@okxweb3/a2a-node 0.2.17 → 0.2.18-beta-4dd056b897-261015113839

package/dist/cli.js

@@ -3788,6 +3788,10 @@ function isDaemonCommand(value) {
   if (parsed.type === "xmtp-send") {
     return typeof parsed.jobId === "string" && typeof parsed.message === "string";
   }
+  if (parsed.type === "xmtp-subscription-push") {
+    const command = parsed;
+    return typeof command.myAgentId === "string" && typeof command.content === "string" && Array.isArray(command.conversationIds) && command.conversationIds.every((item) => typeof item === "string");
+  }
   if (parsed.type === "xmtp-get-pending-list") {
     return true;
   }
@@ -3843,6 +3847,7 @@ var init_command_store = __esm({
     import_node_fs8 = require("node:fs");
     import_node_path11 = require("node:path");
     init_paths();
+    init_session_store();
     ({ DatabaseSync: DatabaseSync2 } = loadSqlite2());
     XMTP_DEBUG_RESULT_TTL_MS = 5 * 6e4;
     CommandStore = class {
@@ -3872,6 +3877,17 @@ var init_command_store = __esm({
           createdAt: Date.now()
         };
       }
+      createXmtpSubscriptionPushCommand(params) {
+        return {
+          id: (0, import_node_crypto2.randomUUID)(),
+          type: "xmtp-subscription-push",
+          myAgentId: params.myAgentId,
+          content: params.content,
+          conversationIds: params.conversationIds,
+          deliveryId: params.deliveryId,
+          createdAt: Date.now()
+        };
+      }
       createXmtpGetPendingListCommand() {
         return {
           id: (0, import_node_crypto2.randomUUID)(),
@@ -3965,6 +3981,65 @@ var init_command_store = __esm({
         );
         return this.commandPath(command.id);
       }
+      /**
+       * Atomic idempotent submit keyed on a business `idempotencyKey` (DEXMARKET-9035,
+       * M2). The FIRST caller for a given key inserts its command and gets
+       * `created: true`; every later caller with the SAME key — including after a
+       * daemon / CommandStore rebuild — gets the ALREADY-persisted command back with
+       * `created: false` and NO new row. Concurrency-safe: correctness rests on the
+       * partial UNIQUE index on `idempotency_key`, not a check-then-insert (which
+       * races), so a `INSERT ... ON CONFLICT DO NOTHING` collapses concurrent
+       * duplicates to exactly one row. Recoverable SQLITE_BUSY/LOCKED errors reuse
+       * the repo's bounded exponential backoff. This never changes the plain
+       * `submit` path used by `xmtp-send` and every other daemon command.
+       */
+      async submitIdempotent(command, idempotencyKey) {
+        if (!idempotencyKey) {
+          throw new Error("submitIdempotent requires a non-empty idempotencyKey");
+        }
+        return this.withBusyRetry(
+          () => this.transaction(() => {
+            const now = Date.now();
+            const insert = this.db.prepare(`
+          INSERT INTO command_queue (
+            id, type, status, command_json, result_json,
+            created_at_ms, updated_at_ms, processing_started_at_ms, completed_at_ms,
+            idempotency_key
+          )
+          VALUES (?, ?, 'pending', ?, NULL, ?, ?, NULL, NULL, ?)
+          ON CONFLICT(idempotency_key) WHERE idempotency_key IS NOT NULL DO NOTHING
+        `).run(
+              command.id,
+              command.type,
+              stringifyForStorage(command),
+              normalizeCreatedAt(command.createdAt, now),
+              now,
+              idempotencyKey
+            );
+            if (Number(insert.changes ?? 0) > 0) {
+              return { path: this.commandPath(command.id), commandId: command.id, created: true };
+            }
+            const existing = this.db.prepare(`
+          SELECT id FROM command_queue WHERE idempotency_key = ?
+        `).get(idempotencyKey);
+            const existingId = existing?.id ?? command.id;
+            return { path: this.commandPath(existingId), commandId: existingId, created: false };
+          })
+        );
+      }
+      async withBusyRetry(operation) {
+        const attempts = 6;
+        for (let attempt = 1; ; attempt += 1) {
+          try {
+            return operation();
+          } catch (err2) {
+            if (!isSqliteBusyError(err2) || attempt >= attempts) {
+              throw err2;
+            }
+            await new Promise((resolve14) => setTimeout(resolve14, Math.min(50 * 2 ** (attempt - 1), 1e3)));
+          }
+        }
+      }
       async listPending() {
         return (await this.listPendingEntries()).map((entry) => entry.command);
       }
@@ -4030,10 +4105,25 @@ var init_command_store = __esm({
         this.db.exec(`
       CREATE INDEX IF NOT EXISTS idx_command_queue_status_created
       ON command_queue(status, created_at_ms, id)
+    `);
+        this.ensureColumn("command_queue", "idempotency_key", "TEXT");
+        this.db.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_command_queue_idempotency_key
+      ON command_queue(idempotency_key)
+      WHERE idempotency_key IS NOT NULL
     `);
         this.purgeExpiredXmtpDebugResults();
         this.importLegacyFileCommands();
       }
+      ensureColumn(table, column, definition) {
+        this.transaction(() => {
+          const rows = this.db.prepare(`PRAGMA table_info(${table})`).all();
+          if (rows.some((row) => row.name === column)) {
+            return;
+          }
+          this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+        });
+      }
       purgeExpiredXmtpDebugResults() {
         this.db.prepare(`
       DELETE FROM command_queue
@@ -4687,7 +4777,7 @@ var require_is = __commonJS({
     function isPrimitive(wat) {
       return wat === null || typeof wat !== "object" && typeof wat !== "function";
     }
-    function isPlainObject4(wat) {
+    function isPlainObject6(wat) {
       return isBuiltin(wat, "Object");
     }
     function isEvent(wat) {
@@ -4703,7 +4793,7 @@ var require_is = __commonJS({
       return Boolean(wat && wat.then && typeof wat.then === "function");
     }
     function isSyntheticEvent(wat) {
-      return isPlainObject4(wat) && "nativeEvent" in wat && "preventDefault" in wat && "stopPropagation" in wat;
+      return isPlainObject6(wat) && "nativeEvent" in wat && "preventDefault" in wat && "stopPropagation" in wat;
     }
     function isNaN2(wat) {
       return typeof wat === "number" && wat !== wat;
@@ -4726,7 +4816,7 @@ var require_is = __commonJS({
     exports2.isEvent = isEvent;
     exports2.isInstanceOf = isInstanceOf;
     exports2.isNaN = isNaN2;
-    exports2.isPlainObject = isPlainObject4;
+    exports2.isPlainObject = isPlainObject6;
     exports2.isPrimitive = isPrimitive;
     exports2.isRegExp = isRegExp;
     exports2.isString = isString;
@@ -19989,6 +20079,23 @@ var init_events = __esm({
       XMTP_RATE_LIMIT_CREATE_SUPPRESSED: "XMTP rate limit create suppressed",
       XMTP_RATE_LIMIT_PROBE: "XMTP rate limit probe",
       XMTP_RATE_LIMIT_RECOVERED: "XMTP rate limit recovered",
+      // ── subscription observability info (DEXMARKET-9096) ───────────
+      // All of the following logger.info checkpoints MUST also be listed in
+      // SENTRY_INFO_ALLOWLIST (index.ts): info() returns early for an unlisted
+      // event, which ships a checkpoint that looks implemented but emits nothing.
+      SUBSCRIPTION_PUSH_STARTED: "Subscription push started",
+      SUBSCRIPTION_PUSH_TARGETS_RESOLVED: "Subscription push targets resolved",
+      SUBSCRIPTION_PUSH_EMPTY_TARGETS: "Subscription push empty targets",
+      SUBSCRIPTION_PUSH_SUMMARY: "Subscription push summary",
+      SUBSCRIPTION_INBOUND_RECEIVED: "Subscription inbound received",
+      SUBSCRIPTION_INBOUND_GATE_DROPPED: "Subscription inbound gate dropped",
+      SUBSCRIPTION_JOBS_QUERY_STARTED: "Subscription jobs query started",
+      SUBSCRIPTION_JOBS_QUERY_SUCCEEDED: "Subscription jobs query succeeded",
+      SUBSCRIPTION_JOBS_EMPTY: "Subscription jobs empty",
+      SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED: "Subscription inbound ownership routed",
+      SUBSCRIPTION_JOB_DISPATCHED: "Subscription job dispatched",
+      SUBSCRIPTION_JOB_DUPLICATE_IGNORED: "Subscription job duplicate ignored",
+      SUBSCRIPTION_FANOUT_SUMMARY: "Subscription fan-out summary",
       // ── error ─────────────────────────────────────────────────────
       XMTP_CONNECTION_FAILED: "XMTP connection failed",
       CONVERSATIONS_STREAM_FAILED: "conversations.stream failed",
@@ -20055,6 +20162,13 @@ var init_events = __esm({
       AGENT_INSTALLATION_LIMIT_NEAR: "Agent installation limit near",
       XMTP_HISTORY_SYNC_REQUEST_FAILED: "XMTP history sync request failed",
       XMTP_DEBUG_SYNC_FAILED: "XMTP debug sync failed",
+      // ── subscription observability error (DEXMARKET-9096) ──────────
+      // error-level: always emitted (no allowlist gate). Error objects are
+      // classified by buildErrorDiagnostics — never attach raw Error.message.
+      SUBSCRIPTION_PUSH_TARGET_FAILED: "Subscription push target failed",
+      SUBSCRIPTION_INBOUND_AGENTIC_ID_MISSING: "Subscription inbound agenticId missing",
+      SUBSCRIPTION_JOBS_FAIL_CLOSED: "Subscription jobs fail closed",
+      SUBSCRIPTION_JOB_FAILED: "Subscription job failed",
       // Underlying XMTP SDK client close failed during recycle/removal/shutdown
       // (DEXMARKET-9116). Error-level → NOT added to SENTRY_INFO_ALLOWLIST.
       XMTP_CLIENT_CLOSE_FAILED: "XMTP client close failed"
@@ -20730,6 +20844,13 @@ var init_sentry_logger = __esm({
     ]);
     SENTRY_TAG_KEYS = /* @__PURE__ */ new Set([
       "agentId",
+      // Subscription correlation agent ids (DEXMARKET-9096). Bounded-cardinality,
+      // same class as agentId/senderAgentId/onchainosAgentId — promoted to indexed
+      // tags for Sentry filtering. NOT added to SENTRY_FINGERPRINT_KEYS, so the
+      // global issue fingerprint is unchanged. High-cardinality ids
+      // (conversationId/messageId/deliveryId) are deliberately NOT here.
+      "aspAgentId",
+      "userAgentId",
       "agentPlatform",
       "aiProvider",
       "cacheName",
@@ -20897,6 +21018,22 @@ var init_sentry_logger = __esm({
       LogEvent.SESSION_KEY_DERIVED,
       LogEvent.SESSIONS_QUERIED,
       LogEvent.SYNC_TICK_COMPLETED,
+      // Subscription observability info checkpoints (DEXMARKET-9096). Each is a
+      // logger.info event; omitting any makes info() drop it silently so the whole
+      // subscription trace would look implemented and emit nothing in production.
+      LogEvent.SUBSCRIPTION_PUSH_STARTED,
+      LogEvent.SUBSCRIPTION_PUSH_TARGETS_RESOLVED,
+      LogEvent.SUBSCRIPTION_PUSH_EMPTY_TARGETS,
+      LogEvent.SUBSCRIPTION_PUSH_SUMMARY,
+      LogEvent.SUBSCRIPTION_INBOUND_RECEIVED,
+      LogEvent.SUBSCRIPTION_INBOUND_GATE_DROPPED,
+      LogEvent.SUBSCRIPTION_JOBS_QUERY_STARTED,
+      LogEvent.SUBSCRIPTION_JOBS_QUERY_SUCCEEDED,
+      LogEvent.SUBSCRIPTION_JOBS_EMPTY,
+      LogEvent.SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED,
+      LogEvent.SUBSCRIPTION_JOB_DISPATCHED,
+      LogEvent.SUBSCRIPTION_JOB_DUPLICATE_IGNORED,
+      LogEvent.SUBSCRIPTION_FANOUT_SUMMARY,
       // XMTP creation rate-limit cooldown checkpoints (DEXMARKET-9116). info() drops
       // any event not listed here, so these must stay registered.
