@okxweb3/a2a-node 0.2.17 → 0.2.18-beta-4dd056b897-261015113839

package/dist/index.js

@@ -4008,7 +4008,7 @@ var require_is = __commonJS({
     function isPrimitive(wat) {
       return wat === null || typeof wat !== "object" && typeof wat !== "function";
     }
-    function isPlainObject4(wat) {
+    function isPlainObject6(wat) {
       return isBuiltin(wat, "Object");
     }
     function isEvent(wat) {
@@ -4024,7 +4024,7 @@ var require_is = __commonJS({
       return Boolean(wat && wat.then && typeof wat.then === "function");
     }
     function isSyntheticEvent(wat) {
-      return isPlainObject4(wat) && "nativeEvent" in wat && "preventDefault" in wat && "stopPropagation" in wat;
+      return isPlainObject6(wat) && "nativeEvent" in wat && "preventDefault" in wat && "stopPropagation" in wat;
     }
     function isNaN2(wat) {
       return typeof wat === "number" && wat !== wat;
@@ -4047,7 +4047,7 @@ var require_is = __commonJS({
     exports2.isEvent = isEvent;
     exports2.isInstanceOf = isInstanceOf;
     exports2.isNaN = isNaN2;
-    exports2.isPlainObject = isPlainObject4;
+    exports2.isPlainObject = isPlainObject6;
     exports2.isPrimitive = isPrimitive;
     exports2.isRegExp = isRegExp;
     exports2.isString = isString;
@@ -19310,6 +19310,23 @@ var init_events = __esm({
       XMTP_RATE_LIMIT_CREATE_SUPPRESSED: "XMTP rate limit create suppressed",
       XMTP_RATE_LIMIT_PROBE: "XMTP rate limit probe",
       XMTP_RATE_LIMIT_RECOVERED: "XMTP rate limit recovered",
+      // ── subscription observability info (DEXMARKET-9096) ───────────
+      // All of the following logger.info checkpoints MUST also be listed in
+      // SENTRY_INFO_ALLOWLIST (index.ts): info() returns early for an unlisted
+      // event, which ships a checkpoint that looks implemented but emits nothing.
+      SUBSCRIPTION_PUSH_STARTED: "Subscription push started",
+      SUBSCRIPTION_PUSH_TARGETS_RESOLVED: "Subscription push targets resolved",
+      SUBSCRIPTION_PUSH_EMPTY_TARGETS: "Subscription push empty targets",
+      SUBSCRIPTION_PUSH_SUMMARY: "Subscription push summary",
+      SUBSCRIPTION_INBOUND_RECEIVED: "Subscription inbound received",
+      SUBSCRIPTION_INBOUND_GATE_DROPPED: "Subscription inbound gate dropped",
+      SUBSCRIPTION_JOBS_QUERY_STARTED: "Subscription jobs query started",
+      SUBSCRIPTION_JOBS_QUERY_SUCCEEDED: "Subscription jobs query succeeded",
+      SUBSCRIPTION_JOBS_EMPTY: "Subscription jobs empty",
+      SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED: "Subscription inbound ownership routed",
+      SUBSCRIPTION_JOB_DISPATCHED: "Subscription job dispatched",
+      SUBSCRIPTION_JOB_DUPLICATE_IGNORED: "Subscription job duplicate ignored",
+      SUBSCRIPTION_FANOUT_SUMMARY: "Subscription fan-out summary",
       // ── error ─────────────────────────────────────────────────────
       XMTP_CONNECTION_FAILED: "XMTP connection failed",
       CONVERSATIONS_STREAM_FAILED: "conversations.stream failed",
@@ -19376,6 +19393,13 @@ var init_events = __esm({
       AGENT_INSTALLATION_LIMIT_NEAR: "Agent installation limit near",
       XMTP_HISTORY_SYNC_REQUEST_FAILED: "XMTP history sync request failed",
       XMTP_DEBUG_SYNC_FAILED: "XMTP debug sync failed",
+      // ── subscription observability error (DEXMARKET-9096) ──────────
+      // error-level: always emitted (no allowlist gate). Error objects are
+      // classified by buildErrorDiagnostics — never attach raw Error.message.
+      SUBSCRIPTION_PUSH_TARGET_FAILED: "Subscription push target failed",
+      SUBSCRIPTION_INBOUND_AGENTIC_ID_MISSING: "Subscription inbound agenticId missing",
+      SUBSCRIPTION_JOBS_FAIL_CLOSED: "Subscription jobs fail closed",
+      SUBSCRIPTION_JOB_FAILED: "Subscription job failed",
       // Underlying XMTP SDK client close failed during recycle/removal/shutdown
       // (DEXMARKET-9116). Error-level → NOT added to SENTRY_INFO_ALLOWLIST.
       XMTP_CLIENT_CLOSE_FAILED: "XMTP client close failed"
@@ -19439,7 +19463,7 @@ function resolveDeliveryId(input) {
   if (slots.every((slot) => slot === "")) {
     return UNKNOWN_LOG_FIELD;
   }
-  const digest = (0, import_node_crypto2.createHash)("sha256").update(slots.join("|")).digest("hex");
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(slots.join("|")).digest("hex");
   return `${DERIVED_DELIVERY_ID_PREFIX}${digest.slice(0, DERIVED_DELIVERY_ID_LENGTH)}`;
 }
 function releaseFields(release) {
@@ -19557,11 +19581,11 @@ function enrichCorrelationFields(extra) {
   }
   return enriched;
 }
-var import_node_crypto2, PROBE_NAME_PATTERN, PROBE_JOB_ID_PATTERN, XMTP_MESSAGE_ID_PATTERN, DERIVED_DELIVERY_ID_PREFIX, DERIVED_DELIVERY_ID_LENGTH, RELEASE_CODE_MAJOR_WEIGHT, RELEASE_CODE_MINOR_WEIGHT, UNKNOWN_LOG_FIELD, UNPARSABLE_RELEASE;
+var import_node_crypto3, PROBE_NAME_PATTERN, PROBE_JOB_ID_PATTERN, XMTP_MESSAGE_ID_PATTERN, DERIVED_DELIVERY_ID_PREFIX, DERIVED_DELIVERY_ID_LENGTH, RELEASE_CODE_MAJOR_WEIGHT, RELEASE_CODE_MINOR_WEIGHT, UNKNOWN_LOG_FIELD, UNPARSABLE_RELEASE;
 var init_log_fields = __esm({
   "../core/src/sentry-logger/log-fields.ts"() {
     "use strict";
-    import_node_crypto2 = require("node:crypto");
+    import_node_crypto3 = require("node:crypto");
     PROBE_NAME_PATTERN = /probe/i;
     PROBE_JOB_ID_PATTERN = /^probe[-_]/i;
     XMTP_MESSAGE_ID_PATTERN = /^[0-9a-f]{16,}$/i;
@@ -19949,6 +19973,9 @@ function applyFatalEventDefaults(event) {
 function isInfoEventAllowlisted(name) {
   return SENTRY_INFO_ALLOWLIST.has(name);
 }
+function isFingerprintKey(key) {
+  return SENTRY_FINGERPRINT_KEYS.includes(key);
+}
 function isTagKey(key) {
   return SENTRY_TAG_KEYS.has(key);
 }
@@ -19960,13 +19987,13 @@ function agentExtras(identity) {
     role: identity.role != null && identity.role !== "" ? String(identity.role) : UNKNOWN_FIELD
   };
 }
-var Sentry, import_node_crypto3, FLOW_ID, SENTRY_EXTRA_BLOCKLIST, SENTRY_EXTRA_BLOCKED_KEY_PARTS, SENTRY_FULL_STRING_EXTRA_KEYS, SENTRY_TAG_KEYS, SENTRY_FINGERPRINT_KEYS, SENTRY_INFO_ALLOWLIST, MAX_EXTRA_STRING_LENGTH, MAX_TAG_VALUE_LENGTH, RELEASE_FIELDS, RUNTIME_FIELDS, SentryLogger, logger, initLogger, shutdown, UNKNOWN_FIELD;
+var Sentry, import_node_crypto4, FLOW_ID, SENTRY_EXTRA_BLOCKLIST, SENTRY_EXTRA_BLOCKED_KEY_PARTS, SENTRY_FULL_STRING_EXTRA_KEYS, SENTRY_TAG_KEYS, SENTRY_FINGERPRINT_KEYS, SENTRY_INFO_ALLOWLIST, MAX_EXTRA_STRING_LENGTH, MAX_TAG_VALUE_LENGTH, RELEASE_FIELDS, RUNTIME_FIELDS, SentryLogger, logger, initLogger, shutdown, UNKNOWN_FIELD;
 var init_sentry_logger = __esm({
   "../core/src/sentry-logger/index.ts"() {
     "use strict";
     init_log();
     Sentry = __toESM(require_cjs4());
-    import_node_crypto3 = require("node:crypto");
+    import_node_crypto4 = require("node:crypto");
     init_events();
     init_log_fields();
     init_xmtp_test_metrics();
@@ -19974,7 +20001,7 @@ var init_sentry_logger = __esm({
     init_runtime_metadata();
     init_events();
     init_log_fields();
-    FLOW_ID = (0, import_node_crypto3.randomUUID)();
+    FLOW_ID = (0, import_node_crypto4.randomUUID)();
     SENTRY_EXTRA_BLOCKLIST = /* @__PURE__ */ new Set([
       "args",
       "apikey",
@@ -20057,6 +20084,13 @@ var init_sentry_logger = __esm({
     ]);
     SENTRY_TAG_KEYS = /* @__PURE__ */ new Set([
       "agentId",
+      // Subscription correlation agent ids (DEXMARKET-9096). Bounded-cardinality,
+      // same class as agentId/senderAgentId/onchainosAgentId — promoted to indexed
+      // tags for Sentry filtering. NOT added to SENTRY_FINGERPRINT_KEYS, so the
+      // global issue fingerprint is unchanged. High-cardinality ids
+      // (conversationId/messageId/deliveryId) are deliberately NOT here.
+      "aspAgentId",
+      "userAgentId",
       "agentPlatform",
       "aiProvider",
       "cacheName",
@@ -20224,6 +20258,22 @@ var init_sentry_logger = __esm({
       LogEvent.SESSION_KEY_DERIVED,
       LogEvent.SESSIONS_QUERIED,
       LogEvent.SYNC_TICK_COMPLETED,
+      // Subscription observability info checkpoints (DEXMARKET-9096). Each is a
+      // logger.info event; omitting any makes info() drop it silently so the whole
+      // subscription trace would look implemented and emit nothing in production.
+      LogEvent.SUBSCRIPTION_PUSH_STARTED,
+      LogEvent.SUBSCRIPTION_PUSH_TARGETS_RESOLVED,
+      LogEvent.SUBSCRIPTION_PUSH_EMPTY_TARGETS,
+      LogEvent.SUBSCRIPTION_PUSH_SUMMARY,
+      LogEvent.SUBSCRIPTION_INBOUND_RECEIVED,
+      LogEvent.SUBSCRIPTION_INBOUND_GATE_DROPPED,
+      LogEvent.SUBSCRIPTION_JOBS_QUERY_STARTED,
+      LogEvent.SUBSCRIPTION_JOBS_QUERY_SUCCEEDED,
+      LogEvent.SUBSCRIPTION_JOBS_EMPTY,
+      LogEvent.SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED,
+      LogEvent.SUBSCRIPTION_JOB_DISPATCHED,
+      LogEvent.SUBSCRIPTION_JOB_DUPLICATE_IGNORED,
+      LogEvent.SUBSCRIPTION_FANOUT_SUMMARY,
       // XMTP creation rate-limit cooldown checkpoints (DEXMARKET-9116). info() drops
       // any event not listed here, so these must stay registered.
       LogEvent.XMTP_RATE_LIMIT_COOLDOWN_STARTED,
@@ -31015,7 +31065,7 @@ var require_websocket2 = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash6 } = require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash7 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -31675,7 +31725,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -32042,7 +32092,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash6 } = require("crypto");
+    var { createHash: createHash7 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -32343,7 +32393,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -32465,7 +32515,7 @@ var init_sentry_config = __esm({
     environment = process.env.SENTRY_ENV === "dev" ? "dev" : "prod";
     SENTRY_CONFIG = {
       projectName: "okx/openclaw-okx-a2a-extension",
-      release: "0.2.17",
+      release: "0.2.18-beta-4dd056b897-261015113839",
       environment,
       runtimeContainer: normalizeRuntimeContainer(process.env.OKX_A2A_RUNTIME_CONTAINER)
     };
@@ -33421,7 +33471,7 @@ async function getCurrentNodeCliVersion() {
   return await getGlobalNpmPackageVersion(UPDATE_PACKAGES.node) ?? getBundledNodeCliVersion();
 }
 function getBundledNodeCliVersion() {
-  return true ? "0.2.17" : null;
+  return true ? "0.2.18-beta-4dd056b897-261015113839" : null;
 }
 function readConfiguredAiProvider() {
   const explicit = process.env.OKX_A2A_AI_PROVIDER || process.env.OKX_AGENT_TASK_AI_CLI;
@@ -33631,7 +33681,7 @@ async function updateHermes(release, options) {
   }
 }
 async function installGatewayPluginForDoctor(target) {
-  const release = isPrereleaseVersion("0.2.17") ? "beta" : "latest";
+  const release = isPrereleaseVersion("0.2.18-beta-4dd056b897-261015113839") ? "beta" : "latest";
   const insideTargetGateway = detectGatewayInvocation() === target;
   const options = {
     restart: !insideTargetGateway,
@@ -44353,6 +44403,7 @@ __export(index_exports, {
   InboundReplayGate: () => InboundReplayGate,
   InvalidXmtpMessageStore: () => InvalidXmtpMessageStore,
   JOB_PROVIDER_BINDING_SOURCES: () => JOB_PROVIDER_BINDING_SOURCES,
+  LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN: () => LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN,
   ListenerDeferredTaskScheduler: () => ListenerDeferredTaskScheduler,
   ListenerMaintenanceGate: () => ListenerMaintenanceGate,
   LogEvent: () => LogEvent,
@@ -44362,6 +44413,9 @@ __export(index_exports, {
   NATIVE_LAUNCHER_EXE_NAME: () => NATIVE_LAUNCHER_EXE_NAME,
   OPENCLAW_GATEWAY_ROUTE_GROUP_ID: () => OPENCLAW_GATEWAY_ROUTE_GROUP_ID,
   ProviderNotReadyError: () => ProviderNotReadyError,
+  RUN_LOG_FILENAME_MAX_BYTES: () => RUN_LOG_FILENAME_MAX_BYTES,
+  SUBSCRIPTION_FANOUT_MAX: () => SUBSCRIPTION_FANOUT_MAX,
+  SUBSCRIPTION_MESSAGE_TYPE: () => SUBSCRIPTION_MESSAGE_TYPE,
   SYSTEM_NOTIFICATION_SESSION_KEY: () => SYSTEM_NOTIFICATION_SESSION_KEY,
   SessionBusyTracker: () => SessionBusyTracker,
   SessionStore: () => SessionStore,
@@ -44407,7 +44461,9 @@ __export(index_exports, {
   buildInboundTerminalExtras: () => buildInboundTerminalExtras,
   buildLaunchdPlist: () => buildLaunchdPlist,
   buildLauncherEntryJs: () => buildLauncherEntryJs,
+  buildListJobsByVerifiedSenderArgs: () => buildListJobsByVerifiedSenderArgs,
   buildMessageEligibleArgs: () => buildMessageEligibleArgs,
+  buildRunLogFileName: () => buildRunLogFileName,
   buildSchtasksCreateArgs: () => buildSchtasksCreateArgs,
   buildSchtasksDeleteArgs: () => buildSchtasksDeleteArgs,
   buildSchtasksEndArgs: () => buildSchtasksEndArgs,
@@ -44416,9 +44472,14 @@ __export(index_exports, {
   buildSeaConfig: () => buildSeaConfig,
   buildServicePath: () => buildServicePath,
   buildSessionKey: () => buildSessionKey,
+  buildSubscriptionEnvelope: () => buildSubscriptionEnvelope,
+  buildSubscriptionInboundExtras: () => buildSubscriptionInboundExtras,
+  buildSubscriptionJobExtras: () => buildSubscriptionJobExtras,
+  buildSubscriptionSendExtras: () => buildSubscriptionSendExtras,
   buildSystemMessageNotice: () => buildSystemMessageNotice,
   buildSystemStoredMessage: () => buildSystemStoredMessage,
   buildSystemdUserService: () => buildSystemdUserService,
+  buildUpgradeRecommendationNotice: () => buildUpgradeRecommendationNotice,
   buildWin32OnchainosCandidates: () => buildWin32OnchainosCandidates,
   buildWindowsParentProcessProbe: () => buildWindowsParentProcessProbe,
   buildXmtpMessageSentExtra: () => buildXmtpMessageSentExtra,
@@ -44433,6 +44494,7 @@ __export(index_exports, {
   checkCodexReadiness: () => checkCodexReadiness,
   claimActiveDaemon: () => claimActiveDaemon,
   classifyJobBindingSource: () => classifyJobBindingSource,
+  classifyListJobsError: () => classifyListJobsError,
   clearCodexReadinessCache: () => clearCodexReadinessCache,
   codexCommandResolvesWithoutOverride: () => codexCommandResolvesWithoutOverride,
   codexReadinessCacheKey: () => codexReadinessCacheKey,
@@ -44444,10 +44506,12 @@ __export(index_exports, {
   createOutboundBehavior: () => createOutboundBehavior,
   createUserAttentionWatchParentMonitor: () => createUserAttentionWatchParentMonitor,
   currentOpenClawGatewaySessionKey: () => currentOpenClawGatewaySessionKey,
+  decideSubscriptionGate: () => decideSubscriptionGate,
   detectAiProviders: () => detectAiProviders,
   detectAiRuntimeSurface: () => detectAiRuntimeSurface,
   detectCurrentAiProvider: () => detectCurrentAiProvider,
   detectGatewayInvocation: () => detectGatewayInvocation,
+  detectListJobsByVerifiedSenderSupport: () => detectListJobsByVerifiedSenderSupport,
   detectMessageEligibleOfflineReplaySupport: () => detectMessageEligibleOfflineReplaySupport,
   detectRuntime: () => detectRuntime,
   ensureDaemonReady: () => ensureDaemonReady,
@@ -44461,6 +44525,7 @@ __export(index_exports, {
   extractDirectToUserNotification: () => extractDirectToUserNotification,
   extractRateLimitEndpoint: () => extractRateLimitEndpoint,
   extractXmtpSentAtMs: () => extractXmtpSentAtMs2,
+  fanOutSubscriptionJobs: () => fanOutSubscriptionJobs,
   findWindowsNativeOkxA2aExe: () => findWindowsNativeOkxA2aExe,
   followFile: () => followFile,
   formatDoctorReportForHumans: () => formatDoctorReportForHumans,
@@ -44473,6 +44538,7 @@ __export(index_exports, {
   getXmtpCreationCooldown: () => getXmtpCreationCooldown,
   handleCapabilitiesCommand: () => handleCapabilitiesCommand,
   handleDoctorCommand: () => handleDoctorCommand,
+  handleSubscriptionPushCommand: () => handleSubscriptionPushCommand,
   handleXmtpDebugCommand: () => handleXmtpDebugCommand,
   handleXmtpSendCommand: () => handleXmtpSendCommand,
   handleXmtpTestCommand: () => handleXmtpTestCommand,
@@ -44487,6 +44553,7 @@ __export(index_exports, {
   invalidateResolvedOnchainosBinForTests: () => invalidateResolvedOnchainosBinForTests,
   isAutostartManagerUnavailableError: () => isAutostartManagerUnavailableError,
   isDefaultTaskHome: () => isDefaultTaskHome,
+  isFingerprintKey: () => isFingerprintKey,
   isGatewayAvailableForHeartbeat: () => isGatewayAvailableForHeartbeat,
   isHermesGatewayPluginEnabled: () => isHermesGatewayPluginEnabled,
   isInfoEventAllowlisted: () => isInfoEventAllowlisted,
@@ -44497,6 +44564,7 @@ __export(index_exports, {
   isPrereleaseVersion: () => isPrereleaseVersion,
   isRetryableOpenClawGatewayError: () => isRetryableOpenClawGatewayError,
   isSqliteBusyError: () => isSqliteBusyError,
+  isSubscriptionEnvelope: () => isSubscriptionEnvelope,
   isSystemdManagerUnavailableMessage: () => isSystemdManagerUnavailableMessage,
   isTagKey: () => isTagKey,
   isValidExternalJobId: () => isValidExternalJobId,
@@ -44505,8 +44573,12 @@ __export(index_exports, {
   killProcessTree: () => killProcessTree,
   launchdPlistHasCurrentRestartPolicy: () => launchdPlistHasCurrentRestartPolicy,
   listAllAgentsWithMetadata: () => listAllAgentsWithMetadata,
+  listJobsByVerifiedSender: () => listJobsByVerifiedSender,
+  listJobsByVerifiedSenderHelpAdvertisesCommand: () => listJobsByVerifiedSenderHelpAdvertisesCommand,
+  listJobsByVerifiedSenderWithCapability: () => listJobsByVerifiedSenderWithCapability,
   logWinCompat: () => logWinCompat,
   logXmtpMessageSent: () => logXmtpMessageSent,
+  logger: () => logger,
   maybeRecommendOnchainosUpgrade: () => maybeRecommendOnchainosUpgrade,
   mergeA2AEnvelopeTips: () => mergeA2AEnvelopeTips,
   messageEligibleHelpAdvertisesOfflineReplay: () => messageEligibleHelpAdvertisesOfflineReplay,
@@ -44514,6 +44586,8 @@ __export(index_exports, {
   normalizeAiProvider: () => normalizeAiProvider,
   normalizeAiRuntimeProvider: () => normalizeAiRuntimeProvider,
   normalizeHermesOkxA2aPluginConfig: () => normalizeHermesOkxA2aPluginConfig,
+  normalizeListJobsResponse: () => normalizeListJobsResponse,
+  normalizeSubscriptionJobs: () => normalizeSubscriptionJobs,
   notifyAgentMessageToUserAttention: () => notifyAgentMessageToUserAttention,
   notifyDirectToUserAttention: () => notifyDirectToUserAttention,
   notifySystemMessageToUser: () => notifySystemMessageToUser,
@@ -44524,6 +44598,7 @@ __export(index_exports, {
   parsePluginYamlVersion: () => parsePluginYamlVersion,
   parseWalletLoginStatus: () => parseWalletLoginStatus,
   parseWindowsParentProcessJson: () => parseWindowsParentProcessJson,
+  partitionSubscriptionJobsByOwner: () => partitionSubscriptionJobsByOwner,
   performRuntimeSwitch: () => performRuntimeSwitch,
   persistAiRuntimeSurfaceBestEffort: () => persistAiRuntimeSurfaceBestEffort,
   persistCurrentRuntimeSelectionForNewJob: () => persistCurrentRuntimeSelectionForNewJob,
@@ -44533,12 +44608,14 @@ __export(index_exports, {
   printXmtpTestUsage: () => printXmtpTestUsage,
   probeCodexAuthStatus: () => probeCodexAuthStatus,
   processFileMessage: () => processFileMessage,
+  processSubscriptionInbound: () => processSubscriptionInbound,
   queryWalletLoginStatus: () => queryWalletLoginStatus,
   readAiProviderTimeoutMs: () => readAiProviderTimeoutMs,
   readAiRuntimeSurfaceBestEffort: () => readAiRuntimeSurfaceBestEffort,
   readCachedCodexReadiness: () => readCachedCodexReadiness,
   readLastLines: () => readLastLines,
   readParentProcessCommandForPlatform: () => readParentProcessCommandForPlatform,
+  readSubscriptionEnvelope: () => readSubscriptionEnvelope,
   readUserAttentionWatcherEvent: () => readUserAttentionWatcherEvent,
   refreshAgentsAndWait: () => refreshAgentsAndWait,
   refreshOnchainosVersionMetadata: () => refreshOnchainosVersionMetadata,
@@ -44549,8 +44626,10 @@ __export(index_exports, {
   replayScanBackoffWithJitterMs: () => replayScanBackoffWithJitterMs,
   reportDoctorRunToSentry: () => reportDoctorRunToSentry,
   reportUserNotificationFailure: () => reportUserNotificationFailure,
+  resetListJobsByVerifiedSenderCapabilityForTests: () => resetListJobsByVerifiedSenderCapabilityForTests,
   resetMessageEligibleOfflineReplayCapabilityForTests: () => resetMessageEligibleOfflineReplayCapabilityForTests,
   resetResolvedOnchainosBinForTests: () => resetResolvedOnchainosBinForTests,
+  resetSubscriptionTargetsForTests: () => resetSubscriptionTargetsForTests,
   resetXmtpCreationCooldownForTests: () => resetXmtpCreationCooldownForTests,
   resolveAiPermissionPreset: () => resolveAiPermissionPreset,
   resolveAiProviderCommand: () => resolveAiProviderCommand,
@@ -44604,6 +44683,8 @@ __export(index_exports, {
   stopOpenClawGateway: () => stopOpenClawGateway,
   stopSystemdAutostart: () => stopSystemdAutostart,
   subscribeUserAttentionEvents: () => subscribeUserAttentionEvents,
+  subscriptionIdempotencyKey: () => subscriptionIdempotencyKey,
+  summarizeSubscriptionPush: () => summarizeSubscriptionPush,
   summarizeXmtpTestEvents: () => summarizeXmtpTestEvents,
   switchProvider: () => switchProvider,
   switchProviderWithReadinessGate: () => switchProviderWithReadinessGate,
@@ -44612,6 +44693,7 @@ __export(index_exports, {
   tailFile: () => tailFile,
   toOpenClawGatewaySessionKey: () => toOpenClawGatewaySessionKey,
   toWindowsInvocation: () => toWindowsInvocation,
+  tryMarkSubscriptionTarget: () => tryMarkSubscriptionTarget,
   writeAiPermissionPresetToConfig: () => writeAiPermissionPresetToConfig
 });
 module.exports = __toCommonJS(index_exports);
@@ -44621,12 +44703,62 @@ init_autostart();
 
