agentbnb 9.0.3 → 9.1.0

package/dist/skills/agentbnb/bootstrap.js

@@ -1,3 +1,13 @@
+import {
+  createLedger,
+  deriveAgentId,
+  ensureIdentity,
+  executeCapabilityBatch,
+  executeCapabilityRequest,
+  identityAuthPlugin,
+  loadOrRepairIdentity,
+  syncCreditsFromRegistry
+} from "../../chunk-PYZGF5QH.js";
 import {
   AutoRequestor,
   BudgetController,
@@ -16,29 +26,9 @@ import {
   requestViaTemporaryRelay,
   resolvePendingRequest,
   verifyUCAN
-} from "../../chunk-SLZBE2I5.js";
-import {
-  requestCapability,
-  requestViaRelay
-} from "../../chunk-W6LOCBWQ.js";
-import {
-  RelayClient,
-  RelayMessageSchema
-} from "../../chunk-DYJ7YGBM.js";
-import {
-  loadPeers
-} from "../../chunk-HLUEOLSZ.js";
-import {
-  createLedger,
-  deriveAgentId,
-  ensureIdentity,
-  executeCapabilityBatch,
-  executeCapabilityRequest,
-  identityAuthPlugin,
-  loadOrRepairIdentity,
-  syncCreditsFromRegistry
-} from "../../chunk-77HAL2ZL.js";
+} from "../../chunk-DBO2335D.js";
 import {
+  NETWORK_FEE_RATE,
   bootstrapAgent,
   buildReputationMap,
   computeReputation,
@@ -57,44 +47,66 @@ import {
   releaseEscrow,
   searchCards,
   settleEscrow
-} from "../../chunk-BNS76U6K.js";
+} from "../../chunk-XL5XD3IG.js";
 import "../../chunk-6QMDJVMS.js";
+import {
+  requestCapability,
+  requestViaRelay
+} from "../../chunk-W6LOCBWQ.js";
 import {
   generateKeyPair,
   loadKeyPair,
   signEscrowReceipt,
   verifyEscrowReceipt
 } from "../../chunk-YNBZLXYS.js";
+import {
+  RelayClient,
+  RelayMessageSchema,
+  SESSION_MESSAGE_TYPES,
+  SessionEndMessageSchema,
+  SessionMessageMessageSchema,
+  SessionOpenMessageSchema,
+  loadSessionConfig
+} from "../../chunk-WOVESOQ7.js";
+import {
+  loadCoreConfig
+} from "../../chunk-QXRNW4OJ.js";
+import {
+  loadPeers
+} from "../../chunk-HLUEOLSZ.js";
 import {
   getConfigDir,
   loadConfig
 } from "../../chunk-IVOYM3WG.js";
 import {
   attachCanonicalAgentId,
-  getActivityFeed,
   getCard,
   getCardsBySkillCapability,
   getEvolutionHistory,
   getFeedbackForProvider,
   getFeedbackForSkill,
   getLatestEvolution,
-  getRequestLog,
-  getSkillRequestCount,
   insertCard,
   insertEvolution,
   insertFeedback,
-  insertRequestLog,
   listCards,
   openDatabase,
   updateCard,
   updateSkillAvailability,
   updateSkillIdleRate
-} from "../../chunk-PG3CLSAH.js";
+} from "../../chunk-VJ2Q33AP.js";
+import {
+  getActivityFeed,
+  getRequestLog,
+  getSkillRequestCount,
+  insertRequestLog
+} from "../../chunk-4XTYT4JW.js";
 import "../../chunk-EE3V3DXK.js";
 import {
   AgentBnBError,
   AnyCardSchema
 } from "../../chunk-UVCNMRPS.js";
+import "../../chunk-3RG5ZIWI.js";
 
 // skills/agentbnb/bootstrap.ts
 import { join as join6, basename as basename2, dirname as dirname4 } from "path";
@@ -102,7 +114,7 @@ import { existsSync as existsSync7, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { exec } from "child_process";
 import { promisify as promisify2 } from "util";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // src/runtime/process-guard.ts
 import { dirname, join } from "path";
@@ -879,9 +891,42 @@ var PipelineExecutor = class {
 };
 
 // src/skills/openclaw-bridge.ts
-import { execFileSync } from "child_process";
+import { spawnSync } from "child_process";
 var DEFAULT_BASE_URL = "http://localhost:3000";
 var DEFAULT_TIMEOUT_MS = 6e4;
+function isOpenClawJsonResponse(value) {
+  return typeof value === "object" && value !== null && "payloads" in value && Array.isArray(value.payloads) && "meta" in value;
+}
+function parseOpenClawResponse(raw) {
+  if (!isOpenClawJsonResponse(raw)) {
+    return raw;
+  }
+  const { payloads, meta } = raw;
+  const texts = payloads.map((p) => p.text).filter((t) => typeof t === "string" && t.length > 0);
+  const mediaUrls = payloads.map((p) => p.mediaUrl).filter((u) => typeof u === "string" && u.length > 0);
+  const openclawMeta = {
+    duration_ms: meta.durationMs,