       LogEvent.XMTP_RATE_LIMIT_COOLDOWN_STARTED,
@@ -25263,7 +25400,7 @@ var require_websocket2 = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash6 } = require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash7 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -25923,7 +26060,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -26290,7 +26427,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash6 } = require("crypto");
+    var { createHash: createHash7 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -26591,7 +26728,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -27018,7 +27155,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     client: {
       id: "gateway-client",
       displayName: "okx-a2a-node",
-      version: "0.2.17",
+      version: "0.2.18-beta-4dd056b897-261015113839",
       platform: "node",
       mode: "backend",
       instanceId
@@ -27029,7 +27166,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     commands: [],
     permissions: {},
     locale: Intl.DateTimeFormat().resolvedOptions().locale || "en-US",
-    userAgent: `okx-a2a-node/${"0.2.17"}`,
+    userAgent: `okx-a2a-node/${"0.2.18-beta-4dd056b897-261015113839"}`,
     auth: {
       ...config.token ? { token: config.token } : {},
       ...config.password ? { password: config.password } : {}
@@ -29089,7 +29226,7 @@ var init_sentry_config = __esm({
     environment = process.env.SENTRY_ENV === "dev" ? "dev" : "prod";
     SENTRY_CONFIG = {
       projectName: "okx/openclaw-okx-a2a-extension",
-      release: "0.2.17",
+      release: "0.2.18-beta-4dd056b897-261015113839",
       environment,
       runtimeContainer: normalizeRuntimeContainer(process.env.OKX_A2A_RUNTIME_CONTAINER)
     };
@@ -40259,7 +40396,7 @@ async function exportDiagnosticLogs(options) {
     node: process.version,
     platform: process.platform,
     arch: process.arch,
-    packageVersion: true ? "0.2.17" : "unknown",
+    packageVersion: true ? "0.2.18-beta-4dd056b897-261015113839" : "unknown",
     sensitiveContentIncluded: options.includeSensitiveContent,
     listenerAndLlmContentIncluded: true,
     credentialsAlwaysRedacted: true,
@@ -61990,6 +62127,247 @@ var init_onchainos = __esm({
   }
 });
 
+// ../core/src/xmtp-sdk/onchainos/list-jobs-by-verified-sender.ts
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function redactLogValue(value, left = 6, right = 4) {
+  if (!value) {
+    return "(none)";
+  }
+  if (value.length <= left + right + 1) {
+    return "(redacted)";
+  }
+  return `${value.slice(0, left)}\u2026${value.slice(-right)}`;
+}
+function guardSessionExpired3(stdout, command) {
+  if (isSessionExpired(stdout)) {
+    reportSessionExpired(command);
+  }
+}
+function guardCatchSessionExpired3(err2, command) {
+  const stdout = String(err2?.stdout ?? "");
+  if (stdout && isSessionExpired(stdout)) {
+    reportSessionExpired(command);
+  }
+}
+function buildListJobsByVerifiedSenderArgs(params) {
+  return [
+    "agent",
+    "list-jobs-by-verified-sender",
+    "--group-id",
+    params.groupId,
+    "--sender-inbox-id",
+    params.senderInboxId,
+    "--agentic-id",
+    params.agenticId
+  ];
+}
+function extractErrorText(errorLike) {
+  if (typeof errorLike === "string") {
+    return errorLike;
+  }
+  if (typeof errorLike === "number") {
+    return String(errorLike);
+  }
+  if (errorLike && typeof errorLike === "object") {
+    const anyErr = errorLike;
+    return [anyErr.code, anyErr.message, anyErr.stdout, anyErr.stderr].filter((value) => typeof value === "string" || typeof value === "number").map(String).join(" ");
+  }
+  return errorLike == null ? "" : String(errorLike);
+}
+function classifyListJobsError(errorLike) {
+  const text = extractErrorText(errorLike);
+  for (const [code, reason] of Object.entries(KNOWN_ERROR_CODES2)) {
+    if (text.includes(code)) {
+      return { reason, errorCode: code };
+    }
+  }
+  if (/\b401\b/.test(text)) {
+    return { reason: "auth_error", errorCode: "401" };
+  }
+  if (/\b403\b/.test(text)) {
+    return { reason: "auth_error", errorCode: "403" };
+  }
+  return { reason: "invalid_response" };
+}
+function normalizeListJobsResponse(data) {
+  const rawJobs = isPlainObject(data) && Array.isArray(data.jobs) ? data.jobs : [];
+  const seen = /* @__PURE__ */ new Set();
+  const jobs = [];
+  let invalidCount = 0;
+  for (const item of rawJobs) {
+    if (!isPlainObject(item) || !isNonEmptyString(item.jobId) || !isNonEmptyString(item.userAgentId) || !isNonEmptyString(item.aspAgentId)) {
+      invalidCount += 1;
+      continue;
+    }
+    const key = `${item.jobId}|${item.userAgentId}|${item.aspAgentId}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    jobs.push({ jobId: item.jobId, userAgentId: item.userAgentId, aspAgentId: item.aspAgentId });
+  }
+  return { jobs, invalidCount };
+}
+async function listJobsByVerifiedSender(params, execFn = exec) {
+  logWithTimestamp(
+    `[onchainos] listing jobs by verified sender: group=${params.groupId} sender=${redactLogValue(params.senderInboxId)} agentic=${params.agenticId}`
+  );
+  let stdout;
+  let stderr;
+  try {
+    ({ stdout, stderr } = await execFn(buildListJobsByVerifiedSenderArgs(params)));
+  } catch (err2) {
+    guardCatchSessionExpired3(err2, "list-jobs-by-verified-sender");
+    const classified = classifyListJobsError(err2);
+    const reason = classified.reason === "invalid_response" ? "network_error" : classified.reason;
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender exec failed (group=${params.groupId} sender=${redactLogValue(params.senderInboxId)}); fail-closed reason=${reason}`
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason, errorCode: classified.errorCode };
+  }
+  if (stderr) {
+    logWithTimestamp(`[onchainos] stderr (list-jobs-by-verified-sender): ${stderr}`);
+  }
+  let res;
+  try {
+    res = parseCliJson(stdout, "list-jobs-by-verified-sender", {
+      groupId: params.groupId,
+      agenticId: params.agenticId
+    });
+  } catch {
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: "invalid_response" };
+  }
+  if (!res.ok) {
+    guardSessionExpired3(stdout, "list-jobs-by-verified-sender");
+    const classified = classifyListJobsError(res.error);
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender ok=false (group=${params.groupId}); fail-closed reason=${classified.reason}`
+    );
+    logger.error(
+      LogEvent.ONCHAINOS_CLI_ERROR,
+      new Error("list-jobs-by-verified-sender ok=false"),
+      cliOkFalseExtras(stdout, "list-jobs-by-verified-sender", {
+        groupId: params.groupId,
+        agenticId: params.agenticId,
+        reason: classified.reason
+      })
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: classified.reason, errorCode: classified.errorCode };
+  }
+  const { jobs, invalidCount } = normalizeListJobsResponse(res.data);
+  if (jobs.length === 0) {
+    logWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender: empty (group=${params.groupId} invalidCount=${invalidCount})`
+    );
+    return { status: "empty", jobs, invalidCount };
+  }
+  logWithTimestamp(
+    `[onchainos] list-jobs-by-verified-sender: ok (group=${params.groupId} jobs=${jobs.length} invalidCount=${invalidCount})`
+  );
+  return { status: "ok", jobs, invalidCount };
+}
+function listJobsByVerifiedSenderHelpAdvertisesCommand(helpText) {
+  if (typeof helpText !== "string" || helpText.length === 0) {
+    return false;
+  }
+  const lower = helpText.toLowerCase();
+  if (/unknown command|unrecognized|not a valid command|no such (sub)?command|command not found/.test(lower)) {
+    return false;
+  }
+  return lower.includes(LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN);
+}
+function maybeRecommendListJobsUpgrade(capability) {
+  if (capability.supported || capabilityRecommendedPairs.has(CAPABILITY_UPGRADE_PAIR_KEY)) {
+    return;
+  }
+  warnWithTimestamp(
+    `[onchainos] list-jobs-by-verified-sender unsupported (reason=${capability.reason}); ${CAPABILITY_UPGRADE_REASON}`
+  );
+  const hook = XmtpService.getInstance().tools?.notifyUpgradeRecommendation;
+  if (!hook) {
+    return;
+  }
+  capabilityRecommendedPairs.add(CAPABILITY_UPGRADE_PAIR_KEY);
+  try {
+    void Promise.resolve(
+      hook({
+        component: "onchainos",
+        capability: LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN,
+        reason: CAPABILITY_UPGRADE_REASON
+      })
+    ).catch((err2) => {
+      warnWithTimestamp("[onchainos] list-jobs-by-verified-sender upgrade notice async delivery failed:", err2);
+    });
+  } catch (err2) {
+    warnWithTimestamp("[onchainos] list-jobs-by-verified-sender upgrade notice threw:", err2);
+  }
+}
+function detectListJobsByVerifiedSenderSupport(execFn = exec) {
+  if (!capabilityProbe2) {
+    capabilityProbe2 = (async () => {
+      try {
+        const { stdout, stderr } = await execFn([
+          "agent",
+          "list-jobs-by-verified-sender",
+          "--help"
+        ]);
+        const supported = listJobsByVerifiedSenderHelpAdvertisesCommand(`${stdout}
+${stderr}`);
+        logWithTimestamp(
+          `[onchainos] list-jobs-by-verified-sender capability: ${supported ? "supported" : "unsupported_cli_capability"}`
+        );
+        return supported ? { supported: true } : { supported: false, reason: "unsupported_cli_capability" };
+      } catch (err2) {
+        logWithTimestamp(
+          "[onchainos] list-jobs-by-verified-sender --help probe failed; treating as onchainos_upgrade_required:",
+          err2
+        );
+        return { supported: false, reason: "onchainos_upgrade_required" };
+      }
+    })().then((capability) => {
+      maybeRecommendListJobsUpgrade(capability);
+      return capability;
+    });
+  }
+  return capabilityProbe2;
+}
+async function listJobsByVerifiedSenderWithCapability(params, execFn = exec) {
+  const capability = await detectListJobsByVerifiedSenderSupport(execFn);
+  if (!capability.supported) {
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender skipped: CLI capability unavailable (reason=${capability.reason}) group=${params.groupId} sender=${redactLogValue(params.senderInboxId)}`
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: capability.reason };
+  }
+  return listJobsByVerifiedSender(params, execFn);
+}
+var KNOWN_ERROR_CODES2, LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN, CAPABILITY_UPGRADE_PAIR_KEY, CAPABILITY_UPGRADE_REASON, capabilityProbe2, capabilityRecommendedPairs;
+var init_list_jobs_by_verified_sender = __esm({
+  "../core/src/xmtp-sdk/onchainos/list-jobs-by-verified-sender.ts"() {
+    "use strict";
+    init_log();
+    init_sentry_logger();
+    init_bin();
+    init_cli_response();
+    init_session_expired();
+    init_xmtp_sdk();
+    KNOWN_ERROR_CODES2 = {
+      "130100079": "sender_not_authorized",
+      "130100073": "sender_not_eligible"
+    };
+    LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN = "list-jobs-by-verified-sender";
+    CAPABILITY_UPGRADE_PAIR_KEY = "onchainos:list-jobs-by-verified-sender";
+    CAPABILITY_UPGRADE_REASON = "OnchainOS does not support `agent list-jobs-by-verified-sender`; the V2 subscription shared-group inbound path is fail-closed until OnchainOS is upgraded. Upgrade the OnchainOS CLI, then re-run.";
+    capabilityProbe2 = null;
+    capabilityRecommendedPairs = /* @__PURE__ */ new Set();
+  }
+});
+
 // ../core/src/xmtp-sdk/onchainos/signer.ts
 async function onchainosSign(agentId, keyUuid, walletAddress, message) {
   logWithTimestamp(
@@ -62659,7 +63037,7 @@ function buildXmtpMessageSentExtra(params) {
 function logXmtpMessageSent(params) {
   logger.info(LogEvent.MESSAGE_SENT, buildXmtpMessageSentExtra(params));
 }
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function readString3(value) {
@@ -62845,8 +63223,8 @@ function buildDmReplyRaw(command, target, localAgentId) {
   });
 }
 function buildGroupReplyRaw(command, target, myXmtpAddress, localAgent) {
-  const payload = isPlainObject(target.payload) ? target.payload : null;
-  const sender = isPlainObject(payload?.sender) ? payload.sender : null;
+  const payload = isPlainObject2(target.payload) ? target.payload : null;
+  const sender = isPlainObject2(payload?.sender) ? payload.sender : null;
   return buildSendEnvelope({
     content: command.message,
     myXmtpAddress,
@@ -63443,8 +63821,8 @@ async function handleXmtpSendCommand(params) {
       payload: parseJson(rawText)
     };
     await store.append(command.jobId, stored, sessionAgentId);
-    const payloadObject = isPlainObject(target.payload) ? target.payload : null;
-    const sender = isPlainObject(payloadObject?.sender) ? payloadObject.sender : null;
+    const payloadObject = isPlainObject2(target.payload) ? target.payload : null;
+    const sender = isPlainObject2(payloadObject?.sender) ? payloadObject.sender : null;
     const remoteAgentId = readString3(sender?.agentId);
     await notifyAgentMessageToUserAttention({
       direction: "outbound" /* OUTBOUND */,
@@ -63497,6 +63875,438 @@ var init_xmtp_send = __esm({
   }
 });
 
+// ../core/src/a2a/subscription-types.ts
+var SUBSCRIPTION_MESSAGE_TYPE;
+var init_subscription_types = __esm({
+  "../core/src/a2a/subscription-types.ts"() {
+    "use strict";
+    SUBSCRIPTION_MESSAGE_TYPE = "a2a-subscription-push";
+  }
+});
+
+// ../core/src/a2a/subscription-envelope.ts
+function isPlainObject3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function buildSubscriptionEnvelope(params) {
+  const envelope = {
+    msgType: SUBSCRIPTION_MESSAGE_TYPE,
+    content: params.content,
+    senderAgentId: params.senderAgentId
+  };
+  if (params.deliveryId) {
+    envelope.deliveryId = params.deliveryId;
+  }
+  return JSON.stringify(envelope);
+}
+function isSubscriptionEnvelope(payload) {
+  return isPlainObject3(payload) && payload.msgType === SUBSCRIPTION_MESSAGE_TYPE;
+}
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function readSubscriptionEnvelope(payload) {
+  if (!isSubscriptionEnvelope(payload)) {
+    return { ok: false, reason: "not_subscription" };
+  }
+  const record = payload;
+  if (!isNonEmptyString2(record.content)) {
+    return { ok: false, reason: "missing_content" };
+  }
+  const envelope = {
+    msgType: SUBSCRIPTION_MESSAGE_TYPE,
+    content: record.content,
+    senderAgentId: isNonEmptyString2(record.senderAgentId) ? record.senderAgentId : ""
+  };
+  if (isNonEmptyString2(record.deliveryId)) {
+    envelope.deliveryId = record.deliveryId;
+  }
+  return { ok: true, envelope };
+}
+var init_subscription_envelope = __esm({
+  "../core/src/a2a/subscription-envelope.ts"() {
+    "use strict";
+    init_subscription_types();
+  }
+});
+
+// src/subscription-telemetry.ts
+function definedExtras(input) {
+  return Object.entries(input).reduce((out, [key, value]) => {
+    if (typeof value === "string" && value.trim().length > 0) {
+      out[key] = value.trim();
+    }
+    return out;
+  }, {});
+}
+function countExtras(input) {
+  return Object.entries(input).reduce((out, [key, value]) => {
+    if (typeof value === "number" && Number.isFinite(value)) {
+      out[key] = String(value);
+    }
+    return out;
+  }, {});
+}
+function buildSubscriptionSendExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome ?? null,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "outbound",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      aspAgentId: input.aspAgentId,
+      conversationId: input.conversationId,
+      reason: input.reason
+    }),
+    ...countExtras({
+      targetCount: input.targetCount,
+      sentCount: input.sentCount,
+      failedCount: input.failedCount,
+      notGroupCount: input.notGroupCount
+    })
+  };
+}
+function buildSubscriptionInboundExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome ?? null,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "inbound",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      userAgentId: input.userAgentId,
+      conversationId: input.conversationId,
+      messageId: input.messageId,
+      senderInboxId: input.senderInboxId,
+      reason: input.reason,
+      errorCode: input.errorCode
+    }),
+    ...countExtras({
+      returnedCount: input.returnedCount,
+      invalidCount: input.invalidCount,
+      ownedCount: input.ownedCount,
+      ignoredCount: input.ignoredCount
+    })
+  };
+}
+function buildSubscriptionJobExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "dispatch",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      jobId: input.jobId,
+      userAgentId: input.userAgentId,
+      aspAgentId: input.aspAgentId,
+      conversationId: input.conversationId,
+      reason: input.reason
+    }),
+    ...countExtras({
+      total: input.total,
+      started: input.started,
+      failed: input.failed,
+      skippedDuplicate: input.skippedDuplicate
+    })
+  };
+}
+var SUBSCRIPTION_TRANSPORT;
+var init_subscription_telemetry = __esm({
+  "src/subscription-telemetry.ts"() {
+    "use strict";
+    init_log_fields();
+    SUBSCRIPTION_TRANSPORT = "xmtp";
+  }
+});
+
+// src/subscription-push.ts
+function describeError(err2) {
+  if (err2 instanceof Error) {
+    return err2.message;
+  }
+  if (typeof err2 === "string" && err2.length > 0) {
+    return err2;
+  }
+  return "unknown error";
+}
+async function requireXmtpClient2(service, address) {
+  const existing = service.getClientByAddress(address);
+  if (existing) {
+    return existing;
+  }
+  await service.refreshAgents();
+  const refreshed = service.getClientByAddress(address);
+  if (!refreshed) {
+    throw new Error(`no XMTP client found for ${address}`);
+  }
+  return refreshed;
+}
+function resolveLocalAddress(service, myAgentId) {
+  const address = service.getAddressByAgentId(myAgentId);
+  if (!address) {
+    throw new Error(`No local communication address found for myAgentId=${myAgentId}`);
+  }
+  return address;
+}
+async function syncConversationsOnLocalMiss2(agent) {
+  const conversations = agent.client.conversations;
+  const existing = conversationSyncPromises2.get(conversations);
+  if (existing) {
+    return existing;
+  }
+  const pending = conversations.sync();
+  conversationSyncPromises2.set(conversations, pending);
+  try {
+    await pending;
+  } finally {
+    if (conversationSyncPromises2.get(conversations) === pending) {
+      conversationSyncPromises2.delete(conversations);
+    }
+  }
+}
+async function findGroupConversation2(agent, conversationId) {
+  let conversation = await agent.client.conversations.getConversationById(conversationId);
+  if (!(conversation instanceof Group)) {
+    await syncConversationsOnLocalMiss2(agent);
+    conversation = await agent.client.conversations.getConversationById(conversationId);
+  }
+  return conversation instanceof Group ? conversation : null;
+}
+async function sendSubscriptionToGroup(params) {
+  const { agent, conversationId, command, myXmtpAddress, senderRole } = params;
+  let conversation;
+  try {
+    conversation = await findGroupConversation2(agent, conversationId);
+  } catch (err2) {
+    return { conversationId, status: "not_group", error: describeError(err2) };
+  }
+  if (!conversation) {
+    return {
+      conversationId,
+      status: "not_group",
+      error: `conversationId=${conversationId} is not a Group (DM or unknown conversation)`
+    };
+  }
+  const envelope = buildSubscriptionEnvelope({
+    content: command.content,
+    senderAgentId: command.myAgentId,
+    deliveryId: command.deliveryId
+  });
+  const sendStartMs = Date.now();
+  try {
+    const xmtpMessageId = await conversation.sendText(envelope);
+    logXmtpMessageSent({
+      xmtpMessageId,
+      conversationId,
+      // V2 has no job dimension (FR-1) — deliveryId (or a fixed marker)
+      // stands in for the telemetry taxonomy's jobId slot.