 // src/ai-runner.ts
 init_log();
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_fs11 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 var import_node_os6 = require("node:os");
 var import_node_path16 = require("node:path");
 init_ai_command();
+
+// src/ai-run-log-path.ts
+var import_node_crypto2 = require("node:crypto");
+var RUN_LOG_FILENAME_MAX_BYTES = 240;
+function buildRunLogFileName(request) {
+  const source = request.source;
+  const sessionKey = request.sessionKey;
+  const messageId = request.messageId;
+  const jobId = request.jobId;
+  const safeMessageId = encodeURIComponent(messageId);
+  const prefix = source === "job-dispatch" ? "ai-" : "ai-session-";
+  const encodedContext = source === "job-dispatch" ? encodeURIComponent(jobId ?? "unknown") : encodeURIComponent(sessionKey);
+  const readable = `${prefix}${encodedContext}-${safeMessageId}.log`;
+  if (Buffer.byteLength(readable, "utf8") <= RUN_LOG_FILENAME_MAX_BYTES) {
+    return readable;
+  }
+  const readableWithoutExt = readable.slice(0, -".log".length);
+  const digest = (0, import_node_crypto2.createHash)("sha256").update(readableWithoutExt).digest("hex").slice(0, 24);
+  const suffix = `-${digest}.log`;
+  const budgetForContext = RUN_LOG_FILENAME_MAX_BYTES - Buffer.byteLength(prefix, "utf8") - Buffer.byteLength(suffix, "utf8");
+  const contextHead = truncateToUtf8ByteBudgetSafe(encodedContext, Math.max(budgetForContext, 0));
+  return `${prefix}${contextHead}${suffix}`;
+}
+function truncateToUtf8ByteBudgetSafe(encoded, maxBytes) {
+  if (maxBytes <= 0) {
+    return "";
+  }
+  if (Buffer.byteLength(encoded, "utf8") <= maxBytes) {
+    return encoded;
+  }
+  let candidateLength = Math.min(maxBytes, encoded.length);
+  while (candidateLength > 0) {
+    const candidate = encoded.slice(0, candidateLength);
+    if (!endsWithSplitEscape(candidate)) {
+      return candidate;
+    }
+    candidateLength -= 1;
+  }
+  return "";
+}
+function endsWithSplitEscape(value) {
+  const percentIndex = value.lastIndexOf("%");
+  if (percentIndex === -1) {
+    return false;
+  }
+  const tail = value.length - percentIndex - 1;
+  return tail < 2;
+}
+
+// src/ai-runner.ts
 init_paths();
 
 // src/file-store.ts
@@ -46307,13 +46439,15 @@ var AiRunner = class {
     );
   }
   buildRunLogPath(request) {
-    const safeMessageId = encodeURIComponent(request.messageId);
-    if (request.source === "job-dispatch") {
-      const safeJobId = encodeURIComponent(request.jobId ?? "unknown");
-      return (0, import_node_path16.join)(this.logsDir, `ai-${safeJobId}-${safeMessageId}.log`);
-    }
-    const safeSessionKey = encodeURIComponent(request.sessionKey);
-    return (0, import_node_path16.join)(this.logsDir, `ai-session-${safeSessionKey}-${safeMessageId}.log`);
+    return (0, import_node_path16.join)(
+      this.logsDir,
+      buildRunLogFileName({
+        source: request.source,
+        sessionKey: request.sessionKey,
+        messageId: request.messageId,
+        jobId: request.jobId
+      })
+    );
   }
   readRunAiSessionId(provider, request, file, sessionMeta) {
     if (request.source === "job-dispatch" && request.jobId) {
@@ -48035,7 +48169,7 @@ function normalizeAttentionProvider(provider) {
   return provider === "unknown" ? null : provider;
 }
 function stableHash(value) {
-  return (0, import_node_crypto4.createHash)("sha256").update(value).digest("hex").slice(0, 24);
+  return (0, import_node_crypto5.createHash)("sha256").update(value).digest("hex").slice(0, 24);
 }
 function formatCommand(args) {
   return args.map(shellQuote).join(" ");
@@ -48062,10 +48196,11 @@ function shortenJobId(jobId) {
 
