@acnlabs/acn-cli 0.13.2 → 0.14.0

package/README.md

@@ -67,6 +67,46 @@ acn heartbeat
 acn heartbeat --agent-id <id>   # override agent ID
 ```
 
+### `acn listen` (Mode B — no public endpoint)
+
+Hold an outbound WebSocket and receive relayed A2A requests in real time.
+
+**Production (recommended):** built-in A2A receiver + wake your host runtime.
+No local A2A port required.
+
+```bash
+# Register for relay delivery, then:
+acn listen --runtime http \
+  --wake-url http://127.0.0.1:10122/hooks/agent \
+  --wake-header 'Authorization: Bearer …'
+
+acn listen --runtime command --wake-exec '/path/to/wake.sh'
+acn listen --runtime log   # debug: print normalized events to stderr
+```
+
+Semantics: CLI answers `message/send` / `message/stream` with a valid A2A
+`accepted` message **immediately**, then POSTs/execs a normalized event to
+wake the host. Wake failure is logged (`wake_failed`) and does **not** fail
+the A2A reply. Dedupe is on by default (`--no-dedupe` to disable).
+
+**Coverage:** only traffic that arrives over the Mode B relay. Open Task Pool
+rows that were never pushed as A2A still need `acn tasks list` / reconcile.
+
+**Compat (advanced):** tunnel to your own A2A server, or let a subprocess
+print the full JSON-RPC response:
+
+```bash
+acn listen --forward http://127.0.0.1:8080
+acn listen --exec './handle-a2a.sh'   # stdout = full A2A JSON-RPC body
+```
+
+> Do not confuse legacy `--exec` with `--runtime command --wake-exec`.
+> The former must emit a protocol-valid A2A response; the latter only wakes
+> the host after the CLI has already answered A2A.
+
+Keep `acn listen` and `acn heartbeat` in the same lifecycle for idle agents
+(see [listen + heartbeat systemd example](../../docs/runbooks/acn-listen-heartbeat.md)).
+
 ### `acn agents`
 
 Discover agents on ACN.

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@acnlabs/acn-cli",
-      version: "0.13.2",
+      version: "0.14.0",
       description: "Official CLI for ACN (Agent Collaboration Network) \u2014 zero-integration agent access",
       main: "dist/index.js",
       bin: {
@@ -87,7 +87,7 @@ var require_package = __commonJS({
 });
 
 // src/index.ts
-var import_commander16 = require("commander");
+var import_commander18 = require("commander");
 
 // src/output.ts
 var jsonMode = false;
@@ -1375,8 +1375,346 @@ ${formatPolicy(res)}`);
 
 // src/commands/listen.ts
 var import_commander10 = require("commander");
-var import_child_process = require("child_process");
+var import_child_process2 = require("child_process");
 var import_ws = __toESM(require("ws"));
+
+// src/commands/normalize-event.ts
+function asRecord(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function asNonEmptyString(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function parseJsonRpcBody(bodyText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return { ok: false, code: -32700, message: "Parse error" };
+  }
+  const body = asRecord(parsed);
+  if (!body) {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  if (body.jsonrpc !== "2.0" || typeof body.method !== "string") {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  return { ok: true, body };
+}
+function extractTaskId(message) {
+  const metadata = asRecord(message.metadata);
+  if (metadata) {
+    const fromMeta = asNonEmptyString(metadata.task_id) ?? asNonEmptyString(metadata.acn_task_id);
+    if (fromMeta) return fromMeta;
+  }
+  const parts = message.parts;
+  if (!Array.isArray(parts)) return null;
+  for (const part of parts) {
+    const p = asRecord(part);
+    if (!p || p.kind !== "data") continue;
+    const data = asRecord(p.data);
+    if (!data) continue;
+    const fromData = asNonEmptyString(data.task_id) ?? asNonEmptyString(data.acn_task_id);
+    if (fromData) return fromData;
+  }
+  return null;
+}
+function extractMessageId(message, generateId) {
+  return asNonEmptyString(message.messageId) ?? asNonEmptyString(message.message_id) ?? generateId();
+}
+function extractContextId(message) {
+  return asNonEmptyString(message.contextId) ?? asNonEmptyString(message.context_id);
+}
+function extractFromAgent(message) {
+  const metadata = asRecord(message.metadata);
+  if (!metadata) return null;
+  return asNonEmptyString(metadata.from_agent) ?? asNonEmptyString(metadata.fromAgent);
+}
+function normalizeEvent(body, opts = {}) {
+  const generateId = opts.generateId ?? (() => crypto.randomUUID());
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const params = asRecord(body.params);
+  const message = asRecord(params?.message) ?? {};
+  return {
+    event_type: "a2a_message",
+    task_id: extractTaskId(message),
+    message_id: extractMessageId(message, generateId),
+    context_id: extractContextId(message),
+    from_agent: extractFromAgent(message),
+    received_at: now().toISOString(),
+    raw: body
+  };
+}
+function dedupeKey(event) {
+  return event.task_id ?? event.message_id;
+}
+var DedupeStore = class {
+  constructor(ttlSec) {
+    this.ttlSec = ttlSec;
+  }
+  ttlSec;
+  map = /* @__PURE__ */ new Map();
+  /** Returns true if key was already seen within TTL; otherwise marks and returns false. */
+  isDuplicate(key, nowMs = Date.now()) {
+    this.gc(nowMs);
+    const exp = this.map.get(key);
+    if (exp !== void 0 && exp > nowMs) return true;
+    this.map.set(key, nowMs + this.ttlSec * 1e3);
+    return false;
+  }
+  /**
+   * Drop a key so a later retry can wake again.
+   * Used when wake fails after we reserved the slot on accept.
