@swarmclawai/swarmclaw 1.2.8 → 1.3.0

package/src/lib/server/storage.ts

@@ -24,8 +24,6 @@ import type {
   GuardianCheckpoint,
   LearnedSkill,
   Message,
-  Mission,
-  MissionEvent,
   ProtocolTemplate,
   ProtocolRun,
   ProtocolRunEvent,
@@ -138,9 +136,6 @@ const COLLECTIONS = [
   'webhook_retry_queue',
   'notifications',
   'chatrooms',
-  'wallets',
-  'wallet_transactions',
-  'wallet_balance_history',
   'moderation_logs',
   'connector_health',
   'connector_outbox',
@@ -152,8 +147,6 @@ const COLLECTIONS = [
   'watch_jobs',
   'delegation_jobs',
   'external_agents',
-  'missions',
-  'mission_events',
   'protocol_templates',
   'protocol_runs',
   'protocol_run_events',
@@ -162,6 +155,9 @@ const COLLECTIONS = [
   'main_loop_states',
   'working_states',
   'daemon_status',
+  'wallets',
+  'wallet_transactions',
+  'goals',
 ] as const
 
 export type StorageCollection = (typeof COLLECTIONS)[number]
@@ -173,6 +169,10 @@ for (const table of COLLECTIONS) {
 // Index for efficient protocol_run_events queries by runId
 db.exec(`CREATE INDEX IF NOT EXISTS idx_protocol_run_events_runid ON protocol_run_events (json_extract(data, '$.runId'))`)
 
+// Indexes for efficient activity log queries
+db.exec(`CREATE INDEX IF NOT EXISTS idx_activity_timestamp ON activity (json_extract(data, '$.timestamp'))`)
+db.exec(`CREATE INDEX IF NOT EXISTS idx_activity_entity ON activity (json_extract(data, '$.entityType'), json_extract(data, '$.entityId'))`)
+
 // Singleton tables (single row)
 db.exec(`CREATE TABLE IF NOT EXISTS settings (id INTEGER PRIMARY KEY CHECK (id = 1), data TEXT NOT NULL)`)
 db.exec(`CREATE TABLE IF NOT EXISTS queue (id INTEGER PRIMARY KEY CHECK (id = 1), data TEXT NOT NULL)`)
@@ -545,8 +545,6 @@ const JSON_FILES: Record<string, string> = {
   documents: path.join(DATA_DIR, 'documents.json'),
   webhooks: path.join(DATA_DIR, 'webhooks.json'),
   external_agents: path.join(DATA_DIR, 'external-agents.json'),
-  missions: path.join(DATA_DIR, 'missions.json'),
-  mission_events: path.join(DATA_DIR, 'mission-events.json'),
   protocol_templates: path.join(DATA_DIR, 'protocol-templates.json'),
   protocol_runs: path.join(DATA_DIR, 'protocol-runs.json'),
   protocol_run_events: path.join(DATA_DIR, 'protocol-run-events.json'),
@@ -1208,25 +1206,6 @@ export const loadProjects = projectsStore.load
 export const saveProjects = projectsStore.save
 export const deleteProject = projectsStore.deleteItem
 
-// --- Missions ---
-const missionsStore = createCollectionStore('missions')
-export const loadMissions = missionsStore.load as () => Record<string, Mission>
-export const saveMissions = missionsStore.save as (items: Record<string, Mission>) => void
-export const loadMission = missionsStore.loadItem as (id: string) => Mission | null
-export const upsertMission = missionsStore.upsert as (id: string, value: Mission) => void
-export const patchMission = missionsStore.patch as (
-  id: string,
-  updater: (current: Mission | null) => Mission | null,
-) => Mission | null
-export const deleteMission = missionsStore.deleteItem
-
-const missionEventsStore = createCollectionStore('mission_events')
-export const loadMissionEvents = missionEventsStore.load as () => Record<string, MissionEvent>
-export const saveMissionEvents = missionEventsStore.save as (items: Record<string, MissionEvent>) => void
-export const loadMissionEvent = missionEventsStore.loadItem as (id: string) => MissionEvent | null
-export const upsertMissionEvent = missionEventsStore.upsert as (id: string, value: MissionEvent) => void
-export const upsertMissionEvents = missionEventsStore.upsertMany as (entries: Array<[string, MissionEvent]>) => void
-
 const protocolTemplatesStore = createCollectionStore('protocol_templates')
 export const loadProtocolTemplates = protocolTemplatesStore.load as () => Record<string, ProtocolTemplate>
 export const saveProtocolTemplates = protocolTemplatesStore.save as (items: Record<string, ProtocolTemplate>) => void
@@ -1491,6 +1470,51 @@ export function logActivity(entry: {
   notify('activity')
 }
 
+/** Paginated activity query using SQL WHERE + LIMIT/OFFSET instead of loading the full collection. */
+export function queryActivity(filters: {
+  entityType?: string
+  entityId?: string
+  actor?: string
+  action?: string
+  since?: number
+  limit?: number
+  offset?: number
+}): unknown[] {
+  const conditions: string[] = []
+  const params: unknown[] = []
+
+  if (filters.entityType) {
+    conditions.push(`json_extract(data, '$.entityType') = ?`)
+    params.push(filters.entityType)
+  }
+  if (filters.entityId) {
+    conditions.push(`json_extract(data, '$.entityId') = ?`)
+    params.push(filters.entityId)
+  }
+  if (filters.actor) {
+    conditions.push(`json_extract(data, '$.actor') = ?`)
+    params.push(filters.actor)
+  }
+  if (filters.action) {
+    conditions.push(`json_extract(data, '$.action') = ?`)
+    params.push(filters.action)
+  }
+  if (typeof filters.since === 'number' && Number.isFinite(filters.since)) {
+    conditions.push(`json_extract(data, '$.timestamp') >= ?`)
+    params.push(filters.since)
+  }
+
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : ''
+  const limit = Math.min(200, Math.max(1, filters.limit ?? 50))
+  const offset = Math.max(0, filters.offset ?? 0)
+
+  const sql = `SELECT data FROM activity ${where} ORDER BY json_extract(data, '$.timestamp') DESC LIMIT ? OFFSET ?`
+  params.push(limit, offset)
+
+  const rows = db.prepare(sql).all(...params) as Array<{ data: string }>
+  return rows.map((r) => JSON.parse(r.data))
+}
+
 // --- Webhook Retry Queue ---
 const webhookRetryQueueStore = createCollectionStore('webhook_retry_queue')
 export const loadWebhookRetryQueue = webhookRetryQueueStore.load
@@ -1541,23 +1565,6 @@ export function markNotificationRead(id: string) {
   }
 }
 
-// --- Wallets ---
-const walletsStore = createCollectionStore('wallets')
-export const loadWallets = walletsStore.load
-export const upsertWallet = walletsStore.upsert
-export const deleteWallet = walletsStore.deleteItem
-
-// --- Wallet Transactions ---
-const walletTransactionsStore = createCollectionStore('wallet_transactions')
-export const loadWalletTransactions = walletTransactionsStore.load
-export const upsertWalletTransaction = walletTransactionsStore.upsert
-export const deleteWalletTransaction = walletTransactionsStore.deleteItem
-
-// --- Wallet Balance History ---
-const walletBalanceHistoryStore = createCollectionStore('wallet_balance_history')
-export const loadWalletBalanceHistory = walletBalanceHistoryStore.load
-export const upsertWalletBalanceSnapshot = walletBalanceHistoryStore.upsert
-
 // --- Moderation Logs ---
 const moderationLogsStore = createCollectionStore('moderation_logs')
 export const loadModerationLogs = moderationLogsStore.load
@@ -1613,6 +1620,29 @@ export const loadPersistedWorkingState = workingStatesStore.loadItem
 export const upsertPersistedWorkingState = workingStatesStore.upsert
 export const deletePersistedWorkingState = workingStatesStore.deleteItem
 
+// --- Wallets ---
+const walletsStore = createCollectionStore('wallets')
+export const loadWallets = walletsStore.load
+export const saveWallets = walletsStore.save
+export const loadWallet = walletsStore.loadItem
+export const upsertWallet = walletsStore.upsert
+export const deleteWalletItem = walletsStore.deleteItem
+
+// --- Wallet Transactions ---
+const walletTransactionsStore = createCollectionStore('wallet_transactions')
+export const loadWalletTransactions = walletTransactionsStore.load
+export const saveWalletTransactions = walletTransactionsStore.save
+export const loadWalletTransaction = walletTransactionsStore.loadItem
+export const upsertWalletTransaction = walletTransactionsStore.upsert
+export const deleteWalletTransaction = walletTransactionsStore.deleteItem
+
+// --- Goals ---
+const goalsStore = createCollectionStore('goals')
+export const loadGoals = goalsStore.load
+export const loadGoal = goalsStore.loadItem
+export const upsertGoal = goalsStore.upsert
+export const deleteGoalItem = goalsStore.deleteItem
+
 export function getSessionMessages(sessionId: string): Message[] {
   const session = loadSession(sessionId)
   return Array.isArray(session?.messages) ? session.messages : []

package/src/lib/server/tasks/task-checkout.ts

@@ -0,0 +1,59 @@
+import type { BoardTask } from '@/types'
+import { withTransaction } from '@/lib/server/persistence/transaction'
+import { loadTasks, saveTasks } from '@/lib/server/tasks/task-repository'
+
+/**
+ * Atomically transition a task from queued → running with a checkout run ID.
+ *
+ * Uses a SQLite IMMEDIATE transaction to prevent two runners from starting the
+ * same task concurrently (Paperclip-inspired atomic checkout pattern).
+ *
+ * Returns the checked-out task on success, or null if the task was already
+ * taken, missing, or no longer in queued status.
+ */
+export function checkoutTask(
+  taskId: string,
+  runId: string,
+): BoardTask | null {
+  return withTransaction(() => {
+    const tasks = loadTasks() as Record<string, BoardTask>
+    const task = tasks[taskId]
+    if (!task || task.status !== 'queued') return null
+    if (task.checkoutRunId) return null // already checked out
+
+    const now = Date.now()
+    task.status = 'running'
+    task.checkoutRunId = runId
+    task.startedAt = now
+    task.lastActivityAt = now
+    task.retryScheduledAt = null
+    task.deadLetteredAt = null
+    task.error = null
+    task.validation = null
+    task.updatedAt = now
+
+    saveTasks(tasks)
+    return { ...task }
+  })
+}
+
+/**
+ * Release a checkout after task completion or failure.
+ * Only the holder of the checkout (matching runId) can release it.
+ */
+export function releaseCheckout(
+  taskId: string,
+  runId: string,
+): boolean {
+  return withTransaction(() => {
+    const tasks = loadTasks() as Record<string, BoardTask>
+    const task = tasks[taskId]
+    if (!task) return false
+    if (task.checkoutRunId !== runId) return false
+
+    task.checkoutRunId = null
+    task.updatedAt = Date.now()
+    saveTasks(tasks)
+    return true
+  })
+}

package/src/lib/server/tasks/task-lifecycle.ts

@@ -176,6 +176,7 @@ export function markValidatedTaskCompleted(
   task.completedAt = options.preserveCompletedAt ? (task.completedAt || options.now) : options.now
   task.updatedAt = options.now
   task.error = null
+  task.checkoutRunId = null
   return task
 }
 
@@ -187,6 +188,7 @@ export function markInvalidCompletedTaskFailed(
   task.status = 'failed'
   task.completedAt = null
   task.updatedAt = options.now
+  task.checkoutRunId = null
   task.error = formatValidationFailure(validation.reasons).slice(0, 500)
   if (options.comment) {
     if (!task.comments) task.comments = []

package/src/lib/server/tasks/task-route-service.ts

@@ -6,11 +6,6 @@ import { logActivity } from '@/lib/server/activity/activity-log'
 import { createNotification } from '@/lib/server/create-notification'
 import { validateDag, cascadeUnblock } from '@/lib/server/dag-validation'
 import { getExtensionManager } from '@/lib/server/extensions'
-import {
-  enrichTaskWithMissionSummary,
-  ensureMissionForTask,
-  noteMissionTaskFinished,
-} from '@/lib/server/missions/mission-service'
 import {
   disableSessionHeartbeat,
   enqueueTask,
@@ -64,9 +59,7 @@ export function prepareTasksForListing() {
   validateCompletedTasksQueue()
   recoverStalledRunningTasks()
   const allTasks = loadTasks()
-  return Object.fromEntries(
-    Object.entries(allTasks).map(([id, task]) => [id, enrichTaskWithMissionSummary(task)]),
-  )
+  return allTasks
 }
 
 export function updateTaskFromRoute(id: string, body: Record<string, unknown>): ServiceResult<BoardTask> {
@@ -128,10 +121,6 @@ export function updateTaskFromRoute(id: string, body: Record<string, unknown>):
   }
 
   saveTask(id, tasks[id])
-  const mission = ensureMissionForTask(tasks[id], { source: 'manual' })
-  if (tasks[id].status === 'completed' || tasks[id].status === 'failed' || tasks[id].status === 'cancelled') {
-    noteMissionTaskFinished(tasks[id], tasks[id].status, tasks[id].id)
-  }
   logActivity({ entityType: 'task', entityId: id, action: 'updated', actor: 'user', summary: `Task updated: "${tasks[id].title}" (${prevStatus} → ${tasks[id].status})` })
   if (prevStatus !== tasks[id].status) {
     pushMainLoopEventToMainSessions({
@@ -143,10 +132,7 @@ export function updateTaskFromRoute(id: string, body: Record<string, unknown>):
   if (prevStatus !== tasks[id].status && tasks[id].status === 'cancelled') {
     disableSessionHeartbeat(tasks[id].sessionId)
     notify('tasks')
-    return serviceOk(enrichTaskWithMissionSummary({
-      ...tasks[id],
-      missionId: mission?.id || tasks[id].missionId || null,
-    }))
+    return serviceOk(tasks[id])
   }
 
   if (prevStatus !== tasks[id].status && (tasks[id].status === 'completed' || tasks[id].status === 'failed')) {
@@ -216,10 +202,7 @@ export function updateTaskFromRoute(id: string, body: Record<string, unknown>):
   }
 
   notify('tasks')
-  return serviceOk(enrichTaskWithMissionSummary({
-    ...tasks[id],
-    missionId: mission?.id || tasks[id].missionId || null,
-  }))
+  return serviceOk(tasks[id])
 }
 
 export function archiveTaskFromRoute(id: string): ServiceResult<BoardTask> {
@@ -346,11 +329,6 @@ export function createTaskFromRoute(body: Record<string, unknown>): ServiceResul
   }
 
   saveTask(id, task)
-  const mission = ensureMissionForTask(task, { source: 'manual' })
-  const finalTask = enrichTaskWithMissionSummary({
-    ...task,
-    missionId: mission?.id || task.missionId || null,
-  })
   logActivity({ entityType: 'task', entityId: id, action: 'created', actor: 'user', summary: `Task created: "${task.title}"` })
   pushMainLoopEventToMainSessions({
     type: 'task_created',
@@ -360,7 +338,7 @@ export function createTaskFromRoute(body: Record<string, unknown>): ServiceResul
     enqueueTask(id)
   }
   notify('tasks')
-  return serviceOk(finalTask)
+  return serviceOk(task)
 }
 
 export function bulkUpdateTasksFromRoute(body: Record<string, unknown>): ServiceResult<{ updated: number; ids: string[] }> {

package/src/lib/server/tasks/task-service.ts

@@ -106,13 +106,6 @@ export function applyTaskContinuationDefaults(
     if (!Object.prototype.hasOwnProperty.call(explicit, 'cwd') && typeof sourceTask.cwd === 'string' && sourceTask.cwd.trim()) {
       parsed.cwd = sourceTask.cwd.trim()
     }
-    if (
-      !Object.prototype.hasOwnProperty.call(explicit, 'missionId')
-      && typeof sourceTask.missionId === 'string'
-      && sourceTask.missionId.trim()
-    ) {
-      parsed.missionId = sourceTask.missionId.trim()
-    }
     const sourceSessionId = typeof sourceTask.checkpoint?.lastSessionId === 'string' && sourceTask.checkpoint.lastSessionId.trim()
       ? sourceTask.checkpoint.lastSessionId.trim()
       : typeof sourceTask.sessionId === 'string' && sourceTask.sessionId.trim()

package/src/lib/server/tool-aliases.ts

@@ -22,7 +22,6 @@ const EXTENSION_ALIAS_GROUPS: string[][] = [
   ['schedule_wake', 'schedule'],
   // http_request/http now aliased into web group above
   ['memory', 'memory_tool', 'memory_search', 'memory_get', 'memory_store', 'memory_update'],
-  ['wallet', 'wallet_tool'],
   ['monitor', 'monitor_tool'],
   ['context_mgmt', 'context_status', 'context_summarize'],
   ['openclaw_workspace'],

package/src/lib/server/tool-capability-policy-advanced.test.ts

@@ -423,17 +423,17 @@ describe('compound scenarios', () => {
     assert.match(tasksBlock.reason, /task management is disabled/)
   })
 
-  it('20 tools requested: correctly partitioned into enabled vs blocked', () => {
+  it('19 tools requested: correctly partitioned into enabled vs blocked', () => {
     const tools = [
       'shell', 'files', 'web', 'web_search', 'web_fetch', 'browser',
       'memory', 'delegate', 'manage_platform', 'manage_tasks',
-      'manage_schedules', 'wallet', 'delete_file', 'canvas',
+      'manage_schedules', 'wallet', 'delete_file',
       'manage_connectors', 'git', 'sandbox', 'claude_code',
       'monitor', 'http_request',
     ]
     const d = resolveSessionToolPolicy(tools, { capabilityPolicyMode: 'strict' })
-    assert.equal(d.requestedExtensions.length, 20)
-    assert.equal(d.enabledExtensions.length + d.blockedExtensions.length, 20)
+    assert.equal(d.requestedExtensions.length, 19)
+    assert.equal(d.enabledExtensions.length + d.blockedExtensions.length, 19)
 
     // memory, web, web_search, web_fetch should be enabled
     assert.ok(d.enabledExtensions.includes('memory'))

package/src/lib/server/tool-capability-policy.ts

@@ -60,8 +60,6 @@ const TOOL_DESCRIPTORS: Record<string, ToolDescriptor> = {
   gemini_cli: { categories: ['delegation', 'execution'], concreteTools: ['delegate_to_gemini_cli'] },
   memory: { categories: ['memory'], concreteTools: ['memory', 'memory_tool', 'memory_search', 'memory_get', 'memory_store', 'memory_update', 'context_status', 'context_summarize'] },
   // http_request consolidated into web 'api' action — no separate descriptor
-  canvas: { categories: ['filesystem'], concreteTools: ['canvas'] },
-  wallet: { categories: ['outbound'], concreteTools: ['wallet', 'wallet_tool'] },
   monitor: { categories: ['execution'], concreteTools: ['monitor', 'monitor_tool'] },
   openclaw_workspace: { categories: ['filesystem', 'platform'], concreteTools: ['openclaw_workspace'] },
   openclaw_nodes: { categories: ['platform'], concreteTools: ['openclaw_nodes'] },

package/src/lib/server/tool-planning.ts

@@ -13,8 +13,6 @@ export const TOOL_CAPABILITY = {
   deliveryMessage: 'delivery.message',
   deliveryMedia: 'delivery.media',
   deliveryVoiceNote: 'delivery.voice_note',
-  walletInspect: 'wallet.inspect',
-  walletExecute: 'wallet.execute',
 } as const
 
 export interface ToolPlanningEntry {
@@ -373,16 +371,6 @@ const CORE_TOOL_PLANNING: Record<string, LegacyToolPlanningEntry[]> = {
       requestMatchers: [],
     },
   ],
-  wallet: [
-    {
-      toolName: 'wallet_tool',
-      capabilities: [TOOL_CAPABILITY.walletInspect, TOOL_CAPABILITY.walletExecute],
-      disciplineGuidance: [
-        'Inspect wallet state once, then act. Use `simulate_transaction` to validate before executing. Do not re-inspect balances between each operation unless the operation changes them.',
-      ],
-      requestMatchers: [],
-    },
-  ],
   image_gen: [
     {
       toolName: 'generate_image',

package/src/lib/server/universal-tool-access.ts

@@ -22,7 +22,6 @@ const UNIVERSAL_CORE_EXTENSION_IDS = [
   'manage_secrets',
   'manage_chatrooms',
   'spawn_subagent',
-  'canvas',
   'http_request',
   'wallet',
   'monitor',

