feat: agentmask + service discovery infrastructure

[FUDCo]

Summary

• Lands the (current state of) Erik's rekm/agentmask branch as base (agentmask vats, OpenClaw MetaMask vendor plugin, capability schema discovery) onto main
• Adds service-discovery type vocabulary, service matcher, sample services (Echo, RandomNumber), and a bridge that wires an LLM into the matcher's ranker
• Adds openclaw service discovery plugin with skill, tools, and validation plan
• Plus assorted relay/daemon/kernel-cli improvements and fixes

Important caveat: this requires using the updated version of the MetaMask browser extension (Erik's updates to put the ocap kernel into it and then some further stuff I needed to add on top of that) in the chip/agentmask branch of the metamask-extension repo. While the changes this PR represents are being proposed for merging into our main branch, we don't really have that option for the browser extension since it's not our repo to mess with. (I suppose we could merge it with some negotiation with the MetaMake team, but since it's highly experimental I'm pretty sure they wouldn't be too keen on that idea. I believe Erik's plan was to eventually have it in under a flag, but I don't thing that's yet an option.)

Test plan

• Follow the procedure in packages/agentmask/openclaw-plugin-discovery/VALIDATION.md end-to-end (matcher daemon and LLM service consumer on VPS, sample services + MetaMask browser extension (providing MetaMask services) on laptop, OpenClaw agent driving discovery and contact)
• Verify (peerId, providerTag) re-registration dedup by reloading the MetaMask extension and confirming the matcher evicts the prior provider entry
• Verify cold-start path: full reset of all parts, then exercise discovery / find-services / call-service

---

Note

Medium Risk
Adds new OpenClaw plugins and supporting docs/state management plus changes CLI behavior (--home, relay bookkeeping, daemon socket safety), which could affect developer workflows and runtime connectivity if misconfigured.

Overview
Adds a new packages/agentmask workspace with documentation and tests, including two OpenClaw plugins: @openclaw/metamask (redeem vendor OCAP URL, request capabilities, introspect via __getDescription__, and call capability methods) and @openclaw/discovery (redeem matcher URL, findServices, inspect contact descriptions, initiate contact, and call obtained services) along with a discovery skill and an end-to-end validation walkthrough.

Updates developer tooling/config: Claude sandbox permissions and Yarn proxy settings for sandboxed installs, plus new discovery planning docs.

Improves @metamask/kernel-cli UX and robustness by adding a global --home override for targeting multiple daemons, enhancing relay startup/status with a dedicated relay state directory and optional --public-ip announcement for NATed hosts, and preventing daemon start from clobbering an already-running daemon’s Unix socket.