 // src/command-store.ts
 init_log();
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_fs12 = require("node:fs");
 var import_node_path17 = require("node:path");
 init_paths();
+init_session_store();
 var { DatabaseSync: DatabaseSync2 } = loadSqlite2();
 var XMTP_DEBUG_RESULT_TTL_MS = 5 * 6e4;
 function stringifyForStorage(value) {
@@ -48087,7 +48222,7 @@ var CommandStore = class {
   }
   createXmtpSendCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-send",
       jobId: params.jobId,
       message: params.message,
@@ -48101,16 +48236,27 @@ var CommandStore = class {
       createdAt: Date.now()
     };
   }
+  createXmtpSubscriptionPushCommand(params) {
+    return {
+      id: (0, import_node_crypto6.randomUUID)(),
+      type: "xmtp-subscription-push",
+      myAgentId: params.myAgentId,
+      content: params.content,
+      conversationIds: params.conversationIds,
+      deliveryId: params.deliveryId,
+      createdAt: Date.now()
+    };
+  }
   createXmtpGetPendingListCommand() {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-get-pending-list",
       createdAt: Date.now()
     };
   }
   createXmtpDenyPendingConversationCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-deny-pending-conversation",
       groupId: params.groupId,
       jobId: params.jobId,
@@ -48121,14 +48267,14 @@ var CommandStore = class {
   }
   createXmtpRefreshAgentsCommand() {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-refresh-agents",
       createdAt: Date.now()
     };
   }
   createXmtpGetConversationHistoryCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-get-conversation-history",
       jobId: params.jobId,
       toAgentId: params.toAgentId,
@@ -48140,7 +48286,7 @@ var CommandStore = class {
   }
   createXmtpDebugCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "xmtp-debug",
       action: params.action,
       groupId: params.groupId,
@@ -48155,7 +48301,7 @@ var CommandStore = class {
   }
   createAiJobMessageDispatchCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "ai-dispatch",
       kind: "job-message",
       jobId: params.jobId,
@@ -48166,7 +48312,7 @@ var CommandStore = class {
   }
   createAiSessionMessageDispatchCommand(params) {
     return {
-      id: (0, import_node_crypto5.randomUUID)(),
+      id: (0, import_node_crypto6.randomUUID)(),
       type: "ai-dispatch",
       kind: "session-message",
       sessionKey: params.sessionKey,
@@ -48194,6 +48340,65 @@ var CommandStore = class {
     );
     return this.commandPath(command.id);
   }
+  /**
+   * Atomic idempotent submit keyed on a business `idempotencyKey` (DEXMARKET-9035,
+   * M2). The FIRST caller for a given key inserts its command and gets
+   * `created: true`; every later caller with the SAME key — including after a
+   * daemon / CommandStore rebuild — gets the ALREADY-persisted command back with
+   * `created: false` and NO new row. Concurrency-safe: correctness rests on the
+   * partial UNIQUE index on `idempotency_key`, not a check-then-insert (which
+   * races), so a `INSERT ... ON CONFLICT DO NOTHING` collapses concurrent
+   * duplicates to exactly one row. Recoverable SQLITE_BUSY/LOCKED errors reuse
+   * the repo's bounded exponential backoff. This never changes the plain
+   * `submit` path used by `xmtp-send` and every other daemon command.
+   */
+  async submitIdempotent(command, idempotencyKey) {
+    if (!idempotencyKey) {
+      throw new Error("submitIdempotent requires a non-empty idempotencyKey");
+    }
+    return this.withBusyRetry(
+      () => this.transaction(() => {
+        const now = Date.now();
+        const insert = this.db.prepare(`
+          INSERT INTO command_queue (
+            id, type, status, command_json, result_json,
+            created_at_ms, updated_at_ms, processing_started_at_ms, completed_at_ms,
+            idempotency_key
+          )
+          VALUES (?, ?, 'pending', ?, NULL, ?, ?, NULL, NULL, ?)
+          ON CONFLICT(idempotency_key) WHERE idempotency_key IS NOT NULL DO NOTHING
+        `).run(
+          command.id,
+          command.type,
+          stringifyForStorage(command),
+          normalizeCreatedAt(command.createdAt, now),
+          now,
+          idempotencyKey
+        );
+        if (Number(insert.changes ?? 0) > 0) {
+          return { path: this.commandPath(command.id), commandId: command.id, created: true };
+        }
+        const existing = this.db.prepare(`
+          SELECT id FROM command_queue WHERE idempotency_key = ?
+        `).get(idempotencyKey);
+        const existingId = existing?.id ?? command.id;
+        return { path: this.commandPath(existingId), commandId: existingId, created: false };
+      })
+    );
+  }
+  async withBusyRetry(operation) {
+    const attempts = 6;
+    for (let attempt = 1; ; attempt += 1) {
+      try {
+        return operation();
+      } catch (err) {
+        if (!isSqliteBusyError(err) || attempt >= attempts) {
+          throw err;
+        }
+        await new Promise((resolve11) => setTimeout(resolve11, Math.min(50 * 2 ** (attempt - 1), 1e3)));
+      }
+    }
+  }
   async listPending() {
     return (await this.listPendingEntries()).map((entry) => entry.command);
   }
@@ -48260,9 +48465,24 @@ var CommandStore = class {
       CREATE INDEX IF NOT EXISTS idx_command_queue_status_created
       ON command_queue(status, created_at_ms, id)
     `);
+    this.ensureColumn("command_queue", "idempotency_key", "TEXT");
+    this.db.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_command_queue_idempotency_key
+      ON command_queue(idempotency_key)
+      WHERE idempotency_key IS NOT NULL
+    `);
     this.purgeExpiredXmtpDebugResults();
     this.importLegacyFileCommands();
   }
+  ensureColumn(table, column, definition) {
+    this.transaction(() => {
+      const rows = this.db.prepare(`PRAGMA table_info(${table})`).all();
+      if (rows.some((row) => row.name === column)) {
+        return;
+      }
+      this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+    });
+  }
   purgeExpiredXmtpDebugResults() {
     this.db.prepare(`
       DELETE FROM command_queue
@@ -48434,6 +48654,10 @@ function isDaemonCommand(value) {
   if (parsed.type === "xmtp-send") {
     return typeof parsed.jobId === "string" && typeof parsed.message === "string";
   }
+  if (parsed.type === "xmtp-subscription-push") {
+    const command = parsed;
+    return typeof command.myAgentId === "string" && typeof command.content === "string" && Array.isArray(command.conversationIds) && command.conversationIds.every((item) => typeof item === "string");
+  }
   if (parsed.type === "xmtp-get-pending-list") {
     return true;
   }
@@ -48600,7 +48824,7 @@ var import_node_path21 = require("node:path");
 // ../../node_modules/@xmtp/node-sdk/dist/index.js
 var import_node_bindings = require("@xmtp/node-bindings");
 var import_node_bindings2 = require("@xmtp/node-bindings");
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 
 // ../../node_modules/@xmtp/node-sdk/node_modules/@xmtp/content-type-primitives/dist/index.js
 var contentTypeToString = (contentType) => `${contentType.authorityId}/${contentType.typeId}:${contentType.versionMajor}.${contentType.versionMinor}`;
@@ -50322,7 +50546,7 @@ var resolveBackend = async (envOrBackend, gatewayHost) => {
   return createBackend({ env: envOrBackend, gatewayHost });
 };
 var createEphemeralIdentifier = () => ({
-  identifier: `0x${(0, import_node_crypto6.randomBytes)(20).toString("hex")}`,
+  identifier: `0x${(0, import_node_crypto7.randomBytes)(20).toString("hex")}`,
   identifierKind: 0
 });
 var toInboxUpdatesCountMap = (value) => {
@@ -55112,7 +55336,7 @@ var sepolia = /* @__PURE__ */ defineChain({
 });
 
 // ../../node_modules/@xmtp/agent-sdk/dist/index.js
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var version2 = "2.3.0";
 var fromSelf = (message, client) => {
   return message.senderInboxId === client.inboxId;
@@ -55807,7 +56031,7 @@ var Agent = class _Agent extends import_node_events.default {
     return this.#client.accountIdentifier?.identifier;
   }
 };
-var CANCEL_ACTION_ID = (0, import_node_crypto7.randomUUID)();
+var CANCEL_ACTION_ID = (0, import_node_crypto8.randomUUID)();
 var LimitedMap = class {
   #map = /* @__PURE__ */ new Map();
   #limit;
@@ -59481,7 +59705,7 @@ function buildSendEnvelope(params) {
 init_log();
 init_sentry_logger();
 init_log_fields();
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 
 // ../core/src/a2a/concurrency.ts
 async function withSharedPromise(registry, key, fn) {
@@ -60883,17 +61107,17 @@ init_ai_provider();
 
 // src/agent-message-notice.ts
 init_log();
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 init_session_store();
 init_ai_provider();
 
 // src/outbound-behavior.ts
 init_log();
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/openclaw-gateway.ts
 init_log();
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 
 // ../core/src/openclaw-gateway-config.ts
 var import_node_fs17 = require("node:fs");
@@ -61386,7 +61610,7 @@ async function callDeleteSessions(params) {
   return await callOpenClawGateway({ method: "okx-a2a.delete_sessions", params });
 }
 async function callSessionsSend(params) {
-  const idempotencyKey = params.idempotencyKey ?? (0, import_node_crypto8.randomUUID)();
+  const idempotencyKey = params.idempotencyKey ?? (0, import_node_crypto9.randomUUID)();
   const sendParams = { key: params.key, message: params.message, idempotencyKey };
   try {
     return await callOpenClawGateway({ method: "sessions.send", params: sendParams });
@@ -61502,7 +61726,7 @@ async function sleep3(ms) {
 var MinimalGatewayClient = class {
   config;
   protocolVersion;
-  instanceId = (0, import_node_crypto8.randomUUID)();
+  instanceId = (0, import_node_crypto9.randomUUID)();
   pending = /* @__PURE__ */ new Map();
   ws = null;
   ready = false;
@@ -61590,7 +61814,7 @@ var MinimalGatewayClient = class {
       }));
     }
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const id = `okx-a2a-${++this.requestSeq}-${(0, import_node_crypto8.randomUUID)()}`;
+    const id = `okx-a2a-${++this.requestSeq}-${(0, import_node_crypto9.randomUUID)()}`;
     const frame = { type: "req", id, method, params };
     return new Promise((resolve11, reject) => {
       const timer = setTimeout(() => {
@@ -61716,7 +61940,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     client: {
       id: "gateway-client",
       displayName: "okx-a2a-node",
-      version: "0.2.17",
+      version: "0.2.18-beta-4dd056b897-261015113839",
       platform: "node",
       mode: "backend",
       instanceId
@@ -61727,7 +61951,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     commands: [],
     permissions: {},
     locale: Intl.DateTimeFormat().resolvedOptions().locale || "en-US",
-    userAgent: `okx-a2a-node/${"0.2.17"}`,
+    userAgent: `okx-a2a-node/${"0.2.18-beta-4dd056b897-261015113839"}`,
     auth: {
       ...config.token ? { token: config.token } : {},
       ...config.password ? { password: config.password } : {}
@@ -62333,7 +62557,7 @@ function resolveSessionGateFallbackMs(env = process.env) {
   return DEFAULT_SESSION_GATE_FALLBACK_MS;
 }
 function resolveUserDeliveryId(input) {
-  return input.idempotencyKey?.trim() || (0, import_node_crypto9.randomUUID)();
+  return input.idempotencyKey?.trim() || (0, import_node_crypto10.randomUUID)();
 }
 var GATEWAY_RPC_TRANSPORT = "gateway_rpc";
 var USER_CHANNEL_TRANSPORT = "user_channel";
@@ -63247,7 +63471,7 @@ function buildSystemMessageIdempotencyKey(input) {
   return `system-message:${identity}`;
 }
 function stableHash2(value) {
-  return (0, import_node_crypto10.createHash)("sha256").update(value).digest("hex").slice(0, 24);
+  return (0, import_node_crypto11.createHash)("sha256").update(value).digest("hex").slice(0, 24);
 }
 
 // src/xmtp-send.ts
@@ -63716,7 +63940,7 @@ async function handleSqliteGroupSendCommand(params) {
     role: senderAgent?.role,
     sendDurationMs: Date.now() - sendStartMs
   });
-  const messageId = `outbound-${(0, import_node_crypto11.randomUUID)()}`;
+  const messageId = `outbound-${(0, import_node_crypto12.randomUUID)()}`;
   await notifyAgentMessageToUserAttention({
     direction: "outbound" /* OUTBOUND */,
     sender: {
@@ -63837,7 +64061,7 @@ async function handleGroupSendCommand(params) {
     sendDurationMs: Date.now() - sendStartMs
   });
   const now = Date.now();
-  const messageId = `outbound-${(0, import_node_crypto11.randomUUID)()}`;
+  const messageId = `outbound-${(0, import_node_crypto12.randomUUID)()}`;
   const stored = {
     id: messageId,
     direction: "outbound",
@@ -64056,7 +64280,7 @@ async function handleXmtpSendCommand(params) {
       sendDurationMs: Date.now() - sendStartMs
     });
     const now = Date.now();
-    const messageId = `outbound-${(0, import_node_crypto11.randomUUID)()}`;
+    const messageId = `outbound-${(0, import_node_crypto12.randomUUID)()}`;
     const stored = {
       id: messageId,
       direction: "outbound",
@@ -64103,6 +64327,357 @@ async function handleXmtpSendCommand(params) {
   }
 }
 