+      jobId: command.deliveryId ?? "subscription-push",
+      chatType: "group",
+      component: "node_xmtp_subscription_push",
+      myXmtpAddress,
+      senderAgentId: command.myAgentId,
+      role: senderRole,
+      sendDurationMs: Date.now() - sendStartMs
+    });
+    const messageId = typeof xmtpMessageId === "string" && xmtpMessageId.length > 0 ? xmtpMessageId : String(xmtpMessageId);
+    logWithTimestamp(
+      `[okx-agent-task] subscription-push sent conversationId=${conversationId} deliveryId=${command.deliveryId ?? "(none)"}`
+    );
+    return { conversationId, status: "sent", messageId };
+  } catch (err2) {
+    logWithTimestamp(
+      `[okx-agent-task] subscription-push failed conversationId=${conversationId} deliveryId=${command.deliveryId ?? "(none)"}`
+    );
+    return { conversationId, status: "failed", error: describeError(err2) };
+  }
+}
+function summarizeSubscriptionPush(results) {
+  let sentCount = 0;
+  let failedCount = 0;
+  for (const result of results) {
+    if (result.status === "sent") {
+      sentCount++;
+    } else {
+      failedCount++;
+    }
+  }
+  return { conversationCount: results.length, sentCount, failedCount };
+}
+async function handleSubscriptionPushCommand(params) {
+  const { command, service } = params;
+  const aspAgentId = command.myAgentId;
+  const deliveryId = command.deliveryId;
+  const conversationIds = command.conversationIds ?? [];
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_STARTED,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_started",
+      aspAgentId,
+      deliveryId,
+      targetCount: conversationIds.length
+    })
+  );
+  if (conversationIds.length === 0) {
+    logger.info(
+      LogEvent.SUBSCRIPTION_PUSH_EMPTY_TARGETS,
+      buildSubscriptionSendExtras({
+        checkpoint: "outbound/subscription_push_empty_targets",
+        outcome: "ignored",
+        aspAgentId,
+        deliveryId,
+        targetCount: 0,
+        reason: "empty_targets"
+      })
+    );
+    return { conversationCount: 0, sentCount: 0, failedCount: 0, results: [] };
+  }
+  const myXmtpAddress = resolveLocalAddress(service, command.myAgentId);
+  const agent = await requireXmtpClient2(service, myXmtpAddress);
+  const senderRole = service.getAgentByAddress?.(myXmtpAddress)?.role;
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_TARGETS_RESOLVED,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_targets_resolved",
+      aspAgentId,
+      deliveryId,
+      targetCount: conversationIds.length
+    })
+  );
+  const settled = await parallelMap(
+    conversationIds,
+    (conversationId) => sendSubscriptionToGroup({
+      agent,
+      conversationId,
+      command,
+      myXmtpAddress,
+      senderRole
+    }),
+    DEFAULT_CONCURRENCY
+  );
+  const results = settled.map((outcome, index2) => {
+    if (outcome.status === "fulfilled") {
+      return outcome.value;
+    }
+    return {
+      conversationId: conversationIds[index2],
+      status: "failed",
+      error: describeError(outcome.reason)
+    };
+  });
+  for (const result of results) {
+    if (result.status === "sent") {
+      continue;
+    }
+    logger.error(
+      LogEvent.SUBSCRIPTION_PUSH_TARGET_FAILED,
+      void 0,
+      buildSubscriptionSendExtras({
+        checkpoint: "outbound/subscription_push_target_failed",
+        outcome: "failed",
+        aspAgentId,
+        deliveryId,
+        conversationId: result.conversationId,
+        reason: result.status
+      })
+    );
+  }
+  const summary = summarizeSubscriptionPush(results);
+  const summaryOutcome = summary.failedCount === 0 ? "success" : summary.sentCount > 0 ? "partial" : "failed";
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_SUMMARY,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_summary",
+      outcome: summaryOutcome,
+      aspAgentId,
+      deliveryId,
+      targetCount: summary.conversationCount,
+      sentCount: summary.sentCount,
+      failedCount: summary.failedCount
+    })
+  );
+  return { ...summary, results };
+}
+var DEFAULT_CONCURRENCY, conversationSyncPromises2;
+var init_subscription_push = __esm({
+  "src/subscription-push.ts"() {
+    "use strict";
+    init_log();
+    init_sentry_logger();
+    init_dist2();
+    init_subscription_envelope();
+    init_concurrency();
+    init_xmtp_send();
+    init_subscription_telemetry();
+    DEFAULT_CONCURRENCY = 20;
+    conversationSyncPromises2 = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// src/ai-run-log-path.ts
+function buildRunLogFileName(request) {
+  const source = request.source;
+  const sessionKey = request.sessionKey;
+  const messageId = request.messageId;
+  const jobId = request.jobId;
+  const safeMessageId = encodeURIComponent(messageId);
+  const prefix = source === "job-dispatch" ? "ai-" : "ai-session-";
+  const encodedContext = source === "job-dispatch" ? encodeURIComponent(jobId ?? "unknown") : encodeURIComponent(sessionKey);
+  const readable = `${prefix}${encodedContext}-${safeMessageId}.log`;
+  if (Buffer.byteLength(readable, "utf8") <= RUN_LOG_FILENAME_MAX_BYTES) {
+    return readable;
+  }
+  const readableWithoutExt = readable.slice(0, -".log".length);
+  const digest = (0, import_node_crypto13.createHash)("sha256").update(readableWithoutExt).digest("hex").slice(0, 24);
+  const suffix = `-${digest}.log`;
+  const budgetForContext = RUN_LOG_FILENAME_MAX_BYTES - Buffer.byteLength(prefix, "utf8") - Buffer.byteLength(suffix, "utf8");
+  const contextHead = truncateToUtf8ByteBudgetSafe(encodedContext, Math.max(budgetForContext, 0));
+  return `${prefix}${contextHead}${suffix}`;
+}
+function truncateToUtf8ByteBudgetSafe(encoded, maxBytes) {
+  if (maxBytes <= 0) {
+    return "";
+  }
+  if (Buffer.byteLength(encoded, "utf8") <= maxBytes) {
+    return encoded;
+  }
+  let candidateLength = Math.min(maxBytes, encoded.length);
+  while (candidateLength > 0) {
+    const candidate = encoded.slice(0, candidateLength);
+    if (!endsWithSplitEscape(candidate)) {
+      return candidate;
+    }
+    candidateLength -= 1;
+  }
+  return "";
+}
+function endsWithSplitEscape(value) {
+  const percentIndex = value.lastIndexOf("%");
+  if (percentIndex === -1) {
+    return false;
+  }
+  const tail = value.length - percentIndex - 1;
+  return tail < 2;
+}
+var import_node_crypto13, RUN_LOG_FILENAME_MAX_BYTES;
+var init_ai_run_log_path = __esm({
+  "src/ai-run-log-path.ts"() {
+    "use strict";
+    import_node_crypto13 = require("node:crypto");
+    RUN_LOG_FILENAME_MAX_BYTES = 240;
+  }
+});
+
 // src/ai-adapter.ts
 function buildClaudeAllowedToolsArgs() {
   return ["--allowedTools", ...CLAUDE_ALLOWED_TOOLS];
@@ -65344,7 +66154,7 @@ function normalizeAttentionProvider(provider) {
   return provider === "unknown" ? null : provider;
 }
 function stableHash2(value) {
-  return (0, import_node_crypto13.createHash)("sha256").update(value).digest("hex").slice(0, 24);
+  return (0, import_node_crypto14.createHash)("sha256").update(value).digest("hex").slice(0, 24);
 }
 function formatCommand(args) {
   return args.map(shellQuote).join(" ");
@@ -65368,17 +66178,18 @@ function shortenJobId2(jobId) {
   }
   return `${jobId.slice(0, 6)}\u2026${jobId.slice(-4)}`;
 }
-var import_node_crypto13, import_node_fs26, import_promises12, import_node_os9, import_node_path31, AiRunner, CODEX_TOOL_FAILURE_MARKER;
+var import_node_crypto14, import_node_fs26, import_promises12, import_node_os9, import_node_path31, AiRunner, CODEX_TOOL_FAILURE_MARKER;
 var init_ai_runner = __esm({
   "src/ai-runner.ts"() {
     "use strict";
     init_log();
-    import_node_crypto13 = require("node:crypto");
+    import_node_crypto14 = require("node:crypto");
     import_node_fs26 = require("node:fs");
     import_promises12 = require("node:fs/promises");
     import_node_os9 = require("node:os");
     import_node_path31 = require("node:path");
     init_ai_command();
+    init_ai_run_log_path();
     init_paths();
     init_file_store();
     init_ai_provider();
@@ -66006,13 +66817,15 @@ var init_ai_runner = __esm({
         );
       }
       buildRunLogPath(request) {
-        const safeMessageId = encodeURIComponent(request.messageId);
-        if (request.source === "job-dispatch") {
-          const safeJobId = encodeURIComponent(request.jobId ?? "unknown");
-          return (0, import_node_path31.join)(this.logsDir, `ai-${safeJobId}-${safeMessageId}.log`);
-        }
-        const safeSessionKey = encodeURIComponent(request.sessionKey);
-        return (0, import_node_path31.join)(this.logsDir, `ai-session-${safeSessionKey}-${safeMessageId}.log`);
+        return (0, import_node_path31.join)(
+          this.logsDir,
+          buildRunLogFileName({
+            source: request.source,
+            sessionKey: request.sessionKey,
+            messageId: request.messageId,
+            jobId: request.jobId
+          })
+        );
       }
       readRunAiSessionId(provider, request, file, sessionMeta) {
         if (request.source === "job-dispatch" && request.jobId) {
@@ -67037,6 +67850,9 @@ function commandSentryExtra(command, extra = {}) {
     base.myAgentId = command.myAgentId ?? "";
     base.toAgentId = command.toAgentId ?? "";
     base.toXmtpAddress = command.toXmtpAddress ?? "";
+  } else if (command.type === "xmtp-subscription-push") {
+    base.myAgentId = command.myAgentId;
+    base.conversationCount = command.conversationIds.length;
   } else if (command.type === "xmtp-deny-pending-conversation") {
     base.groupId = command.groupId;
     base.jobId = command.jobId ?? "";
@@ -67392,6 +68208,10 @@ async function handleDaemonCommand(command, params) {
     });
     return { ok: true, messageId: result.messageId };
   }
+  if (command.type === "xmtp-subscription-push") {
+    const result = await handleSubscriptionPushCommand({ command, service: params.service });
+    return { ok: true, payload: result };
+  }
   if (command.type === "xmtp-get-pending-list") {
     return { ok: true, payload: await listPendingTaskRequests(params) };
   }
@@ -67474,12 +68294,12 @@ async function listPendingTaskRequests(params) {
 }
 async function denyPendingConversationsByJobId(jobId, params, content2) {
   const pending = await listPendingTaskRequests(params);
-  const matched = pending.filter((item) => isPlainObject2(item) && readString4(item.jobId) === jobId);
+  const matched = pending.filter((item) => isPlainObject4(item) && readString4(item.jobId) === jobId);
   const clientAddresses = [...params.service.getClients().keys()];
   const targetsByKey = collectDenyTargetsFromPending(matched, clientAddresses);
   const groupIds = /* @__PURE__ */ new Set();
   for (const item of matched) {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject4(item)) {
       continue;
     }
     const groupId = readString4(item.groupId);
@@ -67506,7 +68326,7 @@ async function denyPendingConversationsByJobId(jobId, params, content2) {
 function collectDenyTargetsFromPending(pending, fallbackAddresses) {
   const targetsByKey = /* @__PURE__ */ new Map();
   for (const item of pending) {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject4(item)) {
       continue;
     }
     const groupId = readString4(item.groupId);
@@ -67531,7 +68351,7 @@ ${groupId}`, {
 async function resolvePendingTargetsByGroupId(groupId, addresses, params) {
   const addressSet = addresses ? new Set(addresses) : null;
   const pending = (await listPendingTaskRequests(params)).filter((item) => {
-    if (!isPlainObject2(item) || readString4(item.groupId) !== groupId) {
+    if (!isPlainObject4(item) || readString4(item.groupId) !== groupId) {
       return false;
     }
     const address = readString4(item.myXmtpAddress);
@@ -67651,7 +68471,7 @@ function filterKnownPendingGroups(items, sessionStore) {
     return items;
   }
   return items.filter((item) => {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject4(item)) {
       return true;
     }
     const jobId = readString4(item.jobId);
