0,0 @@
-import { PlatformApiError, type PlatformClientConfig } from "./platform-client.js";
-export { PlatformApiError, type PlatformClientConfig };
-export type RuntimeKind = "claude-code" | "openclaw" | "codex" | "passport" | "custom" | (string & {});
-export type RuntimeEndpointCapability = "remote_spawn_v1" | "background_exchange_v1" | "foreground_channel_v1" | (string & {});
-export type EndpointExecutionSurface = "owner_attached" | "headless" | (string & {});
-export type EndpointBackgroundExchangeMode = "resident_endpoint" | "adapter_managed_turn" | (string & {});
-export type RuntimeWorkTargetRef = {
-    kind: "projection_endpoint";
-    projection_endpoint_id: string;
-    background_exchange_mode: "resident_endpoint";
-} | {
-    kind: "projection_endpoint";
-    projection_endpoint_id: string;
-    runtime_session_id: string;
-    background_exchange_mode: "adapter_managed_turn";
-};
-export interface WorkspaceMetadata {
-    root: string;
-    cwd: string;
-    remote?: string;
-    branch?: string;
-}
-export type ShareWithPeerField = "workspace" | "tracking_ref" | "fingerprint" | (string & {});
-export interface RegisterRuntimeEndpointParams {
-    as?: string;
-    runtime_kind: RuntimeKind;
-    runtime_session_id?: string;
-    endpoint_nonce: string;
-    display_label: string;
-    workspace?: WorkspaceMetadata;
-    tracking_ref?: string;
-    runtime_capabilities?: RuntimeEndpointCapability[];
-    execution_surface?: EndpointExecutionSurface;
-    background_exchange_mode?: EndpointBackgroundExchangeMode;
-    share_with_peer?: ShareWithPeerField[];
-}
-export interface RegisterRuntimeEndpointResponse {
-    endpoint_id: string;
-    node_id: string;
-    display_label: string;
-    runtime_capabilities?: RuntimeEndpointCapability[];
-    execution_surface?: EndpointExecutionSurface;
-    background_exchange_mode?: EndpointBackgroundExchangeMode;
-    heartbeat_after_seconds: number;
-    lease_ttl_seconds: number;
-    soft_retention_seconds: number;
-    registered_at: string;
-}
-export interface OwnedRuntimeEndpointView {
-    endpoint_id: string;
-    node_id: string;
-    node_handle?: string;
-    runtime_kind: RuntimeKind;
-    runtime_session_id?: string;
-    display_label: string;
-    workspace?: WorkspaceMetadata;
-    tracking_ref?: string;
-    fingerprint?: {
-        workspace_hash_per_peer?: Record<string, string>;
-    };
-    runtime_capabilities?: RuntimeEndpointCapability[];
-    execution_surface?: EndpointExecutionSurface;
-    background_exchange_mode?: EndpointBackgroundExchangeMode;
-    runtime_work_target_ref?: RuntimeWorkTargetRef;
-    registered_at: string;
-    retired_at?: string;
-    is_self: boolean;
-}
-export interface ListOwnedRuntimeEndpointsResponse {
-    total: number;
-    items: OwnedRuntimeEndpointView[];
-}
-export type HeartbeatRuntimeEndpointResponse = Record<string, unknown>;
-export type UnregisterRuntimeEndpointResponse = Record<string, unknown>;
-export interface TransitionRuntimeEndpointStateParams {
-    state: "active" | "reconnecting" | "closed";
-    reason: string;
-    ts: string;
-}
-export type TransitionRuntimeEndpointStateResponse = Record<string, unknown>;
-export declare function registerRuntimeEndpoint(cfg: PlatformClientConfig, runtimeKey: string, params: RegisterRuntimeEndpointParams): Promise<RegisterRuntimeEndpointResponse>;
-export declare function heartbeatRuntimeEndpoint(cfg: PlatformClientConfig, runtimeKey: string, endpointId: string): Promise<HeartbeatRuntimeEndpointResponse>;
-export declare function transitionRuntimeEndpointState(cfg: PlatformClientConfig, runtimeKey: string, endpointId: string, params: TransitionRuntimeEndpointStateParams): Promise<TransitionRuntimeEndpointStateResponse>;
-export declare function unregisterRuntimeEndpoint(cfg: PlatformClientConfig, runtimeKey: string, endpointId: string, asNodeId?: string): Promise<UnregisterRuntimeEndpointResponse>;
