feat: agentmask + service discovery infrastructure (#952)

## Summary

- Lands the (current state of) Erik's `rekm/agentmask` branch as base
(agentmask vats, OpenClaw MetaMask vendor plugin, capability schema
discovery) onto `main`
- Adds service-discovery type vocabulary, service matcher, sample
services (Echo, RandomNumber), and a bridge that wires an LLM into the
matcher's ranker
- Adds openclaw service discovery plugin with skill, tools, and
validation plan
- Plus assorted relay/daemon/kernel-cli improvements and fixes

Important caveat: this _requires_ using the updated version of the
MetaMask browser extension (Erik's updates to put the ocap kernel into
it and then some further stuff I needed to add on top of that) in the
`chip/agentmask` branch of the `metamask-extension` repo. While the
changes this PR represents are being proposed for merging into our
`main` branch, we don't really have that option for the browser
extension since it's not our repo to mess with. (I suppose we _could_
merge it with some negotiation with the MetaMake team, but since it's
highly experimental I'm pretty sure they wouldn't be too keen on that
idea. I believe Erik's plan was to eventually have it in under a flag,
but I don't thing that's yet an option.)

## Test plan

- [ ] Follow the procedure in
`packages/agentmask/openclaw-plugin-discovery/VALIDATION.md` end-to-end
(matcher daemon and LLM service consumer on VPS, sample services +
MetaMask browser extension (providing MetaMask services) on laptop,
OpenClaw agent driving discovery and contact)
- [ ] Verify (peerId, providerTag) re-registration dedup by reloading
the MetaMask extension and confirming the matcher evicts the prior
provider entry
- [ ] Verify cold-start path: full reset of all parts, then exercise
discovery / find-services / call-service

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Large new surface (remote OCAP URLs, LLM-ranked matcher, wallet
signing) depends on experimental MetaMask extension work and correct
multi-daemon/relay setup; misconfiguration can orphan daemons or expose
broad host API proxy behavior documented as MVP.
> 
> **Overview**
> Introduces **`@ocap/agentmask`** as the home for AgentMask/OpenClaw
integration: long-form docs (capability vendor, two-way kernel comms,
host developer guide), a **MetaMask vendor** plugin (`metamask_*` tools
over `ocap daemon`), and a **service discovery** plugin (`discovery_*` /
`service_*` tools) with session state, shared CLI spawning layer,
skills, and Vitest coverage.
> 
> Extends **`kernel-cli`** for multi-daemon workflows: global
**`--home`**, relay **`--public-ip`** / separate **`~/.libp2p-relay`**
bookkeeping, and stricter daemon startup when another process already
owns the same home or socket.
> 
> Small repo hygiene: **Yarn** `httpProxy`/`httpsProxy` from
`HTTPS_PROXY`, and **Claude** sandbox allowances for Yarn/npm and local
Unix sockets.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
b609e24. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

.claude/settings.json

@@ -13,5 +13,14 @@
   },
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true
+  },
+  "sandbox": {
+    "filesystem": {
+      "allowWrite": ["~/.yarn"]
+    },
+    "network": {
+      "allowedDomains": ["registry.yarnpkg.com", "registry.npmjs.org"],
+      "allowUnixSockets": ["/tmp/claude-*/tsx-*/*.pipe"]
+    }
   }
 }

.yarnrc.yml

@@ -6,6 +6,14 @@ enableScripts: false
 
 enableTelemetry: false
 
+# Route yarn's HTTP traffic through the shell's proxy when set.
+# The Claude Code sandbox sets HTTPS_PROXY to its local MITM proxy; yarn
+# doesn't pick up HTTPS_PROXY automatically, so surface it here.
+# Outside a sandbox, HTTPS_PROXY is typically unset and the `:-` default
+# resolves to an empty string, which yarn treats as "no proxy".
+httpProxy: '${HTTPS_PROXY:-}'
+httpsProxy: '${HTTPS_PROXY:-}'
+
 logFilters:
   - code: YN0004
     level: discard

packages/agentmask/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+[Unreleased]: https://github.com/MetaMask/ocap-kernel/

packages/agentmask/README.md

@@ -0,0 +1,9 @@
+# `@ocap/agentmask`
+
+OpenClaw plugin for requesting and using MetaMask wallet capabilities via the OCAP kernel daemon.
+
+The primary artifact is the OpenClaw plugin in [`openclaw-plugin-metamask/`](./openclaw-plugin-metamask/). See its [README](./openclaw-plugin-metamask/README.md) for setup and usage instructions.
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).