@@ -67662,7 +68482,7 @@ function filterKnownPendingGroups(items, sessionStore) {
     return sessionStore.querySessions({ jobId, toAgentId, limit: 1 }).length === 0;
   });
 }
-function isPlainObject2(value) {
+function isPlainObject4(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function readString4(value) {
@@ -67796,6 +68616,10 @@ function formatCommandCompleted(command, result) {
   if (command.type === "xmtp-send") {
     return `[okx-agent-task] xmtp-send command completed id=${command.id} job=${command.jobId} messageId=${result.messageId}`;
   }
+  if (command.type === "xmtp-subscription-push") {
+    const payload = isPlainObject4(result.payload) ? result.payload : {};
+    return `[okx-agent-task] xmtp-subscription-push command completed id=${command.id} deliveryId=${command.deliveryId ?? "(none)"} conversationCount=${payload.conversationCount ?? 0} sentCount=${payload.sentCount ?? 0} failedCount=${payload.failedCount ?? 0}`;
+  }
   if (command.type === "xmtp-get-pending-list") {
     return `[okx-agent-task] xmtp-get-pending-list command completed id=${command.id}`;
   }
@@ -67816,8 +68640,8 @@ function formatCommandCompleted(command, result) {
   return `[okx-agent-task] xmtp-refresh-agents command completed id=${command.id}`;
 }
 function formatXmtpDebugCompleted(command, payload) {
-  const record = isPlainObject2(payload) ? payload : {};
-  const summary = isPlainObject2(record.summary) ? record.summary : {};
+  const record = isPlainObject4(payload) ? payload : {};
+  const summary = isPlainObject4(record.summary) ? record.summary : {};
   const count = command.action === "group-list" ? record.groupCount ?? 0 : command.action === "group-inspect" ? record.conversationFound ? 1 : 0 : summary.matchedCount ?? 0;
   return `[okx-agent-task] xmtp-debug command completed id=${command.id} action=${command.action} rows=${String(count)}`;
 }
@@ -67978,6 +68802,7 @@ var init_command_processor = __esm({
     init_command_store();
     init_invalid_message_store();
     init_xmtp_send();
+    init_subscription_push();
     init_ai_runner();
     init_session_store();
     init_ai_provider();
@@ -68005,7 +68830,7 @@ async function enqueueAiJobMessageDispatch(params) {
   await commands.submit(command);
   return command;
 }
-async function enqueueAiSessionMessageDispatch(params) {
+async function enqueueAiSessionMessageDispatchIdempotent(params) {
   const commands = params.commands ?? new CommandStore(params.homeDir);
   const messageId = params.event.messageId ?? `session-${Date.now()}`;
   const command = commands.createAiSessionMessageDispatchCommand({
@@ -68015,7 +68840,21 @@ async function enqueueAiSessionMessageDispatch(params) {
     jobId: params.event.jobId,
     agentId: params.event.agentId
   });
+  const idempotencyKey = params.event.idempotencyKey?.trim();
+  if (idempotencyKey) {
+    const dbKey = `${command.sessionKey}
+${command.messageId}`;
+    const result = await commands.submitIdempotent(command, dbKey);
+    return {
+      command: result.created ? command : { ...command, id: result.commandId },
+      created: result.created
+    };
+  }
   await commands.submit(command);
+  return { command, created: true };
+}
+async function enqueueAiSessionMessageDispatch(params) {
+  const { command } = await enqueueAiSessionMessageDispatchIdempotent(params);
   return command;
 }
 var init_ai_dispatch_queue = __esm({
@@ -68025,6 +68864,156 @@ var init_ai_dispatch_queue = __esm({
   }
 });
 
+// src/subscription-inbound.ts
+function decideSubscriptionGate(input) {
+  if (!isSubscriptionEnvelope(input.payload)) {
+    return { kind: "not_subscription" };
+  }
+  if (input.chatType === "dm") {
+    return { kind: "drop", reason: "dm_subscription" };
+  }
+  if (input.chatType === "unknown") {
+    return { kind: "drop", reason: "unknown_conversation_subscription" };
+  }
+  const read = readSubscriptionEnvelope(input.payload);
+  if (!read.ok) {
+    return { kind: "drop", reason: "invalid_envelope", detail: read.reason };
+  }
+  if (!input.senderInboxId) {
+    return { kind: "drop", reason: "missing_sender_inbox_id" };
+  }
+  return { kind: "v2", envelope: read.envelope };
+}
+function partitionSubscriptionJobsByOwner(input) {
+  const owned = [];
+  for (const job of input.jobs) {
+    if (job.userAgentId === input.localAgentId) {
+      owned.push(job);
+    }
+  }
+  return {
+    owned,
+    returnedCount: input.jobs.length,
+    ownedCount: owned.length,
+    ignoredCount: input.jobs.length - owned.length
+  };
+}
+function normalizeSubscriptionJobs(input) {
+  const seen = /* @__PURE__ */ new Set();
+  const normalized = [];
+  for (const job of input.jobs) {
+    const dedupKey = `${job.jobId}|${job.userAgentId}|${job.aspAgentId}`;
+    if (seen.has(dedupKey)) {
+      continue;
+    }
+    seen.add(dedupKey);
+    normalized.push({
+      jobId: job.jobId,
+      userAgentId: job.userAgentId,
+      aspAgentId: job.aspAgentId,
+      msgType: SUBSCRIPTION_MESSAGE_TYPE,
+      content: input.envelope.content,
+      ...input.envelope.deliveryId ? { deliveryId: input.envelope.deliveryId } : {},
+      conversationId: input.conversationId,
+      senderInboxId: input.senderInboxId
+    });
+  }
+  return normalized;
+}
+function subscriptionIdempotencyKey(input) {
+  const messageDimension = input.deliveryId || input.messageId;
+  return `${input.myXmtpAddress}|${messageDimension}|${input.jobId}`;
+}
+function tryMarkSubscriptionTarget(key) {
+  if (subscriptionTargets.has(key)) {
+    return false;
+  }
+  subscriptionTargets.set(key, Date.now());
+  while (subscriptionTargets.size > SUBSCRIPTION_TARGETS_MAX) {
+    const oldest = subscriptionTargets.keys().next().value;
+    if (oldest === void 0) {
+      break;
+    }
+    subscriptionTargets.delete(oldest);
+  }
+  return true;
+}
+function redactSenderInboxId(senderInboxId, left = 8, right = 6) {
+  if (!senderInboxId) {
+    return "(none)";
+  }
+  if (senderInboxId.length <= left + right + 1) {
+    return senderInboxId;
+  }
+  return `${senderInboxId.slice(0, left)}\u2026${senderInboxId.slice(-right)}`;
+}
+async function fanOutSubscriptionJobs(input) {
+  const { jobs, myXmtpAddress, messageId, dispatch, concurrency } = input;
+  const total = jobs.length;
+  const capacityAnomaly = total > SUBSCRIPTION_FANOUT_MAX;
+  if (capacityAnomaly) {
+    logWithTimestamp(
+      `[okx-agent-task:${myXmtpAddress}] subscription fan-out capacity anomaly: jobs=${total} max=${SUBSCRIPTION_FANOUT_MAX} message=${messageId}`
+    );
+  }
+  const settled = await parallelMap(
+    jobs,
+    async (job) => {
+      const idempotencyKey = subscriptionIdempotencyKey({
+        myXmtpAddress,
+        deliveryId: job.deliveryId,
+        messageId,
+        jobId: job.jobId
+      });
+      if (subscriptionTargets.has(idempotencyKey)) {
+        return { key: idempotencyKey, outcome: "duplicate" };
+      }
+      const dispatchOutcome = await dispatch(job, idempotencyKey);
+      const isDurableDuplicate = !!dispatchOutcome && dispatchOutcome.created === false;
+      return { key: idempotencyKey, outcome: isDurableDuplicate ? "duplicate" : "started" };
+    },
+    concurrency ?? 20
+  );
+  let started = 0;
+  let failed = 0;
+  let skippedDuplicate = 0;
+  const results = [];
+  settled.forEach((result, idx) => {
+    const job = jobs[idx];
+    if (result.status === "rejected") {
+      failed += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "failed", error: result.reason });
+      logWithTimestamp(
+        `[okx-agent-task:${myXmtpAddress}] subscription dispatch failed message=${messageId} job=${job?.jobId ?? "(unknown)"} sender=${redactSenderInboxId(job?.senderInboxId)}:`,
+        result.reason
+      );
+      return;
+    }
+    tryMarkSubscriptionTarget(result.value.key);
+    if (result.value.outcome === "duplicate") {
+      skippedDuplicate += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "duplicate" });
+    } else {
+      started += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "started" });
+    }
+  });
+  return { total, started, failed, skippedDuplicate, capacityAnomaly, results };
+}
+var SUBSCRIPTION_TARGETS_MAX, subscriptionTargets, SUBSCRIPTION_FANOUT_MAX;
+var init_subscription_inbound = __esm({
+  "src/subscription-inbound.ts"() {
+    "use strict";
+    init_log();
+    init_concurrency();
+    init_subscription_types();
+    init_subscription_envelope();
+    SUBSCRIPTION_TARGETS_MAX = 2e3;
+    subscriptionTargets = /* @__PURE__ */ new Map();
+    SUBSCRIPTION_FANOUT_MAX = 250;
+  }
+});
+
 // src/message-handler.ts
 function tryMarkProcessed(messageId) {
   if (processedMessageIds.has(messageId)) {
@@ -68040,7 +69029,7 @@ function tryMarkProcessed(messageId) {
   }
   return true;
 }
-function isPlainObject3(value) {
+function isPlainObject5(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function safeStringify(value) {
@@ -68100,9 +69089,9 @@ function readNumber(value) {
 }
 function resolveSessionAgentId(params) {
   const { chatType, payload, myXmtpAddress } = params;
-  const payloadObject = isPlainObject3(payload) ? payload : null;
-  const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
-  const message = isPlainObject3(payloadObject?.message) ? payloadObject.message : null;
+  const payloadObject = isPlainObject5(payload) ? payload : null;
+  const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
+  const message = isPlainObject5(payloadObject?.message) ? payloadObject.message : null;
   const localAgentId = XmtpService.getInstance().getAgentByAddress(myXmtpAddress)?.agentId ?? null;
   if (chatType === "group") {
     return readString5(sender?.agentId) ?? readString5(payloadObject?.receiverAgentId) ?? localAgentId;
@@ -68113,7 +69102,7 @@ function resolveSessionAgentId(params) {
   return localAgentId;
 }
 function routeMessage(chatType, parsed, payload) {
-  if (!parsed || !isPlainObject3(payload)) {
+  if (!parsed || !isPlainObject5(payload)) {
     return {
       jobId: BACKUP_JOB_ID,
       route: "backup",
@@ -68125,7 +69114,7 @@ function routeMessage(chatType, parsed, payload) {
     return jobId ? { jobId, route: "job", routeReason: "group-job-id" } : { jobId: BACKUP_JOB_ID, route: "backup", routeReason: "group-missing-job-id" };
   }
   if (chatType === "dm") {
-    const message = isPlainObject3(payload.message) ? payload.message : null;
+    const message = isPlainObject5(payload.message) ? payload.message : null;
     const nestedJobId = readString5(message?.jobId);
     const directJobId = readString5(payload.jobId);
     const jobId = nestedJobId ?? directJobId;
@@ -68138,10 +69127,10 @@ function routeMessage(chatType, parsed, payload) {
   return { jobId: BACKUP_JOB_ID, route: "backup", routeReason: "unknown-conversation" };
 }
 function extractDirectToUserNotification(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return { kind: "none" };
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
   if (message?.isDirectToUser !== true) {
     return { kind: "none" };
   }
@@ -68165,10 +69154,10 @@ function extractDirectToUserNotification(payload) {
   };
 }
 function extractSystemNotification(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return null;
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
   const isDirectCommunication = message?.isDirectCommunication === true;
   if (message?.source !== "system" && !isDirectCommunication) {
     return null;
@@ -68394,7 +69383,7 @@ function inboundStageExtras(stage, outcome) {
     })
   };
 }
-function definedExtras(input) {
+function definedExtras2(input) {
   return Object.entries(input).reduce((out, [key, value]) => {
     const text = readString5(value);
     if (text) {
@@ -68426,7 +69415,7 @@ function buildInboundTerminalExtras(input) {
       originPlatform: classifyOriginPlatform({ env: process.env }),
       deliveryId: resolveDeliveryId({ messageId, jobId, sessionKey })
     }),
-    ...definedExtras({
+    ...definedExtras2({
       messageId,
       conversationId,
       chatType,
@@ -68460,7 +69449,7 @@ function maybeNotifyInboundAgentMessage(params) {