+// src/subscription-push.ts
+init_log();
+init_sentry_logger();
+
+// ../core/src/a2a/subscription-types.ts
+var SUBSCRIPTION_MESSAGE_TYPE = "a2a-subscription-push";
+
+// ../core/src/a2a/subscription-envelope.ts
+function isPlainObject2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function buildSubscriptionEnvelope(params) {
+  const envelope = {
+    msgType: SUBSCRIPTION_MESSAGE_TYPE,
+    content: params.content,
+    senderAgentId: params.senderAgentId
+  };
+  if (params.deliveryId) {
+    envelope.deliveryId = params.deliveryId;
+  }
+  return JSON.stringify(envelope);
+}
+function isSubscriptionEnvelope(payload) {
+  return isPlainObject2(payload) && payload.msgType === SUBSCRIPTION_MESSAGE_TYPE;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function readSubscriptionEnvelope(payload) {
+  if (!isSubscriptionEnvelope(payload)) {
+    return { ok: false, reason: "not_subscription" };
+  }
+  const record = payload;
+  if (!isNonEmptyString(record.content)) {
+    return { ok: false, reason: "missing_content" };
+  }
+  const envelope = {
+    msgType: SUBSCRIPTION_MESSAGE_TYPE,
+    content: record.content,
+    senderAgentId: isNonEmptyString(record.senderAgentId) ? record.senderAgentId : ""
+  };
+  if (isNonEmptyString(record.deliveryId)) {
+    envelope.deliveryId = record.deliveryId;
+  }
+  return { ok: true, envelope };
+}
+
+// src/subscription-telemetry.ts
+init_log_fields();
+var SUBSCRIPTION_TRANSPORT = "xmtp";
+function definedExtras(input) {
+  return Object.entries(input).reduce((out, [key, value]) => {
+    if (typeof value === "string" && value.trim().length > 0) {
+      out[key] = value.trim();
+    }
+    return out;
+  }, {});
+}
+function countExtras(input) {
+  return Object.entries(input).reduce((out, [key, value]) => {
+    if (typeof value === "number" && Number.isFinite(value)) {
+      out[key] = String(value);
+    }
+    return out;
+  }, {});
+}
+function buildSubscriptionSendExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome ?? null,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "outbound",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      aspAgentId: input.aspAgentId,
+      conversationId: input.conversationId,
+      reason: input.reason
+    }),
+    ...countExtras({
+      targetCount: input.targetCount,
+      sentCount: input.sentCount,
+      failedCount: input.failedCount,
+      notGroupCount: input.notGroupCount
+    })
+  };
+}
+function buildSubscriptionInboundExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome ?? null,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "inbound",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      userAgentId: input.userAgentId,
+      conversationId: input.conversationId,
+      messageId: input.messageId,
+      senderInboxId: input.senderInboxId,
+      reason: input.reason,
+      errorCode: input.errorCode
+    }),
+    ...countExtras({
+      returnedCount: input.returnedCount,
+      invalidCount: input.invalidCount,
+      ownedCount: input.ownedCount,
+      ignoredCount: input.ignoredCount
+    })
+  };
+}
+function buildSubscriptionJobExtras(input) {
+  return {
+    stage: input.checkpoint,
+    ...logFieldExtras({
+      checkpoint: input.checkpoint,
+      outcome: input.outcome,
+      transport: SUBSCRIPTION_TRANSPORT,
+      eventFamily: "dispatch",
+      deliveryId: input.deliveryId ?? null
+    }),
+    ...definedExtras({
+      jobId: input.jobId,
+      userAgentId: input.userAgentId,
+      aspAgentId: input.aspAgentId,
+      conversationId: input.conversationId,
+      reason: input.reason
+    }),
+    ...countExtras({
+      total: input.total,
+      started: input.started,
+      failed: input.failed,
+      skippedDuplicate: input.skippedDuplicate
+    })
+  };
+}
+
+// src/subscription-push.ts
+var DEFAULT_CONCURRENCY = 20;
+var conversationSyncPromises2 = /* @__PURE__ */ new WeakMap();
+function describeError(err) {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  if (typeof err === "string" && err.length > 0) {
+    return err;
+  }
+  return "unknown error";
+}
+async function requireXmtpClient2(service, address) {
+  const existing = service.getClientByAddress(address);
+  if (existing) {
+    return existing;
+  }
+  await service.refreshAgents();
+  const refreshed = service.getClientByAddress(address);
+  if (!refreshed) {
+    throw new Error(`no XMTP client found for ${address}`);
+  }
+  return refreshed;
+}
+function resolveLocalAddress(service, myAgentId) {
+  const address = service.getAddressByAgentId(myAgentId);
+  if (!address) {
+    throw new Error(`No local communication address found for myAgentId=${myAgentId}`);
+  }
+  return address;
+}
+async function syncConversationsOnLocalMiss2(agent) {
+  const conversations = agent.client.conversations;
+  const existing = conversationSyncPromises2.get(conversations);
+  if (existing) {
+    return existing;
+  }
+  const pending = conversations.sync();
+  conversationSyncPromises2.set(conversations, pending);
+  try {
+    await pending;
+  } finally {
+    if (conversationSyncPromises2.get(conversations) === pending) {
+      conversationSyncPromises2.delete(conversations);
+    }
+  }
+}
+async function findGroupConversation2(agent, conversationId) {
+  let conversation = await agent.client.conversations.getConversationById(conversationId);
+  if (!(conversation instanceof Group)) {
+    await syncConversationsOnLocalMiss2(agent);
+    conversation = await agent.client.conversations.getConversationById(conversationId);
+  }
+  return conversation instanceof Group ? conversation : null;
+}
+async function sendSubscriptionToGroup(params) {
+  const { agent, conversationId, command, myXmtpAddress, senderRole } = params;
+  let conversation;
+  try {
+    conversation = await findGroupConversation2(agent, conversationId);
+  } catch (err) {
+    return { conversationId, status: "not_group", error: describeError(err) };
+  }
+  if (!conversation) {
+    return {
+      conversationId,
+      status: "not_group",
+      error: `conversationId=${conversationId} is not a Group (DM or unknown conversation)`
+    };
+  }
+  const envelope = buildSubscriptionEnvelope({
+    content: command.content,
+    senderAgentId: command.myAgentId,
+    deliveryId: command.deliveryId
+  });
+  const sendStartMs = Date.now();
+  try {
+    const xmtpMessageId = await conversation.sendText(envelope);
+    logXmtpMessageSent({
+      xmtpMessageId,
+      conversationId,
+      // V2 has no job dimension (FR-1) — deliveryId (or a fixed marker)
+      // stands in for the telemetry taxonomy's jobId slot.
+      jobId: command.deliveryId ?? "subscription-push",
+      chatType: "group",
+      component: "node_xmtp_subscription_push",
+      myXmtpAddress,
+      senderAgentId: command.myAgentId,
+      role: senderRole,
+      sendDurationMs: Date.now() - sendStartMs
+    });
+    const messageId = typeof xmtpMessageId === "string" && xmtpMessageId.length > 0 ? xmtpMessageId : String(xmtpMessageId);
+    logWithTimestamp(
+      `[okx-agent-task] subscription-push sent conversationId=${conversationId} deliveryId=${command.deliveryId ?? "(none)"}`
+    );
+    return { conversationId, status: "sent", messageId };
+  } catch (err) {
+    logWithTimestamp(
+      `[okx-agent-task] subscription-push failed conversationId=${conversationId} deliveryId=${command.deliveryId ?? "(none)"}`
+    );
+    return { conversationId, status: "failed", error: describeError(err) };
+  }
+}
+function summarizeSubscriptionPush(results) {
+  let sentCount = 0;
+  let failedCount = 0;
+  for (const result of results) {
+    if (result.status === "sent") {
+      sentCount++;
+    } else {
+      failedCount++;
+    }
+  }
+  return { conversationCount: results.length, sentCount, failedCount };
+}
+async function handleSubscriptionPushCommand(params) {
+  const { command, service } = params;
+  const aspAgentId = command.myAgentId;
+  const deliveryId = command.deliveryId;
+  const conversationIds = command.conversationIds ?? [];
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_STARTED,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_started",
+      aspAgentId,
+      deliveryId,
+      targetCount: conversationIds.length
+    })
+  );
+  if (conversationIds.length === 0) {
+    logger.info(
+      LogEvent.SUBSCRIPTION_PUSH_EMPTY_TARGETS,
+      buildSubscriptionSendExtras({
+        checkpoint: "outbound/subscription_push_empty_targets",
+        outcome: "ignored",
+        aspAgentId,
+        deliveryId,
+        targetCount: 0,
+        reason: "empty_targets"
+      })
+    );
+    return { conversationCount: 0, sentCount: 0, failedCount: 0, results: [] };
+  }
+  const myXmtpAddress = resolveLocalAddress(service, command.myAgentId);
+  const agent = await requireXmtpClient2(service, myXmtpAddress);
+  const senderRole = service.getAgentByAddress?.(myXmtpAddress)?.role;
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_TARGETS_RESOLVED,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_targets_resolved",
+      aspAgentId,
+      deliveryId,
+      targetCount: conversationIds.length
+    })
+  );
+  const settled = await parallelMap(
+    conversationIds,
+    (conversationId) => sendSubscriptionToGroup({
+      agent,
+      conversationId,
+      command,
+      myXmtpAddress,
+      senderRole
+    }),
+    DEFAULT_CONCURRENCY
+  );
+  const results = settled.map((outcome, index2) => {
+    if (outcome.status === "fulfilled") {
+      return outcome.value;
+    }
+    return {
+      conversationId: conversationIds[index2],
+      status: "failed",
+      error: describeError(outcome.reason)
+    };
+  });
+  for (const result of results) {
+    if (result.status === "sent") {
+      continue;
+    }
+    logger.error(
+      LogEvent.SUBSCRIPTION_PUSH_TARGET_FAILED,
+      void 0,
+      buildSubscriptionSendExtras({
+        checkpoint: "outbound/subscription_push_target_failed",
+        outcome: "failed",
+        aspAgentId,
+        deliveryId,
+        conversationId: result.conversationId,
+        reason: result.status
+      })
+    );
+  }
+  const summary = summarizeSubscriptionPush(results);
+  const summaryOutcome = summary.failedCount === 0 ? "success" : summary.sentCount > 0 ? "partial" : "failed";
+  logger.info(
+    LogEvent.SUBSCRIPTION_PUSH_SUMMARY,
+    buildSubscriptionSendExtras({
+      checkpoint: "outbound/subscription_push_summary",
+      outcome: summaryOutcome,
+      aspAgentId,
+      deliveryId,
+      targetCount: summary.conversationCount,
+      sentCount: summary.sentCount,
+      failedCount: summary.failedCount
+    })
+  );
+  return { ...summary, results };
+}
+
 // src/command-processor.ts
 init_session_store();
 init_ai_provider();
@@ -64783,6 +65358,9 @@ function commandSentryExtra(command, extra = {}) {
     base.myAgentId = command.myAgentId ?? "";
     base.toAgentId = command.toAgentId ?? "";
     base.toXmtpAddress = command.toXmtpAddress ?? "";
+  } else if (command.type === "xmtp-subscription-push") {
+    base.myAgentId = command.myAgentId;
+    base.conversationCount = command.conversationIds.length;
   } else if (command.type === "xmtp-deny-pending-conversation") {
     base.groupId = command.groupId;
     base.jobId = command.jobId ?? "";
@@ -65138,6 +65716,10 @@ async function handleDaemonCommand(command, params) {
     });
     return { ok: true, messageId: result.messageId };
   }
+  if (command.type === "xmtp-subscription-push") {
+    const result = await handleSubscriptionPushCommand({ command, service: params.service });
+    return { ok: true, payload: result };
+  }
   if (command.type === "xmtp-get-pending-list") {
     return { ok: true, payload: await listPendingTaskRequests(params) };
   }
@@ -65220,12 +65802,12 @@ async function listPendingTaskRequests(params) {
 }
 async function denyPendingConversationsByJobId(jobId, params, content) {
   const pending = await listPendingTaskRequests(params);
-  const matched = pending.filter((item) => isPlainObject2(item) && readString2(item.jobId) === jobId);
+  const matched = pending.filter((item) => isPlainObject3(item) && readString2(item.jobId) === jobId);
   const clientAddresses = [...params.service.getClients().keys()];
   const targetsByKey = collectDenyTargetsFromPending(matched, clientAddresses);
   const groupIds = /* @__PURE__ */ new Set();
   for (const item of matched) {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject3(item)) {
       continue;
     }
     const groupId = readString2(item.groupId);
@@ -65252,7 +65834,7 @@ async function denyPendingConversationsByJobId(jobId, params, content) {
 function collectDenyTargetsFromPending(pending, fallbackAddresses) {
   const targetsByKey = /* @__PURE__ */ new Map();
   for (const item of pending) {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject3(item)) {
       continue;
     }
     const groupId = readString2(item.groupId);
@@ -65277,7 +65859,7 @@ ${groupId}`, {
 async function resolvePendingTargetsByGroupId(groupId, addresses, params) {
   const addressSet = addresses ? new Set(addresses) : null;
   const pending = (await listPendingTaskRequests(params)).filter((item) => {
-    if (!isPlainObject2(item) || readString2(item.groupId) !== groupId) {
+    if (!isPlainObject3(item) || readString2(item.groupId) !== groupId) {
       return false;
     }
     const address = readString2(item.myXmtpAddress);
@@ -65397,7 +65979,7 @@ function filterKnownPendingGroups(items, sessionStore) {
     return items;
   }
   return items.filter((item) => {
-    if (!isPlainObject2(item)) {
+    if (!isPlainObject3(item)) {
       return true;
     }
     const jobId = readString2(item.jobId);
@@ -65408,7 +65990,7 @@ function filterKnownPendingGroups(items, sessionStore) {
     return sessionStore.querySessions({ jobId, toAgentId, limit: 1 }).length === 0;
   });
 }
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function readString2(value) {
@@ -65542,6 +66124,10 @@ function formatCommandCompleted(command, result) {
   if (command.type === "xmtp-send") {
     return `[okx-agent-task] xmtp-send command completed id=${command.id} job=${command.jobId} messageId=${result.messageId}`;
   }
+  if (command.type === "xmtp-subscription-push") {
+    const payload = isPlainObject3(result.payload) ? result.payload : {};
+    return `[okx-agent-task] xmtp-subscription-push command completed id=${command.id} deliveryId=${command.deliveryId ?? "(none)"} conversationCount=${payload.conversationCount ?? 0} sentCount=${payload.sentCount ?? 0} failedCount=${payload.failedCount ?? 0}`;
+  }
   if (command.type === "xmtp-get-pending-list") {
     return `[okx-agent-task] xmtp-get-pending-list command completed id=${command.id}`;
   }
@@ -65562,8 +66148,8 @@ function formatCommandCompleted(command, result) {
   return `[okx-agent-task] xmtp-refresh-agents command completed id=${command.id}`;
 }
 function formatXmtpDebugCompleted(command, payload) {
-  const record = isPlainObject2(payload) ? payload : {};
-  const summary = isPlainObject2(record.summary) ? record.summary : {};
+  const record = isPlainObject3(payload) ? payload : {};
+  const summary = isPlainObject3(record.summary) ? record.summary : {};
   const count = command.action === "group-list" ? record.groupCount ?? 0 : command.action === "group-inspect" ? record.conversationFound ? 1 : 0 : summary.matchedCount ?? 0;
   return `[okx-agent-task] xmtp-debug command completed id=${command.id} action=${command.action} rows=${String(count)}`;
 }
@@ -65718,12 +66304,393 @@ function trimForUser2(value) {
 
