@swarmclawai/swarmclaw 1.2.0 → 1.2.2

package/src/lib/server/runtime/watch-job-repository.ts

@@ -0,0 +1,35 @@
+import type { WatchJob } from '@/types'
+
+import {
+  deleteWatchJob as deleteStoredWatchJob,
+  loadWatchJobs as loadStoredWatchJobs,
+  upsertWatchJob as upsertStoredWatchJob,
+  upsertWatchJobs as upsertStoredWatchJobs,
+} from '@/lib/server/storage'
+import { createRecordRepository } from '@/lib/server/persistence/repository-utils'
+
+export const watchJobRepository = createRecordRepository<WatchJob>(
+  'watch-jobs',
+  {
+    get(id) {
+      return (loadStoredWatchJobs() as Record<string, WatchJob>)[id] || null
+    },
+    list() {
+      return loadStoredWatchJobs() as Record<string, WatchJob>
+    },
+    upsert(id, value) {
+      upsertStoredWatchJob(id, value as WatchJob)
+    },
+    upsertMany(entries) {
+      upsertStoredWatchJobs(entries as Array<[string, WatchJob]>)
+    },
+    delete(id) {
+      deleteStoredWatchJob(id)
+    },
+  },
+)
+
+export const loadWatchJobs = () => watchJobRepository.list()
+export const upsertWatchJob = (id: string, value: WatchJob | Record<string, unknown>) => watchJobRepository.upsert(id, value as WatchJob)
+export const upsertWatchJobs = (entries: Array<[string, WatchJob | Record<string, unknown>]>) => watchJobRepository.upsertMany(entries as Array<[string, WatchJob]>)
+export const deleteWatchJob = (id: string) => watchJobRepository.delete(id)

package/src/lib/server/runtime/watch-jobs.ts

@@ -5,7 +5,9 @@ import { genId } from '@/lib/id'
 import type { MailboxEnvelope, WatchJob } from '@/types'
 import { dispatchWake } from '@/lib/server/runtime/wake-dispatcher'
 import { enqueueSystemEvent } from '@/lib/server/runtime/system-events'
-import { loadApprovals, loadTasks, loadWatchJobs, upsertWatchJob, upsertWatchJobs } from '@/lib/server/storage'
+import { loadApprovals } from '@/lib/server/approvals/approval-repository'
+import { loadTasks } from '@/lib/server/tasks/task-repository'
+import { loadWatchJobs, upsertWatchJob, upsertWatchJobs } from '@/lib/server/runtime/watch-job-repository'
 import { notify } from '@/lib/server/ws-hub'
 import { fetchMailboxMessages, getMailboxHighwaterUid } from '@/lib/server/chatrooms/mailbox-utils'
 import { errorMessage } from '@/lib/shared-utils'

package/src/lib/server/sandbox/bridge-auth-registry.ts

@@ -3,10 +3,16 @@ type BridgeAuth = {
   password?: string
 }
 
+const AUTH_BY_PORT_MAX = 200
 const authByPort = new Map<number, BridgeAuth>()
 
 export function setBridgeAuthForPort(port: number, auth: BridgeAuth): void {
   if (!Number.isFinite(port) || port <= 0) return
+  // FIFO eviction at cap
+  if (!authByPort.has(port) && authByPort.size >= AUTH_BY_PORT_MAX) {
+    const firstKey = authByPort.keys().next().value
+    if (firstKey !== undefined) authByPort.delete(firstKey)
+  }
   const token = typeof auth.token === 'string' ? auth.token.trim() : ''
   const password = typeof auth.password === 'string' ? auth.password.trim() : ''
   authByPort.set(port, {

package/src/lib/server/sandbox/novnc-auth.ts

@@ -15,12 +15,22 @@ export type NoVncObserverTokenPayload = {
   password?: string
 }
 