^{Reviewed by Cursor Bugbot for commit 609b020. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​29.0.2 ⏵ 29.1.1	+1		+1	+1
	@​typescript-eslint/​utils@​8.58.0 ⏵ 8.59.2				+1
	rolldown@​1.0.0-rc.13 ⏵ 1.0.0-rc.17
	@​vitest/​browser@​4.1.3 ⏵ 4.1.5	+1		+1
	vitest@​4.1.3 ⏵ 4.1.5			+1
	@​vitest/​coverage-v8@​4.1.3 ⏵ 4.1.5
	@​metamask/​create-release-branch@​4.1.4 ⏵ 4.2.0	+3		+1	+1
	postcss@​8.5.8 ⏵ 8.5.14	+1	+2
	vite@​8.0.6 ⏵ 8.0.10	+1		+1	+1
	turbo@​2.9.1 ⏵ 2.9.9
	@​vitest/​browser-playwright@​4.1.3 ⏵ 4.1.5
	vite-plugin-static-copy@​4.0.1 ⏵ 4.1.0	+1		+1	-2
	@​metamask/​json-rpc-engine@​10.2.4 ⏵ 10.3.0				+4
	@​vitest/​eslint-plugin@​1.6.14 ⏵ 1.6.16	+1		+1	+1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 100.0% likely to have a medium risk anomaly Notes: No explicit evidence of overt malware (network exfiltration, credential theft, backdoors, or filesystem/process activity) appears in this fragment. However, the module contains high-sensitivity dynamic execution capabilities: napi_run_script performs eval-like execution of a JavaScript string obtained from WebAssembly, and emnapiCreateFunction can use the Function constructor for wrapper generation. Combined with wasm-driven indirect callback dispatch and reflective object mutation, this runtime is security-sensitive and should only be used with fully trusted WebAssembly and tightly controlled inputs. Confidence: 1.00 Severity: 0.60 From: ? → npm/rolldown@1.0.0-rc.17 → npm/eslint-plugin-import-x@4.10.6 → npm/eslint-import-resolver-typescript@4.3.4 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 100.0% likely to have a medium risk anomaly Notes: Primary concern is direct dynamic code execution. napi_run_script uses eval() on a string originating from wasm-provided input, and ee uses new Function(...) to construct wrapper functions. If the wasm module or its inputs are attacker-controlled, this provides JavaScript code execution in the host context. Aside from these dynamic execution sinks, the remaining code mainly performs wasm memory/table management and worker async orchestration typical of such runtimes, with no clear hardcoded exfiltration or backdoor behavior in this fragment. Confidence: 1.00 Severity: 0.60 From: ? → npm/rolldown@1.0.0-rc.17 → npm/eslint-plugin-import-x@4.10.6 → npm/eslint-import-resolver-typescript@4.3.4 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 100.0% likely to have a medium risk anomaly Notes: This module appears to be a legitimate wasm-to-JS/Node-API bridge/runtime, but it contains high-impact dynamic execution capabilities: napi_run_script uses eval() on a string originating from the WASM/handle side, and the binding layer can generate functions via new Function(). It also performs indirect host callback invocation based on runtime handles selected by worker/work-queue control. No explicit exfiltration/backdoor behavior is visible in the provided fragment, so malware likelihood is low, but security risk is moderate-to-high due to host-context code execution if the WASM module or its inputs are not fully trusted. Confidence: 1.00 Severity: 0.60 From: ? → npm/rolldown@1.0.0-rc.17 → npm/eslint-plugin-import-x@4.10.6 → npm/eslint-import-resolver-typescript@4.3.4 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @rolldown/binding-wasm32-wasi is 100.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 1.00 Severity: 0.60 From: ? → npm/rolldown@1.0.0-rc.17 → npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.17 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @rolldown/binding-wasm32-wasi is 100.0% likely to have a medium risk anomaly Notes: A JS loader bootstraps a WASI-enabled WebAssembly module and forwards the full host process.env into the WASI environment and worker contexts while preopening the host filesystem root. This design enables an untrusted or tampered WASM binary to read environment variables and access numerous files, potentially exfiltrating data through any available host or network channel. Treat the module as high-risk unless the WASM artifact is from a trusted source; mitigate by restricting preopens to specific directories, avoiding full process.env exposure, and validating the integrity of the WASM binary. Confidence: 1.00 Severity: 0.60 From: ? → npm/rolldown@1.0.0-rc.17 → npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.17 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm rolldown is 100.0% likely to have a medium risk anomaly Notes: No direct signs of classic malware behavior (e.g., exfiltration/persistence/backdoors) are visible in this JS wrapper. However, it has meaningful security/supply-chain risk characteristics: it can load and execute native code from an environment-controlled path (NAPI_RS_NATIVE_LIBRARY_PATH), and in WebContainer it may execute pnpm to install a binding at runtime before requiring it. The actual maliciousness probability is therefore low-to-moderate for this wrapper, but the execution impact is high if the environment or package supply chain is compromised. Confidence: 1.00 Severity: 0.60 From: packages/kernel-utils/package.json → npm/rolldown@1.0.0-rc.17 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.0.0-rc.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm undici is 100.0% likely to have a medium risk anomaly Notes: The code performs an in-place re-encoding of a local file (undici-fetch.js) and overwrites it with latin1-encoded data. There is no evidence of exfiltration, backdoors, or network activity. However, the lack of validation, error handling, and the fact that it can corrupt or permanently alter a source file constitutes a nontrivial risk. In a supply-chain or extension context, such a script could be misused to tamper with code. It is not inherently malicious by itself but is risky and should be restricted or audited before typical usage in a build or runtime environment. Confidence: 1.00 Severity: 0.60 From: ? → npm/jsdom@29.1.1 → npm/undici@7.25.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	70.6% ⬇️ -0.82%	8525 / 12075
🔵	Statements	70.41% ⬇️ -0.84%	8664 / 12305
🔵	Functions	71.58% ⬇️ -0.67%	2051 / 2865
🔵	Branches	64.18% ⬇️ -0.89%	3443 / 5364