 // src/message-handler.ts
 init_log();
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 init_sentry_logger();
 init_log_fields();
 init_paths();
 init_session_store();
 init_ai_provider();
+
+// src/subscription-inbound.ts
+init_log();
+function decideSubscriptionGate(input) {
+  if (!isSubscriptionEnvelope(input.payload)) {
+    return { kind: "not_subscription" };
+  }
+  if (input.chatType === "dm") {
+    return { kind: "drop", reason: "dm_subscription" };
+  }
+  if (input.chatType === "unknown") {
+    return { kind: "drop", reason: "unknown_conversation_subscription" };
+  }
+  const read = readSubscriptionEnvelope(input.payload);
+  if (!read.ok) {
+    return { kind: "drop", reason: "invalid_envelope", detail: read.reason };
+  }
+  if (!input.senderInboxId) {
+    return { kind: "drop", reason: "missing_sender_inbox_id" };
+  }
+  return { kind: "v2", envelope: read.envelope };
+}
+function partitionSubscriptionJobsByOwner(input) {
+  const owned = [];
+  for (const job of input.jobs) {
+    if (job.userAgentId === input.localAgentId) {
+      owned.push(job);
+    }
+  }
+  return {
+    owned,
+    returnedCount: input.jobs.length,
+    ownedCount: owned.length,
+    ignoredCount: input.jobs.length - owned.length
+  };
+}
+function normalizeSubscriptionJobs(input) {
+  const seen = /* @__PURE__ */ new Set();
+  const normalized = [];
+  for (const job of input.jobs) {
+    const dedupKey = `${job.jobId}|${job.userAgentId}|${job.aspAgentId}`;
+    if (seen.has(dedupKey)) {
+      continue;
+    }
+    seen.add(dedupKey);
+    normalized.push({
+      jobId: job.jobId,
+      userAgentId: job.userAgentId,
+      aspAgentId: job.aspAgentId,
+      msgType: SUBSCRIPTION_MESSAGE_TYPE,
+      content: input.envelope.content,
+      ...input.envelope.deliveryId ? { deliveryId: input.envelope.deliveryId } : {},
+      conversationId: input.conversationId,
+      senderInboxId: input.senderInboxId
+    });
+  }
+  return normalized;
+}
+function subscriptionIdempotencyKey(input) {
+  const messageDimension = input.deliveryId || input.messageId;
+  return `${input.myXmtpAddress}|${messageDimension}|${input.jobId}`;
+}
+var SUBSCRIPTION_TARGETS_MAX = 2e3;
+var subscriptionTargets = /* @__PURE__ */ new Map();
+function tryMarkSubscriptionTarget(key) {
+  if (subscriptionTargets.has(key)) {
+    return false;
+  }
+  subscriptionTargets.set(key, Date.now());
+  while (subscriptionTargets.size > SUBSCRIPTION_TARGETS_MAX) {
+    const oldest = subscriptionTargets.keys().next().value;
+    if (oldest === void 0) {
+      break;
+    }
+    subscriptionTargets.delete(oldest);
+  }
+  return true;
+}
+function resetSubscriptionTargetsForTests() {
+  subscriptionTargets.clear();
+}
+var SUBSCRIPTION_FANOUT_MAX = 250;
+function redactSenderInboxId(senderInboxId, left = 8, right = 6) {
+  if (!senderInboxId) {
+    return "(none)";
+  }
+  if (senderInboxId.length <= left + right + 1) {
+    return senderInboxId;
+  }
+  return `${senderInboxId.slice(0, left)}\u2026${senderInboxId.slice(-right)}`;
+}
+async function fanOutSubscriptionJobs(input) {
+  const { jobs, myXmtpAddress, messageId, dispatch, concurrency } = input;
+  const total = jobs.length;
+  const capacityAnomaly = total > SUBSCRIPTION_FANOUT_MAX;
+  if (capacityAnomaly) {
+    logWithTimestamp(
+      `[okx-agent-task:${myXmtpAddress}] subscription fan-out capacity anomaly: jobs=${total} max=${SUBSCRIPTION_FANOUT_MAX} message=${messageId}`
+    );
+  }
+  const settled = await parallelMap(
+    jobs,
+    async (job) => {
+      const idempotencyKey = subscriptionIdempotencyKey({
+        myXmtpAddress,
+        deliveryId: job.deliveryId,
+        messageId,
+        jobId: job.jobId
+      });
+      if (subscriptionTargets.has(idempotencyKey)) {
+        return { key: idempotencyKey, outcome: "duplicate" };
+      }
+      const dispatchOutcome = await dispatch(job, idempotencyKey);
+      const isDurableDuplicate = !!dispatchOutcome && dispatchOutcome.created === false;
+      return { key: idempotencyKey, outcome: isDurableDuplicate ? "duplicate" : "started" };
+    },
+    concurrency ?? 20
+  );
+  let started = 0;
+  let failed = 0;
+  let skippedDuplicate = 0;
+  const results = [];
+  settled.forEach((result, idx) => {
+    const job = jobs[idx];
+    if (result.status === "rejected") {
+      failed += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "failed", error: result.reason });
+      logWithTimestamp(
+        `[okx-agent-task:${myXmtpAddress}] subscription dispatch failed message=${messageId} job=${job?.jobId ?? "(unknown)"} sender=${redactSenderInboxId(job?.senderInboxId)}:`,
+        result.reason
+      );
+      return;
+    }
+    tryMarkSubscriptionTarget(result.value.key);
+    if (result.value.outcome === "duplicate") {
+      skippedDuplicate += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "duplicate" });
+    } else {
+      started += 1;
+      results.push({ jobId: job?.jobId ?? "(unknown)", outcome: "started" });
+    }
+  });
+  return { total, started, failed, skippedDuplicate, capacityAnomaly, results };
+}
+
+// ../core/src/xmtp-sdk/onchainos/list-jobs-by-verified-sender.ts
+init_log();
+init_sentry_logger();
+function isPlainObject4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function redactLogValue(value, left = 6, right = 4) {
+  if (!value) {
+    return "(none)";
+  }
+  if (value.length <= left + right + 1) {
+    return "(redacted)";
+  }
+  return `${value.slice(0, left)}\u2026${value.slice(-right)}`;
+}
+function guardSessionExpired3(stdout, command) {
+  if (isSessionExpired(stdout)) {
+    reportSessionExpired(command);
+  }
+}
+function guardCatchSessionExpired3(err, command) {
+  const stdout = String(err?.stdout ?? "");
+  if (stdout && isSessionExpired(stdout)) {
+    reportSessionExpired(command);
+  }
+}
+function buildListJobsByVerifiedSenderArgs(params) {
+  return [
+    "agent",
+    "list-jobs-by-verified-sender",
+    "--group-id",
+    params.groupId,
+    "--sender-inbox-id",
+    params.senderInboxId,
+    "--agentic-id",
+    params.agenticId
+  ];
+}
+var KNOWN_ERROR_CODES2 = {
+  "130100079": "sender_not_authorized",
+  "130100073": "sender_not_eligible"
+};
+function extractErrorText(errorLike) {
+  if (typeof errorLike === "string") {
+    return errorLike;
+  }
+  if (typeof errorLike === "number") {
+    return String(errorLike);
+  }
+  if (errorLike && typeof errorLike === "object") {
+    const anyErr = errorLike;
+    return [anyErr.code, anyErr.message, anyErr.stdout, anyErr.stderr].filter((value) => typeof value === "string" || typeof value === "number").map(String).join(" ");
+  }
+  return errorLike == null ? "" : String(errorLike);
+}
+function classifyListJobsError(errorLike) {
+  const text = extractErrorText(errorLike);
+  for (const [code, reason] of Object.entries(KNOWN_ERROR_CODES2)) {
+    if (text.includes(code)) {
+      return { reason, errorCode: code };
+    }
+  }
+  if (/\b401\b/.test(text)) {
+    return { reason: "auth_error", errorCode: "401" };
+  }
+  if (/\b403\b/.test(text)) {
+    return { reason: "auth_error", errorCode: "403" };
+  }
+  return { reason: "invalid_response" };
+}
+function normalizeListJobsResponse(data) {
+  const rawJobs = isPlainObject4(data) && Array.isArray(data.jobs) ? data.jobs : [];
+  const seen = /* @__PURE__ */ new Set();
+  const jobs = [];
+  let invalidCount = 0;
+  for (const item of rawJobs) {
+    if (!isPlainObject4(item) || !isNonEmptyString2(item.jobId) || !isNonEmptyString2(item.userAgentId) || !isNonEmptyString2(item.aspAgentId)) {
+      invalidCount += 1;
+      continue;
+    }
+    const key = `${item.jobId}|${item.userAgentId}|${item.aspAgentId}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    jobs.push({ jobId: item.jobId, userAgentId: item.userAgentId, aspAgentId: item.aspAgentId });
+  }
+  return { jobs, invalidCount };
+}
+async function listJobsByVerifiedSender(params, execFn = exec) {
+  logWithTimestamp(
+    `[onchainos] listing jobs by verified sender: group=${params.groupId} sender=${redactLogValue(params.senderInboxId)} agentic=${params.agenticId}`
+  );
+  let stdout;
+  let stderr;
+  try {
+    ({ stdout, stderr } = await execFn(buildListJobsByVerifiedSenderArgs(params)));
+  } catch (err) {
+    guardCatchSessionExpired3(err, "list-jobs-by-verified-sender");
+    const classified = classifyListJobsError(err);
+    const reason = classified.reason === "invalid_response" ? "network_error" : classified.reason;
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender exec failed (group=${params.groupId} sender=${redactLogValue(params.senderInboxId)}); fail-closed reason=${reason}`
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason, errorCode: classified.errorCode };
+  }
+  if (stderr) {
+    logWithTimestamp(`[onchainos] stderr (list-jobs-by-verified-sender): ${stderr}`);
+  }
+  let res;
+  try {
+    res = parseCliJson(stdout, "list-jobs-by-verified-sender", {
+      groupId: params.groupId,
+      agenticId: params.agenticId
+    });
+  } catch {
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: "invalid_response" };
+  }
+  if (!res.ok) {
+    guardSessionExpired3(stdout, "list-jobs-by-verified-sender");
+    const classified = classifyListJobsError(res.error);
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender ok=false (group=${params.groupId}); fail-closed reason=${classified.reason}`
+    );
+    logger.error(
+      LogEvent.ONCHAINOS_CLI_ERROR,
+      new Error("list-jobs-by-verified-sender ok=false"),
+      cliOkFalseExtras(stdout, "list-jobs-by-verified-sender", {
+        groupId: params.groupId,
+        agenticId: params.agenticId,
+        reason: classified.reason
+      })
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: classified.reason, errorCode: classified.errorCode };
+  }
+  const { jobs, invalidCount } = normalizeListJobsResponse(res.data);
+  if (jobs.length === 0) {
+    logWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender: empty (group=${params.groupId} invalidCount=${invalidCount})`
+    );
+    return { status: "empty", jobs, invalidCount };
+  }
+  logWithTimestamp(
+    `[onchainos] list-jobs-by-verified-sender: ok (group=${params.groupId} jobs=${jobs.length} invalidCount=${invalidCount})`
+  );
+  return { status: "ok", jobs, invalidCount };
+}
+var LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN = "list-jobs-by-verified-sender";
+function listJobsByVerifiedSenderHelpAdvertisesCommand(helpText) {
+  if (typeof helpText !== "string" || helpText.length === 0) {
+    return false;
+  }
+  const lower = helpText.toLowerCase();
+  if (/unknown command|unrecognized|not a valid command|no such (sub)?command|command not found/.test(lower)) {
+    return false;
+  }
+  return lower.includes(LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN);
+}
+var CAPABILITY_UPGRADE_PAIR_KEY = "onchainos:list-jobs-by-verified-sender";
+var CAPABILITY_UPGRADE_REASON = "OnchainOS does not support `agent list-jobs-by-verified-sender`; the V2 subscription shared-group inbound path is fail-closed until OnchainOS is upgraded. Upgrade the OnchainOS CLI, then re-run.";
+var capabilityProbe2 = null;
+var capabilityRecommendedPairs = /* @__PURE__ */ new Set();
+function resetListJobsByVerifiedSenderCapabilityForTests() {
+  capabilityProbe2 = null;
+  capabilityRecommendedPairs.clear();
+}
+function maybeRecommendListJobsUpgrade(capability) {
+  if (capability.supported || capabilityRecommendedPairs.has(CAPABILITY_UPGRADE_PAIR_KEY)) {
+    return;
+  }
+  warnWithTimestamp(
+    `[onchainos] list-jobs-by-verified-sender unsupported (reason=${capability.reason}); ${CAPABILITY_UPGRADE_REASON}`
+  );
+  const hook = XmtpService.getInstance().tools?.notifyUpgradeRecommendation;
+  if (!hook) {
+    return;
+  }
+  capabilityRecommendedPairs.add(CAPABILITY_UPGRADE_PAIR_KEY);
+  try {
+    void Promise.resolve(
+      hook({
+        component: "onchainos",
+        capability: LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN,
+        reason: CAPABILITY_UPGRADE_REASON
+      })
+    ).catch((err) => {
+      warnWithTimestamp("[onchainos] list-jobs-by-verified-sender upgrade notice async delivery failed:", err);
+    });
+  } catch (err) {
+    warnWithTimestamp("[onchainos] list-jobs-by-verified-sender upgrade notice threw:", err);
+  }
+}
+function detectListJobsByVerifiedSenderSupport(execFn = exec) {
+  if (!capabilityProbe2) {
+    capabilityProbe2 = (async () => {
+      try {
+        const { stdout, stderr } = await execFn([
+          "agent",
+          "list-jobs-by-verified-sender",
+          "--help"
+        ]);
+        const supported = listJobsByVerifiedSenderHelpAdvertisesCommand(`${stdout}
+${stderr}`);
+        logWithTimestamp(
+          `[onchainos] list-jobs-by-verified-sender capability: ${supported ? "supported" : "unsupported_cli_capability"}`
+        );
+        return supported ? { supported: true } : { supported: false, reason: "unsupported_cli_capability" };
+      } catch (err) {
+        logWithTimestamp(
+          "[onchainos] list-jobs-by-verified-sender --help probe failed; treating as onchainos_upgrade_required:",
+          err
+        );
+        return { supported: false, reason: "onchainos_upgrade_required" };
+      }
+    })().then((capability) => {
+      maybeRecommendListJobsUpgrade(capability);
+      return capability;
+    });
+  }
+  return capabilityProbe2;
+}
+async function listJobsByVerifiedSenderWithCapability(params, execFn = exec) {
+  const capability = await detectListJobsByVerifiedSenderSupport(execFn);
+  if (!capability.supported) {
+    warnWithTimestamp(
+      `[onchainos] list-jobs-by-verified-sender skipped: CLI capability unavailable (reason=${capability.reason}) group=${params.groupId} sender=${redactLogValue(params.senderInboxId)}`
+    );
+    return { status: "fail_closed", jobs: [], invalidCount: 0, reason: capability.reason };
+  }
+  return listJobsByVerifiedSender(params, execFn);
+}
+
+// src/message-handler.ts
 var PROCESSED_IDS_MAX = 1e3;
 var processedMessageIds = /* @__PURE__ */ new Map();
 function tryMarkProcessed(messageId) {
@@ -65740,7 +66707,7 @@ function tryMarkProcessed(messageId) {
   }
   return true;
 }
-function isPlainObject3(value) {
+function isPlainObject5(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function safeStringify(value) {
@@ -65801,9 +66768,9 @@ function readNumber(value) {
 }
 function resolveSessionAgentId(params) {
   const { chatType, payload, myXmtpAddress } = params;
