v1.21.0 — ERC-4337 Session Keys (on-chain caps, beta)

Added — ERC-4337 session keys: caps designed to be enforced on-chain (beta)

The trust-story endgame. The user's ERC-7579 smart account grants the agent's existing EOA a scoped on-chain session via the audited Smart Sessions module (ChainLight/Ackee/Cantina-reviewed, vendor-neutral across Nexus/Kernel/Safe7579): cumulative per-token spend caps, mandatory expiry, optional usage caps — validated by the EntryPoint on every operation. The intent: even a fully compromised host (policy file rewritten, unrestricted: true) should not be able to exceed what the chain granted. This on-chain layer is BETA: the module addresses are verified deployed on Base Sepolia, and the full grant → over-cap-refusal loop will be published before we claim it unconditionally. Until then, rely on the local policy gate (tested) as your primary fence. Zero new dependencies: deterministic module addresses + viem encoders only.

• 5 new MCP tools (135 → 140):
  • chaingpt_aa_session_build_grant / _build_revoke — UNSIGNED grant/revoke payloads; the account OWNER signs externally (never the agent key); unbounded grants are refused by construction. Revoke = chain-level kill.
  • chaingpt_aa_session_status — authoritative on-chain state: account kind, module installed, permission enabled, granted caps.
  • chaingpt_aa_submit_userop — eth_sendUserOperation, custody-free (refuses empty signatures); completes the owner-signs loop.
  • chaingpt_agent_wallet_4337_sign_and_send — the agent acts through the smart account: local gates first (erc4337 who/where sub-policy + the standard per-tx/velocity checks on the inner call), then the agent signs with its keystore EOA in the Smart Sessions USE envelope, and the CHAIN enforces the granted caps at validation. Bundler-side cap rejections render as the chain-side refusal they are — never retried around.
• erc4337 policy sub-policy — fail-closed, type-strict, OFF even in the balanced default (this surface acts on a third-party account): smart-account allowlist + https-only bundler-host allowlist.
• v1 account support: Biconomy Nexus 1.x (Kernel v3 / Safe7579 follow — the module layer is already shared). PreToolUse guard asks on both new signing/submitting tools.

Verification status (be precise on what's proven)

• Proven + tested: the local policy gate — per-tx caps, rolling-24h velocity caps, allowlists, kill switch, custody-free unsigned-tx flow — across 428 vitest cases incl. adversarial refusals.
• Beta / pending live proof: the ON-CHAIN session-cap layer. Smart Sessions module addresses verified deployed on Base Sepolia via eth_getCode; the encoders/readers are unit-tested; the end-to-end grant → over-cap-refusal loop (TESTING.md recipe) is not yet published. We will not market "the chain refuses it even on a hacked host" as a settled fact until that loop is recorded.

Tests

• Suite 399 → 428 (+19 lib/gate from PR A, +10 tool surface/custody-invariant/offline-refusal incl. zero-network assertions on every pre-RPC gate).