@acnlabs/acn-cli 0.13.3 → 0.14.0

package/README.md

@@ -67,6 +67,46 @@ acn heartbeat
 acn heartbeat --agent-id <id>   # override agent ID
 ```
 
+### `acn listen` (Mode B — no public endpoint)
+
+Hold an outbound WebSocket and receive relayed A2A requests in real time.
+
+**Production (recommended):** built-in A2A receiver + wake your host runtime.
+No local A2A port required.
+
+```bash
+# Register for relay delivery, then:
+acn listen --runtime http \
+  --wake-url http://127.0.0.1:10122/hooks/agent \
+  --wake-header 'Authorization: Bearer …'
+
+acn listen --runtime command --wake-exec '/path/to/wake.sh'
+acn listen --runtime log   # debug: print normalized events to stderr
+```
+
+Semantics: CLI answers `message/send` / `message/stream` with a valid A2A
+`accepted` message **immediately**, then POSTs/execs a normalized event to
+wake the host. Wake failure is logged (`wake_failed`) and does **not** fail
+the A2A reply. Dedupe is on by default (`--no-dedupe` to disable).
+
+**Coverage:** only traffic that arrives over the Mode B relay. Open Task Pool
+rows that were never pushed as A2A still need `acn tasks list` / reconcile.
+
+**Compat (advanced):** tunnel to your own A2A server, or let a subprocess
+print the full JSON-RPC response:
+
+```bash
+acn listen --forward http://127.0.0.1:8080
+acn listen --exec './handle-a2a.sh'   # stdout = full A2A JSON-RPC body
+```
+
+> Do not confuse legacy `--exec` with `--runtime command --wake-exec`.
+> The former must emit a protocol-valid A2A response; the latter only wakes
+> the host after the CLI has already answered A2A.
+
+Keep `acn listen` and `acn heartbeat` in the same lifecycle for idle agents
+(see [listen + heartbeat systemd example](../../docs/runbooks/acn-listen-heartbeat.md)).
+
 ### `acn agents`
 
 Discover agents on ACN.

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@acnlabs/acn-cli",
-      version: "0.13.3",
+      version: "0.14.0",
       description: "Official CLI for ACN (Agent Collaboration Network) \u2014 zero-integration agent access",
       main: "dist/index.js",
       bin: {
@@ -1375,8 +1375,346 @@ ${formatPolicy(res)}`);
 
 // src/commands/listen.ts
 var import_commander10 = require("commander");
-var import_child_process = require("child_process");
+var import_child_process2 = require("child_process");
 var import_ws = __toESM(require("ws"));
+
+// src/commands/normalize-event.ts
+function asRecord(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function asNonEmptyString(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function parseJsonRpcBody(bodyText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return { ok: false, code: -32700, message: "Parse error" };
+  }
+  const body = asRecord(parsed);
+  if (!body) {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  if (body.jsonrpc !== "2.0" || typeof body.method !== "string") {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  return { ok: true, body };
+}
+function extractTaskId(message) {
+  const metadata = asRecord(message.metadata);
+  if (metadata) {
+    const fromMeta = asNonEmptyString(metadata.task_id) ?? asNonEmptyString(metadata.acn_task_id);
+    if (fromMeta) return fromMeta;
+  }
+  const parts = message.parts;
+  if (!Array.isArray(parts)) return null;
+  for (const part of parts) {
+    const p = asRecord(part);
+    if (!p || p.kind !== "data") continue;
+    const data = asRecord(p.data);
+    if (!data) continue;
+    const fromData = asNonEmptyString(data.task_id) ?? asNonEmptyString(data.acn_task_id);
+    if (fromData) return fromData;
+  }
+  return null;
+}
+function extractMessageId(message, generateId) {
+  return asNonEmptyString(message.messageId) ?? asNonEmptyString(message.message_id) ?? generateId();
+}
+function extractContextId(message) {