-  const payloadObject = isPlainObject3(payload) ? payload : null;
-  const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
-  const message = isPlainObject3(payloadObject?.message) ? payloadObject.message : null;
+  const payloadObject = isPlainObject5(payload) ? payload : null;
+  const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
+  const message = isPlainObject5(payloadObject?.message) ? payloadObject.message : null;
   const localAgentId = XmtpService.getInstance().getAgentByAddress(myXmtpAddress)?.agentId ?? null;
   if (chatType === "group") {
     return readString3(sender?.agentId) ?? readString3(payloadObject?.receiverAgentId) ?? localAgentId;
@@ -65814,7 +66781,7 @@ function resolveSessionAgentId(params) {
   return localAgentId;
 }
 function routeMessage(chatType, parsed, payload) {
-  if (!parsed || !isPlainObject3(payload)) {
+  if (!parsed || !isPlainObject5(payload)) {
     return {
       jobId: BACKUP_JOB_ID,
       route: "backup",
@@ -65826,7 +66793,7 @@ function routeMessage(chatType, parsed, payload) {
     return jobId ? { jobId, route: "job", routeReason: "group-job-id" } : { jobId: BACKUP_JOB_ID, route: "backup", routeReason: "group-missing-job-id" };
   }
   if (chatType === "dm") {
-    const message = isPlainObject3(payload.message) ? payload.message : null;
+    const message = isPlainObject5(payload.message) ? payload.message : null;
     const nestedJobId = readString3(message?.jobId);
     const directJobId = readString3(payload.jobId);
     const jobId = nestedJobId ?? directJobId;
@@ -65839,10 +66806,10 @@ function routeMessage(chatType, parsed, payload) {
   return { jobId: BACKUP_JOB_ID, route: "backup", routeReason: "unknown-conversation" };
 }
 function extractDirectToUserNotification(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return { kind: "none" };
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
   if (message?.isDirectToUser !== true) {
     return { kind: "none" };
   }
@@ -65866,10 +66833,10 @@ function extractDirectToUserNotification(payload) {
   };
 }
 function extractSystemNotification(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return null;
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
   const isDirectCommunication = message?.isDirectCommunication === true;
   if (message?.source !== "system" && !isDirectCommunication) {
     return null;
@@ -66104,7 +67071,7 @@ function inboundStageExtras(stage, outcome) {
     })
   };
 }
-function definedExtras(input) {
+function definedExtras2(input) {
   return Object.entries(input).reduce((out, [key, value]) => {
     const text = readString3(value);
     if (text) {
@@ -66136,7 +67103,7 @@ function buildInboundTerminalExtras(input) {
       originPlatform: classifyOriginPlatform({ env: process.env }),
       deliveryId: resolveDeliveryId({ messageId, jobId, sessionKey })
     }),
-    ...definedExtras({
+    ...definedExtras2({
       messageId,
       conversationId,
       chatType,
@@ -66170,7 +67137,7 @@ function maybeNotifyInboundAgentMessage(params) {
     return;
   }
   const content = payloadObject.content;
-  const sender = isPlainObject3(payloadObject.sender) ? payloadObject.sender : null;
+  const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
   const localAgent = XmtpService.getInstance().getAgentByAddress(params.deps.myXmtpAddress);
   void notifyAgentMessageToUserAttention({
     direction: "inbound" /* INBOUND */,
@@ -66201,11 +67168,11 @@ function stringifySystemPayload(payload) {
   }
 }
 function summarizePayloadForLog(payload) {
-  if (!isPlainObject3(payload)) {
+  if (!isPlainObject5(payload)) {
     return "payload=non-object";
   }
-  const message = isPlainObject3(payload.message) ? payload.message : null;
-  const sender = isPlainObject3(payload.sender) ? payload.sender : null;
+  const message = isPlainObject5(payload.message) ? payload.message : null;
+  const sender = isPlainObject5(payload.sender) ? payload.sender : null;
   const jobId = readString3(payload.jobId) ?? readString3(message?.jobId);
   const parts = [
     readString3(payload.msgType) ? `type=${readString3(payload.msgType)}` : null,
@@ -66474,7 +67441,7 @@ async function verifyInboundA2AGroupMessage(params) {
       messageId,
       groupId,
       jobId,
-      agentId: readString3(isPlainObject3(payload.sender) ? payload.sender.agentId : null),
+      agentId: readString3(isPlainObject5(payload.sender) ? payload.sender.agentId : null),
       localAgentId: myAgent?.agentId ?? null,
       senderAddress,
       senderInboxId,
@@ -66500,7 +67467,7 @@ async function verifyInboundA2AGroupMessage(params) {
     });
     return false;
   }
-  const sender = isPlainObject3(payload.sender) ? payload.sender : null;
+  const sender = isPlainObject5(payload.sender) ? payload.sender : null;
   const senderAgentId = readString3(sender?.agentId);
   const senderRole = readNumber(sender?.role);
   if (!senderAgentId || !myAgent) {
@@ -66669,9 +67636,302 @@ ${failureMessage}`,
   }
   return true;
 }
+async function processSubscriptionInbound(ctx, deps, input) {
+  const { decision, conversationId, messageId } = input;
+  const senderInboxId = ctx.message.senderInboxId ?? "";
+  if (decision.kind === "drop") {
+    logger.info(
+      LogEvent.SUBSCRIPTION_INBOUND_GATE_DROPPED,
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_gate_dropped",
+        outcome: "dropped",
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: decision.reason
+      })
+    );
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription message dropped reason=${decision.reason}${decision.detail ? ` detail=${decision.detail}` : ""} conv=${conversationId} message=${shortenLogValue(messageId)} sender=${shortenLogValue(senderInboxId)}`
+    );
+    return true;
+  }
+  if (decision.kind === "not_subscription") {
+    return true;
+  }
+  const { envelope } = decision;
+  const agenticId = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId;
+  if (!agenticId) {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription fail-closed: no local agenticId for ${deps.myXmtpAddress}, conv=${conversationId} message=${shortenLogValue(messageId)}`
+    );
+    logger.error(
+      LogEvent.SUBSCRIPTION_INBOUND_AGENTIC_ID_MISSING,
+      new Error("Subscription inbound: local agenticId not resolved"),
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_agentic_id",
+        outcome: "blocked",
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: "missing_agentic_id"
+      })
+    );
+    return true;
+  }
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription received msgType=${envelope.msgType} conv=${conversationId} message=${shortenLogValue(messageId)} sender=${shortenLogValue(senderInboxId)}`
+  );
+  logger.info(
+    LogEvent.SUBSCRIPTION_INBOUND_RECEIVED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_received",
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      deliveryId: envelope.deliveryId,
+      senderInboxId: shortenLogValue(senderInboxId)
+    })
+  );
+  const listJobs = deps.listJobsByVerifiedSenderImpl ?? listJobsByVerifiedSenderWithCapability;
+  logger.info(
+    LogEvent.SUBSCRIPTION_JOBS_QUERY_STARTED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_jobs_query_started",
+      userAgentId: agenticId,
+      conversationId,
+      messageId
+    })
+  );
+  const listJobsResult = await listJobs({
+    groupId: conversationId,
+    senderInboxId,
+    agenticId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription queried status=${listJobsResult.status} jobs=${listJobsResult.jobs.length} invalid=${listJobsResult.invalidCount} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  if (listJobsResult.status === "fail_closed") {
+    logger.error(
+      LogEvent.SUBSCRIPTION_JOBS_FAIL_CLOSED,
+      new Error("Subscription inbound: listJobsByVerifiedSender fail-closed"),
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_jobs_fail_closed",
+        outcome: "blocked",
+        userAgentId: agenticId,
+        conversationId,
+        messageId,
+        senderInboxId: shortenLogValue(senderInboxId),
+        reason: listJobsResult.reason ?? "unknown",
+        errorCode: listJobsResult.errorCode
+      })
+    );
+    return true;
+  }
+  if (listJobsResult.status === "empty") {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription empty: no verified jobs for conv=${conversationId} message=${shortenLogValue(messageId)}`
+    );
+    logger.info(
+      LogEvent.SUBSCRIPTION_JOBS_EMPTY,
+      buildSubscriptionInboundExtras({
+        checkpoint: "inbound/subscription_jobs_empty",
+        outcome: "ignored",
+        userAgentId: agenticId,
+        conversationId,
+        messageId,
+        reason: "jobs_empty",
+        returnedCount: 0,
+        invalidCount: listJobsResult.invalidCount
+      })
+    );
+    return true;
+  }
+  logger.info(
+    LogEvent.SUBSCRIPTION_JOBS_QUERY_SUCCEEDED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_jobs_query_succeeded",
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      returnedCount: listJobsResult.jobs.length,
+      invalidCount: listJobsResult.invalidCount
+    })
+  );
+  const ownership = partitionSubscriptionJobsByOwner({
+    jobs: listJobsResult.jobs,
+    localAgentId: agenticId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription routed receiver=${agenticId} returned=${ownership.returnedCount} localOwned=${ownership.ownedCount} ignored=${ownership.ignoredCount} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  logger.info(
+    LogEvent.SUBSCRIPTION_INBOUND_OWNERSHIP_ROUTED,
+    buildSubscriptionInboundExtras({
+      checkpoint: "inbound/subscription_ownership_routed",
+      outcome: ownership.ownedCount === 0 ? "ignored" : null,
+      userAgentId: agenticId,
+      conversationId,
+      messageId,
+      returnedCount: ownership.returnedCount,
+      ownedCount: ownership.ownedCount,
+      ignoredCount: ownership.ignoredCount
+    })
+  );
+  if (ownership.ownedCount === 0) {
+    return true;
+  }
+  const normalizedJobs = normalizeSubscriptionJobs({
+    jobs: ownership.owned,
+    envelope,
+    conversationId,
+    senderInboxId
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription expanded jobs=${normalizedJobs.length} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  let senderXmtpAddress = null;
+  try {
+    const resolved = await ctx.getSenderAddress();
+    senderXmtpAddress = resolved ? resolved : null;
+  } catch (err) {
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] subscription sender address unresolved (degrading to null) conv=${conversationId} message=${shortenLogValue(messageId)}:`,
+      err
+    );
+  }
+  const fanoutResult = await fanOutSubscriptionJobs({
+    jobs: normalizedJobs,
+    myXmtpAddress: deps.myXmtpAddress,
+    messageId,
+    dispatch: async (job, idempotencyKey) => {
+      const sessionKey = buildSessionKey({
+        jobId: job.jobId,
+        myAgentId: job.userAgentId,
+        toAgentId: job.aspAgentId
+      });
+      deps.sessionStore?.upsertSession({
+        sessionKey,
+        jobId: job.jobId,
+        myAgentId: job.userAgentId,
+        toAgentId: job.aspAgentId,
+        groupId: job.conversationId,
+        myAgentXmtpAddress: deps.myXmtpAddress,
+        toAgentXmtpAddress: senderXmtpAddress
+      });
+      return deps.onSessionMessage?.({
+        sessionKey,
+        content: JSON.stringify({
+          msgType: job.msgType,
+          content: job.content,
+          ...job.deliveryId ? { deliveryId: job.deliveryId } : {},
+          jobId: job.jobId,
+          userAgentId: job.userAgentId,
+          aspAgentId: job.aspAgentId,
+          conversationId: job.conversationId,
+          senderInboxId: job.senderInboxId,
+          // Raw XMTP messageId preserved for sender/receiver telemetry join;
+          // the durable dedup identity is the idempotencyKey passed as this
+          // session-message's own `messageId` field below (M1 fix).
+          xmtpMessageId: messageId
+        }),
+        messageId: idempotencyKey,
+        // Durable exactly-once enqueue key (M2): the wiring persists via
+        // CommandStore.submitIdempotent keyed on sessionKey+messageId so a
+        // re-processed / replayed message never creates a second command.
+        idempotencyKey,
+        jobId: job.jobId,
+        agentId: job.userAgentId
+      });
+    }
+  });
+  logWithTimestamp(
+    `[okx-agent-task:${deps.myXmtpAddress}] subscription fan-out succeeded=${fanoutResult.started} failed=${fanoutResult.failed} skippedDuplicate=${fanoutResult.skippedDuplicate} total=${fanoutResult.total} capacityAnomaly=${fanoutResult.capacityAnomaly} conv=${conversationId} message=${shortenLogValue(messageId)}`
+  );
+  const normalizedJobsById = new Map(normalizedJobs.map((job) => [job.jobId, job]));
+  for (const result of fanoutResult.results) {
+    const job = normalizedJobsById.get(result.jobId);
+    if (result.outcome === "started") {
+      logger.info(
+        LogEvent.SUBSCRIPTION_JOB_DISPATCHED,
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_dispatched",
+          outcome: "success",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId
+        })
+      );
+    } else if (result.outcome === "duplicate") {
+      logger.info(
+        LogEvent.SUBSCRIPTION_JOB_DUPLICATE_IGNORED,
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_duplicate_ignored",
+          outcome: "ignored",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId,
+          reason: "duplicate_delivery"
+        })
+      );
+    } else {
+      logger.error(
+        LogEvent.SUBSCRIPTION_JOB_FAILED,
+        toLoggableError(result.error),
+        buildSubscriptionJobExtras({
+          checkpoint: "dispatch/subscription_job_failed",
+          outcome: "failed",
+          jobId: result.jobId,
+          userAgentId: agenticId,
+          aspAgentId: job?.aspAgentId,
+          conversationId,
+          deliveryId: envelope.deliveryId,
+          reason: "session_dispatch_failed"
+        })
+      );
+    }
+  }
+  logger.info(
+    LogEvent.SUBSCRIPTION_FANOUT_SUMMARY,
+    buildSubscriptionJobExtras({
+      checkpoint: "dispatch/subscription_fanout_summary",
+      outcome: fanoutResult.failed === 0 ? "success" : fanoutResult.started > 0 || fanoutResult.skippedDuplicate > 0 ? "partial" : "failed",
+      conversationId,
+      userAgentId: agenticId,
+      total: fanoutResult.total,
+      started: fanoutResult.started,
+      failed: fanoutResult.failed,
+      skippedDuplicate: fanoutResult.skippedDuplicate
+    })
+  );
+  return true;