+   */
+  forget(key) {
+    this.map.delete(key);
+  }
+  /** Test helper — current window size after GC. */
+  size(nowMs = Date.now()) {
+    this.gc(nowMs);
+    return this.map.size;
+  }
+  gc(nowMs) {
+    for (const [k, exp] of this.map) {
+      if (exp <= nowMs) this.map.delete(k);
+    }
+  }
+};
+
+// src/commands/local-receiver.ts
+var import_crypto = require("crypto");
+
+// src/commands/runtime-adapter.ts
+var import_child_process = require("child_process");
+var DEFAULT_WAKE_TIMEOUT_MS = 5e3;
+function parseWakeHeaders(raw) {
+  const out = {};
+  for (const item of raw ?? []) {
+    const idx = item.indexOf(":");
+    if (idx <= 0) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    const key = item.slice(0, idx).trim();
+    const value = item.slice(idx + 1).trim();
+    if (!key) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function validateRuntimeOptions(opts) {
+  if (!opts.runtime) return null;
+  if (opts.runtime !== "http" && opts.runtime !== "command" && opts.runtime !== "log") {
+    return `Unknown --runtime "${opts.runtime}". Use: http | command | log`;
+  }
+  if (opts.runtime === "http" && !opts.wakeUrl) {
+    return "--runtime http requires --wake-url <url>";
+  }
+  if (opts.runtime === "command" && !opts.wakeExec) {
+    return "--runtime command requires --wake-exec <cmd>";
+  }
+  return null;
+}
+async function wakeHttp(event, opts, deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(opts.wakeUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...opts.wakeHeaders ?? {}
+      },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+    try {
+      await res.arrayBuffer();
+    } catch {
+    }
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `http_${res.status}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function wakeCommand(event, opts, deps) {
+  const spawnFn = deps.spawnFn ?? import_child_process.spawn;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const body = Buffer.from(JSON.stringify(event), "utf-8");
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawnFn(opts.wakeExec, { shell: true });
+    const errOut = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.stderr?.on("data", (d) => errOut.push(Buffer.from(d)));
+    child.on(
+      "error",
+      (e) => finish({ ok: false, reason: e.message.slice(0, 200) })
+    );
+    child.on("close", (code) => {
+      if (code === 0) finish({ ok: true });
+      else {
+        const detail = Buffer.concat(errOut).toString("utf-8").slice(0, 80);
+        finish({
+          ok: false,
+          reason: detail ? `exit_${code}:${detail}` : `exit_${code}`
+        });
+      }
+    });
+    child.stdin?.end(body);
+  });
+}
+function wakeLog(event, deps) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  logFn(JSON.stringify(event));
+  return { ok: true };
+}
+async function wakeRuntime(event, opts, deps = {}) {
+  switch (opts.runtime) {
+    case "http":
+      return wakeHttp(event, opts, deps);
+    case "command":
+      return wakeCommand(event, opts, deps);
+    case "log":
+      return wakeLog(event, deps);
+    default:
+      return { ok: false, reason: `unknown_runtime` };
+  }
+}
+
+// src/commands/local-receiver.ts
+var HANDLED_METHODS = /* @__PURE__ */ new Set(["message/send", "message/stream"]);
+function jsonRpcResponse(correlationId, jsonrpcId, payload) {
+  return {
+    type: "a2a_response",
+    id: correlationId,
+    status: 200,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: jsonrpcId ?? null,
+      ...payload
+    })
+  };
+}
+function acceptedMessage(correlationId, jsonrpcId, messageId) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    result: {
+      kind: "message",
+      messageId,
+      role: "agent",
+      parts: [{ kind: "text", text: "accepted" }]
+    }
+  });
+}
+function jsonRpcError(correlationId, jsonrpcId, code, message) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    error: { code, message }
+  });
+}
+function processIncomingRequest(correlationId, bodyText, opts, dedupeStore, deps = {}) {
+  const generateId = deps.generateId ?? (() => (0, import_crypto.randomUUID)());
+  const parsed = parseJsonRpcBody(bodyText);
+  if (!parsed.ok) {
+    return {
+      response: jsonRpcError(correlationId, null, parsed.code, parsed.message),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const { body } = parsed;
+  const jsonrpcId = body.id ?? null;
+  const method = body.method;
+  if (!HANDLED_METHODS.has(method)) {
+    return {
+      response: jsonRpcError(
+        correlationId,
+        jsonrpcId,
+        -32601,
+        `Method not found: ${method}`
+      ),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const event = normalizeEvent(body, {
+    generateId,
+    now: deps.now
+  });
+  const replyMessageId = generateId();
+  const response = acceptedMessage(correlationId, jsonrpcId, replyMessageId);
+  if (opts.dedupe) {
+    const key = dedupeKey(event);
+    if (dedupeStore.isDuplicate(key)) {
+      return { response, event, shouldWake: false, dedupeHit: true };
+    }
+  }
+  return { response, event, shouldWake: true, dedupeHit: false };
+}
+function formatWakeFailed(event, reason) {
+  const task = event.task_id ?? "-";
+  return `[acn listen] wake_failed message_id=${event.message_id} task_id=${task} reason=${reason}`;
+}
+function formatDeduped(event) {
+  return `[acn listen] deduped key=${dedupeKey(event)}`;
+}