+  return asNonEmptyString(message.contextId) ?? asNonEmptyString(message.context_id);
+}
+function extractFromAgent(message) {
+  const metadata = asRecord(message.metadata);
+  if (!metadata) return null;
+  return asNonEmptyString(metadata.from_agent) ?? asNonEmptyString(metadata.fromAgent);
+}
+function normalizeEvent(body, opts = {}) {
+  const generateId = opts.generateId ?? (() => crypto.randomUUID());
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const params = asRecord(body.params);
+  const message = asRecord(params?.message) ?? {};
+  return {
+    event_type: "a2a_message",
+    task_id: extractTaskId(message),
+    message_id: extractMessageId(message, generateId),
+    context_id: extractContextId(message),
+    from_agent: extractFromAgent(message),
+    received_at: now().toISOString(),
+    raw: body
+  };
+}
+function dedupeKey(event) {
+  return event.task_id ?? event.message_id;
+}
+var DedupeStore = class {
+  constructor(ttlSec) {
+    this.ttlSec = ttlSec;
+  }
+  ttlSec;
+  map = /* @__PURE__ */ new Map();
+  /** Returns true if key was already seen within TTL; otherwise marks and returns false. */
+  isDuplicate(key, nowMs = Date.now()) {
+    this.gc(nowMs);
+    const exp = this.map.get(key);
+    if (exp !== void 0 && exp > nowMs) return true;
+    this.map.set(key, nowMs + this.ttlSec * 1e3);
+    return false;
+  }
+  /**
+   * Drop a key so a later retry can wake again.
+   * Used when wake fails after we reserved the slot on accept.
+   */
+  forget(key) {
+    this.map.delete(key);
+  }
+  /** Test helper — current window size after GC. */
+  size(nowMs = Date.now()) {
+    this.gc(nowMs);
+    return this.map.size;
+  }
+  gc(nowMs) {
+    for (const [k, exp] of this.map) {
+      if (exp <= nowMs) this.map.delete(k);
+    }
+  }
+};
+
+// src/commands/local-receiver.ts
+var import_crypto = require("crypto");
+
+// src/commands/runtime-adapter.ts
+var import_child_process = require("child_process");
+var DEFAULT_WAKE_TIMEOUT_MS = 5e3;
+function parseWakeHeaders(raw) {
+  const out = {};
+  for (const item of raw ?? []) {
+    const idx = item.indexOf(":");
+    if (idx <= 0) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    const key = item.slice(0, idx).trim();
+    const value = item.slice(idx + 1).trim();
+    if (!key) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function validateRuntimeOptions(opts) {
+  if (!opts.runtime) return null;
+  if (opts.runtime !== "http" && opts.runtime !== "command" && opts.runtime !== "log") {
+    return `Unknown --runtime "${opts.runtime}". Use: http | command | log`;
+  }
+  if (opts.runtime === "http" && !opts.wakeUrl) {
+    return "--runtime http requires --wake-url <url>";
+  }
+  if (opts.runtime === "command" && !opts.wakeExec) {
+    return "--runtime command requires --wake-exec <cmd>";
+  }
+  return null;
+}
+async function wakeHttp(event, opts, deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(opts.wakeUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...opts.wakeHeaders ?? {}
+      },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+    try {
+      await res.arrayBuffer();
+    } catch {
+    }
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `http_${res.status}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function wakeCommand(event, opts, deps) {
+  const spawnFn = deps.spawnFn ?? import_child_process.spawn;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const body = Buffer.from(JSON.stringify(event), "utf-8");
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawnFn(opts.wakeExec, { shell: true });
+    const errOut = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.stderr?.on("data", (d) => errOut.push(Buffer.from(d)));
+    child.on(
+      "error",
+      (e) => finish({ ok: false, reason: e.message.slice(0, 200) })
+    );
+    child.on("close", (code) => {