     return;
   }
   const content2 = payloadObject.content;
-  const sender = isPlainObject3(payloadObject.sender) ? payloadObject.sender : null;
+  const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
   const localAgent = XmtpService.getInstance().getAgentByAddress(params.deps.myXmtpAddress);
   void notifyAgentMessageToUserAttention({
     direction: "inbound" /* INBOUND */,
@@ -68491,11 +69480,11 @@ function stringifySystemPayload(payload) {
   }
 }
 function summarizePayloadForLog(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return "payload=non-object";
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
-  const sender = isPlainObject3(payload.sender) ? payload.sender : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
+  const sender = isPlainObject5(payload.sender) ? payload.sender : null;
   const jobId = readString5(payload.jobId) ?? readString5(message?.jobId);
   const parts = [
     readString5(payload.msgType) ? `type=${readString5(payload.msgType)}` : null,
@@ -68764,7 +69753,7 @@ async function verifyInboundA2AGroupMessage(params) {
       messageId,
       groupId,
       jobId,
-      agentId: readString5(isPlainObject3(payload.sender) ? payload.sender.agentId : null),
+      agentId: readString5(isPlainObject5(payload.sender) ? payload.sender.agentId : null),
       localAgentId: myAgent?.agentId ?? null,
       senderAddress,
       senderInboxId,
@@ -68790,7 +69779,7 @@ async function verifyInboundA2AGroupMessage(params) {
     });
     return false;
   }
-  const sender = isPlainObject3(payload.sender) ? payload.sender : null;
+  const sender = isPlainObject5(payload.sender) ? payload.sender : null;
   const senderAgentId = readString5(sender?.agentId);
   const senderRole = readNumber(sender?.role);
   if (!senderAgentId || !myAgent) {
@@ -68959,9 +69948,302 @@ ${failureMessage}`,
   }
   return true;
 }
+async function processSubscriptionInbound(ctx, deps, input) {
+  const { decision, conversationId, messageId } = input;
+  const senderInboxId = ctx.message.senderInboxId ?? "";
+  if (decision.kind === "drop") {
+    logger.info(
+      LogEvent.SUBSCRIPTION_INBOUND_GATE_DROPPED,
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_gate_dropped",
+        outcome: "dropped",
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: decision.reason
+      })
+    );
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription message dropped reason=${decision.reason}${decision.detail ? ` detail=${decision.detail}` : ""} conv=${conversationId} message=${shortenLogValue(messageId)} sender=${shortenLogValue(senderInboxId)}`
+    );
+    return true;
+  }
+  if (decision.kind === "not_subscription") {
+    return true;
+  }
+  const { envelope } = decision;
+  const agenticId = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId;
+  if (!agenticId) {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription fail-closed: no local agenticId for ${deps.myXmtpAddress}, conv=${conversationId} message=${shortenLogValue(messageId)}`
+    );
+    logger.error(
+      LogEvent.SUBSCRIPTION_INBOUND_AGENTIC_ID_MISSING,
+      new Error("Subscription inbound: local agenticId not resolved"),
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_agentic_id",
+        outcome: "blocked",
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: "missing_agentic_id"
+      })
+    );
+    return true;
+  }
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription received msgType=${envelope.msgType} conv=${conversationId} message=${shortenLogValue(messageId)} sender=${shortenLogValue(senderInboxId)}`
+  );
+  logger.info(
+    LogEvent.SUBSCRIPTION_INBOUND_RECEIVED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_received",
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      deliveryId: envelope.deliveryId,
+      senderInboxId: shortenLogValue(senderInboxId)
+    })
+  );
+  const listJobs = deps.listJobsByVerifiedSenderImpl ?? listJobsByVerifiedSenderWithCapability;
+  logger.info(
+    LogEvent.SUBSCRIPTION_JOBS_QUERY_STARTED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_jobs_query_started",
+      userAgentId: agenticId,
+      conversationId,
+      messageId
+    })
+  );
+  const listJobsResult = await listJobs({
+    groupId: conversationId,
+    senderInboxId,
+    agenticId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription queried status=${listJobsResult.status} jobs=${listJobsResult.jobs.length} invalid=${listJobsResult.invalidCount} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  if (listJobsResult.status === "fail_closed") {
+    logger.error(
+      LogEvent.SUBSCRIPTION_JOBS_FAIL_CLOSED,
+      new Error("Subscription inbound: listJobsByVerifiedSender fail-closed"),
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_jobs_fail_closed",
+        outcome: "blocked",
+        userAgentId: agenticId,
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: listJobsResult.reason ?? "unknown",
+        errorCode: listJobsResult.errorCode
+      })
+    );
+    return true;
+  }
+  if (listJobsResult.status === "empty") {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription empty: no verified jobs for conv=${conversationId} message=${shortenLogValue(messageId)}`
+    );
+    logger.info(
+      LogEvent.SUBSCRIPTION_JOBS_EMPTY,
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_jobs_empty",
+        outcome: "ignored",
+        userAgentId: agenticId,
+        conversationId,
+        messageId,
+        reason: "jobs_empty",
+        returnedCount: 0,
+        invalidCount: listJobsResult.invalidCount
+      })
+    );
+    return true;
+  }
+  logger.info(
+    LogEvent.SUBSCRIPTION_JOBS_QUERY_SUCCEEDED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_jobs_query_succeeded",
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      returnedCount: listJobsResult.jobs.length,
+      invalidCount: listJobsResult.invalidCount
+    })
+  );
+  const ownership = partitionSubscriptionJobsByOwner({
+    jobs: listJobsResult.jobs,
+    localAgentId: agenticId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription routed receiver=${agenticId} returned=${ownership.returnedCount} localOwned=${ownership.ownedCount} ignored=${ownership.ignoredCount} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  logger.info(
+    LogEvent.SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_ownership_routed",
+      outcome: ownership.ownedCount === 0 ? "ignored" : null,
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      returnedCount: ownership.returnedCount,
+      ownedCount: ownership.ownedCount,
+      ignoredCount: ownership.ignoredCount
+    })
+  );
+  if (ownership.ownedCount === 0) {
+    return true;
+  }
+  const normalizedJobs = normalizeSubscriptionJobs({
+    jobs: ownership.owned,
+    envelope,
+    conversationId,
+    senderInboxId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription expanded jobs=${normalizedJobs.length} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  let senderXmtpAddress = null;
+  try {
+    const resolved = await ctx.getSenderAddress();
+    senderXmtpAddress = resolved ? resolved : null;
+  } catch (err2) {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription sender address unresolved (degrading to null) conv=${conversationId} message=${shortenLogValue(messageId)}:`,
+      err2
+    );
+  }
+  const fanoutResult = await fanOutSubscriptionJobs({
+    jobs: normalizedJobs,
+    myXmtpAddress: deps.myXmtpAddress,
+    messageId,
+    dispatch: async (job, idempotencyKey) => {
+      const sessionKey = buildSessionKey({
+        jobId: job.jobId,
+        myAgentId: job.userAgentId,
+        toAgentId: job.aspAgentId
+      });
+      deps.sessionStore?.upsertSession({
+        sessionKey,
+        jobId: job.jobId,
+        myAgentId: job.userAgentId,
+        toAgentId: job.aspAgentId,
+        groupId: job.conversationId,
+        myAgentXmtpAddress: deps.myXmtpAddress,
+        toAgentXmtpAddress: senderXmtpAddress
+      });
+      return deps.onSessionMessage?.({
+        sessionKey,
+        content: JSON.stringify({
+          msgType: job.msgType,
+          content: job.content,
+          ...job.deliveryId ? { deliveryId: job.deliveryId } : {},
+          jobId: job.jobId,
+          userAgentId: job.userAgentId,
+          aspAgentId: job.aspAgentId,
+          conversationId: job.conversationId,
+          senderInboxId: job.senderInboxId,
+          // Raw XMTP messageId preserved for sender/receiver telemetry join;
+          // the durable dedup identity is the idempotencyKey passed as this
+          // session-message's own `messageId` field below (M1 fix).
+          xmtpMessageId: messageId
+        }),
+        messageId: idempotencyKey,
+        // Durable exactly-once enqueue key (M2): the wiring persists via
+        // CommandStore.submitIdempotent keyed on sessionKey+messageId so a
+        // re-processed / replayed message never creates a second command.
+        idempotencyKey,
+        jobId: job.jobId,
+        agentId: job.userAgentId
+      });
+    }
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription fan-out succeeded=${fanoutResult.started} failed=${fanoutResult.failed} skippedDuplicate=${fanoutResult.skippedDuplicate} total=${fanoutResult.total} capacityAnomaly=${fanoutResult.capacityAnomaly} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  const normalizedJobsById = new Map(normalizedJobs.map((job) => [job.jobId, job]));
+  for (const result of fanoutResult.results) {
+    const job = normalizedJobsById.get(result.jobId);
+    if (result.outcome === "started") {
+      logger.info(
+        LogEvent.SUBSCRIPTION_JOB_DISPATCHED,
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_dispatched",
+          outcome: "success",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId
+        })
+      );
+    } else if (result.outcome === "duplicate") {
+      logger.info(
+        LogEvent.SUBSCRIPTION_JOB_DUPLICATE_IGNORED,
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_duplicate_ignored",
+          outcome: "ignored",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId,
+          reason: "duplicate_delivery"
+        })
+      );
+    } else {
+      logger.error(
+        LogEvent.SUBSCRIPTION_JOB_FAILED,
+        toLoggableError(result.error),
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_failed",
+          outcome: "failed",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId,
+          reason: "session_dispatch_failed"
+        })
+      );
+    }
+  }
+  logger.info(
+    LogEvent.SUBSCRIPTION_FANOUT_SUMMARY,
+    buildSubscriptionJobExtras({
+      checkpoint: "dispatch/subscription_fanout_summary",
+      outcome: fanoutResult.failed === 0 ? "success" : fanoutResult.started > 0 || fanoutResult.skippedDuplicate > 0 ? "partial" : "failed",
+      conversationId,
+      userAgentId: agenticId,
+      total: fanoutResult.total,
+      started: fanoutResult.started,
+      failed: fanoutResult.failed,
+      skippedDuplicate: fanoutResult.skippedDuplicate
+    })
+  );
+  return true;
+}
 async function processFileMessage(ctx, deps, options = {}) {
   const messageId = ctx.message.id ?? "";
   const timing = createInboundTimingTracker(extractXmtpSentAtMs2(ctx.message));
+  const subscriptionPrecheckRawText = extractRawText(ctx.message.content);
+  const subscriptionPrecheckParse = parseJson2(subscriptionPrecheckRawText);
+  if (subscriptionPrecheckParse.ok && isSubscriptionEnvelope(subscriptionPrecheckParse.data)) {
+    const { chatType: subscriptionChatType, conversationId: subscriptionConversationId } = getConversationInfo(ctx.conversation);
+    const gateDecision = decideSubscriptionGate({
+      // getConversationInfo's declared StoredChatType also lists "system",
+      // but that value is only ever produced for stored-message bookkeeping
+      // elsewhere in this file — the conversation-type branch above never
+      // returns it, so this narrowing is safe.