+}
 async function processFileMessage(ctx, deps, options = {}) {
   const messageId = ctx.message.id ?? "";
   const timing = createInboundTimingTracker(extractXmtpSentAtMs2(ctx.message));
+  const subscriptionPrecheckRawText = extractRawText(ctx.message.content);
+  const subscriptionPrecheckParse = parseJson2(subscriptionPrecheckRawText);
+  if (subscriptionPrecheckParse.ok && isSubscriptionEnvelope(subscriptionPrecheckParse.data)) {
+    const { chatType: subscriptionChatType, conversationId: subscriptionConversationId } = getConversationInfo(ctx.conversation);
+    const gateDecision = decideSubscriptionGate({
+      // getConversationInfo's declared StoredChatType also lists "system",
+      // but that value is only ever produced for stored-message bookkeeping
+      // elsewhere in this file — the conversation-type branch above never
+      // returns it, so this narrowing is safe.
+      chatType: subscriptionChatType === "system" ? "unknown" : subscriptionChatType,
+      payload: subscriptionPrecheckParse.data,
+      senderInboxId: ctx.message.senderInboxId ?? ""
+    });
+    return processSubscriptionInbound(ctx, deps, {
+      decision: gateDecision,
+      conversationId: subscriptionConversationId,
+      messageId: messageId || `subscription-${(0, import_node_crypto13.randomUUID)()}`
+    });
+  }
   if (messageId && !tryMarkProcessed(messageId)) {
     logWithTimestamp(`[okx-agent-task:${deps.myXmtpAddress}] duplicate message ignored: ${messageId}`);
     logger.info(LogEvent.INBOUND_IGNORED_DUPLICATE, timing.extras({
@@ -66694,19 +67954,6 @@ async function processFileMessage(ctx, deps, options = {}) {
     chatType,
     ...extra
   });
-  if (chatType === "dm") {
-    const dmTrustStartedAt = Date.now();
-    const trusted = await isTrustedDmSender({
-      myXmtpAddress: deps.myXmtpAddress,
-      senderInboxId: ctx.message.senderInboxId ?? "",
-      messageId,
-      conversationId
-    });
-    timing.mark("dmTrustCheck", dmTrustStartedAt);
-    if (!trusted) {
-      return true;
-    }
-  }
   const parseStartedAt = Date.now();
   const receivedRawText = extractRawText(ctx.message.content);
   const parseResult = parseJson2(receivedRawText);
@@ -66722,9 +67969,26 @@ async function processFileMessage(ctx, deps, options = {}) {
     }
   }
   timing.mark("payloadParse", parseStartedAt);
+  const parsedDmData = parseResult.ok ? parseResult.data : null;
+  const parsedDmMessage = isPlainObject5(parsedDmData) && isPlainObject5(parsedDmData.message) ? parsedDmData.message : null;
+  const dmCarriesSystemMarkers = parsedDmMessage?.isDirectToUser === true || parsedDmMessage?.source === "system" || parsedDmMessage?.isDirectCommunication === true;
+  const isA2ADm = chatType === "dm" && parseResult.ok && isA2AEnvelope(parseResult.data) && !dmCarriesSystemMarkers;
+  if (chatType === "dm" && !isA2ADm) {
+    const dmTrustStartedAt = Date.now();
+    const trusted = await isTrustedDmSender({
+      myXmtpAddress: deps.myXmtpAddress,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      messageId,
+      conversationId
+    });
+    timing.mark("dmTrustCheck", dmTrustStartedAt);
+    if (!trusted) {
+      return true;
+    }
+  }
   const directToUser = chatType === "dm" && parseResult.ok ? extractDirectToUserNotification(parseResult.data) : { kind: "none" };
   if (directToUser.kind === "invalid") {
-    const droppedMessageId = messageId || `direct-to-user-${(0, import_node_crypto12.randomUUID)()}`;
+    const droppedMessageId = messageId || `direct-to-user-${(0, import_node_crypto13.randomUUID)()}`;
     logger.error(
       LogEvent.INBOUND_DROP_DM_INVALID_PAYLOAD,
       new Error("Invalid direct-to-user system DM"),
@@ -66748,7 +68012,7 @@ async function processFileMessage(ctx, deps, options = {}) {
     await dispatchDirectToUserNotification({
       deps,
       notification: directToUser.notification,
-      messageId: messageId || `direct-to-user-${(0, import_node_crypto12.randomUUID)()}`,
+      messageId: messageId || `direct-to-user-${(0, import_node_crypto13.randomUUID)()}`,
       timing,
       source: options.source ?? "live"
     });
@@ -66756,7 +68020,7 @@ async function processFileMessage(ctx, deps, options = {}) {
   }
   const systemNotification = chatType === "dm" && parseResult.ok ? extractSystemNotification(parseResult.data) : null;
   if (systemNotification) {
-    const systemMessageId = messageId || `system-${(0, import_node_crypto12.randomUUID)()}`;
+    const systemMessageId = messageId || `system-${(0, import_node_crypto13.randomUUID)()}`;
     logWithTimestamp(
       `[okx-agent-task:${deps.myXmtpAddress}] xmtp_system_message_received agentId=${systemNotification.agentId ?? ""} msg=${shortenLogValue(systemMessageId)} event=${systemNotification.event ?? ""} job=${shortenLogValue(systemNotification.jobId)} conv=${conversationId} source=${options.source ?? "live"} rawBytes=${Buffer.byteLength(rawText, "utf8")} rawPreview=${previewRawEnvelope(rawText)}`
     );
@@ -66917,7 +68181,7 @@ async function processFileMessage(ctx, deps, options = {}) {
   timing.mark("routeResolve", routeStartedAt);
   if (route.route === "job" && parseResult.ok && isA2AEnvelope(parseResult.data) && !isValidExternalJobId(route.jobId)) {
     const payloadObject = parseResult.data;
-    const sender = isPlainObject3(payloadObject.sender) ? payloadObject.sender : null;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
     logWithTimestamp(
       `[okx-agent-task:${deps.myXmtpAddress}] inbound A2A message has invalid jobId, dropping: jobLength=${route.jobId.length} group=${conversationId}`
     );
@@ -66946,7 +68210,32 @@ async function processFileMessage(ctx, deps, options = {}) {
     });
     return true;
   }
-  if (route.route === "job" && chatType !== "group") {
+  if (isA2ADm && route.route !== "job") {
+    const payloadObject = parseResult.data;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
+    recordInvalidXmtpMessageBestEffort({
+      messageId,
+      groupId: conversationId,
+      jobId: null,
+      agentId: readString3(sender?.agentId),
+      localAgentId: XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId ?? null,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      reason: "dm_a2a_missing_job_id",
+      stage: "inbound/job_id_validation",
+      logTag: `[okx-agent-task:${deps.myXmtpAddress}]`
+    });
+    logger.info(LogEvent.INBOUND_DROP_INVALID_JOBID, {
+      ...agentExtras({ walletAddress: deps.myXmtpAddress }),
+      conversationId,
+      messageId,
+      chatType,
+      peerInboxId: ctx.message.senderInboxId ?? "",
+      ...inboundStageExtras("inbound/job_id_validation", "dropped"),
+      reason: "dm_a2a_missing_job_id"
+    });
+    return true;
+  }
+  if (route.route === "job" && chatType !== "group" && !isA2ADm) {
     const providerBindStartedAt = Date.now();
     const providerGate = await bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
     timing.mark("providerBind", providerBindStartedAt);
@@ -66986,7 +68275,7 @@ async function processFileMessage(ctx, deps, options = {}) {
     );
   }
   if (route.route === "job" && chatType === "group") {
-    const payloadObject = isPlainObject3(parseResult.ok ? parseResult.data : null) ? parseResult.data : null;
+    const payloadObject = isPlainObject5(parseResult.ok ? parseResult.data : null) ? parseResult.data : null;
     const service = XmtpService.getInstance();
     const trustedSystemSender = service.isTrustedSystemAccountSender({
       senderAddress,
@@ -67012,7 +68301,7 @@ async function processFileMessage(ctx, deps, options = {}) {
       });
       return true;
     }
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     const localAgent = service.getAgentByAddress(deps.myXmtpAddress);
     const myAgentId = localAgent?.agentId ?? readString3(payloadObject?.receiverAgentId) ?? sessionAgentId ?? null;
     const toAgentId = readString3(sender?.agentId);
@@ -67052,7 +68341,7 @@ async function processFileMessage(ctx, deps, options = {}) {
       }));
       return true;
     }
-    const routedMessageId = messageId || `group-${(0, import_node_crypto12.randomUUID)()}`;
+    const routedMessageId = messageId || `group-${(0, import_node_crypto13.randomUUID)()}`;
     const sessionKey = ensureInboundGroupSession(deps, {
       jobId: route.jobId,
       myAgentId,
@@ -67117,8 +68406,102 @@ async function processFileMessage(ctx, deps, options = {}) {
     );
     return true;
   }
+  if (route.route === "job" && isA2ADm) {
+    const payloadObject = parseResult.data;
+    const accepted = await verifyInboundA2AGroupMessage({
+      payload: parseResult.data,
+      myXmtpAddress: deps.myXmtpAddress,
+      senderAddress,
+      senderInboxId: ctx.message.senderInboxId ?? "",
+      jobId: route.jobId,
+      groupId: conversationId,
+      messageId,
+      consentState: void 0,
+      trustedSystemSender: false,
+      isOfflineReplay: options.isOfflineReplay ?? false,
+      timing
+    });
+    if (!accepted) {
+      return true;
+    }
+    const providerBindStartedAt = Date.now();
+    const providerGate = await bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
+    timing.mark("providerBind", providerBindStartedAt);
+    if (!providerGate.allowed) {
+      logger.info(LogEvent.INBOUND_IGNORED_NON_BUSINESS, timing.extras({
+        ...buildInboundTerminalExtras({
+          terminalState: "provider_gate_denied",
+          myXmtpAddress: deps.myXmtpAddress,
+          messageId,
+          conversationId,
+          chatType,
+          jobId: route.jobId,
+          route: route.route,
+          reason: "job_provider_gate_denied"
+        }),
+        routeReason: route.routeReason,
+        providerBinding: providerGate.provider ?? ""
+      }));
+      return true;
+    }
+    const myAgentId = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress)?.agentId ?? readString3(payloadObject.receiverAgentId) ?? sessionAgentId ?? null;
+    const sender = isPlainObject5(payloadObject.sender) ? payloadObject.sender : null;
+    const toAgentId = readString3(sender?.agentId);
+    const routedMessageId = messageId || `dm-${(0, import_node_crypto13.randomUUID)()}`;
+    const sessionKey = ensureInboundGroupSession(deps, {
+      jobId: route.jobId,
+      myAgentId,
+      toAgentId,
+      groupId: null,
+      toAgentXmtpAddress: senderAddress || readString3(payloadObject.fromXmtpAddress)
+    });
+    const dispatchStartedAt = Date.now();
+    void Promise.resolve(deps.onSessionMessage?.({
+      sessionKey,
+      content: rawText,
+      messageId: routedMessageId,
+      jobId: route.jobId,
+      agentId: myAgentId
+    })).then(() => {
+      timing.mark("sessionDispatch", dispatchStartedAt);
+      logger.info(LogEvent.INBOUND_DELIVERED, commonDeliveryExtras({
+        taskId: route.jobId,
+        agentId: myAgentId ?? "",
+        peerWalletAddress: senderAddress,
+        peerInboxId: ctx.message.senderInboxId ?? "",
+        peerAgentId: toAgentId ?? "",
+        sessionKey,
+        messageId: routedMessageId,
+        route: "dm",
+        ...inboundStageExtras("inbound/dm_session_dispatch", "success"),
+        dispatchTarget: deps.onSessionMessage ? "session" : "none"
+      }));
+    }).catch((err) => {
+      logWithTimestamp(`[okx-agent-task:${deps.myXmtpAddress}] onSessionMessage failed:`, err);
+      logger.error(LogEvent.INBOUND_DISPATCH_FAILED, toLoggableError(err), timing.extras({
+        ...buildInboundTerminalExtras({
+          terminalState: "dispatch_failed",
+          myXmtpAddress: deps.myXmtpAddress,
+          messageId: routedMessageId,
+          conversationId,
+          chatType,
+          jobId: route.jobId,
+          sessionKey,
+          route: "dm",
+          reason: "session_dispatch_failed"
+        }),
+        checkpoint: "inbound/dm_session_dispatch_failed",
+        agentId: myAgentId ?? "",
+        peerAgentId: toAgentId ?? ""
+      }));
+    });
+    logWithTimestamp(
+      `[okx-agent-task:${deps.myXmtpAddress}] session dispatch queued route=dm session=${sessionKey} message=${shortenLogValue(routedMessageId)} ${summarizePayloadForLog(parseResult.data)}`
+    );
+    return true;
+  }
   const stored = {
-    id: messageId || `local-${(0, import_node_crypto12.randomUUID)()}`,
+    id: messageId || `local-${(0, import_node_crypto13.randomUUID)()}`,
     direction: "inbound",
     route: route.route,
     routeReason: route.routeReason,
@@ -67136,8 +68519,8 @@ async function processFileMessage(ctx, deps, options = {}) {
   await deps.store.append(route.jobId, stored, sessionAgentId);
   timing.mark("storeAppend", storeAppendStartedAt);
   if ((route.route === "job" || parseResult.ok && !isA2AEnvelope(stored.payload)) && !options.skipNotify) {
-    const payloadObject = isPlainObject3(stored.payload) ? stored.payload : null;
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const payloadObject = isPlainObject5(stored.payload) ? stored.payload : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     const localAgent = XmtpService.getInstance().getAgentByAddress(deps.myXmtpAddress);
     const sessionKey = route.route === "job" ? buildSessionKey({
       jobId: route.jobId,
@@ -67155,8 +68538,8 @@ async function processFileMessage(ctx, deps, options = {}) {
     });
   }
   if (route.route === "job" && chatType === "group" && conversationId && senderAddress) {
-    const payloadObject = isPlainObject3(stored.payload) ? stored.payload : null;
-    const sender = isPlainObject3(payloadObject?.sender) ? payloadObject.sender : null;
+    const payloadObject = isPlainObject5(stored.payload) ? stored.payload : null;
+    const sender = isPlainObject5(payloadObject?.sender) ? payloadObject.sender : null;
     await deps.store.updateXmtpSession(route.jobId, {
       xmtpGroupId: conversationId,
       myXmtpAddress: deps.myXmtpAddress,
@@ -67299,7 +68682,7 @@ function processOfflineFromCoreDeps(store, ctx, deps, options) {
 function buildSystemStoredMessage(params) {
   const now = Date.now();
   return {
-    id: params.id ?? `system-${now}-${(0, import_node_crypto12.randomUUID)()}`,
+    id: params.id ?? `system-${now}-${(0, import_node_crypto13.randomUUID)()}`,
     direction: "system",
     route: "backup",
     routeReason: params.reason,
@@ -67315,7 +68698,7 @@ function buildSystemStoredMessage(params) {
   };
 }
 function isA2AEnvelope(payload) {
-  return isPlainObject3(payload) && payload.msgType === A2A_MESSAGE_TYPE;
+  return isPlainObject5(payload) && payload.msgType === A2A_MESSAGE_TYPE;
 }
 