+    model: meta.agentMeta?.model,
+    provider: meta.agentMeta?.provider
+  };
+  if (texts.length === 0) {
+    return { text: "", media_urls: mediaUrls, _openclaw_meta: openclawMeta };
+  }
+  const lastText = texts[texts.length - 1];
+  try {
+    const structured = JSON.parse(lastText);
+    if (typeof structured === "object" && structured !== null) {
+      return { ...structured, _openclaw_meta: openclawMeta };
+    }
+    return { result: structured, _openclaw_meta: openclawMeta };
+  } catch {
+    return {
+      text: texts.join("\n\n"),
+      media_urls: mediaUrls.length > 0 ? mediaUrls : void 0,
+      _openclaw_meta: openclawMeta
+    };
+  }
+}
 function buildPayload(config, params) {
   return {
     task: config.name,
@@ -948,7 +993,7 @@ Do NOT include explanations, markdown formatting, or code blocks.
 The JSON should contain the output fields specified in your SKILL.md.
 If you cannot complete the task, return: {"error": "reason"}`;
   try {
-    const stdout = execFileSync("openclaw", [
+    const proc = spawnSync("openclaw", [
       "agent",
       "--agent",
       config.agent_name,
@@ -957,21 +1002,37 @@ If you cannot complete the task, return: {"error": "reason"}`;
       "--json",
       "--local"
     ], {
-      timeout: timeoutMs
+      timeout: timeoutMs,
+      maxBuffer: 10 * 1024 * 1024
+      // 10 MB
     });
-    const text = stdout.toString().trim();
+    if (proc.error) {
+      return { success: false, error: proc.error.message };
+    }
+    const stderrText = proc.stderr?.toString() ?? "";
+    const stdoutText = proc.stdout?.toString() ?? "";
+    const text = (stderrText || stdoutText).trim();
+    if (!text) {
+      return {
+        success: false,
+        error: `OpenClaw process channel returned empty output (exit code ${proc.status})`
+      };
+    }
+    const jsonStart = text.lastIndexOf("\n{");
+    const jsonText = jsonStart >= 0 ? text.slice(jsonStart + 1) : text;
     try {
-      const parsed = JSON.parse(text);
-      return { success: true, result: parsed };
+      const parsed = JSON.parse(jsonText);
+      const result = parseOpenClawResponse(parsed);
+      return { success: true, result };
     } catch {
       return {
         success: false,
-        error: `OpenClaw process channel returned invalid JSON: ${text}`
+        error: `OpenClaw process channel returned invalid JSON: ${jsonText.slice(0, 500)}`
       };
     }
   } catch (err) {
-    const message2 = err instanceof Error ? err.message : String(err);
-    return { success: false, error: message2 };
+    const errMsg = err instanceof Error ? err.message : String(err);
+    return { success: false, error: errMsg };
   }
 }
 async function executeTelegram(config, payload) {
@@ -1390,9 +1451,9 @@ var AgentRuntime = class {
     }
     const modes = /* @__PURE__ */ new Map();
     if (this.conductorEnabled) {
-      const { ConductorMode } = await import("../../conductor-mode-NRSVP2AU.js");
-      const { registerConductorCard, CONDUCTOR_OWNER } = await import("../../card-6KL6L4GF.js");
-      const { loadPeers: loadPeers2 } = await import("../../peers-CJ7T4RJO.js");
+      const { ConductorMode } = await import("../../conductor-mode-KKPSNN7V.js");
+      const { registerConductorCard, CONDUCTOR_OWNER } = await import("../../card-VVT3XBOI.js");
+      const { loadPeers: loadPeers2 } = await import("../../peers-IOVCBWAI.js");
       registerConductorCard(this.registryDb);
       const resolveAgentUrl = (owner) => {
         const peers = loadPeers2();
@@ -1726,7 +1787,7 @@ import swaggerUi from "@fastify/swagger-ui";
 import fastifyStatic from "@fastify/static";
 import fastifyWebsocket from "@fastify/websocket";
 import { join as join2, dirname as dirname2 } from "path";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync3 } from "fs";
 import { z as z6 } from "zod";