+const NOVNC_TOKEN_MAX = 500
 const noVncObserverTokens = new Map<string, NoVncObserverTokenEntry>()
 
 function pruneExpiredObserverTokens(now: number): void {
   for (const [token, entry] of noVncObserverTokens) {
     if (entry.expiresAt <= now) noVncObserverTokens.delete(token)
   }
+  // Hard cap as safety net
+  if (noVncObserverTokens.size > NOVNC_TOKEN_MAX) {
+    const excess = noVncObserverTokens.size - NOVNC_TOKEN_MAX
+    const iter = noVncObserverTokens.keys()
+    for (let i = 0; i < excess; i++) {
+      const k = iter.next().value
+      if (k !== undefined) noVncObserverTokens.delete(k)
+    }
+  }
 }
 
 export function isNoVncEnabled(params: { enableNoVnc: boolean; headless: boolean }): boolean {

package/src/lib/server/schedules/schedule-repository.ts

@@ -0,0 +1,42 @@
+import type { Schedule } from '@/types'
+
+import {
+  deleteSchedule as deleteStoredSchedule,
+  loadSchedule as loadStoredSchedule,
+  loadSchedules as loadStoredSchedules,
+  saveSchedules as saveStoredSchedules,
+  upsertSchedule as upsertStoredSchedule,
+  upsertSchedules as upsertStoredSchedules,
+} from '@/lib/server/storage'
+import { createRecordRepository } from '@/lib/server/persistence/repository-utils'
+
+export const scheduleRepository = createRecordRepository<Schedule>(
+  'schedules',
+  {
+    get(id) {
+      return loadStoredSchedule(id) as Schedule | null
+    },
+    list() {
+      return loadStoredSchedules() as Record<string, Schedule>
+    },
+    upsert(id, value) {
+      upsertStoredSchedule(id, value as Schedule)
+    },
+    upsertMany(entries) {
+      upsertStoredSchedules(entries as Array<[string, Schedule]>)
+    },
+    replace(data) {
+      saveStoredSchedules(data as Record<string, Schedule>)
+    },
+    delete(id) {
+      deleteStoredSchedule(id)
+    },
+  },
+)
+
+export const loadSchedules = () => scheduleRepository.list()
+export const loadSchedule = (id: string) => scheduleRepository.get(id)
+export const saveSchedules = (items: Record<string, Schedule | Record<string, unknown>>) => scheduleRepository.replace(items as Record<string, Schedule>)
+export const upsertSchedule = (id: string, value: Schedule | Record<string, unknown>) => scheduleRepository.upsert(id, value as Schedule)
+export const upsertSchedules = (entries: Array<[string, Schedule | Record<string, unknown>]>) => scheduleRepository.upsertMany(entries as Array<[string, Schedule]>)
+export const deleteSchedule = (id: string) => scheduleRepository.delete(id)

package/src/lib/server/session-tools/context.ts

@@ -164,6 +164,7 @@ export function extractResumeIdentifier(text: string): string | null {
   return null
 }
 
+const BINARY_LOOKUP_CACHE_MAX = 100
 const binaryLookupCache = new Map<string, { checkedAt: number; path: string | null }>()
 const BINARY_LOOKUP_TTL_MS = 30_000
 const isWindows = process.platform === 'win32'
@@ -173,6 +174,19 @@ export function findBinaryOnPath(binaryName: string): string | null {
   const cached = binaryLookupCache.get(binaryName)
   if (cached && now - cached.checkedAt < BINARY_LOOKUP_TTL_MS) return cached.path
 
+  // Prune expired + cap
+  for (const [k, v] of binaryLookupCache) {
+    if (now - v.checkedAt > BINARY_LOOKUP_TTL_MS) binaryLookupCache.delete(k)
+  }
+  if (binaryLookupCache.size > BINARY_LOOKUP_CACHE_MAX) {
+    const excess = binaryLookupCache.size - BINARY_LOOKUP_CACHE_MAX
+    const iter = binaryLookupCache.keys()
+    for (let i = 0; i < excess; i++) {
+      const k = iter.next().value
+      if (k !== undefined) binaryLookupCache.delete(k)
+    }
+  }
+
   const { spawnSync } = require('child_process')
   const probe = isWindows
     ? spawnSync('where', [binaryName], { encoding: 'utf-8', timeout: 2000, stdio: 'pipe' })

package/src/lib/server/session-tools/discovery.ts

@@ -11,6 +11,9 @@ import { loadSessions, patchAgent, patchSession } from '../storage'
 import { inferExtensionPublisherSourceFromUrl } from '@/lib/extension-sources'
 import { errorMessage } from '@/lib/shared-utils'
 import { getEnabledCapabilityIds, isExternalExtensionId, normalizeCapabilitySelection } from '@/lib/capability-selection'
+import { log } from '@/lib/server/logger'
+
+const TAG = 'session-tools-discovery'
 
 function grantCapabilitySelection(current: {
   tools?: string[] | null
@@ -62,7 +65,7 @@ async function executeDiscoveryAction(args: Record<string, unknown>, bctx?: Tool
   const q = typeof normalized.query === 'string' ? normalized.query : ''
   const extensionId = explicitExtensionId || (action === 'request_access' ? q.trim() : '')
 