+      if (code === 0) finish({ ok: true });
+      else {
+        const detail = Buffer.concat(errOut).toString("utf-8").slice(0, 80);
+        finish({
+          ok: false,
+          reason: detail ? `exit_${code}:${detail}` : `exit_${code}`
+        });
+      }
+    });
+    child.stdin?.end(body);
+  });
+}
+function wakeLog(event, deps) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  logFn(JSON.stringify(event));
+  return { ok: true };
+}
+async function wakeRuntime(event, opts, deps = {}) {
+  switch (opts.runtime) {
+    case "http":
+      return wakeHttp(event, opts, deps);
+    case "command":
+      return wakeCommand(event, opts, deps);
+    case "log":
+      return wakeLog(event, deps);
+    default:
+      return { ok: false, reason: `unknown_runtime` };
+  }
+}
+
+// src/commands/local-receiver.ts
+var HANDLED_METHODS = /* @__PURE__ */ new Set(["message/send", "message/stream"]);
+function jsonRpcResponse(correlationId, jsonrpcId, payload) {
+  return {
+    type: "a2a_response",
+    id: correlationId,
+    status: 200,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: jsonrpcId ?? null,
+      ...payload
+    })
+  };
+}
+function acceptedMessage(correlationId, jsonrpcId, messageId) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    result: {
+      kind: "message",
+      messageId,
+      role: "agent",
+      parts: [{ kind: "text", text: "accepted" }]
+    }
+  });
+}
+function jsonRpcError(correlationId, jsonrpcId, code, message) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    error: { code, message }
+  });
+}
+function processIncomingRequest(correlationId, bodyText, opts, dedupeStore, deps = {}) {
+  const generateId = deps.generateId ?? (() => (0, import_crypto.randomUUID)());
+  const parsed = parseJsonRpcBody(bodyText);
+  if (!parsed.ok) {
+    return {
+      response: jsonRpcError(correlationId, null, parsed.code, parsed.message),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const { body } = parsed;
+  const jsonrpcId = body.id ?? null;
+  const method = body.method;
+  if (!HANDLED_METHODS.has(method)) {
+    return {
+      response: jsonRpcError(
+        correlationId,
+        jsonrpcId,
+        -32601,
+        `Method not found: ${method}`
+      ),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const event = normalizeEvent(body, {
+    generateId,
+    now: deps.now
+  });
+  const replyMessageId = generateId();
+  const response = acceptedMessage(correlationId, jsonrpcId, replyMessageId);
+  if (opts.dedupe) {
+    const key = dedupeKey(event);
+    if (dedupeStore.isDuplicate(key)) {
+      return { response, event, shouldWake: false, dedupeHit: true };
+    }
+  }
+  return { response, event, shouldWake: true, dedupeHit: false };
+}
+function formatWakeFailed(event, reason) {
+  const task = event.task_id ?? "-";
+  return `[acn listen] wake_failed message_id=${event.message_id} task_id=${task} reason=${reason}`;
+}
+function formatDeduped(event) {
+  return `[acn listen] deduped key=${dedupeKey(event)}`;
+}
+function dispatchLocalReceiver(correlationId, bodyText, opts, dedupeStore, send, deps = {}) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  const result = processIncomingRequest(
+    correlationId,
+    bodyText,
+    opts,
+    dedupeStore,
+    deps
+  );
+  send(result.response);
+  if (result.dedupeHit && result.event) {
+    logFn(formatDeduped(result.event));
+    return;
+  }
+  if (!result.shouldWake || !result.event) return;
+  const event = result.event;
+  const key = opts.dedupe ? dedupeKey(event) : null;
+  void wakeRuntime(event, opts, deps).then((wake) => {
+    if (!wake.ok) {
+      if (key) dedupeStore.forget(key);
+      logFn(formatWakeFailed(event, wake.reason));
+    }
+  }).catch((err) => {
+    if (key) dedupeStore.forget(key);