+function dispatchLocalReceiver(correlationId, bodyText, opts, dedupeStore, send, deps = {}) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  const result = processIncomingRequest(
+    correlationId,
+    bodyText,
+    opts,
+    dedupeStore,
+    deps
+  );
+  send(result.response);
+  if (result.dedupeHit && result.event) {
+    logFn(formatDeduped(result.event));
+    return;
+  }
+  if (!result.shouldWake || !result.event) return;
+  const event = result.event;
+  const key = opts.dedupe ? dedupeKey(event) : null;
+  void wakeRuntime(event, opts, deps).then((wake) => {
+    if (!wake.ok) {
+      if (key) dedupeStore.forget(key);
+      logFn(formatWakeFailed(event, wake.reason));
+    }
+  }).catch((err) => {
+    if (key) dedupeStore.forget(key);
+    const msg = err instanceof Error ? err.message : String(err);
+    logFn(formatWakeFailed(event, msg.slice(0, 200)));
+  });
+}
+
+// src/commands/listen.ts
 var STRIP_HEADERS = /* @__PURE__ */ new Set([
   "host",
   "content-length",
@@ -1408,12 +1746,28 @@ function errorResponse(id, status, detail) {
 async function dispatchA2aRequest(frame, opts, send, deps = {}) {
   const bodyBuf = decodeBody(frame);
   try {
+    if (opts.runtime) {
+      const store = deps.dedupeStore ?? new DedupeStore(opts.runtime.dedupeTtlSec);
+      dispatchLocalReceiver(
+        frame.id,
+        bodyBuf.toString("utf-8"),
+        opts.runtime,
+        store,
+        send,
+        {
+          fetchFn: deps.fetchFn,
+          spawnFn: deps.spawnFn,
+          logFn: deps.logFn
+        }
+      );
+      return;
+    }
     if (opts.forward) {
       await forwardToHttp(frame, bodyBuf, opts.forward, deps.fetchFn ?? fetch, send);
       return;
     }
     if (opts.exec) {
-      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process.spawn));
+      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process2.spawn));
       return;
     }
     send(errorResponse(frame.id, 500, "no handler configured"));
@@ -1518,13 +1872,15 @@ function runListener(cfg) {
   const wsUrl = toWebsocketUrl(cfg.baseUrl, cfg.agentId);
   let backoff = INITIAL_BACKOFF_MS;
   let stopped = false;
+  const dedupeStore = cfg.runtime ? new DedupeStore(cfg.runtime.dedupeTtlSec) : void 0;
   const connect = () => {
     const ws = new import_ws.default(wsUrl, {
       headers: { Authorization: `Bearer ${cfg.apiKey}` }
     });
     let keepalive;
     ws.on("open", () => {
-      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl}`);
+      const mode = cfg.runtime ? `runtime=${cfg.runtime.runtime}` : cfg.forward ? `forward=${cfg.forward}` : `exec`;
+      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl} (${mode})`);
       backoff = INITIAL_BACKOFF_MS;
       keepalive = setInterval(() => {
         if (ws.readyState === import_ws.default.OPEN) {
@@ -1547,7 +1903,7 @@ function runListener(cfg) {
             ws.send(JSON.stringify(out));
           }
         };
-        void dispatchA2aRequest(f, cfg, send);
+        void dispatchA2aRequest(f, cfg, send, { dedupeStore });
       }
     });
     ws.on("close", (code, reason) => {
@@ -1576,53 +1932,220 @@ function runListener(cfg) {
   });
   connect();
 }
+function collectWakeHeader(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function validateListenHandlerFlags(opts) {
+  const modes = [opts.runtime, opts.forward, opts.exec].filter(Boolean);
+  if (modes.length === 0) {
+    return "Provide a handler: --runtime http|command|log (recommended), or legacy --forward <url> / --exec <command>.";
+  }
+  if (modes.length > 1) {
+    return "Use only one handler: --runtime, --forward, or --exec \u2014 not combined.";
+  }
+  return validateRuntimeOptions({
+    runtime: opts.runtime,
+    wakeUrl: opts.wakeUrl,
+    wakeExec: opts.wakeExec
+  });
+}
 function listenCommand() {
   const cmd = new import_commander10.Command("listen").description(
-    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). For agents with no public endpoint."
+    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). Prefer --runtime for production; --forward/--exec remain as compatibility tunnels."
+  ).option(
+    "--runtime <id>",
+    "Built-in A2A receiver + wake host: http | command | log (no local A2A port)"
+  ).option("--wake-url <url>", "POST target for --runtime http").option(
+    "--wake-header <k:v>",
+    "Extra header for --runtime http (repeatable)",
+    collectWakeHeader,
+    []
   ).option(
+    "--wake-exec <cmd>",
+    "Shell command for --runtime command (event JSON on stdin). Not the same as legacy --exec (which must print a full A2A response)."
+  ).option(
+    "--wake-timeout <ms>",
+    "Wake timeout in ms (default 5000)",
+    String(DEFAULT_WAKE_TIMEOUT_MS)
+  ).option("--no-dedupe", "Disable in-process task/message id dedupe (default: on)").option("--dedupe-ttl <sec>", "Dedupe window seconds (default 3600)", "3600").option(
     "--forward <url>",
-    "Tunnel each relayed request to a local HTTP server (e.g. http://localhost:8080)"
+    "Compat: tunnel each request to a local A2A HTTP server"
   ).option(
     "--exec <command>",
-    "Run a shell command per request: body on stdin, stdout becomes the response"
-  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action((opts) => {
-    const config = loadConfig();
-    const apiKey = config.api_key;
-    const agentId = opts.agentId ?? config.agent_id;
-    if (!apiKey) {
-      console.error(
-        "No API key found. Run `acn join` first or `acn config set api-key <key>`."