@@ -1918,9 +1979,10 @@ function buildDraftCard(apiKey, owner) {
 }
 
 // src/relay/websocket-relay.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/relay/relay-credit.ts
+var coreConductorFee = loadCoreConfig("economics");
 function lookupCardPrice(registryDb, cardId, skillId) {
   const row = registryDb.prepare("SELECT data FROM capability_cards WHERE id = ?").get(cardId);
   if (!row) return null;
@@ -1967,8 +2029,11 @@ function settleForRelay(creditDb, escrowId, recipientOwner) {
 }
 function calculateConductorFee(totalSubTaskCost) {
   if (totalSubTaskCost <= 0) return 0;
-  const fee = Math.ceil(totalSubTaskCost * 0.1);
-  return Math.max(1, Math.min(20, fee));
+  const rate = coreConductorFee?.conductor?.sub_task_fee_rate ?? 0.1;
+  const min = coreConductorFee?.conductor?.sub_task_fee_min ?? 1;
+  const max = coreConductorFee?.conductor?.sub_task_fee_max ?? 20;
+  const fee = Math.ceil(totalSubTaskCost * rate);
+  return Math.max(min, Math.min(max, fee));
 }
 function releaseForRelay(creditDb, escrowId) {
   if (escrowId === void 0) return;
@@ -2022,10 +2087,9 @@ function processEscrowSettle(creditDb, escrowId, success, providerAgentId, signa
   if (!escrowRow) {
     throw new Error(`Escrow not found or already settled: ${escrowId}`);
   }
-  const NETWORK_FEE_RATE2 = 0.05;
   if (success) {
     settleEscrow(creditDb, escrowId, providerAgentId);
-    const networkFee = Math.floor(escrowRow.amount * NETWORK_FEE_RATE2);
+    const networkFee = Math.floor(escrowRow.amount * NETWORK_FEE_RATE);
     const providerAmount = escrowRow.amount - networkFee;
     return {
       escrow_id: escrowId,
@@ -2346,12 +2410,413 @@ function handleJobRelayResponse(opts) {
   }
 }
 
+// src/session/session-manager.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
+// src/session/session-escrow.ts
+var SessionEscrow = class {
+  constructor(creditDb) {
+    this.creditDb = creditDb;
+  }
+  /** escrowId → { budget, spent } */
+  tracking = /* @__PURE__ */ new Map();
+  /**
+   * Hold the full session budget in escrow.
+   * @returns The escrow ID for tracking.
+   */
+  holdBudget(owner, budget, cardId) {
+    const escrowId = holdEscrow(this.creditDb, owner, budget, cardId);
+    this.tracking.set(escrowId, { budget, spent: 0 });
+    return escrowId;
+  }
+  /**
+   * Record a per-message deduction against the session budget.
+   * Does not touch the DB — tracking is in-memory until settle.
+   */
+  deductMessage(escrowId, rate) {
+    return this.deduct(escrowId, rate);
+  }
+  /**
+   * Record a per-minute deduction against the session budget.
+   */
+  deductMinute(escrowId, rate) {
+    return this.deduct(escrowId, rate);
+  }
+  /**
+   * Settle the session escrow. Pays the provider the actual cost and
+   * refunds the remainder to the requester.
+   */
+  settle(escrowId, providerOwner) {
+    const t = this.tracking.get(escrowId);
+    if (!t) {
+      settleEscrow(this.creditDb, escrowId, providerOwner);
+      return;
+    }
+    if (t.spent <= 0) {
+      releaseEscrow(this.creditDb, escrowId);
+    } else {
+      settleEscrow(this.creditDb, escrowId, providerOwner);
+    }
+    this.tracking.delete(escrowId);
+  }
+  /**
+   * Release the escrow entirely — full refund to requester.
+   */
+  refund(escrowId) {
+    releaseEscrow(this.creditDb, escrowId);
+    this.tracking.delete(escrowId);
+  }
+  /**
+   * Get remaining budget for a session escrow.
+   */
+  getRemainingBudget(escrowId) {
+    const t = this.tracking.get(escrowId);
+    if (!t) return 0;
+    return t.budget - t.spent;
+  }
+  /**
+   * Get total spent for a session escrow.
+   */
+  getSpent(escrowId) {
+    return this.tracking.get(escrowId)?.spent ?? 0;
+  }
+  /**
+   * Check if the budget is exhausted.
+   */
+  isBudgetExhausted(escrowId) {
+    return this.getRemainingBudget(escrowId) <= 0;
+  }
+  /**
+   * Calculate the cost for a single interaction based on pricing model.