+    const msg = err instanceof Error ? err.message : String(err);
+    logFn(formatWakeFailed(event, msg.slice(0, 200)));
+  });
+}
+
+// src/commands/listen.ts
 var STRIP_HEADERS = /* @__PURE__ */ new Set([
   "host",
   "content-length",
@@ -1408,12 +1746,28 @@ function errorResponse(id, status, detail) {
 async function dispatchA2aRequest(frame, opts, send, deps = {}) {
   const bodyBuf = decodeBody(frame);
   try {
+    if (opts.runtime) {
+      const store = deps.dedupeStore ?? new DedupeStore(opts.runtime.dedupeTtlSec);
+      dispatchLocalReceiver(
+        frame.id,
+        bodyBuf.toString("utf-8"),
+        opts.runtime,
+        store,
+        send,
+        {
+          fetchFn: deps.fetchFn,
+          spawnFn: deps.spawnFn,
+          logFn: deps.logFn
+        }
+      );
+      return;
+    }
     if (opts.forward) {
       await forwardToHttp(frame, bodyBuf, opts.forward, deps.fetchFn ?? fetch, send);
       return;
     }
     if (opts.exec) {
-      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process.spawn));
+      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process2.spawn));
       return;
     }
     send(errorResponse(frame.id, 500, "no handler configured"));
@@ -1518,13 +1872,15 @@ function runListener(cfg) {
   const wsUrl = toWebsocketUrl(cfg.baseUrl, cfg.agentId);
   let backoff = INITIAL_BACKOFF_MS;
   let stopped = false;
+  const dedupeStore = cfg.runtime ? new DedupeStore(cfg.runtime.dedupeTtlSec) : void 0;
   const connect = () => {
     const ws = new import_ws.default(wsUrl, {
       headers: { Authorization: `Bearer ${cfg.apiKey}` }
     });
     let keepalive;
     ws.on("open", () => {
-      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl}`);
+      const mode = cfg.runtime ? `runtime=${cfg.runtime.runtime}` : cfg.forward ? `forward=${cfg.forward}` : `exec`;
+      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl} (${mode})`);
       backoff = INITIAL_BACKOFF_MS;
       keepalive = setInterval(() => {
         if (ws.readyState === import_ws.default.OPEN) {
@@ -1547,7 +1903,7 @@ function runListener(cfg) {
             ws.send(JSON.stringify(out));
           }
         };
-        void dispatchA2aRequest(f, cfg, send);
+        void dispatchA2aRequest(f, cfg, send, { dedupeStore });
       }
     });
     ws.on("close", (code, reason) => {
@@ -1576,47 +1932,114 @@ function runListener(cfg) {
   });
   connect();
 }
+function collectWakeHeader(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function validateListenHandlerFlags(opts) {
+  const modes = [opts.runtime, opts.forward, opts.exec].filter(Boolean);
+  if (modes.length === 0) {
+    return "Provide a handler: --runtime http|command|log (recommended), or legacy --forward <url> / --exec <command>.";
+  }
+  if (modes.length > 1) {
+    return "Use only one handler: --runtime, --forward, or --exec \u2014 not combined.";
+  }
+  return validateRuntimeOptions({
+    runtime: opts.runtime,
+    wakeUrl: opts.wakeUrl,
+    wakeExec: opts.wakeExec
+  });
+}
 function listenCommand() {
   const cmd = new import_commander10.Command("listen").description(
-    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). For agents with no public endpoint."
+    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). Prefer --runtime for production; --forward/--exec remain as compatibility tunnels."
+  ).option(
+    "--runtime <id>",
+    "Built-in A2A receiver + wake host: http | command | log (no local A2A port)"
+  ).option("--wake-url <url>", "POST target for --runtime http").option(
+    "--wake-header <k:v>",
+    "Extra header for --runtime http (repeatable)",
+    collectWakeHeader,
+    []
   ).option(
+    "--wake-exec <cmd>",
+    "Shell command for --runtime command (event JSON on stdin). Not the same as legacy --exec (which must print a full A2A response)."