-  console.log('[discovery] Executing action:', action, { query: q, extensionId })
+  log.info(TAG, 'Executing action:', { action, query: q, extensionId })
 
   try {
     switch (action) {
@@ -87,7 +90,7 @@ async function executeDiscoveryAction(args: Record<string, unknown>, bctx?: Tool
         const results: Record<string, unknown>[] = []
         
         try {
-          console.log('[discovery] Searching ClawHub...')
+          log.info(TAG, 'Searching ClawHub...')
           const hubResults = await searchClawHub(q)
           if (hubResults && hubResults.skills) {
             results.push(...hubResults.skills.map((s) => ({
@@ -101,11 +104,11 @@ async function executeDiscoveryAction(args: Record<string, unknown>, bctx?: Tool
             })))
           }
         } catch (err: unknown) {
-          console.error('[discovery] ClawHub search failed:', errorMessage(err))
+          log.error(TAG, 'ClawHub search failed:', errorMessage(err))
         }
 
         try {
-          console.log('[discovery] Searching SwarmClaw registry...')
+          log.info(TAG, 'Searching SwarmClaw registry...')
           const registryResults = new Map<string, Record<string, unknown>>()
           const registries = [
             { url: 'https://swarmclaw.ai/registry/extensions.json', catalogSource: 'swarmclaw-site' },
@@ -133,7 +136,7 @@ async function executeDiscoveryAction(args: Record<string, unknown>, bctx?: Tool
           }
           results.push(...registryResults.values())
         } catch (err: unknown) {
-          console.error('[discovery] SC Registry search failed:', errorMessage(err))
+          log.error(TAG, 'SC Registry search failed:', errorMessage(err))
         }
 
         if (results.length === 0) {
@@ -226,7 +229,7 @@ async function executeDiscoveryAction(args: Record<string, unknown>, bctx?: Tool
     }
   } catch (err: unknown) {
     const msg = errorMessage(err)
-    console.error('[discovery] executeDiscoveryAction failed:', msg)
+    log.error(TAG, 'executeDiscoveryAction failed:', msg)
     return `Error: ${msg}`
   }
 }

package/src/lib/server/session-tools/index.ts

@@ -57,6 +57,8 @@ import {
 export type { ToolContext, SessionToolsResult }
 export { sweepOrphanedBrowsers, cleanupSessionBrowser, getActiveBrowserCount, hasActiveBrowser }
 
+const TAG = 'session-tools'
+
 const DELEGATION_TOOL_NAMES = new Set([
   'delegate',
   'spawn_subagent',
@@ -455,7 +457,7 @@ export async function buildSessionTools(cwd: string, enabledExtensions: string[]
       abortSignalRef,
     }
   } catch (err: any) {
-    console.error('[session-tools] buildSessionTools critical failure:', err.message)
+    log.error(TAG, 'buildSessionTools critical failure:', err.message)
     throw err
   }
 }

package/src/lib/server/session-tools/platform.ts

@@ -226,7 +226,7 @@ const PlatformExtension: Extension = {
   description: 'Unified management of agents, projects, tasks, schedules, skills, documents, and secrets.',
   hooks: {
     getCapabilityDescription: () => 'I can manage durable execution context across agents, projects, tasks, schedules, documents, skills, webhooks, connectors, sessions, and encrypted secrets.',
-    getOperatingGuidance: () => ['Use projects to hold longer-lived goals, objectives, and credential requirements.', 'Create/update tasks for long-lived goals to track progress.', 'Use schedules for follow-ups and heartbeat-style check-ins. Check existing schedules before creating new ones.', 'Inspect existing chats before creating duplicates.'],
+    getOperatingGuidance: () => ['Use projects to hold longer-lived goals, objectives, and credential requirements.', 'Create/update tasks for long-lived goals to track progress.', 'When work on a task is finished, update its status to completed with a concrete result summary. Cancel or archive tasks that are no longer relevant. Stale open tasks block project progress.', 'Use schedules for follow-ups and heartbeat-style check-ins. Check existing schedules before creating new ones.', 'Inspect existing chats before creating duplicates.'],
   } as ExtensionHooks,
   tools: [
     {

package/src/lib/server/session-tools/subagent.ts

@@ -5,6 +5,7 @@ import type { Extension, ExtensionHooks } from '@/types'
 import { registerNativeCapability } from '../native-capabilities'
 import { normalizeToolInputArgs } from './normalize-tool-args'
 import { errorMessage, sleep } from '@/lib/shared-utils'
+import { loadAgents } from '@/lib/server/storage'
 import {
   cancelDelegationJob,
   getDelegationJob,
@@ -99,7 +100,12 @@ function validateAllowedSubagentTarget(agentId: string, ctx: ActionContext): str
     ? ctx.delegationTargetAgentIds.filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0)
     : []
   if (allowedAgentIds.length === 0 || allowedAgentIds.includes(agentId)) return null
-  return `Error: agent "${agentId}" is not in the allowed delegate agent list.`
+
+  const agents = loadAgents()
+  const allowedNames = allowedAgentIds
+    .map(id => agents[id]?.name ? `${agents[id].name} [${id}]` : id)
+    .join(', ')
+  return `Error: agent "${agentId}" is not in your allowed delegation list. You may only delegate to: ${allowedNames}. Do not retry with this agent.`
 }
 
 function parseBooleanLike(value: unknown): boolean | unknown {
@@ -538,6 +544,21 @@ registerNativeCapability('subagent', SubagentExtension)
  */
 export function buildSubagentTools(bctx: ToolBuildContext): StructuredToolInterface[] {
   if (!bctx.ctx?.delegationEnabled || !bctx.hasExtension('spawn_subagent')) return []
+
+  let description = SubagentExtension.tools![0].description
+  if (bctx.ctx?.delegationTargetMode === 'selected') {
+    const allowedIds = (bctx.ctx.delegationTargetAgentIds || []).filter(
+      (id): id is string => typeof id === 'string' && id.trim().length > 0,
+    )
+    if (allowedIds.length > 0) {
+      const agents = loadAgents()
+      const allowedSummary = allowedIds
+        .map(id => agents[id]?.name ? `${agents[id].name} [${id}]` : id)
+        .join(', ')
+      description += ` DELEGATION RESTRICTED: You may ONLY delegate to these agents: ${allowedSummary}. Attempts to delegate to any other agent will be rejected.`
+    }
+  }
+
   return [
     tool(
       async (args) => executeSubagentAction(args, {
@@ -548,7 +569,7 @@ export function buildSubagentTools(bctx: ToolBuildContext): StructuredToolInterf
       }),
       {
         name: 'spawn_subagent',
-        description: SubagentExtension.tools![0].description,
+        description,
         schema: subagentToolSchema
       }
     )

package/src/lib/server/session-tools/wallet.ts

@@ -39,6 +39,9 @@ import {
   simulateSolanaTransaction,
 } from '../solana'
 import { TOOL_CAPABILITY } from '../tool-planning'
+import { log } from '@/lib/server/logger'
+
+const TAG = 'wallet'
 import { clearWalletPortfolioCache } from '@/lib/server/wallet/wallet-portfolio'
 import {
   createAgentWallet,
@@ -1042,7 +1045,7 @@ async function executeWalletAction(args: unknown, context: { agentId?: string |
   } catch (err: unknown) {
     const msg = errorMessage(err)
     if (msg.includes('429') || msg.toLowerCase().includes('too many requests')) {
-      console.warn('[wallet] Solana RPC rate-limited. Consider using a dedicated RPC endpoint (SOLANA_RPC_URL env var).')
+      log.warn(TAG, 'Solana RPC rate-limited. Consider using a dedicated RPC endpoint (SOLANA_RPC_URL env var).')
     }
     return JSON.stringify({ error: msg })
   }