+      chatType: subscriptionChatType === "system" ? "unknown" : subscriptionChatType,
+      payload: subscriptionPrecheckParse.data,
+      senderInboxId: ctx.message.senderInboxId ?? ""
+    });
+    return processSubscriptionInbound(ctx, deps, {
+      decision: gateDecision,
+      conversationId: subscriptionConversationId,
+      messageId: messageId || `subscription-${(0, import_node_crypto15.randomUUID)()}`
+    });
+  }
   if (messageId && !tryMarkProcessed(messageId)) {
     logWithTimestamp(`[okx-agent-task:${deps.myXmtpAddress}] duplicate message ignored: ${messageId}`);
     logger.info(LogEvent.INBOUND_IGNORED_DUPLICATE, timing.extras({
@@ -68984,19 +70266,6 @@ async function processFileMessage(ctx, deps, options = {}) {
     chatType,
     ...extra
   });
-  if (chatType === "dm") {
-    const dmTrustStartedAt = Date.now();
-    const trusted = await isTrustedDmSender({
-      myXmtpAddress: deps.myXmtpAddress,
-      senderInboxId: ctx.message.senderInboxId ?? "",
-      messageId,
-      conversationId
-    });
-    timing.mark("dmTrustCheck", dmTrustStartedAt);
-    if (!trusted) {
-      return true;
-    }
-  }
   const parseStartedAt = Date.now();
   const receivedRawText = extractRawText(ctx.message.content);
   const parseResult = parseJson2(receivedRawText);
@@ -69012,9 +70281,26 @@ async function processFileMessage(ctx, deps, options = {}) {
     }
   }
   timing.mark("payloadParse", parseStartedAt);
+  const parsedDmData = parseResult.ok ? parseResult.data : null;
+  const parsedDmMessage = isPlainObject5(parsedDmData) && isPlainObject5(parsedDmData.message) ? parsedDmData.message : null;
+  const dmCarriesSystemMarkers = parsedDmMessage?.isDirectToUser === true || parsedDmMessage?.source === "system" || parsedDmMessage?.isDirectCommunication === true;
+  const isA2ADm = chatType === "dm" && parseResult.ok && isA2AEnvelope(parseResult.data) && !dmCarriesSystemMarkers;
+  if (chatType === "dm" && !isA2ADm) {
+    const dmTrustStartedAt = Date.now();
+    const trusted = await isTrustedDmSender({
+      myXmtpAddress: deps.myXmtpAddress,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      messageId,
+      conversationId
+    });
+    timing.mark("dmTrustCheck", dmTrustStartedAt);
+    if (!trusted) {
+      return true;
+    }
+  }
   const directToUser = chatType === "dm" && parseResult.ok ? extractDirectToUserNotification(parseResult.data) : { kind: "none" };
   if (directToUser.kind === "invalid") {
-    const droppedMessageId = messageId || `direct-to-user-${(0, import_node_crypto14.randomUUID)()}`;
+    const droppedMessageId = messageId || `direct-to-user-${(0, import_node_crypto15.randomUUID)()}`;
     logger.error(
       LogEvent.INBOUND_DROP_DM_INVALID_PAYLOAD,
       new Error("Invalid direct-to-user system DM"),
@@ -69038,7 +70324,7 @@ async function processFileMessage(ctx, deps, options = {}) {
     await dispatchDirectToUserNotification({
       deps,
       notification: directToUser.notification,
-      messageId: messageId || `direct-to-user-${(0, import_node_crypto14.randomUUID)()}`,
+      messageId: messageId || `direct-to-user-${(0, import_node_crypto15.randomUUID)()}`,
       timing,
       source: options.source ?? "live"
     });
@@ -69046,7 +70332,7 @@ async function processFileMessage(ctx, deps, options = {}) {
   }
   const systemNotification = chatType === "dm" && parseResult.ok ? extractSystemNotification(parseResult.data) : null;
   if (systemNotification) {
-    const systemMessageId = messageId || `system-${(0, import_node_crypto14.randomUUID)()}`;
+    const systemMessageId = messageId || `system-${(0, import_node_crypto15.randomUUID)()}`;
     logWithTimestamp(
       `[okx-agent-task:${deps.myXmtpAddress}] xmtp_system_message_received agentId=${systemNotification.agentId ?? ""} msg=${shortenLogValue(systemMessageId)} event=${systemNotification.event ?? ""} job=${shortenLogValue(systemNotification.jobId)} conv=${conversationId} source=${options.source ?? "live"} rawBytes=${Buffer.byteLength(rawText, "utf8")} rawPreview=${previewRawEnvelope(rawText)}`
     );
@@ -69207,7 +70493,7 @@ async function processFileMessage(ctx, deps, options = {}) {
   timing.mark("routeResolve", routeStartedAt);
   if (route.route === "job" && parseResult.ok && isA2AEnvelope(parseResult.data) && !isValidExternalJobId(route.jobId)) {
     const payloadObject = parseResult.data;
-    const sender = isPlainObject3(payloadObject.sender) ? payloadObject.sender : null;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
     logWithTimestamp(
       `[okx-agent-task:${deps.myXmtpAddress}] inbound A2A message has invalid jobId, dropping: jobLength=${route.jobId.length} group=${conversationId}`
     );
@@ -69236,7 +70522,32 @@ async function processFileMessage(ctx, deps, options = {}) {
     });
     return true;
   }
-  if (route.route === "job" && chatType !== "group") {
+  if (isA2ADm && route.route !== "job") {
+    const payloadObject = parseResult.data;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
+    recordInvalidXmtpMessageBestEffort({
+      messageId,
+      groupId: conversationId,
+      jobId: null,
+      agentId: readString5(sender?.agentId),
+      localAgentId: XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId ?? null,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      reason: "dm_a2a_missing_job_id",
+      stage: "inbound/job_id_validation",
+      logTag: `[okx-agent-task:${deps.myXmtpAddress}]`
+    });
+    logger.info(LogEvent.INBOUND_DROP_INVALID_JOBID, {
+      ...agentExtras({ walletAddress: deps.myXmtpAddress }),
+      conversationId,
+      messageId,
+      chatType,
+      peerInboxId: ctx.message.senderInboxId ?? "",
+      ...inboundStageExtras("inbound/job_id_validation", "dropped"),
+      reason: "dm_a2a_missing_job_id"
+    });
+    return true;
+  }
+  if (route.route === "job" && chatType !== "group" && !isA2ADm) {
     const providerBindStartedAt = Date.now();
     const providerGate = await bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
     timing.mark("providerBind", providerBindStartedAt);
@@ -69276,7 +70587,7 @@ async function processFileMessage(ctx, deps, options = {}) {
     );
   }
   if (route.route === "job" && chatType === "group") {
-    const payloadObject = isPlainObject3(parseResult.ok ? parseResult.data : null) ? parseResult.data : null;
+    const payloadObject = isPlainObject5(parseResult.ok ? parseResult.data : null) ? parseResult.data : null;
     const service = XmtpService.getInstance();
     const trustedSystemSender = service.isTrustedSystemAccountSender({
       senderAddress,
@@ -69302,7 +70613,7 @@ async function processFileMessage(ctx, deps, options = {}) {
       });
       return true;
     }
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     const localAgent = service.getAgentByAddress(deps.myXmtpAddress);
     const myAgentId = localAgent?.agentId ?? readString5(payloadObject?.receiverAgentId) ?? sessionAgentId ?? null;
     const toAgentId = readString5(sender?.agentId);
@@ -69342,7 +70653,7 @@ async function processFileMessage(ctx, deps, options = {}) {
       }));
       return true;
     }
-    const routedMessageId = messageId || `group-${(0, import_node_crypto14.randomUUID)()}`;
+    const routedMessageId = messageId || `group-${(0, import_node_crypto15.randomUUID)()}`;
     const sessionKey = ensureInboundGroupSession(deps, {
       jobId: route.jobId,
       myAgentId,
@@ -69407,8 +70718,102 @@ async function processFileMessage(ctx, deps, options = {}) {
     );
     return true;
   }
+  if (route.route === "job" && isA2ADm) {
+    const payloadObject = parseResult.data;
+    const accepted = await verifyInboundA2AGroupMessage({
+      payload: parseResult.data,
+      myXmtpAddress: deps.myXmtpAddress,
+      senderAddress,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      jobId: route.jobId,
+      groupId: conversationId,
+      messageId,
+      consentState: void 0,
+      trustedSystemSender: false,
+      isOfflineReplay: options.isOfflineReplay ?? false,
+      timing
+    });
+    if (!accepted) {
+      return true;
+    }
+    const providerBindStartedAt = Date.now();
+    const providerGate = await bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
+    timing.mark("providerBind", providerBindStartedAt);
+    if (!providerGate.allowed) {
+      logger.info(LogEvent.INBOUND_IGNORED_NON_BUSINESS, timing.extras({
+        ...buildInboundTerminalExtras({
+          terminalState: "provider_gate_denied",
+          myXmtpAddress: deps.myXmtpAddress,
+          messageId,
+          conversationId,
+          chatType,
+          jobId: route.jobId,
+          route: route.route,
+          reason: "job_provider_gate_denied"
+        }),
+        routeReason: route.routeReason,
+        providerBinding: providerGate.provider ?? ""
+      }));
+      return true;
+    }
+    const myAgentId = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId ?? readString5(payloadObject.receiverAgentId) ?? sessionAgentId ?? null;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
+    const toAgentId = readString5(sender?.agentId);
+    const routedMessageId = messageId || `dm-${(0, import_node_crypto15.randomUUID)()}`;
+    const sessionKey = ensureInboundGroupSession(deps, {
+      jobId: route.jobId,
+      myAgentId,
+      toAgentId,
+      groupId: null,
+      toAgentXmtpAddress: senderAddress || readString5(payloadObject.fromXmtpAddress)
+    });
+    const dispatchStartedAt = Date.now();
+    void Promise.resolve(deps.onSessionMessage?.({
+      sessionKey,
+      content: rawText,
+      messageId: routedMessageId,
+      jobId: route.jobId,
+      agentId: myAgentId
+    })).then(() => {
+      timing.mark("sessionDispatch", dispatchStartedAt);
+      logger.info(LogEvent.INBOUND_DELIVERED, commonDeliveryExtras({
+        taskId: route.jobId,
+        agentId: myAgentId ?? "",
+        peerWalletAddress: senderAddress,
+        peerInboxId: ctx.message.senderInboxId ?? "",
+        peerAgentId: toAgentId ?? "",
+        sessionKey,
+        messageId: routedMessageId,
+        route: "dm",
+        ...inboundStageExtras("inbound/dm_session_dispatch", "success"),
+        dispatchTarget: deps.onSessionMessage ? "session" : "none"
+      }));
+    }).catch((err2) => {
+      logWithTimestamp(`[okx-agent-task:${deps.myXmtpAddress}] onSessionMessage failed:`, err2);
+      logger.error(LogEvent.INBOUND_DISPATCH_FAILED, toLoggableError(err2), timing.extras({
+        ...buildInboundTerminalExtras({
+          terminalState: "dispatch_failed",
+          myXmtpAddress: deps.myXmtpAddress,
+          messageId: routedMessageId,
+          conversationId,
+          chatType,
+          jobId: route.jobId,
+          sessionKey,
+          route: "dm",
+          reason: "session_dispatch_failed"
+        }),
+        checkpoint: "inbound/dm_session_dispatch_failed",
+        agentId: myAgentId ?? "",
+        peerAgentId: toAgentId ?? ""
+      }));
+    });
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] session dispatch queued route=dm session=${sessionKey} message=${shortenLogValue(routedMessageId)} ${summarizePayloadForLog(parseResult.data)}`
+    );
+    return true;
+  }
   const stored = {
-    id: messageId || `local-${(0, import_node_crypto14.randomUUID)()}`,
+    id: messageId || `local-${(0, import_node_crypto15.randomUUID)()}`,
     direction: "inbound",
     route: route.route,
     routeReason: route.routeReason,
@@ -69426,8 +70831,8 @@ async function processFileMessage(ctx, deps, options = {}) {
   await deps.store.append(route.jobId, stored, sessionAgentId);
   timing.mark("storeAppend", storeAppendStartedAt);
   if ((route.route === "job" || parseResult.ok && !isA2AEnvelope(stored.payload)) && !options.skipNotify) {
-    const payloadObject = isPlainObject3(stored.payload) ? stored.payload : null;
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const payloadObject = isPlainObject5(stored.payload) ? stored.payload : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     const localAgent = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress);
     const sessionKey = route.route === "job" ? buildSessionKey({
       jobId: route.jobId,
@@ -69445,8 +70850,8 @@ async function processFileMessage(ctx, deps, options = {}) {
     });
   }
   if (route.route === "job" && chatType === "group" && conversationId && senderAddress) {
-    const payloadObject = isPlainObject3(stored.payload) ? stored.payload : null;
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const payloadObject = isPlainObject5(stored.payload) ? stored.payload : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     await deps.store.updateXmtpSession(route.jobId, {
       xmtpGroupId: conversationId,
       myXmtpAddress: deps.myXmtpAddress,
@@ -69589,7 +70994,7 @@ function processOfflineFromCoreDeps(store, ctx, deps, options) {
 function buildSystemStoredMessage(params) {
   const now = Date.now();
   return {
-    id: params.id ?? `system-${now}-${(0, import_node_crypto14.randomUUID)()}`,
+    id: params.id ?? `system-${now}-${(0, import_node_crypto15.randomUUID)()}`,
     direction: "system",
     route: "backup",
     routeReason: params.reason,
@@ -69605,14 +71010,14 @@ function buildSystemStoredMessage(params) {
   };
 }
 function isA2AEnvelope(payload) {
-  return isPlainObject3(payload) && payload.msgType === A2A_MESSAGE_TYPE;
+  return isPlainObject5(payload) && payload.msgType === A2A_MESSAGE_TYPE;
 }
-var import_node_crypto14, PROCESSED_IDS_MAX, processedMessageIds, EXTERNAL_JOB_ID_PATTERN, INBOUND_TRANSPORT, INBOUND_EVENT_FAMILY, INBOUND_TERMINAL_FIELDS;
+var import_node_crypto15, PROCESSED_IDS_MAX, processedMessageIds, EXTERNAL_JOB_ID_PATTERN, INBOUND_TRANSPORT, INBOUND_EVENT_FAMILY, INBOUND_TERMINAL_FIELDS;
 var init_message_handler = __esm({
   "src/message-handler.ts"() {
     "use strict";
     init_log();
-    import_node_crypto14 = require("node:crypto");
+    import_node_crypto15 = require("node:crypto");
     init_dist2();
     init_a2a();
     init_envelope_shared();
@@ -69627,6 +71032,10 @@ var init_message_handler = __esm({
     init_session_store();
     init_agent_message_notice();
     init_ai_provider();
+    init_subscription_envelope();
+    init_subscription_inbound();
+    init_list_jobs_by_verified_sender();
+    init_subscription_telemetry();
     PROCESSED_IDS_MAX = 1e3;
     processedMessageIds = /* @__PURE__ */ new Map();
     EXTERNAL_JOB_ID_PATTERN = /^0x[0-9a-fA-F]{64}$/;
@@ -69680,7 +71089,7 @@ function isOriginalParentProcessAlive(options) {
 }
 function registerUserAttentionWatcher(options) {
   return options.store.registerUserAttentionWatcher({
-    id: options.id ?? (0, import_node_crypto15.randomUUID)(),
+    id: options.id ?? (0, import_node_crypto16.randomUUID)(),
     provider: options.provider,
     jobId: options.jobId,
     nowMs: options.nowMs ?? Date.now(),
@@ -69759,11 +71168,11 @@ function userWatchEventDeliveredSentryExtra(event) {
     hasDecision: String(event.hasDecision)
   };
 }
-var import_node_crypto15, USER_ATTENTION_WATCH_REPLACED_MESSAGE, USER_ATTENTION_WATCHER_SCAN_MS, USER_ATTENTION_WATCHER_TTL_MS, USER_ATTENTION_WATCH_PARENT_CHECK_MS;
+var import_node_crypto16, USER_ATTENTION_WATCH_REPLACED_MESSAGE, USER_ATTENTION_WATCHER_SCAN_MS, USER_ATTENTION_WATCHER_TTL_MS, USER_ATTENTION_WATCH_PARENT_CHECK_MS;
 var init_user_attention_watchers = __esm({
   "src/user-attention-watchers.ts"() {
     "use strict";
-    import_node_crypto15 = require("node:crypto");
+    import_node_crypto16 = require("node:crypto");
     init_sentry_logger();
     USER_ATTENTION_WATCH_REPLACED_MESSAGE = "Another okx-a2a user watch with the same job scope was started, so this watcher has been closed. Do not run this watch command again automatically, because starting another watcher may interrupt a different session that is already monitoring task progress.";
     USER_ATTENTION_WATCHER_SCAN_MS = 500;
@@ -69785,6 +71194,7 @@ __export(listener_exports, {
   ListenerDeferredTaskScheduler: () => ListenerDeferredTaskScheduler,
   ListenerMaintenanceGate: () => ListenerMaintenanceGate,
   XMTP_CLIENT_RECYCLE_INTERVAL_ENV: () => XMTP_CLIENT_RECYCLE_INTERVAL_ENV,
+  buildUpgradeRecommendationNotice: () => buildUpgradeRecommendationNotice,
   getHermesGatewayPluginStatus: () => getHermesGatewayPluginStatus,
   hermesConfigEnablesOkxA2a: () => hermesConfigEnablesOkxA2a,
   isGatewayAvailableForHeartbeat: () => isGatewayAvailableForHeartbeat,
@@ -69801,6 +71211,34 @@ async function runHeartbeatRefreshCycle(options) {
   const refresh = options.refresh && refreshAllowed ? await timeSettled(options.refresh) : void 0;
   return { heartbeat, versionRefresh, refresh };
 }
+function buildUpgradeRecommendationNotice(input) {
+  const capability = input.capability?.trim() ?? "";
+  if (capability === MESSAGE_ELIGIBLE_OFFLINE_REPLAY_HELP_TOKEN) {
+    return {
+      title: "OnchainOS upgrade recommended",
+      content: "The installed OnchainOS version does not support offline-replay preferences. Subscription messages will continue to replay normally. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade",
+      idempotencyKey: UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+    };
+  }
+  if (capability === LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN) {
+    return {
+      title: "OnchainOS upgrade required for Subscription Shared Group",
+      content: "The installed OnchainOS version does not support the verified-sender task query required by Subscription Shared Group. Until OnchainOS is upgraded, Subscription Shared Group messages fail closed and are NOT routed to an AI Session. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade",
+      idempotencyKey: LIST_JOBS_UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+    };
+  }
+  const capabilitySlug = capability ? capability.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") : "";
+  const idempotencyKey = capabilitySlug ? `system:onchainos-${capabilitySlug}-upgrade` : "system:onchainos-capability-upgrade";
+  const capabilityLabel = capability || "a required capability";
+  const reasonSuffix = input.reason?.trim() ? ` ${input.reason.trim()}` : "";
+  return {
+    title: "OnchainOS upgrade recommended",
+    content: `The installed OnchainOS version does not support ${capabilityLabel}.${reasonSuffix} Upgrade OnchainOS to enable this capability.
+
+Suggested command: onchainos upgrade`,
+    idempotencyKey
+  };
+}
 function resolveOfflineReplayIntervalSec(systemConfig) {
   const interval = systemConfig.offlineReplayInterval;
   if (typeof interval !== "number" || !Number.isFinite(interval) || interval <= 0) {
@@ -70028,8 +71466,12 @@ async function runListenerWithLock(options, paths) {
       onJobMessageStored: async (event) => {
         await enqueueAiJobMessageDispatch({ commands, event });
       },
+      // Returns { created } so the V2 subscription fan-out can distinguish a
+      // durable DB duplicate (idempotent success) from a fresh enqueue. V1
+      // group/system callers ignore the return; their events carry no
+      // idempotencyKey, so the plain submit path (unchanged) is used.
       onSessionMessage: async (event) => {
-        await enqueueAiSessionMessageDispatch({ commands, event });
+        return enqueueAiSessionMessageDispatchIdempotent({ commands, event });
       }
     }),
     processOfflineMessage: (ctx, deps, replayOptions) => processOfflineFromCoreDeps(store, ctx, deps, {
@@ -70039,7 +71481,7 @@ async function runListenerWithLock(options, paths) {
         await enqueueAiJobMessageDispatch({ commands, event });
       },
       onSessionMessage: async (event) => {
-        await enqueueAiSessionMessageDispatch({ commands, event });
+        return enqueueAiSessionMessageDispatchIdempotent({ commands, event });
       }
     }),
     notifySessionExpired: (command) => {
@@ -70057,12 +71499,12 @@ async function runListenerWithLock(options, paths) {
       });
     },
     notifyUpgradeRecommendation: (input) => {
-      const content2 = "The installed OnchainOS version does not support offline-replay preferences. Subscription messages will continue to replay normally. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade";
+      const notice = buildUpgradeRecommendationNotice(input);
       void notifySystemMessageToUser({
-        title: "OnchainOS upgrade recommended",
-        content: content2,
+        title: notice.title,
+        content: notice.content,
         store: sessionStore,
-        idempotencyKey: UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+        idempotencyKey: notice.idempotencyKey
       }).catch((err2) => {
         logWithTimestamp(
           `[okx-agent-task] upgrade recommendation notify failed component=${input.component} capability=${input.capability}:`,
@@ -70071,12 +71513,12 @@ async function runListenerWithLock(options, paths) {
       });
     }
   });
-  service.setPluginVersion("0.2.17");
+  service.setPluginVersion("0.2.18-beta-4dd056b897-261015113839");
   await service.init();
   const pluginVersionStatus = service.pluginVersionStatus;
   if (pluginVersionStatus.unavailable) {
     throw new Error(
-      `@okxweb3/a2a-node v${"0.2.17"} is below the required minimum v${pluginVersionStatus.minVersion}`
+      `@okxweb3/a2a-node v${"0.2.18-beta-4dd056b897-261015113839"} is below the required minimum v${pluginVersionStatus.minVersion}`
     );
   }
   const systemConfig = service.getSystemConfig();
@@ -70104,7 +71546,7 @@ async function runListenerWithLock(options, paths) {
       onchainosAgentId: "*",
       reason: "system-config missing sentryDsn",
       pluginId: "@okxweb3/a2a-node",
-      pluginVersion: "0.2.17"
+      pluginVersion: "0.2.18-beta-4dd056b897-261015113839"
     });
   }
   logWithTimestamp(
@@ -70454,7 +71896,7 @@ async function timeSettled(fn) {
     return { durationMs: Date.now() - startedAt, error };
   }
 }
-var import_node_fs27, import_promises13, import_node_os10, import_node_path32, DEFAULT_OFFLINE_REPLAY_INTERVAL_SEC, DEFAULT_XMTP_CLIENT_RECYCLE_INTERVAL_SEC, XMTP_CLIENT_RECYCLE_INTERVAL_ENV, HEARTBEAT_GATEWAY_CHECK_TIMEOUT_MS, AUTH_RECOVERY_PROBE_INTERVAL_MS, AUTH_RECOVERY_REFRESH_BACKOFF_MS, AgentRefreshAuthGate, AgentRefreshCoordinator, ListenerDeferredTaskScheduler, ListenerMaintenanceGate, UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY, SHUTDOWN_FORCE_RESOLVE_MS;
+var import_node_fs27, import_promises13, import_node_os10, import_node_path32, DEFAULT_OFFLINE_REPLAY_INTERVAL_SEC, DEFAULT_XMTP_CLIENT_RECYCLE_INTERVAL_SEC, XMTP_CLIENT_RECYCLE_INTERVAL_ENV, HEARTBEAT_GATEWAY_CHECK_TIMEOUT_MS, AUTH_RECOVERY_PROBE_INTERVAL_MS, AUTH_RECOVERY_REFRESH_BACKOFF_MS, AgentRefreshAuthGate, AgentRefreshCoordinator, ListenerDeferredTaskScheduler, ListenerMaintenanceGate, UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY, LIST_JOBS_UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY, SHUTDOWN_FORCE_RESOLVE_MS;
 var init_listener = __esm({
   "src/listener.ts"() {
     "use strict";
@@ -70467,6 +71909,7 @@ var init_listener = __esm({
     init_onchainos();
     init_system_config();
     init_offline_replay_capability();
+    init_list_jobs_by_verified_sender();
     init_signer();
     init_bin();
     init_xmtp_sdk();
@@ -70647,6 +72090,7 @@ var init_listener = __esm({
       }
     };
     UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY = "system:onchainos-offline-replay-upgrade";
+    LIST_JOBS_UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY = "system:onchainos-list-jobs-by-verified-sender-upgrade";
     SHUTDOWN_FORCE_RESOLVE_MS = 5e3;
   }
 });
@@ -88736,7 +90180,7 @@ var require_fetch_pb = __commonJS({
         }
       });
     }
-    function isPlainObject4(value) {
+    function isPlainObject6(value) {
       const isObject = Object.prototype.toString.call(value).slice(8, -1) === "Object";
       const isObjLike = value !== null && isObject;
       if (!isObjLike || !isObject) {
@@ -88759,7 +90203,7 @@ var require_fetch_pb = __commonJS({
         const isNonEmptyPrimitiveArray = Array.isArray(value) && value.every((v) => isPrimitive(v)) && value.length > 0;
         const isNonZeroValuePrimitive = isPrimitive(value) && !isZeroValuePrimitive(value);
         let objectToMerge = {};
-        if (isPlainObject4(value)) {
+        if (isPlainObject6(value)) {
           objectToMerge = flattenRequestPayload(value, newPath);
         } else if (isNonZeroValuePrimitive || isNonEmptyPrimitiveArray) {
           objectToMerge = { [newPath]: value };
@@ -114328,10 +115772,10 @@ var require_node4 = __commonJS({
 
 // ../../node_modules/@xmtp/content-type-remote-attachment/dist/index.js
 async function encrypt(plain, secret, additionalData) {
-  const salt = import_node_crypto16.webcrypto.getRandomValues(new Uint8Array(KDFSaltSize));
-  const nonce = import_node_crypto16.webcrypto.getRandomValues(new Uint8Array(AESGCMNonceSize));
+  const salt = import_node_crypto17.webcrypto.getRandomValues(new Uint8Array(KDFSaltSize));
+  const nonce = import_node_crypto17.webcrypto.getRandomValues(new Uint8Array(AESGCMNonceSize));
   const key = await hkdf(secret, salt);
-  const encrypted = await import_node_crypto16.webcrypto.subtle.encrypt(aesGcmParams(nonce), key, plain);
+  const encrypted = await import_node_crypto17.webcrypto.subtle.encrypt(aesGcmParams(nonce), key, plain);
   return new Ciphertext({
     aes256GcmHkdfSha256: {
       payload: new Uint8Array(encrypted),
@@ -114345,7 +115789,7 @@ async function decrypt(encrypted, secret, additionalData) {
     throw new Error("invalid payload ciphertext");
   }
   const key = await hkdf(secret, encrypted.aes256GcmHkdfSha256.hkdfSalt);
-  const decrypted = await import_node_crypto16.webcrypto.subtle.decrypt(aesGcmParams(encrypted.aes256GcmHkdfSha256.gcmNonce), key, encrypted.aes256GcmHkdfSha256.payload);
+  const decrypted = await import_node_crypto17.webcrypto.subtle.decrypt(aesGcmParams(encrypted.aes256GcmHkdfSha256.gcmNonce), key, encrypted.aes256GcmHkdfSha256.payload);
   return new Uint8Array(decrypted);
 }
 function aesGcmParams(nonce, additionalData) {
@@ -114356,18 +115800,18 @@ function aesGcmParams(nonce, additionalData) {
   return spec;
 }
 async function hkdf(secret, salt) {
-  const key = await import_node_crypto16.webcrypto.subtle.importKey("raw", secret, "HKDF", false, [
+  const key = await import_node_crypto17.webcrypto.subtle.importKey("raw", secret, "HKDF", false, [
     "deriveKey"
   ]);
-  return import_node_crypto16.webcrypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt, info: hkdfNoInfo }, key, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+  return import_node_crypto17.webcrypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt, info: hkdfNoInfo }, key, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
 }
-var import_proto, import_node_crypto16, ContentTypeAttachment, AttachmentCodec, KDFSaltSize, AESGCMNonceSize, AESGCMTagLength, Ciphertext, hkdfNoInfo, ContentTypeRemoteAttachment, RemoteAttachmentCodec;
+var import_proto, import_node_crypto17, ContentTypeAttachment, AttachmentCodec, KDFSaltSize, AESGCMNonceSize, AESGCMTagLength, Ciphertext, hkdfNoInfo, ContentTypeRemoteAttachment, RemoteAttachmentCodec;
 var init_dist6 = __esm({
   "../../node_modules/@xmtp/content-type-remote-attachment/dist/index.js"() {
     init_dist5();
     init_secp256k12();
     import_proto = __toESM(require_node4(), 1);
-    import_node_crypto16 = require("node:crypto");
+    import_node_crypto17 = require("node:crypto");
     ContentTypeAttachment = new ContentTypeId({
       authorityId: "xmtp.org",
       typeId: "attachment",
@@ -114447,7 +115891,7 @@ var init_dist6 = __esm({
         if (payload.length === 0) {
           throw new Error(`no payload for remote attachment at ${remoteAttachment.url}`);
         }
-        const digestBytes = new Uint8Array(await import_node_crypto16.webcrypto.subtle.digest("SHA-256", payload));
+        const digestBytes = new Uint8Array(await import_node_crypto17.webcrypto.subtle.digest("SHA-256", payload));
         const digest = etc.bytesToHex(digestBytes);
         if (digest !== remoteAttachment.contentDigest) {
           throw new Error("content digest does not match");
@@ -114471,7 +115915,7 @@ var init_dist6 = __esm({
         return codec.decode(encodedContent, codecRegistry);
       }
       static async encodeEncrypted(content$1, codec) {
-        const secret = import_node_crypto16.webcrypto.getRandomValues(new Uint8Array(32));
+        const secret = import_node_crypto17.webcrypto.getRandomValues(new Uint8Array(32));
         const encodedContent = import_proto.content.EncodedContent.encode(codec.encode(content$1, {
           codecFor() {
             return void 0;
@@ -114484,7 +115928,7 @@ var init_dist6 = __esm({
         if (!salt || !nonce || !payload) {
           throw new Error("missing encryption key");
         }
-        const digestBytes = new Uint8Array(await import_node_crypto16.webcrypto.subtle.digest("SHA-256", payload));
+        const digestBytes = new Uint8Array(await import_node_crypto17.webcrypto.subtle.digest("SHA-256", payload));
         const digest = etc.bytesToHex(digestBytes);
         return {
           digest,
@@ -114702,7 +116146,7 @@ async function uploadFile(params) {
   const attachment = { filename, mimeType, data: new Uint8Array(data) };
   const encrypted = await RemoteAttachmentCodec.encodeEncrypted(attachment, new AttachmentCodec());
   ensureFileDirs();
-  const encryptedPath = (0, import_node_path35.resolve)(FILE_WORK_DIR, `${(0, import_node_crypto17.randomUUID)()}.enc`);
+  const encryptedPath = (0, import_node_path35.resolve)(FILE_WORK_DIR, `${(0, import_node_crypto18.randomUUID)()}.enc`);
   (0, import_node_fs29.writeFileSync)(encryptedPath, encrypted.payload);
   try {
     const stdout = runOnchainos([
@@ -114746,7 +116190,7 @@ async function uploadFile(params) {
 }
 async function downloadFile(params) {
   ensureFileDirs();
-  const encryptedPath = (0, import_node_path35.resolve)(FILE_WORK_DIR, `${(0, import_node_crypto17.randomUUID)()}.enc`);