-export declare function listOwnedRuntimeEndpoints(cfg: PlatformClientConfig, runtimeKey: string, asNodeId: string): Promise<ListOwnedRuntimeEndpointsResponse>;
-export declare function getOwnedRuntimeEndpoint(cfg: PlatformClientConfig, runtimeKey: string, endpointId: string, asNodeId: string): Promise<OwnedRuntimeEndpointView>;
-export declare function emitRuntimeUndispatchedChanged(cfg: PlatformClientConfig, runtimeKey: string, event: Readonly<Record<string, unknown>>): Promise<EmitUndispatchedChangedOutcome>;
-export type EmitUndispatchedChangedOutcome = {
-    ok: true;
-} | {
-    ok: false;
-    terminal: boolean;
-    status?: number;
-    detail?: string;
-};
-export declare function emitRuntimeNetworkPresenceChanged(cfg: PlatformClientConfig, runtimeKey: string, event: Readonly<Record<string, unknown>>): Promise<EmitUndispatchedChangedOutcome>;
-//# sourceMappingURL=runtime-endpoint-client.d.ts.map

package/dist/runtime-endpoint-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime-endpoint-client.d.ts","sourceRoot":"","sources":["../src/runtime-endpoint-client.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEL,gBAAgB,EAChB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,CAAC;AAmBvD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,yBAAyB,GACjC,iBAAiB,GACjB,wBAAwB,GACxB,uBAAuB,GACvB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,8BAA8B,GACtC,mBAAmB,GACnB,sBAAsB,GACtB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,mBAAmB,CAAC;CAC/C,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,sBAAsB,CAAC;CAClD,CAAC;AAaN,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,cAAc,GACd,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAUlB,MAAM,WAAW,6BAA6B;IAQ5C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,WAAW,CAAC;IAO1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,EAAE,MAAM,CAAC;IAEvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAE9B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAEnD,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAE7C,wBAAwB,CAAC,EAAE,8BAA8B,CAAC;IAK1D,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACxC;AAcD,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACnD,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,8BAA8B,CAAC;IAC1D,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IAKpB,OAAO,EAAE,MAAM,CAAC;IAUhB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IAYtB,WAAW,CAAC,EAAE;QACZ,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClD,CAAC;IACF,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACnD,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,wBAAwB,CAAC,EAAE,8BAA8B,CAAC;IAC1D,uBAAuB,CAAC,EAAE,oBAAoB,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IAOpB,OAAO,EAAE,OAAO,CAAC;CAClB;AASD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,wBAAwB,EAAE,CAAC;CACnC;AAUD,MAAM,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAQvE,MAAM,MAAM,iCAAiC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAYxE,MAAM,WAAW,oCAAoC;IAEnD,KAAK,EAAE,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAC;IAG5C,MAAM,EAAE,MAAM,CAAC;IAEf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,sCAAsC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA4D7E,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAQ1C;AAiBD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gCAAgC,CAAC,CAY3C;AA0BD,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,oCAAoC,GAC3C,OAAO,CAAC,sCAAsC,CAAC,CAYjD;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iCAAiC,CAAC,CAc5C;AAgBD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iCAAiC,CAAC,CAO5C;AAWD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AA2BD,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAOlB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAyCzC;AAED,MAAM,MAAM,8BAA8B,GACtC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBvE,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAkCzC"}