package/src/lib/server/sessions/session-repository.ts

@@ -0,0 +1,85 @@
+import type { Message, Session } from '@/types'
+
+import {
+  deleteSession as deleteStoredSession,
+  disableAllSessionHeartbeats as disableAllStoredSessionHeartbeats,
+  getSessionMessages as getStoredSessionMessages,
+  loadSession as loadStoredSession,
+  loadSessions as loadStoredSessions,
+  patchSession as patchStoredSession,
+  saveSessions as replaceStoredSessions,
+  upsertSession as upsertStoredSession,
+} from '@/lib/server/storage'
+import { createRecordRepository } from '@/lib/server/persistence/repository-utils'
+
+export const sessionRepository = createRecordRepository<Session>(
+  'sessions',
+  {
+    get(id) {
+      return loadStoredSession(id) as Session | null
+    },
+    list() {
+      return loadStoredSessions() as Record<string, Session>
+    },
+    upsert(id, value) {
+      upsertStoredSession(id, value as Session)
+    },
+    upsertMany(entries) {
+      replaceStoredSessions(Object.fromEntries(entries))
+    },
+    replace(data) {
+      replaceStoredSessions(data)
+    },
+    patch(id, updater) {
+      return patchStoredSession(id, updater as (current: Session | null) => Session | null) as Session | null
+    },
+    delete(id) {
+      deleteStoredSession(id)
+    },
+  },
+)
+
+export function listSessions(): Record<string, Session> {
+  return sessionRepository.list()
+}
+
+export function getSession(id: string): Session | null {
+  return sessionRepository.get(id)
+}
+
+export function getSessions(ids: string[]): Record<string, Session> {
+  return sessionRepository.getMany(ids)
+}
+
+export function saveSession(id: string, session: Session | Record<string, unknown>): void {
+  sessionRepository.upsert(id, session as Session)
+}
+
+export function saveSessionMany(entries: Array<[string, Session | Record<string, unknown>]>): void {
+  sessionRepository.upsertMany(entries as Array<[string, Session]>)
+}
+
+export function replaceSessions(sessions: Record<string, Session | Record<string, unknown>>): void {
+  sessionRepository.replace(sessions as Record<string, Session>)
+}
+
+export function patchSession(id: string, updater: (current: Session | null) => Session | null): Session | null {
+  return sessionRepository.patch(id, updater)
+}
+
+export function deleteSession(id: string): void {
+  sessionRepository.delete(id)
+}
+
+export function getSessionMessages(sessionId: string): Message[] {
+  return getStoredSessionMessages(sessionId)
+}
+
+export function disableAllSessionHeartbeats(): number {
+  return disableAllStoredSessionHeartbeats()
+}
+
+export const loadSessions = listSessions
+export const loadSession = getSession
+export const saveSessions = replaceSessions
+export const upsertSession = saveSession

package/src/lib/server/settings/settings-repository.ts

@@ -0,0 +1,25 @@
+import type { AppSettings } from '@/types'
+
+import {
+  loadPublicSettings as loadStoredPublicSettings,
+  loadSettings as loadStoredSettings,
+  saveSettings as saveStoredSettings,
+} from '@/lib/server/storage'
+import { createSingletonRepository } from '@/lib/server/persistence/repository-utils'
+
+export const settingsRepository = createSingletonRepository<AppSettings>(
+  'settings',
+  {
+    get() {
+      return loadStoredSettings()
+    },
+    save(value) {
+      saveStoredSettings(value)
+    },
+  },
+)
+
+export const loadSettings = () => settingsRepository.get()
+export const saveSettings = (value: AppSettings | Record<string, unknown>) => settingsRepository.save(value as AppSettings)
+export const patchSettings = (updater: (current: AppSettings) => AppSettings | Record<string, unknown>) => settingsRepository.patch(updater as (current: AppSettings) => AppSettings)
+export const loadPublicSettings = () => loadStoredPublicSettings()

package/src/lib/server/skills/clawhub-client.ts

@@ -1,5 +1,8 @@
 import type { ClawHubSkill } from '@/types'
 import { errorMessage } from '@/lib/shared-utils'
+import { log } from '@/lib/server/logger'
+
+const TAG = 'clawhub-client'
 