+  const encryptedPath = (0, import_node_path35.resolve)(FILE_WORK_DIR, `${(0, import_node_crypto18.randomUUID)()}.enc`);
   try {
     const stdout = runOnchainos([
       "agent",
@@ -114771,7 +116215,7 @@ async function downloadFile(params) {
       throw new Error(`file download failed: ${stdout}`);
     }
     const payload = new Uint8Array((0, import_node_fs29.readFileSync)(encryptedPath));
-    const digestBytes = new Uint8Array(await import_node_crypto17.webcrypto.subtle.digest("SHA-256", payload));
+    const digestBytes = new Uint8Array(await import_node_crypto18.webcrypto.subtle.digest("SHA-256", payload));
     const actualDigest = Array.from(digestBytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
     if (actualDigest !== params.digest) {
       throw new Error(`file download digest verification failed: expected=${params.digest}, actual=${actualDigest}`);
@@ -114779,7 +116223,7 @@ async function downloadFile(params) {
     const decryptedBytes = await decryptAttachmentPayload(payload, params);
     const encodedContent = import_proto2.content.EncodedContent.decode(decryptedBytes);
     const attachment = new AttachmentCodec().decode(encodedContent);
-    const outputFilename = params.filename || attachment.filename || `${(0, import_node_crypto17.randomUUID)()}.bin`;
+    const outputFilename = params.filename || attachment.filename || `${(0, import_node_crypto18.randomUUID)()}.bin`;
     const outputDir = DOWNLOADS_DIR;
     ensureA2aTaskDir(outputDir);
     const outputPath = (0, import_node_path35.resolve)(outputDir, (0, import_node_path35.basename)(outputFilename));
@@ -114796,15 +116240,15 @@ async function decryptAttachmentPayload(payload, params) {
   const secretBytes = new Uint8Array(Buffer.from(params.secret, "base64"));
   const saltBytes = new Uint8Array(Buffer.from(params.salt, "base64"));
   const nonceBytes = new Uint8Array(Buffer.from(params.nonce, "base64"));
-  const hkdfKey = await import_node_crypto17.webcrypto.subtle.importKey("raw", secretBytes, "HKDF", false, ["deriveKey"]);
-  const aesKey = await import_node_crypto17.webcrypto.subtle.deriveKey(
+  const hkdfKey = await import_node_crypto18.webcrypto.subtle.importKey("raw", secretBytes, "HKDF", false, ["deriveKey"]);
+  const aesKey = await import_node_crypto18.webcrypto.subtle.deriveKey(
     { name: "HKDF", hash: "SHA-256", salt: saltBytes, info: new Uint8Array().buffer },
     hkdfKey,
     { name: "AES-GCM", length: 256 },
     false,
     ["decrypt"]
   );
-  return new Uint8Array(await import_node_crypto17.webcrypto.subtle.decrypt({ name: "AES-GCM", iv: nonceBytes }, aesKey, toArrayBuffer(payload)));
+  return new Uint8Array(await import_node_crypto18.webcrypto.subtle.decrypt({ name: "AES-GCM", iv: nonceBytes }, aesKey, toArrayBuffer(payload)));
 }
 function toArrayBuffer(bytes) {
   return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
@@ -114944,12 +116388,12 @@ function readRequiredOption(args, name) {
   }
   return value;
 }
-var import_node_crypto17, import_node_fs29, import_node_path35, import_proto2, OKX_A2A_PATHS, OKX_A2A_HOME_DIR, FILE_WORK_DIR, DOWNLOADS_DIR, SYSTEM_CONFIG_PATH;
+var import_node_crypto18, import_node_fs29, import_node_path35, import_proto2, OKX_A2A_PATHS, OKX_A2A_HOME_DIR, FILE_WORK_DIR, DOWNLOADS_DIR, SYSTEM_CONFIG_PATH;
 var init_file_cli = __esm({
   "src/file-cli.ts"() {
     "use strict";
     init_win_spawn();
-    import_node_crypto17 = require("node:crypto");
+    import_node_crypto18 = require("node:crypto");
     import_node_fs29 = require("node:fs");
     import_node_path35 = require("node:path");
     init_dist6();
@@ -118447,7 +119891,7 @@ async function getCurrentNodeCliVersion() {
   return await getGlobalNpmPackageVersion(UPDATE_PACKAGES.node) ?? getBundledNodeCliVersion();
 }
 function getBundledNodeCliVersion() {
-  return true ? "0.2.17" : null;
+  return true ? "0.2.18-beta-4dd056b897-261015113839" : null;
 }
 function readConfiguredAiProvider() {
   const explicit = process.env.OKX_A2A_AI_PROVIDER || process.env.OKX_AGENT_TASK_AI_CLI;
@@ -118657,7 +120101,7 @@ async function updateHermes(release, options) {
   }
 }
 async function installGatewayPluginForDoctor(target) {
-  const release = isPrereleaseVersion("0.2.17") ? "beta" : "latest";
+  const release = isPrereleaseVersion("0.2.18-beta-4dd056b897-261015113839") ? "beta" : "latest";
   const insideTargetGateway = detectGatewayInvocation() === target;
   const options = {
     restart: !insideTargetGateway,
@@ -119710,7 +121154,7 @@ async function runDoctor(options = {}) {
     platform: options.platform ?? process.platform,
     env: options.env ?? process.env,
     target: options.target ?? resolveDoctorTarget(options.env ?? process.env),
-    cliVersion: options.cliVersion ?? (true ? "0.2.17" : "0.0.0"),
+    cliVersion: options.cliVersion ?? (true ? "0.2.18-beta-4dd056b897-261015113839" : "0.0.0"),
     fixMode: options.fix === true,
     nonInteractive: options.nonInteractive === true,
     packageChanged: false,
@@ -120817,7 +122261,7 @@ init_sentry_config();
 init_runtime_metadata();
 var CURRENT_GATEWAY_SESSION_KEYS_ENV4 = "OKX_A2A_CURRENT_GATEWAY_SESSION_KEYS";
 function printUsage3() {
-  console.log(`okx-a2a ${"0.2.17"}
+  console.log(`okx-a2a ${"0.2.18-beta-4dd056b897-261015113839"}
 
 Usage:
   okx-a2a <command> [options]
@@ -120847,6 +122291,8 @@ Commands:
               Alias for runtime switch-current
   job-provider Manage job-to-provider bindings
   xmtp-send    Queue an XMTP message through the running daemon
+  subscription-push
+              Queue a V2 subscription push to one or more XMTP Group conversations
   trade-records
               Insert, query, and soft-delete local business trade records
   capabilities Print machine-readable A2A capability negotiation status (used by OnchainOS)
@@ -120859,7 +122305,7 @@ Run \`okx-a2a <command> -h\` for command-specific help.
 `);
 }
 function printVersion() {
-  console.log("0.2.17");
+  console.log("0.2.18-beta-4dd056b897-261015113839");
 }
 function printDaemonUsage() {
   console.log(`Usage: okx-a2a daemon <start|restart|stop|status|autostart> [options]
@@ -120956,6 +122402,18 @@ Options:
   --json                      Print machine-readable output with ok boolean
 `);
 }
+function printSubscriptionPushUsage() {
+  console.log(`Usage: okx-a2a subscription-push --my-agent-id <id> --message <text> (--conversation-id <id> ... | --conversation-ids <id,id,...>) [options]
+
+Options:
+  --my-agent-id <id>           Local sender agent id used to resolve the XMTP client
+  --message <text>              Subscription content
+  --conversation-id <id>        Target Group conversationId (repeatable)
+  --conversation-ids <id,id>     Comma-separated list of target Group conversationIds
+  --delivery-id <id>             Optional deliveryId carried in the V2 envelope
+  --json                         Print machine-readable output with ok boolean
+`);
+}
 function printCommandUsage(command) {
   if (command === "daemon" || command === "start" || command === "restart" || command === "stop" || command === "status") {
     printDaemonUsage();
@@ -121025,6 +122483,10 @@ function printCommandUsage(command) {
     printXmtpSendUsage();
     return true;
   }
+  if (command === "subscription-push") {
+    printSubscriptionPushUsage();
+    return true;
+  }
   if (command === "trade-records") {
     printTradeRecordsUsageProxy();
     return true;
@@ -121352,6 +122814,79 @@ async function queueXmtpSend(args) {
     commands.close();
   }
 }
+async function queueXmtpSubscriptionPush(args) {
+  if (hasHelpFlag5(args)) {
+    printSubscriptionPushUsage();
+    return;
+  }
+  assertOnlyKnownOptions(args, {
+    command: "subscription-push",
+    options: /* @__PURE__ */ new Set([
+      "--my-agent-id",
+      "--message",
+      "--conversation-id",
+      "--conversation-ids",
+      "--delivery-id"
+    ]),
+    flags: /* @__PURE__ */ new Set(["--json"])
+  });
+  const json = hasFlag2(args, "--json");
+  const myAgentId = readOption5(args, "--my-agent-id");
+  const content2 = readOption5(args, "--message");
+  const deliveryId = readOption5(args, "--delivery-id");
+  const conversationIds = readSubscriptionPushConversationIds(args);
+  if (!myAgentId || !content2) {
+    throw new Error("subscription-push requires --my-agent-id and --message");
+  }
+  await assertDaemonRunningForQueuedCommand2("subscription-push");
+  const commands = new CommandStore();
+  try {
+    const command = commands.createXmtpSubscriptionPushCommand({
+      myAgentId,
+      content: content2,
+      conversationIds,
+      deliveryId
+    });
+    await commands.submit(command);
+    const result = await commands.waitForResult(command.id, Number.POSITIVE_INFINITY);
+    if (!result) {
+      printSubscriptionPushCommandResult(json, {
+        id: command.id,
+        ok: false,
+        completedAt: Date.now(),
+        error: "subscription-push finished without result"
+      });
+      process.exitCode = 1;
+      return;
+    }
+    if (!result.ok) {
+      printSubscriptionPushCommandResult(json, result);
+      process.exitCode = 1;
+      return;
+    }
+    printSubscriptionPushCommandResult(json, result);
+  } finally {
+    commands.close();
+  }
+}
+function readSubscriptionPushConversationIds(args) {
+  const ids = /* @__PURE__ */ new Set();
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--conversation-id" && args[i + 1]) {
+      ids.add(args[i + 1]);
+    }
+  }
+  const commaList = readOption5(args, "--conversation-ids");
+  if (commaList) {
+    for (const item of commaList.split(",")) {
+      const trimmed = item.trim();
+      if (trimmed) {
+        ids.add(trimmed);
+      }
+    }
+  }
+  return [...ids];
+}
 function parseXmtpSendPayloadOption(raw) {
   const trimmed = raw?.trim();
   if (!trimmed) {
@@ -121661,6 +123196,23 @@ function printXmtpSendCommandResult(json, result) {
   }
   console.log(`ok=false xmtp-send failed command=${result.id} error=${result.error ?? "unknown error"}`);
 }
+function printSubscriptionPushCommandResult(json, result) {
+  const payload = result.payload;
+  if (json) {
+    console.log(JSON.stringify({
+      ok: result.ok,
+      commandId: result.id,
+      payload: result.payload ?? null,
+      error: result.error ?? null
+    }));
+    return;
+  }
+  if (result.ok) {
+    console.log(`ok=true subscription-push command=${result.id} conversationCount=${payload?.conversationCount ?? 0} sentCount=${payload?.sentCount ?? 0} failedCount=${payload?.failedCount ?? 0}`);
+    return;
+  }
+  console.log(`ok=false subscription-push failed command=${result.id} error=${result.error ?? "unknown error"}`);
+}
 function formatDaemonCommandResult(type, result) {
   if (!result.ok) {
     return `ok=false ${type} command=${result.id} error=${result.error ?? "unknown error"}`;
@@ -122354,7 +123906,7 @@ async function main() {
   if (command === "xmtp-test") {
     const { handleXmtpTestCommand: handleXmtpTestCommand2 } = await Promise.resolve().then(() => (init_xmtp_test_cli(), xmtp_test_cli_exports));
     await handleXmtpTestCommand2(process.argv.slice(3), {
-      packageVersion: "0.2.17",
+      packageVersion: "0.2.18-beta-4dd056b897-261015113839",
       agentSdkVersion: "2.3.0",
       nodeSdkVersion: "6.1.0",
       nodeBindingsVersion: "1.11.0"
@@ -122367,6 +123919,12 @@ async function main() {
     await flushDirectCliSentry();
     return;
   }
+  if (command === "subscription-push") {
+    await initDirectCliSentry();
+    await queueXmtpSubscriptionPush(process.argv.slice(3));
+    await flushDirectCliSentry();
+    return;
+  }
   if (command === "task") {
     await initDirectCliSentry();
     await handleTaskCommand(process.argv.slice(3));