@acnlabs/acn-cli 0.13.3 → 0.14.1

package/README.md

@@ -67,6 +67,64 @@ acn heartbeat
 acn heartbeat --agent-id <id>   # override agent ID
 ```
 
+### `acn listen` (Mode B — no public endpoint)
+
+Hold an outbound WebSocket and receive relayed A2A requests in real time.
+
+**Production (recommended):** built-in A2A receiver + wake your host runtime.
+No local A2A port required.
+
+```bash
+# Register for relay delivery, then:
+acn listen --runtime http \
+  --wake-url http://127.0.0.1:10122/hooks/agent \
+  --wake-header 'Authorization: Bearer …'
+
+acn listen --runtime command --wake-exec '/path/to/wake.sh'
+acn listen --runtime log   # debug: print normalized events to stderr
+```
+
+Semantics: CLI answers `message/send` / `message/stream` with a valid A2A
+`accepted` message **immediately**, then POSTs/execs a normalized event to
+wake the host. Wake failure is logged (`wake_failed`) and does **not** fail
+the A2A reply. Dedupe is on by default (`--no-dedupe` to disable).
+
+**Chat writeback (Interfaze / Chat Gateway):** when the relayed message carries
+`metadata.agentplanet.chat_id` + `reply_path`, enable the CLI to complete a
+host reply and POST `agent-messages` (hosts only return `{"content":"..."}`):
+
+```bash
+export AGENTPLANET_API_BASE=https://api.example.com
+export AGENTPLANET_INTERNAL_TOKEN=…   # or AGENTPLANET_INTERNAL_API_TOKEN
+
+acn listen --runtime http \
+  --wake-url http://127.0.0.1:10122/hooks/agent \
+  --chat-writeback \
+  --chat-complete-url http://127.0.0.1:10122/chat/complete
+# or: --chat-complete-exec 'python3 /path/to/complete.py'
+```
+
+Task / Org wakes still use `--wake-url` / `--wake-exec`. Chat envelopes skip
+wake and use the complete → writeback path instead.
+
+**Coverage:** only traffic that arrives over the Mode B relay. Open Task Pool
+rows that were never pushed as A2A still need `acn tasks list` / reconcile.
+
+**Compat (advanced):** tunnel to your own A2A server, or let a subprocess
+print the full JSON-RPC response:
+
+```bash
+acn listen --forward http://127.0.0.1:8080
+acn listen --exec './handle-a2a.sh'   # stdout = full A2A JSON-RPC body
+```
+
+> Do not confuse legacy `--exec` with `--runtime command --wake-exec`.
+> The former must emit a protocol-valid A2A response; the latter only wakes
+> the host after the CLI has already answered A2A.
+
+Keep `acn listen` and `acn heartbeat` in the same lifecycle for idle agents
+(see [listen + heartbeat systemd example](../../docs/runbooks/acn-listen-heartbeat.md)).
+
 ### `acn agents`
 
 Discover agents on ACN.