package/src/lib/server/usage/cost-rollup.ts

@@ -0,0 +1,124 @@
+import type { Agent } from '@/types'
+import { patchAgent } from '@/lib/server/agents/agent-repository'
+import { logActivity } from '@/lib/server/activity/activity-log'
+import { notify } from '@/lib/server/ws-hub'
+import { log } from '@/lib/server/logger'
+
+const TAG = 'cost-rollup'
+
+const ONE_HOUR_MS = 60 * 60 * 1000
+
+function toWindowBoundaries(now: number) {
+  const d = new Date(now)
+  const dayStart = new Date(d)
+  dayStart.setUTCHours(0, 0, 0, 0)
+  const monthStart = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), 1))
+  return {
+    hourStartTs: now - ONE_HOUR_MS,
+    dayStartTs: dayStart.getTime(),
+    monthStartTs: monthStart.getTime(),
+  }
+}
+
+/**
+ * Push-based cost rollup: atomically increments the agent's persisted spend
+ * fields and checks budgets. Called immediately after each usage record is appended.
+ */
+export function rollupCostToAgent(agentId: string, costUsd: number): void {
+  if (!agentId || !Number.isFinite(costUsd) || costUsd <= 0) return
+
+  const now = Date.now()
+  const costCents = Math.round(costUsd * 100)
+  const { hourStartTs, dayStartTs, monthStartTs } = toWindowBoundaries(now)
+
+  const updated = patchAgent(agentId, (current) => {
+    if (!current) return null
+    const lastRollup = current.lastSpendRollupAt ?? 0
+    const lastBounds = toWindowBoundaries(lastRollup)
+
+    // Reset windows that have rolled over since last rollup
+    let hourly = current.spentHourlyCents ?? 0
+    let daily = current.spentDailyCents ?? 0
+    let monthly = current.spentMonthlyCents ?? 0
+
+    if (lastRollup < hourStartTs) hourly = 0
+    if (lastBounds.dayStartTs < dayStartTs) daily = 0
+    if (lastBounds.monthStartTs < monthStartTs) monthly = 0
+
+    return {
+      ...current,
+      spentHourlyCents: hourly + costCents,
+      spentDailyCents: daily + costCents,
+      spentMonthlyCents: monthly + costCents,
+      lastSpendRollupAt: now,
+    }
+  })
+
+  if (!updated) return
+
+  // Check budgets and enforce
+  checkAndEnforceBudget(updated)
+}
+
+/**
+ * Checks agent's persisted spend against configured budgets and logs
+ * activity entries when thresholds are hit.
+ */
+function checkAndEnforceBudget(agent: Agent): void {
+  const WARNING_RATIO = 0.8
+
+  const windows = [
+    { key: 'hourly' as const, budget: agent.hourlyBudget, spent: (agent.spentHourlyCents ?? 0) / 100 },
+    { key: 'daily' as const, budget: agent.dailyBudget, spent: (agent.spentDailyCents ?? 0) / 100 },
+    { key: 'monthly' as const, budget: agent.monthlyBudget, spent: (agent.spentMonthlyCents ?? 0) / 100 },
+  ]
+
+  for (const { key, budget, spent } of windows) {
+    if (!budget || !Number.isFinite(budget) || budget <= 0) continue
+    const ratio = spent / budget
+
+    if (ratio >= 1) {
+      log.warn(TAG, `Agent "${agent.name}" exceeded ${key} budget: $${spent.toFixed(4)} / $${budget.toFixed(2)}`)
+      logActivity({
+        entityType: 'budget',
+        entityId: agent.id,
+        action: 'budget_exceeded',
+        actor: 'system',
+        summary: `Agent "${agent.name}" exceeded ${key} budget: $${spent.toFixed(4)} / $${budget.toFixed(2)}`,
+        detail: { window: key, spent, budget, ratio },
+      })
+      notify('agents')
+    } else if (ratio >= WARNING_RATIO) {
+      logActivity({
+        entityType: 'budget',
+        entityId: agent.id,
+        action: 'budget_warning',
+        actor: 'system',
+        summary: `Agent "${agent.name}" nearing ${key} budget: $${spent.toFixed(4)} / $${budget.toFixed(2)} (${Math.round(ratio * 100)}%)`,
+        detail: { window: key, spent, budget, ratio },
+      })
+    }
+  }
+}
+
+/**
+ * Reset all agents' daily spend counters. Call at UTC midnight.
+ */
+export function resetDailySpends(agents: Record<string, Agent>): void {
+  for (const agent of Object.values(agents)) {
+    if ((agent.spentDailyCents ?? 0) > 0) {
+      patchAgent(agent.id, (current) => current ? { ...current, spentDailyCents: 0 } : null)
+    }
+  }
+}
+
+/**
+ * Reset all agents' monthly spend counters. Call at UTC month boundary.
+ */
+export function resetMonthlySpends(agents: Record<string, Agent>): void {
+  for (const agent of Object.values(agents)) {
+    if ((agent.spentMonthlyCents ?? 0) > 0) {
+      patchAgent(agent.id, (current) => current ? { ...current, spentMonthlyCents: 0 } : null)
+    }
+  }
+}