+  ).option(
+    "--wake-timeout <ms>",
+    "Wake timeout in ms (default 5000)",
+    String(DEFAULT_WAKE_TIMEOUT_MS)
+  ).option("--no-dedupe", "Disable in-process task/message id dedupe (default: on)").option("--dedupe-ttl <sec>", "Dedupe window seconds (default 3600)", "3600").option(
     "--forward <url>",
-    "Tunnel each relayed request to a local HTTP server (e.g. http://localhost:8080)"
+    "Compat: tunnel each request to a local A2A HTTP server"
   ).option(
     "--exec <command>",
-    "Run a shell command per request: body on stdin, stdout becomes the response"
-  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action((opts) => {
-    const config = loadConfig();
-    const apiKey = config.api_key;
-    const agentId = opts.agentId ?? config.agent_id;
-    if (!apiKey) {
-      console.error(
-        "No API key found. Run `acn join` first or `acn config set api-key <key>`."
-      );
-      process.exit(1);
-    }
-    if (!agentId) {
-      console.error(
-        "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
-      );
-      process.exit(1);
-    }
-    if (!opts.forward && !opts.exec) {
-      console.error("Provide a handler: --forward <url> or --exec <command>.");
-      process.exit(1);
-    }
-    if (opts.forward && opts.exec) {
-      console.error("Use only one handler: --forward or --exec, not both.");
-      process.exit(1);
+    "Compat: shell per request; stdout must be a full A2A JSON-RPC response"
+  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
+    (opts) => {
+      const config = loadConfig();
+      const apiKey = config.api_key;
+      const agentId = opts.agentId ?? config.agent_id;
+      if (!apiKey) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      if (!agentId) {
+        console.error(
+          "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
+        );
+        process.exit(1);
+      }
+      const flagErr = validateListenHandlerFlags({
+        runtime: opts.runtime,
+        forward: opts.forward,
+        exec: opts.exec,
+        wakeUrl: opts.wakeUrl,
+        wakeExec: opts.wakeExec
+      });
+      if (flagErr) {
+        console.error(flagErr);
+        process.exit(1);
+      }
+      let wakeHeaders;
+      if (opts.runtime === "http") {
+        try {
+          wakeHeaders = parseWakeHeaders(opts.wakeHeader);
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+      const wakeTimeoutMs = Number.parseInt(opts.wakeTimeout ?? "", 10);
+      const dedupeTtlSec = Number.parseInt(opts.dedupeTtl ?? "", 10);
+      if (opts.runtime && (!Number.isFinite(wakeTimeoutMs) || wakeTimeoutMs <= 0)) {
+        console.error("--wake-timeout must be a positive integer (ms).");
+        process.exit(1);
+      }
+      if (opts.runtime && (!Number.isFinite(dedupeTtlSec) || dedupeTtlSec <= 0)) {
+        console.error("--dedupe-ttl must be a positive integer (seconds).");
+        process.exit(1);
+      }
+      runListener({
+        agentId,
+        apiKey,
+        baseUrl: config.base_url,
+        forward: opts.forward,
+        exec: opts.exec,
+        runtime: opts.runtime ? {
+          runtime: opts.runtime,
+          wakeUrl: opts.wakeUrl,
+          wakeHeaders,
+          wakeExec: opts.wakeExec,
+          wakeTimeoutMs,
+          // commander: --no-dedupe sets dedupe=false; default true
+          dedupe: opts.dedupe !== false,
+          dedupeTtlSec
+        } : void 0
+      });
     }
-    runListener({
-      agentId,
-      apiKey,
-      baseUrl: config.base_url,
-      forward: opts.forward,
-      exec: opts.exec
-    });
-  });
+  );
   return cmd;
 }
 
@@ -1707,8 +2130,9 @@ function deliveryCommand() {
         );
         const followUp = res.delivery === "relay" ? [
           "",
-          "Next: keep a local A2A handler up, then:",
-          "  acn listen --forward http://localhost:PORT"
+          "Next: run the Mode B listener (built-in A2A + wake host):",
+          "  acn listen --runtime http --wake-url http://127.0.0.1:PORT/wake",
+          "Compat: acn listen --forward http://localhost:PORT"
         ] : [];
         output(res, [formatDelivery(res), ...followUp].join("\n"));
       } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acnlabs/acn-cli",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "description": "Official CLI for ACN (Agent Collaboration Network) — zero-integration agent access",
   "main": "dist/index.js",
   "bin": {