 export interface ClawHubSearchResult {
   skills: ClawHubSkill[]
@@ -177,7 +180,7 @@ export async function searchClawHub(query: string, page = 1, limit = 20, cursor?
     return { skills, total, page, nextCursor: data.nextCursor }
   } catch (err: unknown) {
     const error = errorMessage(err)
-    console.warn('[clawhub] search failed:', error)
+    log.warn(TAG, 'search failed:', error)
     return { skills: [], total: 0, page, error }
   }
 }

package/src/lib/server/skills/runtime-skill-resolver.ts

@@ -9,7 +9,7 @@ import type {
   SkillRequirements,
   SkillSecuritySummary,
 } from '@/types'
-import { dedup } from '@/lib/shared-utils'
+import { dedup, hmrSingleton } from '@/lib/shared-utils'
 import { expandExtensionIds, getExtensionAliases, normalizeExtensionId } from '@/lib/server/tool-aliases'
 import { loadLearnedSkills, loadSettings, loadSkills } from '@/lib/server/storage'
 import { cosineSimilarity, getEmbedding } from '@/lib/server/embeddings'
@@ -160,7 +160,8 @@ const SOURCE_PRIORITY: Record<RuntimeSkillSource, number> = {
 }
 
 const DEFAULT_RUNTIME_SKILL_TOP_K = 8
-const embeddingCache = new Map<string, Promise<number[] | null>>()
+const SKILL_EMBEDDING_CACHE_MAX = 200
+const embeddingCache = hmrSingleton('__swarmclaw_skill_embedding_cache__', () => new Map<string, Promise<number[] | null>>())
 
 function normalizeKey(value: string | null | undefined): string {
   return String(value || '')
@@ -859,6 +860,11 @@ async function getCachedSkillEmbedding(
   const key = getSkillEmbeddingCacheKey(skill)
   let cached = embeddingCache.get(key)
   if (!cached) {
+    // FIFO eviction when cache exceeds cap
+    if (embeddingCache.size >= SKILL_EMBEDDING_CACHE_MAX) {
+      const firstKey = embeddingCache.keys().next().value
+      if (firstKey !== undefined) embeddingCache.delete(firstKey)
+    }
     cached = embeddingResolver(buildSkillEmbeddingText(skill))
     embeddingCache.set(key, cached)
   }

package/src/lib/server/skills/skill-discovery.test.ts

@@ -5,14 +5,14 @@ import path from 'node:path'
 import test from 'node:test'
 import { clearDiscoveredSkillsCache, discoverSkills } from './skill-discovery'
 
-test('discoverSkills includes tracked bundled skills from bundled-skills', () => {
+test('discoverSkills includes tracked bundled skills from skills', () => {
   const skills = discoverSkills({ cwd: path.join(process.cwd(), 'src') })
   const googleWorkspaceSkill = skills.find((skill) => skill.name === 'google-workspace')
 
   assert.ok(googleWorkspaceSkill)
   assert.equal(googleWorkspaceSkill?.source, 'bundled')
   assert.equal(
-    googleWorkspaceSkill?.sourcePath.endsWith(path.join('bundled-skills', 'google-workspace', 'SKILL.md')),
+    googleWorkspaceSkill?.sourcePath.endsWith(path.join('skills', 'google-workspace', 'SKILL.md')),
     true,
   )
 })

package/src/lib/server/skills/skill-discovery.ts

@@ -19,7 +19,7 @@ interface DiscoveryCache {
 }
 
 const CACHE_TTL_MS = 5_000
-const BUNDLED_SKILLS_DIR = path.join(process.cwd(), 'bundled-skills')
+const BUNDLED_SKILLS_DIR = path.join(process.cwd(), 'skills')
 const LEGACY_BUNDLED_SKILLS_DIR = path.join(DATA_DIR, 'skills')
 
 let cache: DiscoveryCache | null = null
@@ -84,7 +84,7 @@ function scanLayer(
 
 /**
  * Discover skills from three layers:
- *   1. Bundled: `bundled-skills/` (tracked with the app)
+ *   1. Bundled: `skills/` (tracked with the app)
  *      Legacy fallback: `data/skills/`
  *   2. Workspace: `<swarmclaw-home>/skills/` (user-installed)
  *   3. Project: `<cwd>/skills/` (project-local)

package/src/lib/server/skills/skill-eligibility.ts

@@ -10,11 +10,17 @@ export interface SkillEligibilityResult {
   reasons: string[]
 }
 