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/agentmask/src/index.ts	100%	100%	100%	100%
packages/kernel-cli/src/app.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	36-465
packages/kernel-cli/src/commands/daemon-entry.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	13-141
packages/kernel-cli/src/commands/daemon-spawn.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	10-84
packages/kernel-cli/src/commands/relay.ts	90.12% ⬆️ +3.68%	98.03% ⬆️ +1.37%	63.63% ⬆️ +16.97%	93.5% ⬆️ +2.43%	139, 145-151, 202, 209
packages/kernel-node-runtime/src/daemon/rpc-socket-server.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	43-270
packages/kernel-utils/src/libp2p-relay.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	19-220
packages/kernel-utils/src/nodejs/index.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/kernel-utils/src/nodejs/libp2p-relay-home.ts	100%	100%	100%	100%
packages/llm-bridge/src/conversation.ts	96.66%	78.57%	100%	96.66%	142
packages/llm-bridge/src/index.ts	0%	0%	0%	0%	36-85
packages/llm-bridge/src/openclaw-client.ts	94.44%	100%	75%	100%	76
packages/llm-bridge/src/protocol.ts	0%	100%	100%	0%	26-86
packages/llm-bridge/src/run-bridge.ts	0%	0%	0%	0%	53-184
packages/ocap-kernel/src/index.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/ocap-kernel/src/remotes/kernel/OcapURLManager.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/ocap-kernel/src/vats/VatManager.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/sample-services/src/cluster-config.ts	100%	100%	100%	100%
packages/sample-services/src/index.ts	100%	100%	100%	100%
packages/sample-services/src/echo-service/index.ts	0%	0%	0%	0%	18-76
packages/sample-services/src/echo-service/service.ts	0%	0%	0%	0%	4-24
packages/sample-services/src/random-number-service/index.ts	0%	0%	0%	0%	21-79
packages/sample-services/src/random-number-service/service.ts	0%	0%	0%	0%	4-56
packages/sample-services/src/vat-lib/contact-endpoint.ts	0%	0%	0%	0%	60-101
packages/sample-services/src/vat-lib/describe.ts	0%	100%	0%	0%	21-25
packages/sample-services/src/vat-lib/index.ts	100%	100%	100%	100%
packages/sample-services/src/vat-lib/matcher-registration.ts	0%	0%	0%	0%	39-70
packages/sample-services/src/vat-lib/registration-token.ts	0%	0%	0%	0%	24-37
packages/service-discovery-types/src/contact.ts	100%	100%	100%	100%
packages/service-discovery-types/src/index.ts	100%	100%	100%	100%
packages/service-discovery-types/src/matcher.ts	100%	100%	100%	100%
packages/service-discovery-types/src/method-schema-convert.ts	94.11%	86.36%	100%	94.11%	54-55
packages/service-discovery-types/src/service-description.ts	100%	100%	100%	100%
packages/service-matcher/src/cluster-config.ts	100%	100%	100%	100%
packages/service-matcher/src/index.ts	100%	100%	100%	100%
packages/service-matcher/src/matcher-vat/index.ts	87.83%	67.24%	90.62%	88.96%	125-127, 151, 182-184, 238-246, 275, 282, 307, 312-314, 344-346, 365-367, 385, 407, 591, 601, 624-626

Generated in workflow #4417 for commit 609b020 by the Vitest Coverage Report Action

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bd1868d. Configure here.}