+   */
+  calculateCost(pricingModel, rate, durationMinutes) {
+    switch (pricingModel) {
+      case "per_message":
+        return rate;
+      case "per_minute":
+        return Math.ceil(durationMinutes ?? 1) * rate;
+      case "per_session":
+        return rate;
+    }
+  }
+  deduct(escrowId, amount) {
+    const t = this.tracking.get(escrowId);
+    if (!t) {
+      throw new Error(`No session escrow tracking for ${escrowId}`);
+    }
+    t.spent += amount;
+    return { spent: t.spent, remaining: t.budget - t.spent };
+  }
+};
+
+// src/session/session-manager.ts
+var SessionManager = class {
+  sessions = /* @__PURE__ */ new Map();
+  idleTimers = /* @__PURE__ */ new Map();
+  durationTimers = /* @__PURE__ */ new Map();
+  escrow;
+  config;
+  sendToAgent;
+  /** Maps agent connection key → set of session IDs they participate in. */
+  agentSessions = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.escrow = new SessionEscrow(opts.creditDb);
+    this.config = opts.config ?? loadSessionConfig();
+    this.sendToAgent = opts.sendToAgent;
+  }
+  /**
+   * Open a new session between requester and provider.
+   */
+  openSession(msg, requesterKey) {
+    const requesterSessions = this.agentSessions.get(requesterKey);
+    if (requesterSessions && requesterSessions.size >= this.config.abuse.max_concurrent_sessions_per_agent) {
+      this.sendToAgent(requesterKey, {
+        type: "session_error",
+        session_id: msg.session_id,
+        code: "MAX_CONCURRENT_SESSIONS",
+        message: `Maximum concurrent sessions (${this.config.abuse.max_concurrent_sessions_per_agent}) reached`
+      });
+      throw new Error("Max concurrent sessions reached");
+    }
+    const escrowId = this.escrow.holdBudget(msg.requester_id, msg.budget, msg.card_id);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const session = {
+      id: msg.session_id,
+      requester_id: msg.requester_id,
+      provider_id: msg.provider_id,
+      skill_id: msg.skill_id,
+      card_id: msg.card_id,
+      status: "open",
+      escrow_id: escrowId,
+      budget: msg.budget,
+      spent: 0,
+      pricing_model: msg.pricing_model,
+      messages: [],
+      created_at: now,
+      updated_at: now
+    };
+    this.sessions.set(session.id, session);
+    this.trackAgentSession(requesterKey, session.id);
+    this.trackAgentSession(msg.provider_id, session.id);
+    this.sendToAgent(requesterKey, {
+      type: "session_ack",
+      session_id: session.id,
+      escrow_id: escrowId,
+      status: "open"
+    });
+    const initialMsg = this.createMessage(session.id, "requester", msg.initial_message);
+    session.messages.push(initialMsg);
+    session.status = "active";
+    session.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    this.sendToAgent(msg.provider_id, {
+      type: "session_message",
+      session_id: session.id,
+      sender: "requester",
+      content: msg.initial_message
+    });
+    if (session.pricing_model === "per_session") {
+      const cost = this.config.pricing.per_session_flat_rate;
+      this.escrow.deductMessage(escrowId, cost);
+      session.spent = cost;
+    }
+    this.resetIdleTimer(session.id);
+    this.startDurationTimer(session.id);
+    return session;
+  }
+  /**
+   * Route a message within an active session.
+   */
+  routeMessage(msg, senderKey) {
+    const session = this.sessions.get(msg.session_id);
+    if (!session) {
+      this.sendToAgent(senderKey, {
+        type: "session_error",
+        session_id: msg.session_id,
+        code: "SESSION_NOT_FOUND",
+        message: "Session not found"
+      });
+      return;
+    }
+    if (session.status !== "active") {
+      this.sendToAgent(senderKey, {
+        type: "session_error",
+        session_id: msg.session_id,
+        code: "SESSION_NOT_ACTIVE",
+        message: `Session is ${session.status}, not active`
+      });
+      return;
+    }
+    if (session.messages.length >= this.config.pricing.max_messages_per_session) {
+      this.endSessionInternal(session, "budget_exhausted");
+      return;
+    }
+    if (session.pricing_model === "per_message" && msg.sender === "provider") {
+      const rate = this.config.pricing.per_message_base_rate;
+      const { remaining } = this.escrow.deductMessage(session.escrow_id, rate);
+      session.spent += rate;
+      if (remaining <= 0) {
+        const record2 = this.createMessage(session.id, msg.sender, msg.content, msg.metadata);
+        session.messages.push(record2);
+        session.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+        const targetKey2 = this.getCounterpartyKey(session, msg.sender);
+        this.sendToAgent(targetKey2, {
+          type: "session_message",
+          session_id: session.id,
+          sender: msg.sender,
+          content: msg.content,
+          metadata: msg.metadata
+        });
+        this.endSessionInternal(session, "budget_exhausted");
+        return;
+      }
+    }
+    const record = this.createMessage(session.id, msg.sender, msg.content, msg.metadata);
+    session.messages.push(record);
+    session.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    const targetKey = this.getCounterpartyKey(session, msg.sender);
+    this.sendToAgent(targetKey, {
+      type: "session_message",
+      session_id: session.id,
+      sender: msg.sender,
+      content: msg.content,
+      metadata: msg.metadata
+    });
+    this.resetIdleTimer(session.id);
+  }
+  /**
+   * End a session at the request of either party.