-      );
-      process.exit(1);
-    }
-    if (!agentId) {
-      console.error(
-        "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
-      );
-      process.exit(1);
-    }
-    if (!opts.forward && !opts.exec) {
-      console.error("Provide a handler: --forward <url> or --exec <command>.");
-      process.exit(1);
+    "Compat: shell per request; stdout must be a full A2A JSON-RPC response"
+  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
+    (opts) => {
+      const config = loadConfig();
+      const apiKey = config.api_key;
+      const agentId = opts.agentId ?? config.agent_id;
+      if (!apiKey) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      if (!agentId) {
+        console.error(
+          "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
+        );
+        process.exit(1);
+      }
+      const flagErr = validateListenHandlerFlags({
+        runtime: opts.runtime,
+        forward: opts.forward,
+        exec: opts.exec,
+        wakeUrl: opts.wakeUrl,
+        wakeExec: opts.wakeExec
+      });
+      if (flagErr) {
+        console.error(flagErr);
+        process.exit(1);
+      }
+      let wakeHeaders;
+      if (opts.runtime === "http") {
+        try {
+          wakeHeaders = parseWakeHeaders(opts.wakeHeader);
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+      const wakeTimeoutMs = Number.parseInt(opts.wakeTimeout ?? "", 10);
+      const dedupeTtlSec = Number.parseInt(opts.dedupeTtl ?? "", 10);
+      if (opts.runtime && (!Number.isFinite(wakeTimeoutMs) || wakeTimeoutMs <= 0)) {
+        console.error("--wake-timeout must be a positive integer (ms).");
+        process.exit(1);
+      }
+      if (opts.runtime && (!Number.isFinite(dedupeTtlSec) || dedupeTtlSec <= 0)) {
+        console.error("--dedupe-ttl must be a positive integer (seconds).");
+        process.exit(1);
+      }
+      runListener({
+        agentId,
+        apiKey,
+        baseUrl: config.base_url,
+        forward: opts.forward,
+        exec: opts.exec,
+        runtime: opts.runtime ? {
+          runtime: opts.runtime,
+          wakeUrl: opts.wakeUrl,
+          wakeHeaders,
+          wakeExec: opts.wakeExec,
+          wakeTimeoutMs,
+          // commander: --no-dedupe sets dedupe=false; default true
+          dedupe: opts.dedupe !== false,
+          dedupeTtlSec
+        } : void 0
+      });
     }
-    if (opts.forward && opts.exec) {
-      console.error("Use only one handler: --forward or --exec, not both.");
-      process.exit(1);
+  );
+  return cmd;
+}
+
+// src/commands/delivery.ts
+var import_commander11 = require("commander");
+var DELIVERY_DESC = {
+  direct: "direct (Mode A) \u2014 ACN dials your public A2A endpoint over HTTP",
+  relay: "relay (Mode B) \u2014 hold an outbound WebSocket with `acn listen`; no public URL",
+  none: "none \u2014 pull/reject only (communication_policy is manifest or closed; not Mode A/B)"
+};
+function requireAgentId3() {
+  const config = loadConfig();
+  if (!config.api_key) {
+    console.error(
+      "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+    );
+    process.exit(1);
+  }
+  if (!config.agent_id) {
+    console.error(
+      "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
+    );
+    process.exit(1);
+  }
+  return config.agent_id;
+}
+function formatDelivery(d) {
+  const lines = [
+    `Delivery : ${DELIVERY_DESC[d.delivery] ?? d.delivery}`,
+    `Policy   : ${d.communication_mode ?? "?"}  (reception \u2014 not the same as delivery)`,
+    `Endpoint : ${d.endpoint ?? "(none)"}`
+  ];
+  if (d.a2a_handshake_ok === false) {
+    lines.push("A2A probe: false \u2014 URL reachable but not JSON-RPC; fix the path");
+  } else if (d.a2a_handshake_ok === true) {
+    lines.push("A2A probe: ok");
+  }
+  if (d.next_step_hint) {
+    lines.push("", d.next_step_hint);
+  }
+  return lines.join("\n");
+}
+function deliveryCommand() {
+  const cmd = new import_commander11.Command("delivery").description(
+    "Inbound delivery transport (Mode A direct / Mode B relay). Orthogonal to reception policy (`acn inbox mode`)."
+  );
+  cmd.command("get").description("Show derived delivery transport (direct | relay | none)").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
+    const agentId = opts.agentId ?? requireAgentId3();
+    try {
+      const res = await acnGet(`/agents/${agentId}/delivery`);
+      output(res, formatDelivery(res));
+    } catch (err) {
+      handleError(err);
     }
-    runListener({
-      agentId,
-      apiKey,
-      baseUrl: config.base_url,
-      forward: opts.forward,
-      exec: opts.exec
-    });
   });
+  cmd.command("set <transport>").description(
+    "Switch delivery without re-registering: relay (Mode B) or direct (Mode A). Requires push reception policy (open / allowlist)."
+  ).option(
+    "-e, --endpoint <url>",
+    "Required for direct: public A2A JSON-RPC URL (e.g. https://host/a2a)"
+  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
+    async (transport, opts) => {
+      const agentId = opts.agentId ?? requireAgentId3();
+      const normalized = transport.trim().toLowerCase();
+      if (normalized !== "relay" && normalized !== "direct") {
+        console.error(
+          `Unknown transport "${transport}". Use: relay | direct`
+        );
+        process.exit(1);
+      }
+      if (normalized === "direct" && !opts.endpoint) {
+        console.error(
+          "direct requires --endpoint <url> (full A2A path, e.g. https://host/a2a)."
+        );
+        process.exit(1);
+      }
+      if (normalized === "relay" && opts.endpoint) {
+        console.error(
+          "relay must not include --endpoint (clear the public URL; use `acn listen`)."
+        );
+        process.exit(1);
+      }
+      const body = normalized === "relay" ? { delivery: "relay" } : { delivery: "direct", endpoint: opts.endpoint };
+      try {
+        const res = await acnPatch(
+          `/agents/${agentId}/delivery`,
+          body
+        );
+        const followUp = res.delivery === "relay" ? [
+          "",
+          "Next: run the Mode B listener (built-in A2A + wake host):",
+          "  acn listen --runtime http --wake-url http://127.0.0.1:PORT/wake",
+          "Compat: acn listen --forward http://localhost:PORT"
+        ] : [];
+        output(res, [formatDelivery(res), ...followUp].join("\n"));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
   return cmd;
 }
 
 // src/commands/session.ts
-var import_commander11 = require("commander");
-function requireAgentId3() {
+var import_commander12 = require("commander");
+function requireAgentId4() {
   const config = loadConfig();
   if (!config.api_key) {
     console.error("No API key found. Run `acn join` first or `acn config set api-key <key>`.");
@@ -1666,12 +2189,12 @@ function formatEntry2(s, index) {
   return lines.join("\n");
 }
 function sessionCommand() {
-  const cmd = new import_commander11.Command("session").description(
+  const cmd = new import_commander12.Command("session").description(
     "Real-time session layer: bidirectional channel between two agents"
   );
   cmd.command("invite <target_agent_id>").description("Invite an agent to a real-time session").option("--ttl-seconds <s>", "Session TTL in seconds (60\u20131800, default 300)", parseInt).option("--metadata <json>", "Optional JSON object attached to the invitation (max 4KB)").action(
     async (targetId, opts) => {
-      requireAgentId3();
+      requireAgentId4();
       try {
         const body = {};
         if (opts.ttlSeconds !== void 0) body.ttl_seconds = opts.ttlSeconds;
@@ -1692,7 +2215,7 @@ ${formatEntry2(res)}`
     }
   );
   cmd.command("accept <session_id>").description("Accept a pending session invitation (invitee only)").action(async (sessionId) => {
-    requireAgentId3();
+    requireAgentId4();
     try {
       const res = await acnPost(`/sessions/${sessionId}/accept`);
       output(res, `Session accepted.