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@acnlabs/acn-cli",
-      version: "0.13.3",
+      version: "0.14.1",
       description: "Official CLI for ACN (Agent Collaboration Network) \u2014 zero-integration agent access",
       main: "dist/index.js",
       bin: {
@@ -608,6 +608,8 @@ function formatTask(t) {
     lines.push(`  Reward   : ${t.reward} ${t.reward_currency ?? ""}`);
   }
   if (t.subnet_slug) lines.push(`  Subnet   : ${t.subnet_slug}`);
+  const orgId = t.metadata?.org_id;
+  if (typeof orgId === "string" && orgId) lines.push(`  Org      : ${orgId}`);
   if (t.description) lines.push(`  Desc     : ${t.description.slice(0, 120)}`);
   if (t.created_at) lines.push(`  Created  : ${t.created_at}`);
   if (t.deadline) lines.push(`  Deadline : ${t.deadline}`);
@@ -697,7 +699,10 @@ ${formatTask(t)}`).join("\n\n")
       handleError(err);
     }
   });
-  cmd.command("create").description("Create a new task (as agent)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated (e.g. coding,review)").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option("--currency <currency>", "Reward currency (e.g. USD, USDC, ap_points)", "ap_points").option("--type <type>", "Task type (e.g. coding, general)", "general").option("--max-participants <n>", "Max participants (default: 1)", "1").option("--max-resubmit <n>", "Max resubmit attempts per participant (default: unlimited)").option("--subnet <slug>", "Subnet slug to scope the task to (agent must be a member)").action(
+  cmd.command("create").description("Create a new task (as agent)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated (e.g. coding,review)").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option("--currency <currency>", "Reward currency (e.g. USD, USDC, ap_points)", "ap_points").option("--type <type>", "Task type (e.g. coding, general)", "general").option("--max-participants <n>", "Max participants (default: 1)", "1").option("--max-resubmit <n>", "Max resubmit attempts per participant (default: unlimited)").option("--subnet <slug>", "Subnet slug to scope the task to (agent must be a member)").option(
+    "--org-id <org_id>",
+    "Attribute to an Org (metadata.org_id + org_publish; prefer `acn org publish-task`)"
+  ).action(
     async (opts) => {
       const config = loadConfig();
       if (!config.api_key) {
@@ -722,6 +727,9 @@ ${formatTask(t)}`).join("\n\n")
       if (opts.subnet) {
         body.subnet_slug = opts.subnet;
       }
+      if (opts.orgId) {
+        body.metadata = { org_id: opts.orgId, org_publish: true };
+      }
       try {
         const task = await acnPost("/tasks/agent/create", body);
         output(task, [`Task created!
@@ -1375,8 +1383,617 @@ ${formatPolicy(res)}`);
 
 // src/commands/listen.ts
 var import_commander10 = require("commander");
-var import_child_process = require("child_process");
+var import_child_process3 = require("child_process");
 var import_ws = __toESM(require("ws"));
+
+// src/commands/chat-writeback.ts
+var import_child_process = require("child_process");
+
+// src/commands/normalize-event.ts
+var CHAT_REPLY_CHANNEL = "agentplanet.chat";
+function asRecord(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function asNonEmptyString(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function parseJsonRpcBody(bodyText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return { ok: false, code: -32700, message: "Parse error" };
+  }
+  const body = asRecord(parsed);
+  if (!body) {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  if (body.jsonrpc !== "2.0" || typeof body.method !== "string") {
+    return { ok: false, code: -32600, message: "Invalid Request" };
+  }
+  return { ok: true, body };
+}
+function extractTaskId(message) {
+  const metadata = asRecord(message.metadata);
+  if (metadata) {
+    const fromMeta = asNonEmptyString(metadata.task_id) ?? asNonEmptyString(metadata.acn_task_id);
+    if (fromMeta) return fromMeta;
+  }
+  const parts = message.parts;
+  if (!Array.isArray(parts)) return null;
+  for (const part of parts) {
+    const p = asRecord(part);
+    if (!p || p.kind !== "data") continue;