+   */
+  endSession(msg, _senderKey) {
+    const session = this.sessions.get(msg.session_id);
+    if (!session) return;
+    if (session.status === "settled" || session.status === "closed") return;
+    this.endSessionInternal(session, msg.reason);
+  }
+  /**
+   * Handle agent disconnection — end all their active sessions.
+   */
+  handleDisconnect(agentKey) {
+    const sessionIds = this.agentSessions.get(agentKey);
+    if (!sessionIds) return;
+    for (const sessionId of sessionIds) {
+      const session = this.sessions.get(sessionId);
+      if (session && session.status !== "settled" && session.status !== "closed") {
+        this.endSessionInternal(session, "error");
+      }
+    }
+  }
+  /** Get a session by ID. */
+  getSession(sessionId) {
+    return this.sessions.get(sessionId);
+  }
+  /** List sessions, optionally filtered by agent. */
+  listSessions(agentId) {
+    if (!agentId) return Array.from(this.sessions.values());
+    return Array.from(this.sessions.values()).filter(
+      (s) => s.requester_id === agentId || s.provider_id === agentId
+    );
+  }
+  /** Clean up all timers (for graceful shutdown). */
+  shutdown() {
+    for (const timer of this.idleTimers.values()) clearTimeout(timer);
+    for (const timer of this.durationTimers.values()) clearTimeout(timer);
+    this.idleTimers.clear();
+    this.durationTimers.clear();
+  }
+  // -------------------------------------------------------------------------
+  // Internal helpers
+  // -------------------------------------------------------------------------
+  endSessionInternal(session, reason) {
+    session.status = "closing";
+    session.end_reason = reason;
+    session.ended_at = (/* @__PURE__ */ new Date()).toISOString();
+    this.clearTimers(session.id);
+    if (session.spent > 0) {
+      this.escrow.settle(session.escrow_id, session.provider_id);
+    } else {
+      this.escrow.refund(session.escrow_id);
+    }
+    const durationMs = Date.now() - new Date(session.created_at).getTime();
+    const settledMsg = {
+      type: "session_settled",
+      session_id: session.id,
+      total_cost: session.spent,
+      messages_count: session.messages.length,
+      duration_seconds: Math.round(durationMs / 1e3),
+      refunded: session.budget - session.spent
+    };
+    session.status = "settled";
+    session.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    this.sendToAgent(session.requester_id, settledMsg);
+    this.sendToAgent(session.provider_id, settledMsg);
+    session.status = "closed";
+    this.untrackAgentSession(session.requester_id, session.id);
+    this.untrackAgentSession(session.provider_id, session.id);
+  }
+  resetIdleTimer(sessionId) {
+    const existing = this.idleTimers.get(sessionId);
+    if (existing) clearTimeout(existing);
+    const timer = setTimeout(() => {
+      const session = this.sessions.get(sessionId);
+      if (session && session.status === "active") {
+        this.endSessionInternal(session, "timeout");
+      }
+    }, this.config.timeouts.idle_timeout_ms);
+    this.idleTimers.set(sessionId, timer);
+  }
+  startDurationTimer(sessionId) {
+    const timer = setTimeout(() => {
+      const session = this.sessions.get(sessionId);
+      if (session && session.status !== "settled" && session.status !== "closed") {
+        this.endSessionInternal(session, "timeout");
+      }
+    }, this.config.timeouts.max_session_duration_ms);
+    this.durationTimers.set(sessionId, timer);
+  }
+  clearTimers(sessionId) {
+    const idle = this.idleTimers.get(sessionId);
+    if (idle) {
+      clearTimeout(idle);
+      this.idleTimers.delete(sessionId);
+    }
+    const dur = this.durationTimers.get(sessionId);
+    if (dur) {
+      clearTimeout(dur);
+      this.durationTimers.delete(sessionId);
+    }
+  }
+  createMessage(sessionId, sender, content, metadata) {
+    return {
+      id: randomUUID5(),
+      session_id: sessionId,
+      sender,
+      content,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata
+    };
+  }
+  getCounterpartyKey(session, sender) {