@@ -1702,7 +2225,7 @@ ${formatEntry2(res)}`);
     }
   });
   cmd.command("reject <session_id>").description("Reject a pending session invitation (invitee only)").action(async (sessionId) => {
-    requireAgentId3();
+    requireAgentId4();
     try {
       const res = await acnPost(`/sessions/${sessionId}/reject`);
       output(res, `Session rejected.
@@ -1712,7 +2235,7 @@ ${formatEntry2(res)}`);
     }
   });
   cmd.command("close <session_id>").description("Close an active session (either party may close)").action(async (sessionId) => {
-    requireAgentId3();
+    requireAgentId4();
     try {
       const res = await acnDelete(`/sessions/${sessionId}`);
       output(res, `Session closed.
@@ -1722,7 +2245,7 @@ ${formatEntry2(res)}`);
     }
   });
   cmd.command("pending").description("List pending session invitations addressed to you").action(async () => {
-    requireAgentId3();
+    requireAgentId4();
     try {
       const res = await acnGet("/sessions/pending");
       const sessions = res.sessions ?? [];
@@ -1744,8 +2267,8 @@ ${formatEntry2(res)}`);
 }
 
 // src/commands/subnet.ts
-var import_commander12 = require("commander");
-function requireAgentId4() {
+var import_commander13 = require("commander");
+function requireAgentId5() {
   const config = loadConfig();
   if (!config.api_key) {
     console.error("No API key found. Run `acn join` first or `acn config set api-key <key>`.");
@@ -1832,7 +2355,7 @@ function formatSubnet(s, index) {
   return lines.join("\n");
 }
 function subnetCommand() {
-  const cmd = new import_commander12.Command("subnet").description("Manage ACN subnets");
+  const cmd = new import_commander13.Command("subnet").description("Manage ACN subnets");
   cmd.command("list").description(
     "List subnets. Without --all/--parent shows only subnets you have joined."
   ).option("--all", "Show all public subnets on ACN (not just your own)").option(
@@ -1871,7 +2394,7 @@ function subnetCommand() {
 ` + subnets.map((s, i) => formatSubnet(s, i)).join("\n\n")
         );
       } else {
-        const agentId = opts.agentId ?? requireAgentId4();
+        const agentId = opts.agentId ?? requireAgentId5();
         const res = await acnGet(
           `/subnets/${agentId}/subnets`
         );
@@ -1910,7 +2433,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
   cmd.command("join <subnet_id>").description(
     "Join a subnet. ADR-0004: branches on response shape (open/allowlist/auto-invite/pending)."
   ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (subnetId, opts) => {
-    const agentId = opts.agentId ?? requireAgentId4();
+    const agentId = opts.agentId ?? requireAgentId5();
     try {
       const res = await acnPost(
         `/agents/${agentId}/subnets/${subnetId}`
@@ -1921,7 +2444,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
     }
   });
   cmd.command("leave <subnet_id>").description("Leave a subnet").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (subnetId, opts) => {
-    const agentId = opts.agentId ?? requireAgentId4();
+    const agentId = opts.agentId ?? requireAgentId5();
     try {
       const res = await acnDelete(
         `/agents/${agentId}/subnets/${subnetId}`
@@ -2049,7 +2572,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
       handleError(err);
     }
   });
-  const requests = new import_commander12.Command("requests").description(
+  const requests = new import_commander13.Command("requests").description(
     "Manage join-requests for a subnet (ADR-0004)"
   );
   requests.command("list <subnet_id>").description(
@@ -2093,7 +2616,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
   requests.command("pending").description(
     "Owner-side convenience: list pending join_requests across every subnet you own. Client-side aggregation \u2014 issues N+1 calls (one per owned subnet)."
   ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId4();
+    const agentId = opts.agentId ?? requireAgentId5();
     try {
       const subs = await acnGet(`/agents/${agentId}/subnets`);
       const subnetIds = subs.subnets ?? [];
@@ -2191,7 +2714,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
     }
   );
   cmd.addCommand(requests);
-  const invitations = new import_commander12.Command("invitations").description(
+  const invitations = new import_commander13.Command("invitations").description(
     "Manage invitations on a subnet (ADR-0004)"
   );
   invitations.command("send <subnet_id>").description(
@@ -2246,7 +2769,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
   invitations.command("pending").description(
     "Invitee view: list pending invitations addressed to you across all subnets (backed by GET /agents/{aid}/subnet-invitations)."
   ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId4();
+    const agentId = opts.agentId ?? requireAgentId5();
     try {
       const res = await acnGet(
         `/agents/${agentId}/subnet-invitations`
@@ -2327,7 +2850,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
     }
   );
   cmd.addCommand(invitations);
-  const allowlist = new import_commander12.Command("allowlist").description(
+  const allowlist = new import_commander13.Command("allowlist").description(
     "Manage a subnet allowlist (ADR-0004)"
   );
   allowlist.command("list <subnet_id>").description("Owner-only: list allowlist entries for a subnet.").option("--limit <n>", "Page size (1-500, default 100)", "100").option("--offset <n>", "Page offset (default 0)", "0").action(
@@ -2395,7 +2918,7 @@ ${JSON.stringify(res.agents, null, 2)}`);
     }
   );
   cmd.addCommand(allowlist);
-  const harness = new import_commander12.Command("harness").description("Manage Org Harness webhook for a subnet");
+  const harness = new import_commander13.Command("harness").description("Manage Org Harness webhook for a subnet");
   harness.command("set <subnet_id>").description("Register an Org Harness webhook on a subnet you own").requiredOption("--url <url>", "Harness webhook URL (HTTPS)").option("--secret <secret>", "HMAC-SHA256 signing secret (recommended)").action(async (subnetId, opts) => {
     const config = loadConfig();
     if (!config.api_key) {
@@ -2437,9 +2960,198 @@ ${JSON.stringify(res.agents, null, 2)}`);
   return cmd;
 }
 
+// src/commands/org.ts
+var import_commander14 = require("commander");
+function formatOrg(o) {
+  const lines = [
+    `  ID       : ${o.org_id}`,
+    `  Name     : ${o.display_name}`,
+    `  Status   : ${o.status ?? "\u2014"}`,
+    `  Owner    : ${o.owner?.kind ?? "none"}${o.owner?.subject ? ` (${o.owner.subject})` : ""}`,
+    `  Steward  : ${o.steward_agent_id ?? "\u2014"}`,
+    `  Subnet   : ${o.fencing?.subnet_id ?? o.subnet_id ?? "\u2014"}`
+  ];
+  if (o.fencing?.join_policy) lines.push(`  Join     : ${o.fencing.join_policy}`);
+  if (o.harness_webhook?.registered) {
+    lines.push(`  Harness  : ${o.harness_webhook.url ?? "(registered)"}`);
+  }
+  return lines.join("\n");
+}
+function orgCommand() {
+  const cmd = new import_commander14.Command("org").description("Manage ACN organisations (Org Harness)");
+  cmd.command("create").description("Create an Org (binds/creates a subnet fence)").requiredOption("--name <name>", "Display name").option("--steward <agent_id>", "Steward agent (required for human JWT callers)").option("--subnet <slug>", "Bind existing subnet slug (must be owned by steward)").option("--join-policy <policy>", "open | approval", "open").option("--private", "Private subnet fence", false).option("--harness-url <url>", "Register Org Harness webhook on the fence subnet").option("--harness-secret <secret>", "HMAC secret for harness webhook").action(
+    async (opts) => {
+      try {
+        const body = {
+          display_name: opts.name,
+          is_private: Boolean(opts.private),
+          join_policy: opts.joinPolicy ?? "open"
+        };
+        if (opts.steward) body.steward_agent_id = opts.steward;
+        if (opts.subnet) body.subnet_id = opts.subnet;
+        if (opts.harnessUrl) body.harness_url = opts.harnessUrl;
+        if (opts.harnessSecret) body.harness_secret = opts.harnessSecret;
+        const org = await acnPost("/orgs", body);
+        output(org, formatOrg(org));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
+  cmd.command("show <orgId>").description("Show Org details").action(async (orgId) => {
+    try {
+      const org = await acnGet(`/orgs/${orgId}`);
+      output(org, formatOrg(org));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  cmd.command("update <orgId>").description("Update Org charter / plugins / display name").option("--name <name>", "New display name").option("--charter <json>", "Charter JSON object").option("--plugins <json>", "Plugins JSON object (merged)").action(
+    async (orgId, opts) => {
+      try {
+        const body = {};
+        if (opts.name) body.display_name = opts.name;
+        if (opts.charter) body.charter = JSON.parse(opts.charter);
+        if (opts.plugins) body.plugins = JSON.parse(opts.plugins);
+        const org = await acnPatch(`/orgs/${orgId}`, body);
+        output(org, formatOrg(org));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
+  const members = cmd.command("members").description("Manage Org members");
+  members.command("list <orgId>").description("List active members (marks degraded vs subnet fence)").action(async (orgId) => {
+    try {
+      const res = await acnGet(`/orgs/${orgId}/members`);
+      const text = (res.members ?? []).map((m) => {
+        const flags = [];
+        if (m.acn?.degraded) flags.push("degraded");
+        if (m.acn && !m.acn.subnet_member) flags.push("not-in-subnet");
+        const flagStr = flags.length ? `  [${flags.join(",")}]` : "";
+        return `  ${m.agent_id}  role=${m.role}  status=${m.status}${flagStr}`;
+      }).join("\n");
+      const header = res.degraded_count || res.fence_missing ? `  (degraded=${res.degraded_count} fence_missing=${res.fence_missing})
+` : "";
+      output(res, header + (text || "  (no members)"));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  members.command("add <orgId> <agentId>").description("Add an agent member").option("--role <role>", "Member role", "worker").action(async (orgId, agentId, opts) => {
+    try {
+      const m = await acnPost(`/orgs/${orgId}/members`, {
+        agent_id: agentId,
+        role: opts.role
+      });
+      output(m, `Added ${m.agent_id} as ${m.role}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  members.command("remove <orgId> <agentId>").description("Remove an agent member").action(async (orgId, agentId) => {
+    try {
+      const m = await acnDelete(`/orgs/${orgId}/members/${agentId}`);
+      output(m, `Removed ${m.agent_id}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  cmd.command("claim <orgId>").description("Claim ownership of an unclaimed Org (created_by only)").option("--as <kind>", "human | agent").option("--subject <id>", "Owner subject (defaults to caller)").action(async (orgId, opts) => {
+    try {
+      const body = {};
+      if (opts.as) body.owner_kind = opts.as;
+      if (opts.subject) body.owner_subject = opts.subject;
+      const org = await acnPost(`/orgs/${orgId}/claim`, body);
+      output(org, formatOrg(org));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  cmd.command("transfer <orgId>").description("Transfer Org ownership").requiredOption("--kind <kind>", "human | agent").requiredOption("--subject <id>", "New owner subject").action(async (orgId, opts) => {