package/src/lib/server/usage/usage-repository.ts

@@ -8,6 +8,7 @@ import {
   saveUsage as saveStoredUsage,
 } from '@/lib/server/storage'
 import { perf } from '@/lib/server/runtime/perf'
+import { rollupCostToAgent } from './cost-rollup'
 
 export function loadUsage(): Record<string, UsageRecord[]> {
   return perf.measureSync('repository', 'usage.list', () => loadStoredUsage())
@@ -19,6 +20,11 @@ export function saveUsage(data: Record<string, UsageRecord[]>): void {
 
 export function appendUsage(sessionId: string, record: unknown): void {
   perf.measureSync('repository', 'usage.append', () => appendStoredUsage(sessionId, record), { sessionId })
+  // Push-based cost rollup: update persisted spend fields and check budgets
+  const rec = record as Partial<UsageRecord>
+  if (rec.agentId && typeof rec.estimatedCost === 'number' && rec.estimatedCost > 0) {
+    rollupCostToAgent(rec.agentId, rec.estimatedCost)
+  }
 }
 
 export function getUsageSpendSince(minTimestamp: number): number {

package/src/lib/server/wallets/wallet-crypto.ts

@@ -0,0 +1,33 @@
+import { encryptKey, decryptKey } from '@/lib/server/storage'
+
+/**
+ * Generate a new Ethereum wallet (Base L2 compatible) with an encrypted private key.
+ * Uses ethers v6 for keypair generation and the existing AES-256-GCM encryption
+ * from storage.ts (CREDENTIAL_SECRET env var).
+ */
+export async function generateEthereumWallet(): Promise<{ address: string; encryptedPrivateKey: string }> {
+  const { Wallet } = await import('ethers')
+  const wallet = Wallet.createRandom()
+  const encryptedPrivateKey = encryptKey(wallet.privateKey)
+  return {
+    address: wallet.address,
+    encryptedPrivateKey,
+  }
+}
+
+export async function normalizeEthereumAddress(address: string): Promise<string | null> {
+  const { getAddress } = await import('ethers')
+  try {
+    return getAddress(address.trim())
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Decrypt a wallet's private key for server-side use only.
+ * Never expose the result to API responses or the frontend.
+ */
+export function decryptWalletPrivateKey(encrypted: string): string {
+  return decryptKey(encrypted)
+}

package/src/lib/server/wallets/wallet-repository.ts

@@ -0,0 +1,24 @@
+import {
+  loadWallets as loadWalletsStore,
+  saveWallets as saveWalletsStore,
+  loadWallet as loadWalletItem,
+  upsertWallet,
+  deleteWalletItem,
+} from '@/lib/server/storage'
+import type { AgentWallet } from '@/types/swarmdock'
+
+export function loadWallets(): Record<string, AgentWallet> {
+  return loadWalletsStore() as Record<string, AgentWallet>
+}
+
+export function loadWallet(id: string): AgentWallet | null {
+  return loadWalletItem(id) as AgentWallet | null
+}
+
+export function saveWallet(id: string, wallet: AgentWallet): void {
+  upsertWallet(id, wallet)
+}
+
+export function deleteWallet(id: string): void {
+  deleteWalletItem(id)
+}