v0.8.0 — Agent nickname session scoping

What's new

Agent nickname scoping — every CLI command now requires --nick / -n, a 6-character identifier that isolates sessions between concurrent agents. Sessions created by one nick are invisible and inaccessible to others.

Session isolation

• Sessions are stamped with their creator's nick at creation time
• session list, debug.status, debug.last, and debug.log return only data belonging to the requesting nick
• Accessing another agent's session returns SESSION_SCOPE_MISMATCH (retry: never)
• SESSION_NOT_FOUND is now terminal (retry: never) — closed sessions don't come back

Safety guards

Four daemon-enforced mechanisms prevent runaway agents from hammering the browser:

• Minimum interval (900ms default) — requests arriving too fast are rejected with RATE_LIMITED
• Per-nick rate cap (60/min default) — sliding window, rejected with RATE_LIMITED
• Metronome detection — three consecutive equal-interval requests trigger METRONOME_DETECTED (retry: never)
• Error-path delay — jittered 500ms–2s pause before error responses, making loops self-throttling

Configuration

All pacing and safety parameters are now configurable via BPROXY_HOME/config.json. The daemon validates config at startup and fails closed if pacing ranges undercut the safety floor.

Privacy

Raw nicks never appear in logs or API responses. The daemon generates an ownerHash (8 hex chars from sha256 with a per-instance salt) for log correlation. Bootstrap responses (tab.open, session.create) include ownerHash so the agent knows its own identifier.

Extension

Minimal change — stores session field in trace entries for scoped debug.log filtering. Nick is stripped before WS dispatch and rejected if leaked.

---

Install

npm install -g @dimdasci/bproxy

Extension: Download the attached zip, extract, then load unpacked in chrome://extensions (Developer mode).

---

Full design: Phase 8 spec
Decision: ADR-030
Changelog: v0.7.5...v0.8.0