+    try {
+      const org = await acnPost(`/orgs/${orgId}/transfer`, {
+        new_owner_kind: opts.kind,
+        new_owner_subject: opts.subject
+      });
+      output(org, formatOrg(org));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  cmd.command("release <orgId>").description("Release Org ownership back to none").action(async (orgId) => {
+    try {
+      const org = await acnPost(`/orgs/${orgId}/release`, {});
+      output(org, formatOrg(org));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  cmd.command("dissolve <orgId>").description("Dissolve an Org (owner or created_by when unclaimed)").action(async (orgId) => {
+    try {
+      const org = await acnPost(`/orgs/${orgId}/dissolve`, {});
+      output(org, formatOrg(org));
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  const work = cmd.command("work").description("Minimal Org work queue");
+  work.command("list <orgId>").description("List work items").option("--open", "Only open (todo / in_progress)", false).action(async (orgId, opts) => {
+    try {
+      const q = opts.open ? "?open_only=true" : "";
+      const res = await acnGet(
+        `/orgs/${orgId}/work${q}`
+      );
+      const text = (res.work ?? []).map(
+        (w) => `  ${w.work_id}  [${w.status}]  ${w.title}` + (w.assignee_agent_id ? `  \u2192 ${w.assignee_agent_id}` : "")
+      ).join("\n");
+      output(res, text || "  (no work)");
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  work.command("create <orgId>").description("Create a work item").requiredOption("--title <title>", "Work title").option("--assignee <agent_id>", "Assignee agent").action(async (orgId, opts) => {
+    try {
+      const body = { title: opts.title };
+      if (opts.assignee) body.assignee_agent_id = opts.assignee;
+      const w = await acnPost(`/orgs/${orgId}/work`, body);
+      output(w, `Created ${w.work_id}: ${w.title}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  work.command("update <orgId> <workId>").description("Update work status").requiredOption("--status <status>", "todo | in_progress | done | cancelled").option("--assignee <agent_id>", "Assignee agent").action(
+    async (orgId, workId, opts) => {
+      try {
+        const body = { status: opts.status };
+        if (opts.assignee) body.assignee_agent_id = opts.assignee;
+        const w = await acnPatch(
+          `/orgs/${orgId}/work/${workId}`,
+          body
+        );
+        output(w, `Updated ${w.work_id} \u2192 ${w.status}`);
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
+  cmd.command("tick <orgId>").description("Thin Loop tick (lists open work, emits org.loop_tick)").action(async (orgId) => {
+    try {
+      const res = await acnPost(
+        `/orgs/${orgId}/loop/tick`,
+        {}
+      );
+      output(res, `Loop tick: ${res.open_count} open work item(s)`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+  return cmd;
+}
+
 // src/commands/follow.ts
-var import_commander13 = require("commander");
-function requireAgentId5() {
+var import_commander15 = require("commander");
+function requireAgentId6() {
   const config = loadConfig();
   if (!config.api_key) {
     console.error("No API key found. Run `acn join` first or `acn config set api-key <key>`.");
@@ -2461,9 +3173,9 @@ function formatAgent2(a, i) {
   ].join("\n");
 }
 function followCommand() {
-  const cmd = new import_commander13.Command("follow").description("Follow/unfollow agents and inspect follow graph");
+  const cmd = new import_commander15.Command("follow").description("Follow/unfollow agents and inspect follow graph");
   cmd.command("add <target_id>").description("Follow another agent").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (targetId, opts) => {
-    const agentId = opts.agentId ?? requireAgentId5();
+    const agentId = opts.agentId ?? requireAgentId6();
     try {
       const res = await acnPost(
         `/agents/${agentId}/follows/${targetId}`
@@ -2475,7 +3187,7 @@ function followCommand() {
     }
   });
   cmd.command("remove <target_id>").description("Unfollow an agent").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (targetId, opts) => {
-    const agentId = opts.agentId ?? requireAgentId5();
+    const agentId = opts.agentId ?? requireAgentId6();
     try {
       const res = await acnDelete(
         `/agents/${agentId}/follows/${targetId}`
@@ -2487,7 +3199,7 @@ function followCommand() {
     }
   });
   cmd.command("list").description("List agents you follow").option("--limit <n>", "Max results", parseInt).option("--offset <n>", "Pagination offset", parseInt).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId5();
+    const agentId = opts.agentId ?? requireAgentId6();
     try {
       const params = {};
       if (opts.limit !== void 0) params.limit = opts.limit;
@@ -2512,7 +3224,7 @@ function followCommand() {
     }
   });
   cmd.command("followers").description("List agents that follow you").option("--limit <n>", "Max results", parseInt).option("--offset <n>", "Pagination offset", parseInt).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId5();
+    const agentId = opts.agentId ?? requireAgentId6();
     try {
       const params = {};
       if (opts.limit !== void 0) params.limit = opts.limit;
@@ -2537,7 +3249,7 @@ function followCommand() {
     }
   });
   cmd.command("check <target_id>").description("Check whether you are following a specific agent").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (targetId, opts) => {
-    const agentId = opts.agentId ?? requireAgentId5();
+    const agentId = opts.agentId ?? requireAgentId6();
     try {
       const res = await acnGet(
         `/agents/${agentId}/follows/${targetId}`
@@ -2552,8 +3264,8 @@ function followCommand() {
 }
 
 // src/commands/wallet.ts
-var import_commander14 = require("commander");
-function requireAgentId6() {
+var import_commander16 = require("commander");
+function requireAgentId7() {
   const config = loadConfig();
   if (!config.api_key) {
     console.error("No API key found. Run `acn join` first or `acn config set api-key <key>`.");
@@ -2569,7 +3281,7 @@ function parseCsv(value) {
   return value.split(",").map((s) => s.trim()).filter(Boolean);
 }
 async function showWalletInfo(opts) {
-  const agentId = opts.agentId ?? requireAgentId6();
+  const agentId = opts.agentId ?? requireAgentId7();
   try {
     const res = await acnGet(`/agents/${agentId}/wallets`);
     const lines = [`Agent  : ${res.agent_id}`];
@@ -2595,7 +3307,7 @@ async function showWalletInfo(opts) {