+    return sender === "requester" ? session.provider_id : session.requester_id;
+  }
+  trackAgentSession(agentKey, sessionId) {
+    let set = this.agentSessions.get(agentKey);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.agentSessions.set(agentKey, set);
+    }
+    set.add(sessionId);
+  }
+  untrackAgentSession(agentKey, sessionId) {
+    const set = this.agentSessions.get(agentKey);
+    if (set) {
+      set.delete(sessionId);
+      if (set.size === 0) this.agentSessions.delete(agentKey);
+    }
+  }
+};
+
+// src/session/session-relay.ts
+function attachSessionHandler(opts) {
+  const { sessionManager } = opts;
+  return {
+    handleSessionMessage(msg, senderKey) {
+      if (!SESSION_MESSAGE_TYPES.has(msg.type)) return false;
+      switch (msg.type) {
+        case "session_open": {
+          const parsed = SessionOpenMessageSchema.parse(msg);
+          sessionManager.openSession(parsed, senderKey);
+          return true;
+        }
+        case "session_message": {
+          const parsed = SessionMessageMessageSchema.parse(msg);
+          sessionManager.routeMessage(parsed, senderKey);
+          return true;
+        }
+        case "session_end": {
+          const parsed = SessionEndMessageSchema.parse(msg);
+          sessionManager.endSession(parsed, senderKey);
+          return true;
+        }
+        // session_ack, session_settled, session_error are relay→agent only
+        // They should not arrive from agents, but we silently absorb them
+        case "session_ack":
+        case "session_settled":
+        case "session_error":
+          return true;
+        default:
+          return false;
+      }
+    }
+  };
+}
+
 // src/relay/websocket-relay.ts
-var RATE_LIMIT_MAX = 60;
-var RATE_LIMIT_WINDOW_MS = 6e4;
-var RELAY_IDLE_TIMEOUT_MS = 3e4;
-var RELAY_HARD_TIMEOUT_MS = 3e5;
-var RELAY_DISCONNECT_GRACE_MS = RELAY_HARD_TIMEOUT_MS + 3e4;
+var coreRelay = loadCoreConfig("relay");
+var RATE_LIMIT_MAX = coreRelay?.rate_limit_max ?? 60;
+var RATE_LIMIT_WINDOW_MS = coreRelay?.rate_limit_window_ms ?? 6e4;
+var RELAY_IDLE_TIMEOUT_MS = coreRelay?.relay_idle_timeout_ms ?? 3e4;
+var RELAY_HARD_TIMEOUT_MS = coreRelay?.relay_hard_timeout_ms ?? 3e5;
+var RELAY_DISCONNECT_GRACE_MS = coreRelay?.relay_disconnect_grace_ms ?? RELAY_HARD_TIMEOUT_MS + 3e4;
 function readTimeoutOverride(envKey, fallbackMs) {
   const raw = process.env[envKey];
   if (!raw) return fallbackMs;
@@ -2582,7 +3047,7 @@ function registerWebSocketRelay(server, db, creditDb) {
   function logAgentJoined(owner, cardName, cardId) {
     try {
       insertRequestLog(db, {
-        id: randomUUID5(),
+        id: randomUUID6(),
         card_id: cardId,
         card_name: cardName,
         requester: owner,
@@ -2600,6 +3065,19 @@ function registerWebSocketRelay(server, db, creditDb) {
       ws.send(JSON.stringify(msg));
     }
   }
+  function sendToAgentByKey(agentKey, msg) {
+    const connKey = resolveConnectionKey(agentKey);
+    const ws = connKey ? connections.get(connKey) : void 0;
+    if (ws && ws.readyState === 1) {
+      ws.send(JSON.stringify(msg));
+    }
+  }
+  const sessionManager = creditDb ? new SessionManager({
+    creditDb,
+    sendToAgent: sendToAgentByKey,
+    isAgentOnline: (key) => !!resolveConnectionKey(key)
+  }) : void 0;
+  const sessionHandler = sessionManager ? attachSessionHandler({ sessionManager }) : void 0;
   function handleRegister(ws, msg) {
     const { owner, card } = msg;
     const existing = connections.get(owner);
@@ -2819,6 +3297,9 @@ function registerWebSocketRelay(server, db, creditDb) {
       }
     }
     markOwnerOffline(owner);
+    if (sessionManager) {
+      sessionManager.handleDisconnect(owner);
+    }
     for (const [reqId, pending] of pendingRequests) {
       if (pending.targetOwner === owner) {
         clearPendingTimers(pending);
@@ -3013,6 +3494,13 @@ function registerWebSocketRelay(server, db, creditDb) {
               handleBalanceSync(socket, msg);
               break;
             default:
+              if (sessionHandler && registeredOwner) {
+                const handled = sessionHandler.handleSessionMessage(