+const BINARY_CACHE_MAX = 200
 const binaryCache = new Map<string, boolean>()
 
 function hasBinary(name: string): boolean {
   const cached = binaryCache.get(name)
   if (cached !== undefined) return cached
+  // FIFO eviction at cap
+  if (binaryCache.size >= BINARY_CACHE_MAX) {
+    const firstKey = binaryCache.keys().next().value
+    if (firstKey !== undefined) binaryCache.delete(firstKey)
+  }
   try {
     execSync(`which ${name}`, { stdio: 'ignore', timeout: 2000 })
     binaryCache.set(name, true)

package/src/lib/server/skills/skill-repository.ts

@@ -0,0 +1,14 @@
+export {
+  deleteLearnedSkill,
+  deleteSkill,
+  loadLearnedSkill,
+  loadLearnedSkills,
+  loadSkillSuggestions,
+  loadSkills,
+  patchLearnedSkill,
+  patchSkillSuggestion,
+  saveLearnedSkills,
+  saveSkills,
+  upsertLearnedSkill,
+  upsertSkillSuggestion,
+} from '@/lib/server/storage'

package/src/lib/server/solana.ts

@@ -129,11 +129,17 @@ export function getSolanaExplorerUrl(cluster: SolanaCluster | string | null | un
   return `https://explorer.solana.com/${prefix}/${value}${clusterSuffix}`
 }
 
+const CONNECTION_CACHE_MAX = 50
 const connectionCache = new Map<string, Connection>()
 
 function getCachedConnection(url: string): Connection {
   let conn = connectionCache.get(url)
   if (!conn) {
+    // FIFO eviction if cache exceeds cap
+    if (connectionCache.size >= CONNECTION_CACHE_MAX) {
+      const firstKey = connectionCache.keys().next().value
+      if (firstKey !== undefined) connectionCache.delete(firstKey)
+    }
     conn = new Connection(url, {
       commitment: 'confirmed',
       disableRetryOnRateLimit: true,

package/src/lib/server/storage-auth.ts

@@ -3,6 +3,9 @@ import path from 'path'
 import crypto from 'crypto'
 
 import { DATA_DIR, IS_BUILD_BOOTSTRAP } from './data-dir'
+import { log } from '@/lib/server/logger'
+
+const TAG = 'storage-auth'
 
 // --- .env loading ---
 function loadEnv() {
@@ -24,7 +27,7 @@ if (!IS_BUILD_BOOTSTRAP && !process.env.CREDENTIAL_SECRET) {
   const envPath = path.join(process.cwd(), '.env.local')
   fs.appendFileSync(envPath, `\nCREDENTIAL_SECRET=${secret}\n`)
   process.env.CREDENTIAL_SECRET = secret
-  console.log('[credentials] Generated CREDENTIAL_SECRET in .env.local')
+  log.info(TAG, 'Generated CREDENTIAL_SECRET in .env.local')
 }
 
 // Auto-generate ACCESS_KEY if missing (used for simple auth)
@@ -35,10 +38,7 @@ if (!IS_BUILD_BOOTSTRAP && !process.env.ACCESS_KEY) {
   fs.appendFileSync(envPath, `\nACCESS_KEY=${key}\n`)
   process.env.ACCESS_KEY = key
   fs.writeFileSync(SETUP_FLAG, key)
-  console.log(`\n${'='.repeat(50)}`)
-  console.log(`  ACCESS KEY: ${key}`)
-  console.log(`  Use this key to connect from the browser.`)
-  console.log(`${'='.repeat(50)}\n`)
+  log.info(TAG, `ACCESS KEY: ${key} — Use this key to connect from the browser.`)
 }
 
 export function getAccessKey(): string {

package/src/lib/server/storage-normalization.ts

@@ -526,5 +526,9 @@ function normalizeStoredRecordInner(
   if ('missionSummary' in session) delete session.missionSummary
   // Default geminiSessionId for new field
   if (session.geminiSessionId === undefined) session.geminiSessionId = null
+  // Default injectedMemoryIds for proactive recall dedup
+  if (!session.injectedMemoryIds || typeof session.injectedMemoryIds !== 'object') {
+    session.injectedMemoryIds = {}
+  }
   return session
 }