   }
 }
 function walletCommand() {
-  const cmd = new import_commander14.Command("wallet").description("View and manage agent's wallet & payment info");
+  const cmd = new import_commander16.Command("wallet").description("View and manage agent's wallet & payment info");
   cmd.command("info", { isDefault: true }).description("Show wallet, payment methods, pricing, and ERC-8004 status").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(showWalletInfo);
   cmd.command("set-capability").description("Declare which payment methods, networks, and wallets you accept").requiredOption(
     "--methods <csv>",
@@ -2605,7 +3317,7 @@ function walletCommand() {
     `Wallet addresses by network, JSON, e.g. '{"ethereum":"0x..."}'`
   ).option("--no-accepts", "Disable accepting payments (default: enabled)").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
     async (opts) => {
-      const agentId = opts.agentId ?? requireAgentId6();
+      const agentId = opts.agentId ?? requireAgentId7();
       let walletMap = {};
       if (opts.wallets) {
         try {
@@ -2640,7 +3352,7 @@ function walletCommand() {
   );
   cmd.command("set-pricing").description("Set OpenAI-style per-million-token pricing for your agent (USD)").requiredOption("--input <usd>", "USD per 1M input tokens").requiredOption("--output <usd>", "USD per 1M output tokens").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
     async (opts) => {
-      const agentId = opts.agentId ?? requireAgentId6();
+      const agentId = opts.agentId ?? requireAgentId7();
       const inputPrice = Number(opts.input);
       const outputPrice = Number(opts.output);
       if (!Number.isFinite(inputPrice) || inputPrice < 0) {
@@ -2668,7 +3380,7 @@ function walletCommand() {
     }
   );
   cmd.command("tasks").description("List the payment tasks the current agent is involved in").option("--status <s>", "Filter by status (e.g. created, payment_confirmed, task_completed)").option("--limit <n>", "Max number of tasks to return (default 50)").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId6();
+    const agentId = opts.agentId ?? requireAgentId7();
     const params = {};
     if (opts.status) params.status = opts.status;
     if (opts.limit !== void 0) {
@@ -2708,7 +3420,7 @@ function walletCommand() {
     }
   });
   cmd.command("stats").description("Show the current agent's payment statistics").option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(async (opts) => {
-    const agentId = opts.agentId ?? requireAgentId6();
+    const agentId = opts.agentId ?? requireAgentId7();
     try {
       const res = await acnGet(`/payments/stats/${agentId}`);
       const lines = [`Stats for ${agentId}:`];
@@ -2774,8 +3486,8 @@ function walletCommand() {
 }
 
 // src/commands/pay.ts
-var import_commander15 = require("commander");
-function requireAgentId7() {
+var import_commander17 = require("commander");
+function requireAgentId8() {
   const config = loadConfig();
   if (!config.api_key) {
     console.error("No API key found. Run `acn join` first or `acn config set api-key <key>`.");
@@ -2788,11 +3500,11 @@ function requireAgentId7() {
   return config.agent_id;
 }
 function payCommand() {
-  const cmd = new import_commander15.Command("pay").description("Manage payment tasks between agents");
-  const createCmd = new import_commander15.Command("create").description("Create a payment task to another agent");
+  const cmd = new import_commander17.Command("pay").description("Manage payment tasks between agents");
+  const createCmd = new import_commander17.Command("create").description("Create a payment task to another agent");
   createCmd.requiredOption("--to <agent>", "Recipient agent ID").requiredOption("--amount <n>", "Payment amount (positive number)").requiredOption("--currency <c>", "Currency code, e.g. USD, USDC").requiredOption("--method <m>", "Payment method, e.g. usdc, eth, platform_credits").requiredOption("--network <n>", "Network, e.g. ethereum, base, solana").option("--description <text>", "Free-text description for the payment task").option("--metadata <json>", "Additional metadata as JSON object").action(
     async (opts) => {
-      const fromAgent = requireAgentId7();
+      const fromAgent = requireAgentId8();
       const amount = Number(opts.amount);
       if (!Number.isFinite(amount) || amount <= 0) {
         console.error("--amount must be a positive number.");
@@ -2835,7 +3547,7 @@ function payCommand() {
       }
     }
   );
-  const confirmCmd = new import_commander15.Command("confirm").description(
+  const confirmCmd = new import_commander17.Command("confirm").description(
     "Confirm an external payment has been made (buyer only)"
   );
   confirmCmd.requiredOption("--task-id <id>", "Payment task ID to confirm").requiredOption(
@@ -2857,11 +3569,11 @@ function payCommand() {
       handleError(err);
     }
   });
-  const statusCmd = new import_commander15.Command("status").description(
+  const statusCmd = new import_commander17.Command("status").description(
     "Show payment tasks for the authenticated agent"
   );
   statusCmd.option("--status <s>", "Filter by status (e.g. created, payment_confirmed)").option("--limit <n>", "Max results (default 50)", "50").action(async (opts) => {
-    const agentId = requireAgentId7();
+    const agentId = requireAgentId8();
     try {
       const res = await acnGet(
         `/payments/tasks/agent/${agentId}`,
@@ -2880,7 +3592,7 @@ function payCommand() {
 
 // src/index.ts
 var { version } = require_package();
-var program = new import_commander16.Command();
+var program = new import_commander18.Command();
 program.name("acn").description("ACN CLI \u2014 Agent Collaboration Network command-line interface").version(version).option("--json", "Output raw JSON (useful for agent parsing)").hook("preAction", (thisCommand) => {
   const opts = thisCommand.opts();
   if (opts.json) setJsonMode(true);
@@ -2895,8 +3607,10 @@ program.addCommand(messageCommand());
 program.addCommand(notifyCommand());
 program.addCommand(inboxCommand());
 program.addCommand(listenCommand());
+program.addCommand(deliveryCommand());
 program.addCommand(sessionCommand());
 program.addCommand(subnetCommand());
+program.addCommand(orgCommand());
 program.addCommand(followCommand());
 program.addCommand(walletCommand());
 program.addCommand(payCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acnlabs/acn-cli",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "description": "Official CLI for ACN (Agent Collaboration Network) — zero-integration agent access",
   "main": "dist/index.js",
   "bin": {