+                  msg,
+                  registeredOwner
+                );
+                if (handled) break;
+              }
               break;
           }
         })();
@@ -3047,6 +3535,7 @@ function registerWebSocketRelay(server, db, creditDb) {
       pendingRequests.clear();
       rateLimits.clear();
       agentCapacities.clear();
+      if (sessionManager) sessionManager.shutdown();
     },
     setOnAgentOnline: (cb) => {
       onAgentOnlineCallback = cb;
@@ -3063,7 +3552,7 @@ function registerWebSocketRelay(server, db, creditDb) {
 
 // src/identity/guarantor.ts
 import { z as z2 } from "zod";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var MAX_AGENTS_PER_GUARANTOR = 10;
 var GUARANTOR_CREDIT_POOL = 50;
 var GuarantorRecordSchema = z2.object({
@@ -3102,7 +3591,7 @@ function registerGuarantor(db, githubLogin) {
     );
   }
   const record = {
-    id: randomUUID6(),
+    id: randomUUID7(),
     github_login: githubLogin,
     agent_count: 0,
     credit_pool: GUARANTOR_CREDIT_POOL,
@@ -3176,7 +3665,7 @@ function getAgentGuarantor(db, agentId) {
 function initiateGithubAuth() {
   return {
     auth_url: "https://github.com/login/oauth/authorize?client_id=PLACEHOLDER&scope=read:user",
-    state: randomUUID6()
+    state: randomUUID7()
   };
 }
 
@@ -5486,14 +5975,14 @@ function createRegistryServer(opts) {
               return { card_id: target.cardId, skill_id: target.skillId };
             }
             if (!relayClient) {
-              const { RelayClient: RelayClient2 } = await import("../../websocket-client-WHEHIYIZ.js");
+              const { RelayClient: RelayClient2 } = await import("../../websocket-client-RT4KLJL4.js");
               relayClient = new RelayClient2({
                 registryUrl: relayRegistryUrl,
                 owner: relayRequesterOwner,
                 token: "batch-token",
                 card: {
                   spec_version: "1.0",
-                  id: randomUUID7(),
+                  id: randomUUID8(),
                   owner: relayRequesterOwner,
                   name: relayRequesterOwner,
                   description: "Batch requester",
@@ -5508,7 +5997,7 @@ function createRegistryServer(opts) {
               });
               await relayClient.connect();
             }
-            const { requestViaRelay: requestViaRelay2 } = await import("../../client-YB3IYO3S.js");
+            const { requestViaRelay: requestViaRelay2 } = await import("../../client-XOSXFC7Q.js");
             return requestViaRelay2(relayClient, {
               targetOwner: target.owner,
               cardId: target.cardId,
@@ -5764,7 +6253,7 @@ function createRegistryServer(opts) {
       if (!opts.creditDb) {
         return reply.code(404).send({ error: "Credit system not enabled" });
       }
-      const { getReliabilityMetrics } = await import("../../reliability-metrics-JSOY3PNW.js");
+      const { getReliabilityMetrics } = await import("../../reliability-metrics-22JTZGB4.js");
       const metrics = getReliabilityMetrics(opts.creditDb, owner);
       if (!metrics) {
         return reply.code(404).send({ error: "No reliability data for this provider" });
@@ -5820,7 +6309,7 @@ function createRegistryServer(opts) {
           }
           let reliability = null;
           if (opts.creditDb) {
-            const { getReliabilityMetrics } = await import("../../reliability-metrics-JSOY3PNW.js");
+            const { getReliabilityMetrics } = await import("../../reliability-metrics-22JTZGB4.js");
             reliability = getReliabilityMetrics(opts.creditDb, providerIdentity);
           }
           agents.push({
@@ -5976,7 +6465,7 @@ async function stopAnnouncement() {
 }
 
 // src/runtime/resolve-self-cli.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync } from "child_process";
 import { existsSync as existsSync4, realpathSync } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir2 } from "os";
@@ -5992,7 +6481,7 @@ function resolveSelfCli() {
     nodeExecDir: dirname3(process.execPath),
     exists: existsSync4,
     realpath: realpathSync,