 // src/listener.ts
@@ -67443,7 +68826,7 @@ async function enqueueAiJobMessageDispatch(params) {
   await commands.submit(command);
   return command;
 }
-async function enqueueAiSessionMessageDispatch(params) {
+async function enqueueAiSessionMessageDispatchIdempotent(params) {
   const commands = params.commands ?? new CommandStore(params.homeDir);
   const messageId = params.event.messageId ?? `session-${Date.now()}`;
   const command = commands.createAiSessionMessageDispatchCommand({
@@ -67453,15 +68836,25 @@ async function enqueueAiSessionMessageDispatch(params) {
     jobId: params.event.jobId,
     agentId: params.event.agentId
   });
+  const idempotencyKey = params.event.idempotencyKey?.trim();
+  if (idempotencyKey) {
+    const dbKey = `${command.sessionKey}
+${command.messageId}`;
+    const result = await commands.submitIdempotent(command, dbKey);
+    return {
+      command: result.created ? command : { ...command, id: result.commandId },
+      created: result.created
+    };
+  }
   await commands.submit(command);
-  return command;
+  return { command, created: true };
 }
 
 // src/listener.ts
 init_paths();
 
 // src/user-attention-watchers.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 init_sentry_logger();
 var USER_ATTENTION_WATCH_REPLACED_MESSAGE = "Another okx-a2a user watch with the same job scope was started, so this watcher has been closed. Do not run this watch command again automatically, because starting another watcher may interrupt a different session that is already monitoring task progress.";
 var USER_ATTENTION_WATCHER_SCAN_MS = 500;
@@ -67504,7 +68897,7 @@ function isOriginalParentProcessAlive(options) {
 }
 function registerUserAttentionWatcher(options) {
   return options.store.registerUserAttentionWatcher({
-    id: options.id ?? (0, import_node_crypto13.randomUUID)(),
+    id: options.id ?? (0, import_node_crypto14.randomUUID)(),
     provider: options.provider,
     jobId: options.jobId,
     nowMs: options.nowMs ?? Date.now(),
@@ -67796,6 +69189,35 @@ var ListenerMaintenanceGate = class {
   }
 };
 var UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY = "system:onchainos-offline-replay-upgrade";
+var LIST_JOBS_UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY = "system:onchainos-list-jobs-by-verified-sender-upgrade";
+function buildUpgradeRecommendationNotice(input) {
+  const capability = input.capability?.trim() ?? "";
+  if (capability === MESSAGE_ELIGIBLE_OFFLINE_REPLAY_HELP_TOKEN) {
+    return {
+      title: "OnchainOS upgrade recommended",
+      content: "The installed OnchainOS version does not support offline-replay preferences. Subscription messages will continue to replay normally. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade",
+      idempotencyKey: UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+    };
+  }
+  if (capability === LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN) {
+    return {
+      title: "OnchainOS upgrade required for Subscription Shared Group",
+      content: "The installed OnchainOS version does not support the verified-sender task query required by Subscription Shared Group. Until OnchainOS is upgraded, Subscription Shared Group messages fail closed and are NOT routed to an AI Session. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade",
+      idempotencyKey: LIST_JOBS_UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+    };
+  }
+  const capabilitySlug = capability ? capability.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") : "";
+  const idempotencyKey = capabilitySlug ? `system:onchainos-${capabilitySlug}-upgrade` : "system:onchainos-capability-upgrade";
+  const capabilityLabel = capability || "a required capability";
+  const reasonSuffix = input.reason?.trim() ? ` ${input.reason.trim()}` : "";
+  return {
+    title: "OnchainOS upgrade recommended",
+    content: `The installed OnchainOS version does not support ${capabilityLabel}.${reasonSuffix} Upgrade OnchainOS to enable this capability.
+
+Suggested command: onchainos upgrade`,
+    idempotencyKey
+  };
+}
 function resolveOfflineReplayIntervalSec(systemConfig) {
   const interval = systemConfig.offlineReplayInterval;
   if (typeof interval !== "number" || !Number.isFinite(interval) || interval <= 0) {
@@ -68024,8 +69446,12 @@ async function runListenerWithLock(options, paths) {
       onJobMessageStored: async (event) => {
         await enqueueAiJobMessageDispatch({ commands, event });
       },
+      // Returns { created } so the V2 subscription fan-out can distinguish a
+      // durable DB duplicate (idempotent success) from a fresh enqueue. V1
+      // group/system callers ignore the return; their events carry no
+      // idempotencyKey, so the plain submit path (unchanged) is used.
       onSessionMessage: async (event) => {
-        await enqueueAiSessionMessageDispatch({ commands, event });
+        return enqueueAiSessionMessageDispatchIdempotent({ commands, event });
       }
     }),
     processOfflineMessage: (ctx, deps, replayOptions) => processOfflineFromCoreDeps(store, ctx, deps, {
@@ -68035,7 +69461,7 @@ async function runListenerWithLock(options, paths) {
         await enqueueAiJobMessageDispatch({ commands, event });
       },
       onSessionMessage: async (event) => {
-        await enqueueAiSessionMessageDispatch({ commands, event });
+        return enqueueAiSessionMessageDispatchIdempotent({ commands, event });
       }
     }),
     notifySessionExpired: (command) => {
@@ -68053,12 +69479,12 @@ async function runListenerWithLock(options, paths) {
       });
     },
     notifyUpgradeRecommendation: (input) => {
-      const content = "The installed OnchainOS version does not support offline-replay preferences. Subscription messages will continue to replay normally. Upgrade OnchainOS to enable this capability.\n\nSuggested command: onchainos upgrade";
+      const notice = buildUpgradeRecommendationNotice(input);
       void notifySystemMessageToUser({
-        title: "OnchainOS upgrade recommended",
-        content,
+        title: notice.title,
+        content: notice.content,
         store: sessionStore,
-        idempotencyKey: UPGRADE_RECOMMENDATION_IDEMPOTENCY_KEY
+        idempotencyKey: notice.idempotencyKey
       }).catch((err) => {
         logWithTimestamp(
           `[okx-agent-task] upgrade recommendation notify failed component=${input.component} capability=${input.capability}:`,
@@ -68067,12 +69493,12 @@ async function runListenerWithLock(options, paths) {
       });
     }
   });
-  service.setPluginVersion("0.2.17");
+  service.setPluginVersion("0.2.18-beta-4dd056b897-261015113839");
   await service.init();
   const pluginVersionStatus = service.pluginVersionStatus;
   if (pluginVersionStatus.unavailable) {
     throw new Error(
-      `@okxweb3/a2a-node v${"0.2.17"} is below the required minimum v${pluginVersionStatus.minVersion}`
+      `@okxweb3/a2a-node v${"0.2.18-beta-4dd056b897-261015113839"} is below the required minimum v${pluginVersionStatus.minVersion}`
     );
   }
   const systemConfig = service.getSystemConfig();
@@ -68100,7 +69526,7 @@ async function runListenerWithLock(options, paths) {
       onchainosAgentId: "*",
       reason: "system-config missing sentryDsn",
       pluginId: "@okxweb3/a2a-node",
-      pluginVersion: "0.2.17"
+      pluginVersion: "0.2.18-beta-4dd056b897-261015113839"
     });
   }
   logWithTimestamp(
@@ -69562,7 +70988,7 @@ var import_node_path34 = require("node:path");
 var import_jszip = __toESM(require_lib3());
 
 // src/logs-export-archive.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_fs24 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path31 = require("node:path");
@@ -70198,7 +71624,7 @@ async function writeArchiveAtomically(outputPath, archive, overwrite) {
   await (0, import_promises13.mkdir)((0, import_node_path31.dirname)(outputPath), { recursive: true });
   const temporaryPath = (0, import_node_path31.join)(
     (0, import_node_path31.dirname)(outputPath),
-    `.${(0, import_node_path31.basename)(outputPath)}.${(0, import_node_crypto14.randomUUID)()}.tmp`
+    `.${(0, import_node_path31.basename)(outputPath)}.${(0, import_node_crypto15.randomUUID)()}.tmp`
   );
   try {
     await (0, import_promises13.writeFile)(temporaryPath, archive, { flag: "wx", mode: 384 });
@@ -70217,7 +71643,7 @@ async function writeArchiveAtomically(outputPath, archive, overwrite) {
   }
 }
 function hashDiagnosticFileContent(content) {
-  return (0, import_node_crypto14.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto15.createHash)("sha256").update(content).digest("hex");
 }
 function isUnavailableError(err) {
   return !!err && typeof err === "object" && "diagnosticUnavailable" in err;
@@ -70477,7 +71903,7 @@ function isProvider2(value) {
 }
 
 // src/logs-export-utils.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs26 = require("node:fs");
 var import_promises14 = require("node:fs/promises");
 var import_node_path33 = require("node:path");
@@ -70620,7 +72046,7 @@ async function assertRegularFile2(path2) {
 }
 async function inspectRegularFile(path2) {
   const file = await assertRegularFile2(path2);
-  const hash2 = (0, import_node_crypto15.createHash)("sha256");
+  const hash2 = (0, import_node_crypto16.createHash)("sha256");
   for await (const chunk of (0, import_node_fs26.createReadStream)(path2)) {
     hash2.update(chunk);
   }
@@ -70873,7 +72299,7 @@ async function exportDiagnosticLogs(options) {
     node: process.version,
     platform: process.platform,
     arch: process.arch,
-    packageVersion: true ? "0.2.17" : "unknown",
+    packageVersion: true ? "0.2.18-beta-4dd056b897-261015113839" : "unknown",
     sensitiveContentIncluded: options.includeSensitiveContent,
     listenerAndLlmContentIncluded: true,
     credentialsAlwaysRedacted: true,
@@ -72785,7 +74211,7 @@ async function runDoctor(options = {}) {
     platform: options.platform ?? process.platform,
     env: options.env ?? process.env,
     target: options.target ?? resolveDoctorTarget(options.env ?? process.env),
-    cliVersion: options.cliVersion ?? (true ? "0.2.17" : "0.0.0"),
+    cliVersion: options.cliVersion ?? (true ? "0.2.18-beta-4dd056b897-261015113839" : "0.0.0"),
     fixMode: options.fix === true,
     nonInteractive: options.nonInteractive === true,
     packageChanged: false,
@@ -73032,6 +74458,7 @@ init_autostart_windows();
   InboundReplayGate,
   InvalidXmtpMessageStore,
   JOB_PROVIDER_BINDING_SOURCES,
+  LIST_JOBS_BY_VERIFIED_SENDER_HELP_TOKEN,
   ListenerDeferredTaskScheduler,
   ListenerMaintenanceGate,
   LogEvent,
@@ -73041,6 +74468,9 @@ init_autostart_windows();
   NATIVE_LAUNCHER_EXE_NAME,
   OPENCLAW_GATEWAY_ROUTE_GROUP_ID,
   ProviderNotReadyError,
+  RUN_LOG_FILENAME_MAX_BYTES,
+  SUBSCRIPTION_FANOUT_MAX,
+  SUBSCRIPTION_MESSAGE_TYPE,
   SYSTEM_NOTIFICATION_SESSION_KEY,
   SessionBusyTracker,
   SessionStore,
@@ -73086,7 +74516,9 @@ init_autostart_windows();
   buildInboundTerminalExtras,
   buildLaunchdPlist,
   buildLauncherEntryJs,
+  buildListJobsByVerifiedSenderArgs,
   buildMessageEligibleArgs,
+  buildRunLogFileName,
   buildSchtasksCreateArgs,
   buildSchtasksDeleteArgs,
   buildSchtasksEndArgs,
@@ -73095,9 +74527,14 @@ init_autostart_windows();
   buildSeaConfig,
   buildServicePath,
   buildSessionKey,
+  buildSubscriptionEnvelope,
+  buildSubscriptionInboundExtras,
+  buildSubscriptionJobExtras,
+  buildSubscriptionSendExtras,
   buildSystemMessageNotice,
   buildSystemStoredMessage,
   buildSystemdUserService,
+  buildUpgradeRecommendationNotice,
   buildWin32OnchainosCandidates,
   buildWindowsParentProcessProbe,
   buildXmtpMessageSentExtra,
@@ -73112,6 +74549,7 @@ init_autostart_windows();
   checkCodexReadiness,
   claimActiveDaemon,
   classifyJobBindingSource,
+  classifyListJobsError,
   clearCodexReadinessCache,
   codexCommandResolvesWithoutOverride,
   codexReadinessCacheKey,
@@ -73123,10 +74561,12 @@ init_autostart_windows();
   createOutboundBehavior,
   createUserAttentionWatchParentMonitor,
   currentOpenClawGatewaySessionKey,
+  decideSubscriptionGate,
   detectAiProviders,
   detectAiRuntimeSurface,
   detectCurrentAiProvider,
   detectGatewayInvocation,
+  detectListJobsByVerifiedSenderSupport,
   detectMessageEligibleOfflineReplaySupport,
   detectRuntime,
   ensureDaemonReady,
@@ -73140,6 +74580,7 @@ init_autostart_windows();
   extractDirectToUserNotification,
   extractRateLimitEndpoint,
   extractXmtpSentAtMs,
+  fanOutSubscriptionJobs,
   findWindowsNativeOkxA2aExe,
   followFile,
   formatDoctorReportForHumans,
@@ -73152,6 +74593,7 @@ init_autostart_windows();
   getXmtpCreationCooldown,
   handleCapabilitiesCommand,
   handleDoctorCommand,
+  handleSubscriptionPushCommand,
   handleXmtpDebugCommand,
   handleXmtpSendCommand,
   handleXmtpTestCommand,
@@ -73166,6 +74608,7 @@ init_autostart_windows();
   invalidateResolvedOnchainosBinForTests,
   isAutostartManagerUnavailableError,
   isDefaultTaskHome,
+  isFingerprintKey,
   isGatewayAvailableForHeartbeat,
   isHermesGatewayPluginEnabled,
   isInfoEventAllowlisted,
@@ -73176,6 +74619,7 @@ init_autostart_windows();
   isPrereleaseVersion,
   isRetryableOpenClawGatewayError,
   isSqliteBusyError,
+  isSubscriptionEnvelope,
   isSystemdManagerUnavailableMessage,
   isTagKey,
   isValidExternalJobId,
@@ -73184,8 +74628,12 @@ init_autostart_windows();
   killProcessTree,
   launchdPlistHasCurrentRestartPolicy,
   listAllAgentsWithMetadata,
+  listJobsByVerifiedSender,
+  listJobsByVerifiedSenderHelpAdvertisesCommand,
+  listJobsByVerifiedSenderWithCapability,
   logWinCompat,
   logXmtpMessageSent,
+  logger,
   maybeRecommendOnchainosUpgrade,
   mergeA2AEnvelopeTips,
   messageEligibleHelpAdvertisesOfflineReplay,
@@ -73193,6 +74641,8 @@ init_autostart_windows();
   normalizeAiProvider,
   normalizeAiRuntimeProvider,
   normalizeHermesOkxA2aPluginConfig,
+  normalizeListJobsResponse,
+  normalizeSubscriptionJobs,
   notifyAgentMessageToUserAttention,
   notifyDirectToUserAttention,
   notifySystemMessageToUser,
@@ -73203,6 +74653,7 @@ init_autostart_windows();
   parsePluginYamlVersion,
   parseWalletLoginStatus,
   parseWindowsParentProcessJson,
+  partitionSubscriptionJobsByOwner,
   performRuntimeSwitch,
   persistAiRuntimeSurfaceBestEffort,
   persistCurrentRuntimeSelectionForNewJob,
@@ -73212,12 +74663,14 @@ init_autostart_windows();
   printXmtpTestUsage,
   probeCodexAuthStatus,
   processFileMessage,
+  processSubscriptionInbound,
   queryWalletLoginStatus,
   readAiProviderTimeoutMs,
   readAiRuntimeSurfaceBestEffort,
   readCachedCodexReadiness,
   readLastLines,
   readParentProcessCommandForPlatform,
+  readSubscriptionEnvelope,
   readUserAttentionWatcherEvent,
   refreshAgentsAndWait,
   refreshOnchainosVersionMetadata,
@@ -73228,8 +74681,10 @@ init_autostart_windows();
   replayScanBackoffWithJitterMs,
   reportDoctorRunToSentry,
   reportUserNotificationFailure,
+  resetListJobsByVerifiedSenderCapabilityForTests,
   resetMessageEligibleOfflineReplayCapabilityForTests,
   resetResolvedOnchainosBinForTests,
+  resetSubscriptionTargetsForTests,
   resetXmtpCreationCooldownForTests,
   resolveAiPermissionPreset,
   resolveAiProviderCommand,
@@ -73283,6 +74738,8 @@ init_autostart_windows();
   stopOpenClawGateway,
   stopSystemdAutostart,
   subscribeUserAttentionEvents,
+  subscriptionIdempotencyKey,
+  summarizeSubscriptionPush,
   summarizeXmtpTestEvents,
   switchProvider,
   switchProviderWithReadinessGate,
@@ -73291,6 +74748,7 @@ init_autostart_windows();
   tailFile,
   toOpenClawGatewaySessionKey,
   toWindowsInvocation,
+  tryMarkSubscriptionTarget,
   writeAiPermissionPresetToConfig
 });
 /*! Bundled license information: