mycomesh-consumer 0.9.12 → 0.9.14

package/networks/mycomesh-v11-sepolia.json

@@ -33,7 +33,7 @@
           "text"
         ],
         "streaming": true,
-        "tools": false,
+        "tools": true,
         "dialects": [
           "openai-responses",
           "openai-chat",
@@ -56,7 +56,7 @@
           "text"
         ],
         "streaming": true,
-        "tools": false,
+        "tools": true,
         "dialects": [
           "openai-responses",
           "openai-chat",
@@ -79,7 +79,7 @@
           "text"
         ],
         "streaming": true,
-        "tools": false,
+        "tools": true,
         "dialects": [
           "openai-responses",
           "openai-chat",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mycomesh-consumer",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "MycoMesh V11 Consumer: a custodied deposit, relay-blind encrypted requests to any Provider, and a local OpenAI-compatible endpoint.",
   "repository": {
     "type": "git",

package/src/account.mjs

@@ -46,9 +46,12 @@ export async function setup(network, { ownerPrivate, key, deposit, limit, forceF
     await faucet(network, owner);
   }
   const send = (to, data) => sendTransaction(network.rpc_urls, ownerPrivate, { to, data });
+  log("approving the deposit (transaction 1 of 3)...");
   await send(network.stablecoin, encodeCall("approve(address,uint256)", [["address", network.settlement], ["uint", deposit]]));
+  log("depositing (transaction 2 of 3)...");
   await send(network.settlement, encodeCall("deposit(uint256)", [["uint", deposit]]));
   if (!status.grant?.active || BigInt(status.grant.max_per_request) !== limit) {
+    log("authorizing this machine's payment key (transaction 3 of 3)...");
     await send(network.settlement, encodeCall("registerKey(address,uint256,uint64)", [["address", key], ["uint", limit], ["uint", 0]]));
   }
   return { owner, key, deposit: deposit.toString(), max_per_request: limit.toString() };

package/src/chain.mjs

@@ -10,7 +10,9 @@ export async function rpcCall(urls, method, params, { timeoutMs = 15000 } = {})
         body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }), signal: AbortSignal.timeout(timeoutMs),
       });
       const body = await response.json();
-      if (body.error) throw Object.assign(new Error(`${method}: ${JSON.stringify(body.error).slice(0, 300)}`), { answered: true });
+      // An endpoint without the history asked for (pruned logs) is not an answer: try the next one.
+      const endpointOnly = /pruned|history unavailable|missing trie node|rate limit|too many requests/i.test(JSON.stringify(body.error ?? ""));
+      if (body.error) throw Object.assign(new Error(`${method}: ${JSON.stringify(body.error).slice(0, 300)}`), { answered: !endpointOnly });
       return body.result;
     } catch (error) {
       if (error.answered) throw error;

package/src/cli.mjs

@@ -24,15 +24,15 @@ const USAGE = `Usage: mycomesh-consumer <command> [options]
   address                  print the payment key address
   wallet                   print the owner wallet address (a V3 keystore; MetaMask can import it)
   faucet                   testnet: get gas ETH and tUSDC for the owner wallet
-  setup --deposit UNITS [--max-per-request UNITS]
+  setup [--deposit 20tUSDC] [--max-per-request 1tUSDC]
                            deposit into the settlement contract and authorize the payment key
-                           (on testnets, tops the wallet up from the faucet first)
+                           (on testnets, tops the wallet up from the faucet first; default 20 tUSDC)
   balance [--owner ADDR]   show the custodied deposit
   rewards [claim]          MYCO earned by the owner wallet (80% of each hour's emission goes to the
                            Consumers who paid that hour's fees); \`claim\` mints it to the wallet
   withdraw [UNITS]         request a withdrawal of the deposit; run again after the delay to receive it
-  request "prompt" [--stream]
-                           send one request and print the verified answer
+  request "prompt" [--stream] [--json]
+                           send one request and print the verified answer (JSON when piped or with --json)
   serve [--port 8110]      run the local web console and OpenAI-compatible endpoint (default)
   tenant add NAME [--budget UNITS] [--max-per-request UNITS]
                            multi-tenant accounts: a payment key and API key per tenant, capped on-chain
@@ -41,10 +41,23 @@ const USAGE = `Usage: mycomesh-consumer <command> [options]
                            reveal a recorded request and response to a Provider-AI jury
                            (within 24 hours; the reporter bond is returned if fraud is confirmed)
 
+Amounts: a bare integer is base units (1 tUSDC = 1000000); 20tUSDC or 20.5 means tUSDC.
 Common: --network FILE (default: the bundled MycoMesh V11 Sepolia manifest), --data-dir DIR, --model ID,
   --max-fee UNITS, --provider SIGNER, --owner-key-file F (raw key or keystore instead of the local wallet).
 The wallet password comes from MYCOMESH_WALLET_PASSWORD or a terminal prompt.`;
 
+// Amounts: a bare integer is base units (1e-6 tUSDC), as before; "20tUSDC", "20 usdc" or "20.5" are tUSDC.
+export function parseAmount(value, name) {
+  const text = String(value).trim();
+  const match = /^([0-9]+(?:\.[0-9]{1,6})?)\s*(t?usdc)?$/i.exec(text);
+  if (!match) throw new Error(`${name}: write base units (20000000) or tUSDC (20tUSDC, 20.5)`);
+  if (!match[2] && !match[1].includes(".")) return BigInt(match[1]);
+  const [whole, fraction = ""] = match[1].split(".");
+  return BigInt(whole) * 1_000_000n + BigInt(fraction.padEnd(6, "0"));
+}
+export const tusdc = (units) => `${(Number(units) / 1e6).toLocaleString("en-US", { maximumFractionDigits: 6 })} tUSDC`;
+const human = () => Boolean(process.stdout.isTTY) && !process.env.MYCOMESH_JSON;
+
 function dataDir(value) {
   const dir = value || process.env.MYCOMESH_CONSUMER_DATA_DIR || join(homedir(), ".mycomesh", "v11");
   mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -77,7 +90,7 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
       port: { type: "string", default: "8110" }, host: { type: "string", default: "127.0.0.1" },
       "max-output-tokens": { type: "string", default: "4096" }, help: { type: "boolean" },
       reason: { type: "string", default: "unrelated_response" }, faucet: { type: "boolean" }, provider: { type: "string" },
-      statement: { type: "string", default: "" }, stream: { type: "boolean" }, budget: { type: "string" },
+      statement: { type: "string", default: "" }, stream: { type: "boolean" }, json: { type: "boolean" }, budget: { type: "string" },
       "no-browser": { type: "boolean" },
     },
   });
@@ -93,6 +106,11 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
     if (!values["owner-key-file"]) {
       stdout.write(`owner wallet ${walletAddress(await createWallet(dir))} (${join(dir, "owner-wallet.json")})\n`);
     }
+    if (human()) {
+      stdout.write("\nThe first address is this machine's payment key: it signs each request, holds no money, needs no password.\n"
+        + "The owner wallet holds your tUSDC and deposit; it is password-protected and signs deposits, withdrawals and claims.\n"
+        + "Next: mycomesh-consumer setup   (gets testnet funds and deposits 20 tUSDC; about a minute)\n");
+    }
     return 0;
   }
   if (command === "wallet") {
@@ -107,14 +125,15 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
   }
   if (command === "setup") {
     const keyPrivate = paymentKey(dir);
-    if (!values.deposit) throw new Error("--deposit UNITS is required");
     if (!values["owner-key-file"]) await createWallet(dir);
     const result = await setup(network, {
-      ownerPrivate: await ownerKey(values["owner-key-file"], dir), key: addressOf(keyPrivate), deposit: BigInt(values.deposit),
-      limit: BigInt(values["max-per-request"] || values["max-fee"]), forceFaucet: values.faucet,
+      ownerPrivate: await ownerKey(values["owner-key-file"], dir), key: addressOf(keyPrivate),
+      deposit: parseAmount(values.deposit ?? "20tUSDC", "--deposit"),
+      limit: parseAmount(values["max-per-request"] || values["max-fee"], "--max-per-request"), forceFaucet: values.faucet,
       log: (line) => stdout.write(`${line}\n`),
     });
     stdout.write(`deposited ${result.deposit} and authorized ${result.key} up to ${result.max_per_request} per request\n`);
+    if (human()) stdout.write(`Ready: ${tusdc(result.deposit)} deposited. Try: mycomesh-consumer request "hello", or mycomesh-consumer serve\n`);
     return 0;
   }
   if (command === "withdraw") {
@@ -128,7 +147,7 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
       stdout.write(`withdrew ${status.withdrawal.amount}\n`);
       return 0;
     }
-    const amount = BigInt(rest[0] || status.deposit);
+    const amount = rest[0] ? parseAmount(rest[0], "amount") : BigInt(status.deposit);
     await requestWithdrawal(network, owner, amount);
     stdout.write(`requested a withdrawal of ${amount}; run \`withdraw\` again after the delay\n`);
     return 0;
@@ -136,7 +155,8 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
   if (command === "balance") {
     const owner = values.owner || ownerAddress(values["owner-key-file"], dir);
     if (!owner) throw new Error("--owner, --owner-key-file or a local wallet (`init`) is required");
-    stdout.write(`${await availableBalance(network, owner)}\n`);
+    const balance = await availableBalance(network, owner);
+    stdout.write(human() ? `${tusdc(balance)} deposited (${balance} base units)\n` : `${balance}\n`);
     return 0;
   }
   if (command === "rewards") {
@@ -164,18 +184,19 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
     const owner = await ownerKey(values["owner-key-file"], dir);
     if (action === "add") {
       const created = await addTenant(network, dir, owner, name, {
-        maxPerRequest: BigInt(values["max-per-request"] || values["max-fee"]), budget: BigInt(values.budget || 0) });
+        maxPerRequest: parseAmount(values["max-per-request"] || values["max-fee"], "--max-per-request"),
+        budget: parseAmount(values.budget || 0, "--budget") });
       stdout.write(`${JSON.stringify(created)}\nThe API key is shown once; give it to the tenant (Authorization: Bearer ...).\n`);
       return 0;
     }
     const tenant = loadTenants(dir)[name];
     if (!tenant) throw new Error(`no tenant ${name}`);
-    if (action === "budget") { await setBudget(network, owner, tenant.key, BigInt(amount)); stdout.write(`budget of ${name} set to ${amount}\n`); return 0; }
+    if (action === "budget") { await setBudget(network, owner, tenant.key, parseAmount(amount, "budget")); stdout.write(`budget of ${name} set to ${amount}\n`); return 0; }
     if (action === "revoke") { await revokeTenant(network, dir, owner, name); stdout.write(`revoked ${name}\n`); return 0; }
     throw new Error("tenant add | list | budget | revoke");
   }
   const keyPrivate = paymentKey(dir, command === "serve");
-  const consumer = new Consumer({ network, keyPrivate, maxFee: Number(values["max-fee"]), journalDir: dir });
+  const consumer = new Consumer({ network, keyPrivate, maxFee: Number(parseAmount(values["max-fee"], "--max-fee")), journalDir: dir });
   if (command === "request") {
     const { response, receipt } = await consumer.request({
       endpoint: "responses", model: values.model, content: rest.join(" "), maxOutputTokens: Number(values["max-output-tokens"]),
@@ -183,6 +204,12 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
     });
     if (values.stream) process.stderr.write("\n");
     const output = response.output;
+    if (human() && !values.json) {
+      if (!values.stream) stdout.write(`${output.output_text ?? JSON.stringify(output)}\n`);
+      stdout.write(`\n— ${tusdc(receipt.receipt.actual_fee)} · Provider ${receipt.authorization.provider_signer.slice(0, 10)}… · `
+        + "verified against the Provider's signed receipt (--json for details)\n");
+      return 0;
+    }
     stdout.write(`${JSON.stringify({ output_text: output.output_text ?? output, fee: receipt.receipt.actual_fee,
       provider: receipt.authorization.provider_signer, request_id: receipt.authorization.request_id,
       settlement_key: settlementKey(receipt.authorization.key, receipt.authorization.request_id) })}\n`);

package/src/console.mjs

@@ -11,6 +11,9 @@ import { networkPrices } from "./pricing.mjs";
 import { claimRewards, rewardsSummary } from "./rewards.mjs";
 
 const PAGE = new URL("./web/console.html", import.meta.url);
+// Only actions that sign with the owner wallet ask for its password; after one, the wallet stays unlocked in
+// this process for a while so the next signature is a confirmation, not another password.
+export const UNLOCK_MS = 15 * 60_000;
 
 /**
  * Only this machine's own pages may call the local node: reject other Host
@@ -26,7 +29,18 @@ export function localRequestAllowed(req, port) {
 export function consoleRoutes({ consumer, dataDir }) {
   const network = consumer.network;
   const owner = () => ownerAddress(undefined, dataDir);
-  const withWallet = (body) => unlockWallet(dataDir, body.password);
+  let unlocked = null; // { key, until }
+  const isUnlocked = () => Boolean(unlocked && Date.now() < unlocked.until);
+  const withWallet = (body) => {
+    if (body.password) {
+      unlocked = { key: unlockWallet(dataDir, body.password), until: Date.now() + UNLOCK_MS };
+    } else if (!isUnlocked()) {
+      unlocked = null;
+      throw Object.assign(new Error("wallet is locked"), { status: 401, code: "locked" });
+    }
+    unlocked.until = Date.now() + UNLOCK_MS; // each signature keeps it open a little longer
+    return unlocked.key;
+  };
   const units = (value, name) => {
     if (!/^[0-9]+$/.test(String(value ?? ""))) throw Object.assign(new Error(`${name} must be a whole number of base units`), { status: 400 });
     return BigInt(value);
@@ -37,7 +51,7 @@ export function consoleRoutes({ consumer, dataDir }) {
       const address = owner();
       return {
         network: { id: network.network_id, chain_id: network.chain_id, settlement: network.settlement, faucet: Boolean(network.faucet_url) },
-        payment_key: consumer.key, max_fee: String(consumer.maxFee),
+        payment_key: consumer.key, max_fee: String(consumer.maxFee), unlocked_until: isUnlocked() ? unlocked.until : null,
         wallet: address ? await walletStatus(network, address, consumer.key) : null,
       };
     },
@@ -71,6 +85,8 @@ export function consoleRoutes({ consumer, dataDir }) {
       return { claimed: await claimRewards(network, ownerPrivate, addressOf(ownerPrivate)) };
     },
     "POST /api/wallet": async (body) => ({ owner: walletAddress(await createWallet(dataDir, body.password)) }),
+    "POST /api/unlock": async (body) => { withWallet({ password: body.password }); return { unlocked_until: unlocked.until }; },
+    "POST /api/lock": async () => { unlocked = null; return { locked: true }; },
     "POST /api/faucet": async () => {
       const address = owner();
       if (!address) throw Object.assign(new Error("create the wallet first"), { status: 400 });

package/src/consumer.mjs

@@ -14,8 +14,8 @@ import { consoleRoutes, localRequestAllowed } from "./console.mjs";
 import { pinnedOptions, splitPin } from "./tlspin.mjs";
 import { compareRank, rankKey, reputation } from "./reputation.mjs";
 import { hashApiKey } from "./tenants.mjs";
-import { anthropicError, anthropicStream, fromAnthropic, fromGemini, geminiError, geminiRoute, geminiStream,
-  toAnthropic, toGemini } from "./dialects.mjs";
+import { anthropicError, anthropicStream, countAnthropicTokens, countGeminiTokens, fromAnthropic, fromGemini, fromResponses,
+  geminiError, geminiRoute, geminiStream, responsesUsesTools, toAnthropic, toGemini, toResponses } from "./dialects.mjs";
 
 // Discovery is served from cache and refreshed in the background once it is older than its fresh period; only
 // data older than its usable period (or none yet) makes a request wait for it.
@@ -412,7 +412,7 @@ export class Consumer {
       for (let index = 0; index < candidates.length; index += 1) {
         const descriptor = candidates[index];
         // Authorize what this request can really cost, not the Consumer's whole per-request cap.
-        const plan = planRequest(descriptor, endpoint, content, maxOutputTokens, this.maxFee);
+        const plan = planRequest(descriptor, endpoint, content, maxOutputTokens, this.maxFee, options.tools);
         const maxFee = Math.min(Number(this.maxFee), Math.max(raisedFee || 0, plan.maxFee));
         const prepared = prepareRequest({
           descriptor, deployment: this.deployment, keyPrivate: this.keyPrivate, relaySigner: relay.signer,
@@ -501,14 +501,17 @@ async function readJson(req) {
 async function dialectRequest(req, res, active, path, setWriter) {
   const body = await readJson(req);
   const gemini = geminiRoute(path);
+  // Token counting (Claude Code and the Gemini CLI ask before long requests): an estimate, no request is sent.
+  const json = (value) => { res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" }); return res.end(JSON.stringify(value)); };
+  if (path === "/v1/messages/count_tokens") return json(countAnthropicTokens(body));
+  if (gemini?.count) return json(countGeminiTokens(body, gemini.model));
   const ask = gemini ? fromGemini(body, gemini.model) : fromAnthropic(body);
   const stream = gemini ? gemini.stream : ask.stream;
   const request = { endpoint: "chat", model: ask.model, content: ask.messages, maxOutputTokens: ask.maxOutputTokens, options: ask.options,
     session: ask.session || req.headers["x-claude-code-session-id"] || req.headers["session_id"] || req.headers["x-session-id"] || undefined };
   if (!stream) {
     const { response, receipt } = await active.request(request);
-    const answer = outputText(response.output);
-    const out = gemini ? toGemini(ask.model, answer, receipt.receipt) : toAnthropic(ask.model, answer, receipt.receipt);
+    const out = gemini ? toGemini(ask.model, response.output, receipt.receipt) : toAnthropic(ask.model, response.output, receipt.receipt);
     res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
     return res.end(JSON.stringify(out));
   }
@@ -520,7 +523,32 @@ async function dialectRequest(req, res, active, path, setWriter) {
   setWriter(writer);
   let streamedAny = false;
   const { response, receipt } = await active.request({ ...request, onDelta: (piece) => { streamedAny ||= Boolean(piece); writer.delta(piece); } });
-  writer.finish(outputText(response.output), receipt.receipt, streamedAny);
+  writer.finish(response.output, receipt.receipt, streamedAny);
+  return res.end();
+}
+
+/**
+ * Responses with tools (Codex CLI and other agents): translated to the network's chat shape and back, so the
+ * Provider sees one way of calling tools; the client gets function_call / custom_tool_call items to run.
+ */
+async function responsesWithTools(res, active, body, session, setWriter) {
+  const { model, stream } = body;
+  const { messages, options, custom } = fromResponses(body);
+  const maxOutputTokens = body.max_output_tokens ?? 4096;
+  const request = { endpoint: "chat", model, content: messages, maxOutputTokens, options, session };
+  if (!stream) {
+    const { response, receipt } = await active.request(request);
+    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+    return res.end(JSON.stringify(toResponses(model, response.output, receipt.receipt, custom)));
+  }
+  const write = (text) => {
+    if (!res.headersSent) res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-store", connection: "keep-alive" });
+    res.write(text);
+  };
+  const writer = responseStream(write, { model });
+  setWriter(writer);
+  const { response, receipt } = await active.request({ ...request, onDelta: (text) => writer.delta(text) });
+  writer.finish(toResponses(model, response.output, receipt.receipt, custom));
   return res.end();
 }
 
@@ -540,7 +568,7 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
     };
     try {
       const path = new URL(req.url, "http://localhost").pathname.replace(/^\/v1\/v1\//, "/v1/");
-      dialect = path === "/v1/messages" ? "anthropic" : geminiRoute(path) ? "gemini" : "openai";
+      dialect = path === "/v1/messages" || path === "/v1/messages/count_tokens" ? "anthropic" : geminiRoute(path) ? "gemini" : "openai";
       // A tenant's API key selects its own payment key and budget; tenants may call from anywhere.
       const tenant = /^\/v1(beta|alpha)?\//.test(path) && bearer(req) ? tenants()[hashApiKey(bearer(req))] : undefined;
       if (!tenant && !localRequestAllowed(req, server.address().port)) {
@@ -570,6 +598,8 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
       }
       const body = await readJson(req);
       const chat = path.endsWith("/chat/completions");
+      const session = req.headers["session_id"] || req.headers["x-session-id"] || undefined;
+      if (!chat && responsesUsesTools(body)) return await responsesWithTools(res, active, body, body.prompt_cache_key || session, (w) => { writer = w; });
       const { model, stream, stream_options: streamOptions, ...rest } = body;
       const content = chat ? rest.messages : rest.input;
       delete rest.messages;
@@ -578,7 +608,6 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
       delete rest.max_output_tokens;
       delete rest.max_tokens;
       delete rest.max_completion_tokens;
-      const session = req.headers["session_id"] || req.headers["x-session-id"] || undefined;
       if (!stream) {
         const { response } = await active.request({ endpoint: chat ? "chat" : "responses", model, content, maxOutputTokens, options: rest, session });
         return send(200, response.output);
@@ -597,7 +626,7 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
       if (res.headersSent) { writer?.fail(error.message); return res.end(); }
       if (error.message === "wrong wallet password") return send(401, { error: error.message });
       if (error.status && error.status < 500 && !error.dispatched && routes[`${req.method} ${new URL(req.url, "http://x").pathname}`]) {
-        return send(error.status, { error: error.message });
+        return send(error.status, { error: error.message, ...(error.code ? { code: error.code } : {}) });
       }
       const status = error.code === "outcome_unknown" ? 504 : (error.status && error.status < 500 ? error.status : 502);
       if (dialect === "anthropic") return send(status, anthropicError(error.message, status));

package/src/dialects.mjs

@@ -1,6 +1,7 @@
-// Client dialects for the local endpoint: Anthropic Messages and Gemini generateContent, translated to and
-// from the network's chat requests (OpenAI shape), streaming included. Token counts come from the
-// Provider-signed receipt, so every client sees what it was charged for.
+// Client dialects for the local endpoint: Anthropic Messages, Gemini generateContent and OpenAI Responses with
+// tools, translated to and from the network's one shape (OpenAI Chat Completions: tools, assistant tool_calls,
+// role "tool" results), streaming included. The Consumer's own client runs the tools; the network only carries
+// the calls and their results. Token counts come from the Provider-signed receipt.
 import { randomUUID } from "node:crypto";
 
 const id = (prefix) => `${prefix}${randomUUID().replace(/-/g, "")}`;
@@ -9,109 +10,294 @@ export class DialectError extends Error {
   constructor(message, status = 400) { super(message); this.status = status; }
 }
 
-/** Text of Anthropic or Gemini content: a string or text blocks/parts. Other block kinds are refused. */
+/** Text of Anthropic or Gemini content: a string or text blocks/parts; images and documents become a note. */
 function text(content, where) {
   if (typeof content === "string") return content;
+  if (content === undefined || content === null) return "";
   if (!Array.isArray(content)) throw new DialectError(`${where}: content must be text`);
   return content.map((part) => {
     if (typeof part === "string") return part;
     if (part && typeof part.text === "string" && (part.type === undefined || part.type === "text")) return part.text;
     if (part?.type === "thinking" || part?.type === "redacted_thinking" || part?.thought) return "";
-    throw new DialectError(`${where}: only text content is supported (got ${part?.type || Object.keys(part || {})[0] || "unknown"})`);
+    if (part?.type === "image" || part?.inlineData || part?.type === "input_image") return "[image omitted: this network carries text only]";
+    if (part?.type === "document") return part.source?.type === "text" ? String(part.source.data ?? "") : "[document omitted]";
+    if (part?.type === "input_text" || part?.type === "output_text") return String(part.text ?? "");
+    throw new DialectError(`${where}: unsupported content (${part?.type || Object.keys(part || {})[0] || "unknown"})`);
   }).join("");
 }
 
-const unsupportedTools = (present) => {
-  if (present) throw new DialectError("tool use is not supported on this network yet; send text-only requests");
+const parseArguments = (value) => {
+  if (value && typeof value === "object") return value;
+  try { return JSON.parse(value || "{}"); } catch { return { input: String(value) }; }
 };
 
+/** The answer and tool calls of a network response (a chat completion). */
+export function answerOf(output) {
+  const choice = output?.choices?.[0] || {};
+  const message = choice.message || {};
+  return { text: typeof message.content === "string" ? message.content : "", calls: Array.isArray(message.tool_calls) ? message.tool_calls : [],
+    finish: choice.finish_reason || "stop" };
+}
+
 // ---------------- Anthropic Messages ----------------
 
-/** POST /v1/messages body -> { model, messages, maxOutputTokens, options, stream } */
+/** POST /v1/messages body -> { model, messages, maxOutputTokens, options, stream, session } */
 export function fromAnthropic(body) {
   if (typeof body.model !== "string" || !Array.isArray(body.messages)) throw new DialectError("model and messages are required");
-  unsupportedTools(body.tools?.length || body.tool_choice);
   const messages = [];
   if (body.system !== undefined) messages.push({ role: "system", content: text(body.system, "system") });
   for (const message of body.messages) {
-    if (!["user", "assistant"].includes(message?.role)) throw new DialectError("messages alternate user and assistant");
-    messages.push({ role: message.role, content: text(message.content, `${message.role} message`) });
+    if (message?.role === "system") { messages.push({ role: "system", content: text(message.content, "system message") }); continue; }
+    if (!["user", "assistant"].includes(message?.role)) throw new DialectError(`unsupported message role ${message?.role}`);
+    const blocks = typeof message.content === "string" ? [{ type: "text", text: message.content }] : message.content || [];
+    if (message.role === "assistant") {
+      const calls = blocks.filter((b) => b?.type === "tool_use").map((b) => ({ id: b.id, type: "function",
+        function: { name: b.name, arguments: JSON.stringify(b.input ?? {}) } }));
+      const words = text(blocks.filter((b) => b?.type !== "tool_use"), "assistant message");
+      messages.push({ role: "assistant", content: words || (calls.length ? null : ""), ...(calls.length ? { tool_calls: calls } : {}) });
+      continue;
+    }
+    // A user turn: tool results answer the previous assistant's calls; the rest is what the user said.
+    for (const block of blocks.filter((b) => b?.type === "tool_result")) {
+      const result = text(block.content ?? "", "tool_result");
+      messages.push({ role: "tool", tool_call_id: block.tool_use_id, content: block.is_error ? `Error: ${result}` : result });
+    }
+    const rest = blocks.filter((b) => b?.type !== "tool_result");
+    if (rest.length || !blocks.length) messages.push({ role: "user", content: text(rest, "user message") });
   }
   const options = {};
   for (const key of ["temperature", "top_p"]) if (body[key] !== undefined) options[key] = body[key];
   if (body.stop_sequences) options.stop = body.stop_sequences;
-  // Claude Code puts its session in metadata.user_id: a conversation's turns share it.
-  const session = typeof body.metadata?.user_id === "string" ? body.metadata.user_id : undefined;
+  // The effort the user chose in the client (Claude Code: output_config.effort) is the model's reasoning effort.
+  const effort = body.output_config?.effort;
+  if (["minimal", "low", "medium", "high"].includes(effort)) options.reasoning_effort = effort;
+  const tools = (body.tools || []).filter((t) => t?.name && (t.type === undefined || t.type === "custom" || t.input_schema));
+  if (tools.length) {
+    options.tools = tools.map((t) => ({ type: "function", function: { name: t.name, description: t.description || "",
+      parameters: t.input_schema || { type: "object", properties: {} } } }));
+    const choice = body.tool_choice;
+    if (choice?.type === "any") options.tool_choice = "required";
+    else if (choice?.type === "tool" && choice.name) options.tool_choice = { type: "function", function: { name: choice.name } };
+    else if (choice?.type === "none") options.tool_choice = "none";
+  }
+  // Claude Code puts its session in metadata.user_id (a JSON string with session_id): a conversation's turns share it.
+  let session = typeof body.metadata?.user_id === "string" ? body.metadata.user_id : undefined;
+  try { session = JSON.parse(session).session_id || session; } catch {}
   return { model: body.model, messages, maxOutputTokens: body.max_tokens ?? 4096, options, stream: body.stream === true, session };
 }
 
-export function toAnthropic(model, answer, receipt) {
+const anthropicStop = (answer) => answer.calls.length ? "tool_use" : answer.finish === "length" ? "max_tokens" : "end_turn";
+
+export function toAnthropic(model, output, receipt) {
+  const answer = answerOf(output);
+  const content = answer.text ? [{ type: "text", text: answer.text }] : [];
+  for (const call of answer.calls) content.push({ type: "tool_use", id: call.id, name: call.function?.name, input: parseArguments(call.function?.arguments) });
   return {
-    id: id("msg_"), type: "message", role: "assistant", model,
-    content: [{ type: "text", text: answer }], stop_reason: "end_turn", stop_sequence: null,
+    id: id("msg_"), type: "message", role: "assistant", model, content: content.length ? content : [{ type: "text", text: "" }],
+    stop_reason: anthropicStop(answer), stop_sequence: null,
     usage: { input_tokens: Number(receipt.input_tokens), output_tokens: Number(receipt.output_tokens) },
   };
 }
 
-/** Anthropic's SSE event sequence, fed with text as it arrives. */
+/** Anthropic's SSE event sequence: text as it arrives, then tool_use blocks when the verified answer is in. */
 export function anthropicStream(write, model) {
   const event = (type, data) => write(`event: ${type}\ndata: ${JSON.stringify({ type, ...data })}\n\n`);
   let started = false;
+  let textOpen = false;
+  let index = 0;
   const start = () => {
     if (started) return;
     started = true;
     event("message_start", { message: { id: id("msg_"), type: "message", role: "assistant", model, content: [],
       stop_reason: null, stop_sequence: null, usage: { input_tokens: 0, output_tokens: 0 } } });
-    event("content_block_start", { index: 0, content_block: { type: "text", text: "" } });
+  };
+  const openText = () => {
+    if (textOpen) return;
+    textOpen = true;
+    event("content_block_start", { index, content_block: { type: "text", text: "" } });
   };
   return {
-    delta(piece) { start(); if (piece) event("content_block_delta", { index: 0, delta: { type: "text_delta", text: piece } }); },
-    finish(answer, receipt, streamedAny) {
+    delta(piece) {
+      start();
+      if (!piece) return;
+      openText();
+      event("content_block_delta", { index, delta: { type: "text_delta", text: piece } });
+    },
+    finish(output, receipt, streamedAny) {
       start();
-      if (!streamedAny && answer) event("content_block_delta", { index: 0, delta: { type: "text_delta", text: answer } });
-      event("content_block_stop", { index: 0 });
-      event("message_delta", { delta: { stop_reason: "end_turn", stop_sequence: null },
+      const answer = answerOf(output);
+      if (!streamedAny && answer.text) { openText(); event("content_block_delta", { index, delta: { type: "text_delta", text: answer.text } }); }
+      if (!textOpen && !answer.calls.length) openText();
+      if (textOpen) { event("content_block_stop", { index }); index += 1; }
+      for (const call of answer.calls) {
+        event("content_block_start", { index, content_block: { type: "tool_use", id: call.id, name: call.function?.name, input: {} } });
+        event("content_block_delta", { index, delta: { type: "input_json_delta", partial_json: JSON.stringify(parseArguments(call.function?.arguments)) } });
+        event("content_block_stop", { index });
+        index += 1;
+      }
+      event("message_delta", { delta: { stop_reason: anthropicStop(answer), stop_sequence: null },
         usage: { input_tokens: Number(receipt.input_tokens), output_tokens: Number(receipt.output_tokens) } });
       event("message_stop", {});
     },
-    fail(message) { event("error", { error: { type: "api_error", message } }); },
+    fail(message) { start(); event("error", { error: { type: "api_error", message } }); },
   };
 }
 
+/** /v1/messages/count_tokens: an upper-bound estimate (UTF-8 bytes / 3, as prices are authorized). */
+export function countAnthropicTokens(body) {
+  const ask = fromAnthropic({ max_tokens: 1, ...body });
+  const bytes = Buffer.byteLength(JSON.stringify(ask.messages), "utf8") + Buffer.byteLength(JSON.stringify(ask.options.tools || []), "utf8");
+  return { input_tokens: Math.ceil(bytes / 3) };
+}
+
 export const anthropicError = (message, status) => ({ type: "error", error: {
   type: status === 401 || status === 403 ? "authentication_error" : status === 404 ? "not_found_error"
     : status === 402 ? "billing_error" : status >= 500 ? "api_error" : "invalid_request_error", message } });
 
+// ---------------- OpenAI Responses (with tools) ----------------
+
+/** Whether a Responses request needs the tool translation (tools, or tool calls and results in its input). */
+export function responsesUsesTools(body) {
+  return (Array.isArray(body.tools) && body.tools.length > 0)
+    || (Array.isArray(body.input) && body.input.some((item) => /^(function_call|custom_tool_call)/.test(item?.type || "")));
+}
+
+/** POST /v1/responses body with tools -> { messages, options, custom } (custom: names of freeform tools). */
+export function fromResponses(body) {
+  const messages = [];
+  if (body.instructions) messages.push({ role: "system", content: String(body.instructions) });
+  const custom = new Set();
+  const tools = [];
+  for (const tool of body.tools || []) {
+    if (tool?.type === "function" && tool.name) {
+      tools.push({ type: "function", function: { name: tool.name, description: tool.description || "", parameters: tool.parameters || { type: "object", properties: {} } } });
+    } else if (tool?.type === "custom" && tool.name) {
+      // A freeform tool (Codex's apply_patch): one string argument carries its whole input.
+      custom.add(tool.name);
+      tools.push({ type: "function", function: { name: tool.name, description: `${tool.description || ""}\nPut the tool's complete raw input in the "input" string.`,
+        parameters: { type: "object", properties: { input: { type: "string" } }, required: ["input"] } } });
+    } // hosted tools (web search, file search, ...) cannot run on this network: they are left out
+  }
+  const input = typeof body.input === "string" ? [{ role: "user", content: body.input }] : body.input || [];
+  const assistant = () => {
+    const last = messages.at(-1);
+    if (last?.role === "assistant") return last;
+    const fresh = { role: "assistant", content: null, tool_calls: [] };
+    messages.push(fresh);
+    return fresh;
+  };
+  for (const item of input) {
+    const type = item?.type || (item?.role ? "message" : "");
+    if (type === "message") {
+      const role = item.role === "developer" ? "system" : item.role;
+      const words = text(item.content, `${role} message`);
+      if (role === "assistant") { const a = assistant(); a.content = (a.content || "") + words; }
+      else messages.push({ role, content: words });
+    } else if (type === "function_call" || type === "custom_tool_call") {
+      const a = assistant();
+      (a.tool_calls ||= []).push({ id: item.call_id, type: "function", function: { name: item.name,
+        arguments: type === "custom_tool_call" ? JSON.stringify({ input: item.input ?? "" }) : (item.arguments ?? "{}") } });
+    } else if (type === "function_call_output" || type === "custom_tool_call_output") {
+      const output = typeof item.output === "string" ? item.output : text(item.output, "tool output");
+      messages.push({ role: "tool", tool_call_id: item.call_id, content: output });
+    } // reasoning items and the like stay with the client
+  }
+  for (const message of messages) if (message.role === "assistant" && !message.tool_calls?.length) delete message.tool_calls;
+  const options = {};
+  for (const key of ["temperature", "top_p", "reasoning", "parallel_tool_calls"]) if (body[key] !== undefined) options[key] = body[key];
+  if (tools.length) options.tools = tools;
+  const choice = body.tool_choice;
+  if (choice === "none" || choice === "required" || choice === "auto") options.tool_choice = choice;
+  else if (choice?.name) options.tool_choice = { type: "function", function: { name: choice.name } };
+  return { messages, options, custom };
+}
+
+/** A network answer (chat completion) as a Responses object, freeform tools as custom_tool_call items. */
+export function toResponses(model, output, receipt, custom = new Set()) {
+  const answer = answerOf(output);
+  const items = [];
+  if (answer.text || !answer.calls.length) {
+    items.push({ type: "message", id: id("msg_"), role: "assistant", status: "completed",
+      content: [{ type: "output_text", text: answer.text, annotations: [] }] });
+  }
+  for (const call of answer.calls) {
+    const name = call.function?.name;
+    items.push(custom.has(name)
+      ? { type: "custom_tool_call", id: id("ctc_"), call_id: call.id, name, input: String(parseArguments(call.function?.arguments).input ?? ""), status: "completed" }
+      : { type: "function_call", id: id("fc_"), call_id: call.id, name, arguments: call.function?.arguments || "{}", status: "completed" });
+  }
+  const input = Number(receipt?.input_tokens ?? output?.usage?.prompt_tokens ?? 0);
+  const out = Number(receipt?.output_tokens ?? output?.usage?.completion_tokens ?? 0);
+  return { id: id("resp_"), object: "response", created_at: Math.floor(Date.now() / 1000), model, status: "completed",
+    output: items, output_text: answer.text, usage: { input_tokens: input, output_tokens: out, total_tokens: input + out } };
+}
+
 // ---------------- Gemini generateContent ----------------
 
-const GEMINI_PATH = /^\/(?:v1|v1beta|v1alpha)\/models\/([^/:]+):(generateContent|streamGenerateContent)$/;
+const GEMINI_PATH = /^\/(?:v1|v1beta|v1alpha)\/models\/([^/:]+):(generateContent|streamGenerateContent|countTokens)$/;
 
 /** The model and whether it streams, for a Gemini path; null for any other path. */
 export function geminiRoute(path) {
   const match = GEMINI_PATH.exec(path);
-  return match ? { model: decodeURIComponent(match[1]), stream: match[2] === "streamGenerateContent" } : null;
+  return match ? { model: decodeURIComponent(match[1]), stream: match[2] === "streamGenerateContent", count: match[2] === "countTokens" } : null;
 }
 
 export function fromGemini(body, model) {
   if (!Array.isArray(body.contents)) throw new DialectError("contents are required");
-  unsupportedTools(body.tools?.length);
   const messages = [];
   const system = body.systemInstruction || body.system_instruction;
   if (system) messages.push({ role: "system", content: text(system.parts ?? system, "systemInstruction") });
+  // Gemini answers a call by the function's name; the network by an id. Pair each response with the
+  // earliest unanswered call of that name.
+  const open = [];
+  let counter = 0;
   for (const item of body.contents) {
-    const role = item.role === "model" ? "assistant" : "user";
-    messages.push({ role, content: text(item.parts, `${item.role || "user"} content`) });
+    const parts = item.parts || [];
+    const calls = parts.filter((p) => p.functionCall);
+    const results = parts.filter((p) => p.functionResponse);
+    const words = text(parts.filter((p) => !p.functionCall && !p.functionResponse), `${item.role || "user"} content`);
+    if (item.role === "model") {
+      const toolCalls = calls.map((p) => {
+        const call = { id: p.functionCall.id || `call_${counter++}`, type: "function",
+          function: { name: p.functionCall.name, arguments: JSON.stringify(p.functionCall.args ?? {}) } };
+        open.push(call);
+        return call;
+      });
+      messages.push({ role: "assistant", content: words || (toolCalls.length ? null : ""), ...(toolCalls.length ? { tool_calls: toolCalls } : {}) });
+      continue;
+    }
+    for (const part of results) {
+      const index = open.findIndex((call) => call.function.name === part.functionResponse.name);
+      const call = index >= 0 ? open.splice(index, 1)[0] : null;
+      messages.push({ role: "tool", tool_call_id: part.functionResponse.id || call?.id || `call_${counter++}`,
+        content: JSON.stringify(part.functionResponse.response ?? {}) });
+    }
+    if (words || !results.length) messages.push({ role: "user", content: words });
   }
   const config = body.generationConfig || body.generation_config || {};
   const options = {};
   if (config.temperature !== undefined) options.temperature = config.temperature;
   if (config.topP !== undefined) options.top_p = config.topP;
   if (config.stopSequences) options.stop = config.stopSequences;
+  const declarations = (body.tools || []).flatMap((t) => t.functionDeclarations || t.function_declarations || []);
+  if (declarations.length) {
+    options.tools = declarations.map((d) => ({ type: "function", function: { name: d.name, description: d.description || "",
+      parameters: d.parametersJsonSchema || d.parameters || { type: "object", properties: {} } } }));
+    const mode = body.toolConfig?.functionCallingConfig?.mode;
+    if (mode === "NONE") options.tool_choice = "none";
+    else if (mode === "ANY") options.tool_choice = "required";
+  }
   return { model, messages, maxOutputTokens: config.maxOutputTokens ?? 4096, options };
 }
 
-function geminiChunk(model, piece, receipt) {
-  const chunk = { candidates: [{ content: { role: "model", parts: [{ text: piece }] }, index: 0 }], modelVersion: model };
+function geminiParts(piece, calls = []) {
+  const parts = piece ? [{ text: piece }] : [];
+  for (const call of calls) parts.push({ functionCall: { name: call.function?.name, args: parseArguments(call.function?.arguments) } });
+  return parts.length ? parts : [{ text: "" }];
+}
+
+function geminiChunk(model, parts, receipt) {
+  const chunk = { candidates: [{ content: { role: "model", parts }, index: 0 }], modelVersion: model };
   if (receipt) {
     chunk.candidates[0].finishReason = "STOP";
     const input = Number(receipt.input_tokens); const output = Number(receipt.output_tokens);
@@ -120,14 +306,27 @@ function geminiChunk(model, piece, receipt) {
   return chunk;
 }
 
-export const toGemini = (model, answer, receipt) => geminiChunk(model, answer, receipt);
+export const toGemini = (model, output, receipt) => {
+  const answer = answerOf(output);
+  return geminiChunk(model, geminiParts(answer.text, answer.calls), receipt);
+};
 
-/** streamGenerateContent with alt=sse: one JSON chunk per event; the last carries finishReason and usage. */
+/** countTokens: an upper-bound estimate (UTF-8 bytes / 3, as prices are authorized). */
+export function countGeminiTokens(body, model) {
+  const ask = fromGemini({ contents: [], ...body }, model);
+  const bytes = Buffer.byteLength(JSON.stringify(ask.messages), "utf8") + Buffer.byteLength(JSON.stringify(ask.options.tools || []), "utf8");
+  return { totalTokens: Math.ceil(bytes / 3) };
+}
+
+/** streamGenerateContent with alt=sse: one JSON chunk per event; the last carries calls, finishReason and usage. */
 export function geminiStream(write, model) {
   const chunk = (value) => write(`data: ${JSON.stringify(value)}\n\n`);
   return {
-    delta(piece) { if (piece) chunk(geminiChunk(model, piece)); },
-    finish(answer, receipt, streamedAny) { chunk(geminiChunk(model, streamedAny ? "" : answer, receipt)); },
+    delta(piece) { if (piece) chunk(geminiChunk(model, [{ text: piece }])); },
+    finish(output, receipt, streamedAny) {
+      const answer = answerOf(output);
+      chunk(geminiChunk(model, geminiParts(streamedAny ? "" : answer.text, answer.calls), receipt));
+    },
     fail(message) { chunk({ error: { code: 500, message, status: "INTERNAL" } }); },
   };
 }

package/src/protocol.mjs

@@ -117,8 +117,10 @@ export function openResponse(prepared, result, deployment, now = Math.floor(Date
  * (mycomesh/protocol.py worst_case_tokens): content UTF-8 length / 3, plus the backend's own input, plus
  * the full max_output_tokens.
  */
-export function worstCaseTokens(endpoint, content, maxOutputTokens, inputOverheadTokens = 0) {
-  const bytes = Buffer.byteLength(JSON.stringify(content ?? null), "utf8");
+export function worstCaseTokens(endpoint, content, maxOutputTokens, inputOverheadTokens = 0, tools = null) {
+  // Tool definitions are input too, counted as the Provider counts them (protocol.py).
+  const bytes = Buffer.byteLength(JSON.stringify(content ?? null), "utf8")
+    + (Array.isArray(tools) && tools.length ? Buffer.byteLength(JSON.stringify(tools), "utf8") : 0);
   return [Math.ceil(bytes / 3) + Number(inputOverheadTokens || 0), Number(maxOutputTokens)];
 }
 
@@ -129,12 +131,12 @@ export function worstCaseTokens(endpoint, content, maxOutputTokens, inputOverhea
  * many requests share one deposit and one Provider's daily capacity at once. When even the worst case does
  * not fit the cap, the output is trimmed to what the cap pays for, rather than having the Provider refuse.
  */
-export function planRequest(descriptor, endpoint, content, maxOutputTokens, cap) {
+export function planRequest(descriptor, endpoint, content, maxOutputTokens, cap, tools = null) {
   const prices = descriptor.prices || {};
   const inPrice = Number(prices.input_per_1k || 0);
   const outPrice = Number(prices.output_per_1k || 0);
   const floor = Math.max(Number(prices.minimum_fee || 0), 1);
-  const [input] = worstCaseTokens(endpoint, content, 0, descriptor.input_overhead_tokens);
+  const [input] = worstCaseTokens(endpoint, content, 0, descriptor.input_overhead_tokens, tools);
   const worst = (output) => Math.max(Math.ceil((input * inPrice + output * outPrice) / 1000), floor);
   let output = Number(maxOutputTokens);
   if (worst(output) > Number(cap) && outPrice > 0) {

package/src/sse.mjs

@@ -173,7 +173,11 @@ export function chatStream(write, { model }, { includeUsage = false } = {}) {
       const choice = (payload?.choices || [])[0] || {};
       const text = typeof choice.message?.content === "string" ? choice.message.content : "";
       if (text.startsWith(streamed) && text.length > streamed.length) chunk({ content: text.slice(streamed.length) });
-      chunk({}, choice.finish_reason || "stop");
+      // Tool calls come whole, once the answer is verified.
+      const tools = Array.isArray(choice.message?.tool_calls) ? choice.message.tool_calls : [];
+      tools.forEach((tool, index) => chunk({ tool_calls: [{ index, id: tool.id, type: tool.type || "function",
+        function: { name: tool.function?.name || "", arguments: tool.function?.arguments || "" } }] }));
+      chunk({}, choice.finish_reason || (tools.length ? "tool_calls" : "stop"));
       if (includeUsage && payload?.usage) {
         write(`data: ${JSON.stringify({ id, object: "chat.completion.chunk", created, model, choices: [], usage: payload.usage })}\n\n`);
       }

package/src/web/console.html

@@ -50,6 +50,7 @@
   <span class="badge" id="net">连接中…</span>
   <span class="badge" id="relays">Relay —</span>
   <span class="muted mono" id="paykey" style="margin-left:auto"></span>
+  <button class="ghost" id="lock" style="display:none;padding:4px 10px" title="钱包已解锁：15 分钟内签名不用再输密码">🔓 锁定钱包</button>
 </header>
 <nav>
   <button data-tab="chat" class="active">对话</button>
@@ -142,7 +143,9 @@
 