-    runWhich: (pathEnv) => execFileSync2("which", ["agentbnb"], {
+    runWhich: (pathEnv) => execFileSync("which", ["agentbnb"], {
       encoding: "utf8",
       env: { ...process.env, PATH: pathEnv }
     }).trim(),
@@ -6113,11 +6602,11 @@ function extractErrorMessage(err) {
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
 import { join as join4 } from "path";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { Cron as Cron2 } from "croner";
 function buildFallbackRelayCard(owner) {
   return {
-    id: randomUUID8(),
+    id: randomUUID9(),
     owner,
     name: owner,
     description: "Agent registered via CLI",
@@ -6286,7 +6775,7 @@ var ServiceCoordinator = class {
       console.log("Conductor mode enabled \u2014 orchestrate/plan skills available via gateway");
     }
     if (opts.conductorEnabled && this.config.conductor?.public) {
-      const { buildConductorCard } = await import("../../card-6KL6L4GF.js");
+      const { buildConductorCard } = await import("../../card-VVT3XBOI.js");
       const conductorCard = attachCanonicalAgentId(
         this.runtime.registryDb,
         buildConductorCard(this.config.owner)
@@ -6362,8 +6851,8 @@ var ServiceCoordinator = class {
       }
     }
     if (opts.registryUrl && opts.relay) {
-      const { RelayClient: RelayClient2 } = await import("../../websocket-client-WHEHIYIZ.js");
-      const { executeCapabilityRequest: executeCapabilityRequest2 } = await import("../../execute-DNRNU3HM.js");
+      const { RelayClient: RelayClient2 } = await import("../../websocket-client-RT4KLJL4.js");
+      const { executeCapabilityRequest: executeCapabilityRequest2 } = await import("../../execute-IEQ3RV7I.js");
       const localCards = listCards(this.runtime.registryDb, this.config.owner);
       const { primaryCard, additionalCards } = buildRelayRegistrationCards(this.config.owner, localCards);
       if (this.config.conductor?.public) {
@@ -6661,11 +7150,11 @@ function sleep2(ms) {
 }
 
 // src/app/agentbnb-service.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 
 // src/credit/escrow-receipt.ts
 import { z as z7 } from "zod";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var EscrowReceiptSchema = z7.object({
   requester_owner: z7.string().min(1),
   requester_agent_id: z7.string().optional(),
@@ -6687,7 +7176,7 @@ function createSignedEscrowReceipt(db, privateKey, publicKey, opts) {
     card_id: opts.cardId,
     ...opts.skillId ? { skill_id: opts.skillId } : {},
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    nonce: randomUUID9()
+    nonce: randomUUID10()
   };
   const signature = signEscrowReceipt(receiptData, privateKey);
   const receipt = {
@@ -6937,13 +7426,13 @@ var AgentBnBService = class {
     if (!this.config.registry) {
       throw new AgentBnBError("Registry is required for relay fallback.", "RELAY_NOT_AVAILABLE");
     }
-    const requesterId = `${this.config.owner}:req:${randomUUID10()}`;
+    const requesterId = `${this.config.owner}:req:${randomUUID11()}`;
     const tempRelay = new RelayClient({
       registryUrl: this.config.registry,
       owner: requesterId,
       token: this.config.token,
       card: {
-        id: randomUUID10(),
+        id: randomUUID11(),
         owner: requesterId,
         name: requesterId,
         description: "Requester",
@@ -7806,7 +8295,7 @@ function registerDecomposerCard(configDir, owner) {
       "SELECT id FROM capability_cards WHERE owner = ? AND json_extract(data, '$.capability_type') = ?"
     ).get(owner, "task_decomposition");
     if (existing) return;
-    const cardId = randomUUID11();
+    const cardId = randomUUID12();
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const card = {
       spec_version: "2.0",
@@ -7873,7 +8362,7 @@ function deriveAgentName(configDir) {
   if (parent && parent !== "." && parent !== ".agentbnb" && parent !== homedir4().split("/").pop()) {
     return parent;
   }
-  return `agent-${randomUUID11().slice(0, 8)}`;
+  return `agent-${randomUUID12().slice(0, 8)}`;
 }
 var defaultDeps = { resolveSelfCli, runCommand };
 async function autoOnboard(configDir, deps = defaultDeps) {