 <dialog id="dialog"><form method="dialog" id="dialog-form">
   <h3 id="dialog-title" style="margin-top:0"></h3><div id="dialog-body"></div>
-  <label>钱包密码</label><input type="password" id="dialog-pw" required>
+  <div id="dialog-pw-box"><label>钱包密码</label><input type="password" id="dialog-pw" required>
+    <p class="muted" style="margin:6px 0 0">输入一次后，15 分钟内再签名不用重复输入。</p></div>
+  <p class="muted" id="dialog-unlocked" style="display:none">钱包已解锁，确认后用它签名。</p>
   <div class="row" style="justify-content:flex-end"><button class="ghost" value="cancel" formnovalidate>取消</button><button class="primary" value="ok">确认</button></div>
 </form></dialog>
 <div id="toast"></div>
@@ -163,16 +166,41 @@ function toast(text, bad = false) {
 async function api(path, body) {
   const response = await fetch(path, body === undefined ? {} : { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
   const data = await response.json().catch(() => ({}));
-  if (!response.ok) throw new Error(typeof data.error === "string" ? data.error : data.error?.message || `HTTP ${response.status}`);
+  if (!response.ok) {
+    const message = typeof data.error === "string" ? data.error : data.error?.message || `HTTP ${response.status}`;
+    throw Object.assign(new Error(message === "wrong wallet password" ? "钱包密码不对" : message), { code: data.code });
+  }
   return data;
 }
-function ask(title, bodyHtml = "") {
+// Only actions signed by the owner wallet come here. While the wallet is unlocked (15 minutes after the last
+// signature) this is a plain confirmation; otherwise it asks for the password once.
+const unlocked = () => Boolean(status?.unlocked_until && status.unlocked_until > Date.now());
+function ask(title, bodyHtml = "", { password = !unlocked() } = {}) {
   return new Promise((resolve) => {
     $("dialog-title").textContent = title; $("dialog-body").innerHTML = bodyHtml; $("dialog-pw").value = "";
-    $("dialog").onclose = () => resolve($("dialog").returnValue === "ok" ? { password: $("dialog-pw").value, form: $("dialog-body") } : null);
+    $("dialog-pw-box").style.display = password ? "" : "none"; $("dialog-pw").required = password;
+    $("dialog-unlocked").style.display = password ? "none" : "";
+    $("dialog").onclose = () => resolve($("dialog").returnValue === "ok"
+      ? { password: password ? $("dialog-pw").value : undefined, form: $("dialog-body") } : null);
     $("dialog").showModal();
   });
 }
+/** Ask, sign, and when the unlock ran out meanwhile, ask once more with the password. */
+async function signed(button, title, bodyHtml, call) {
+  let answer = await ask(title, bodyHtml); if (!answer) return;
+  await busy(button, async () => {
+    try { await call(answer); } catch (error) {
+      if (error.code !== "locked") throw error;
+      status.unlocked_until = null;
+      answer = await ask(title, bodyHtml, { password: true }); if (!answer) return;
+      await call(answer);
+    }
+    status = { ...status, unlocked_until: Date.now() + 15 * 60_000 }; showLock();
+  });
+}
+function showLock() {
+  $("lock").style.display = unlocked() ? "" : "none";
+}
 async function busy(button, work) {
   button.disabled = true; const label = button.textContent; button.textContent = "处理中…";
   try { await work(); } catch (error) { toast(error.message, true); } finally { button.disabled = false; button.textContent = label; }
@@ -190,7 +218,7 @@ let status = null;
 async function refreshWallet() {
   status = await api("/api/status");
   $("net").textContent = `${status.network.id} · 链 ${status.network.chain_id}`; $("net").className = "badge ok";
-  $("paykey").textContent = `付款 key ${short(status.payment_key)}`;
+  $("paykey").textContent = `付款 key ${short(status.payment_key)}`; showLock();
   $("no-wallet").style.display = status.wallet ? "none" : "block"; $("has-wallet").style.display = status.wallet ? "block" : "none";
   $("faucet-btn").style.display = status.network.faucet ? "" : "none";
   const w = status.wallet; if (!w) return;
@@ -241,60 +269,46 @@ async function refreshTenants() {
       const cell = row.lastElementChild;
       for (const [label, action] of [["调整预算", "budget"], ["撤销", "revoke"]]) {
         const button = document.createElement("button"); button.className = "ghost"; button.textContent = label; button.style.marginRight = "6px";
-        button.onclick = async () => {
-          const answer = await ask(`${label}：${t.name}`, action === "budget" ? `<label>新的总预算（tUSDC）</label><input id="new-budget" value="${fmt(t.budget)}">` : "");
-          if (!answer) return;
-          await busy(button, async () => {
+        button.onclick = () => signed(button, `${label}：${t.name}`,
+          action === "budget" ? `<label>新的总预算（tUSDC）</label><input id="new-budget" value="${fmt(t.budget)}">` : "", async (answer) => {
             await api(`/api/tenants/${action}`, { password: answer.password, name: t.name,
               ...(action === "budget" ? { budget: toUnits(answer.form.querySelector("#new-budget").value) } : {}) });
             toast("已更新"); await refreshTenants();
           });
-        };
         cell.append(button);
       }
     }
     $("tenants").append(row);
   }
 }
-$("t-add").onclick = async () => {
-  const answer = await ask(`添加租户 ${$("t-name").value}`); if (!answer) return;
-  await busy($("t-add"), async () => {
-    const created = await api("/api/tenants", { password: answer.password, name: $("t-name").value.trim(),
-      budget: toUnits($("t-budget").value), max_per_request: toUnits($("t-limit").value) });
-    $("t-created").style.display = "block";
-    $("t-created").textContent = `租户 ${created.name} 的 API key（只显示这一次）：${created.api_key}`;
-    await refreshTenants();
-  });
-};
+$("t-add").onclick = () => signed($("t-add"), `添加租户 ${$("t-name").value}`, "", async (answer) => {
+  const created = await api("/api/tenants", { password: answer.password, name: $("t-name").value.trim(),
+    budget: toUnits($("t-budget").value), max_per_request: toUnits($("t-limit").value) });
+  $("t-created").style.display = "block";
+  $("t-created").textContent = `租户 ${created.name} 的 API key（只显示这一次）：${created.api_key}`;
+  await refreshTenants();
+});
 $("create-wallet").onclick = () => busy($("create-wallet"), async () => {
   if ($("new-pw").value !== $("new-pw2").value) throw new Error("两次输入的密码不一致");
   await api("/api/wallet", { password: $("new-pw").value }); toast("钱包已创建"); await refreshWallet();
 });
+$("lock").onclick = async () => { await api("/api/lock", {}); status.unlocked_until = null; showLock(); toast("钱包已锁定"); };
 $("faucet-btn").onclick = () => busy($("faucet-btn"), async () => { await api("/api/faucet", {}); toast("已领取测试 ETH 和 tUSDC"); await refreshWallet(); });
-$("deposit-btn").onclick = async () => {
-  const answer = await ask(`存入 ${$("dep-amount").value} tUSDC`, `<p class="muted">单次请求上限 ${$("dep-limit").value} tUSDC。需要几笔链上交易，约 1 分钟。</p>`);
-  if (!answer) return;
-  await busy($("deposit-btn"), async () => {
+$("deposit-btn").onclick = () => signed($("deposit-btn"), `存入 ${$("dep-amount").value} tUSDC`,
+  `<p class="muted">单次请求上限 ${$("dep-limit").value} tUSDC。需要几笔链上交易，约 1 分钟。</p>`, async (answer) => {
     await api("/api/setup", { password: answer.password, deposit: toUnits($("dep-amount").value), max_per_request: toUnits($("dep-limit").value) });
     toast("押金已存入"); await refreshWallet();
   });
-};
-$("myco-claim").onclick = async () => {
-  const answer = await ask("领取 MYCO"); if (!answer) return;
-  await busy($("myco-claim"), async () => {
-    const { claimed } = await api("/api/rewards/claim", { password: answer.password });
-    const hours = Object.values(claimed).reduce((a, b) => a + b, 0);
-    toast(hours ? `已领取 ${hours} 个小时的 MYCO` : "暂时没有可领取的 MYCO"); await refreshRewards();
-  });
-};
-$("withdraw-btn").onclick = async () => {
-  const answer = await ask("取回押金"); if (!answer) return;
-  await busy($("withdraw-btn"), async () => {
-    const amount = $("wd-amount").value.trim();
-    const result = await api("/api/withdraw", { password: answer.password, ...(amount ? { amount: toUnits(amount) } : {}) });
-    toast(result.withdrawn ? `已取回 ${fmt(result.withdrawn)} tUSDC` : `已申请取回 ${fmt(result.requested)} tUSDC`); await refreshWallet();
-  });
-};
+$("myco-claim").onclick = () => signed($("myco-claim"), "领取 MYCO", "", async (answer) => {
+  const { claimed } = await api("/api/rewards/claim", { password: answer.password });
+  const hours = Object.values(claimed).reduce((a, b) => a + b, 0);
+  toast(hours ? `已领取 ${hours} 个小时的 MYCO` : "暂时没有可领取的 MYCO"); await refreshRewards();
+});
+$("withdraw-btn").onclick = () => signed($("withdraw-btn"), "取回押金", "", async (answer) => {
+  const amount = $("wd-amount").value.trim();
+  const result = await api("/api/withdraw", { password: answer.password, ...(amount ? { amount: toUnits(amount) } : {}) });
+  toast(result.withdrawn ? `已取回 ${fmt(result.withdrawn)} tUSDC` : `已申请取回 ${fmt(result.requested)} tUSDC`); await refreshWallet();
+});
 
 // ---------------- chat ----------------
 let conversation = [];
@@ -349,15 +363,11 @@ async function refreshHistory() {
     const action = document.createElement("td");
     if (entry.status === "pending" && entry.release_at > now) {
       const button = document.createElement("button"); button.className = "ghost"; button.textContent = "争议";
-      button.onclick = async () => {
-        const answer = await ask("发起争议", `<p class="muted">会公开这次的问题和回答给随机抽选的 Provider-AI 陪审团，并锁定 1 tUSDC 保证金；确认欺诈后退款并返还保证金。</p>
-          <label>说明</label><textarea id="statement" placeholder="例如：回答与问题完全无关"></textarea>`);
-        if (!answer) return;
-        await busy(button, async () => {
+      button.onclick = () => signed(button, "发起争议", `<p class="muted">会公开这次的问题和回答给随机抽选的 Provider-AI 陪审团，并锁定 1 tUSDC 保证金；确认欺诈后退款并返还保证金。</p>
+          <label>说明</label><textarea id="statement" placeholder="例如：回答与问题完全无关"></textarea>`, async (answer) => {
           const result = await api("/api/dispute", { password: answer.password, settlement_key: entry.settlement_key, statement: answer.form.querySelector("#statement").value });
           toast(`争议已提交，${result.relays_accepted.length} 个 Relay 接收了证据`); await refreshHistory();
         });
-      };
       action.append(button);
     }
     row.append(action); $("history").append(row);