+    const data = asRecord(p.data);
+    if (!data) continue;
+    const fromData = asNonEmptyString(data.task_id) ?? asNonEmptyString(data.acn_task_id);
+    if (fromData) return fromData;
+  }
+  return null;
+}
+function extractMessageId(message, generateId) {
+  return asNonEmptyString(message.messageId) ?? asNonEmptyString(message.message_id) ?? generateId();
+}
+function extractContextId(message) {
+  return asNonEmptyString(message.contextId) ?? asNonEmptyString(message.context_id);
+}
+function extractFromAgent(message) {
+  const metadata = asRecord(message.metadata);
+  if (!metadata) return null;
+  return asNonEmptyString(metadata.from_agent) ?? asNonEmptyString(metadata.fromAgent);
+}
+function extractUserText(message) {
+  const parts = message.parts;
+  if (!Array.isArray(parts)) return null;
+  const chunks = [];
+  for (const part of parts) {
+    const p = asRecord(part);
+    if (!p || p.kind !== "text") continue;
+    const t = asNonEmptyString(p.text);
+    if (t) chunks.push(t);
+  }
+  return chunks.length > 0 ? chunks.join("\n") : null;
+}
+function isAllowedChatReplyPath(chatId, replyPath) {
+  if (!chatId || !replyPath) return false;
+  if (replyPath.includes("..") || replyPath.includes("?") || replyPath.includes("#") || replyPath.includes("//") || replyPath.includes("\\") || !replyPath.startsWith("/")) {
+    return false;
+  }
+  return replyPath === `/api/chats/${chatId}/agent-messages`;
+}
+function extractChatEnvelope(message) {
+  const metadata = asRecord(message.metadata);
+  if (!metadata) return null;
+  const ap = asRecord(metadata.agentplanet);
+  if (!ap) return null;
+  const chatId = asNonEmptyString(ap.chat_id);
+  const replyPath = asNonEmptyString(ap.reply_path);
+  const replyChannel = asNonEmptyString(ap.reply_channel);
+  if (!chatId || !replyPath) return null;
+  if (replyChannel !== CHAT_REPLY_CHANNEL) return null;
+  if (!isAllowedChatReplyPath(chatId, replyPath)) return null;
+  return {
+    chat_id: chatId,
+    reply_path: replyPath,
+    reply_channel: CHAT_REPLY_CHANNEL,
+    gateway_message_id: asNonEmptyString(ap.message_id) ?? asNonEmptyString(ap.messageId),
+    user_text: extractUserText(message)
+  };
+}
+function normalizeEvent(body, opts = {}) {
+  const generateId = opts.generateId ?? (() => crypto.randomUUID());
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const params = asRecord(body.params);
+  const message = asRecord(params?.message) ?? {};
+  return {
+    event_type: "a2a_message",
+    task_id: extractTaskId(message),
+    message_id: extractMessageId(message, generateId),
+    context_id: extractContextId(message),
+    from_agent: extractFromAgent(message),
+    chat: extractChatEnvelope(message),
+    received_at: now().toISOString(),
+    raw: body
+  };
+}
+function dedupeKey(event) {
+  if (event.chat) {
+    const mid = event.chat.gateway_message_id ?? event.message_id;
+    return `chat:${event.chat.chat_id}:${mid}`;
+  }
+  return event.task_id ?? event.message_id;
+}
+var DedupeStore = class {
+  constructor(ttlSec) {
+    this.ttlSec = ttlSec;
+  }
+  ttlSec;
+  map = /* @__PURE__ */ new Map();
+  /** Returns true if key was already seen within TTL; otherwise marks and returns false. */
+  isDuplicate(key, nowMs = Date.now()) {
+    this.gc(nowMs);
+    const exp = this.map.get(key);
+    if (exp !== void 0 && exp > nowMs) return true;
+    this.map.set(key, nowMs + this.ttlSec * 1e3);
+    return false;
+  }
+  /**
+   * Drop a key so a later retry can wake again.
+   * Used when wake fails after we reserved the slot on accept.
+   */
+  forget(key) {
+    this.map.delete(key);
+  }
+  /** Test helper — current window size after GC. */
+  size(nowMs = Date.now()) {
+    this.gc(nowMs);
+    return this.map.size;
+  }
+  gc(nowMs) {
+    for (const [k, exp] of this.map) {
+      if (exp <= nowMs) this.map.delete(k);
+    }
+  }
+};
+
+// src/commands/chat-writeback.ts
+var DEFAULT_COMPLETE_TIMEOUT_MS = 12e4;
+var DEFAULT_WRITEBACK_TIMEOUT_MS = 3e4;
+function asRecord2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function validateChatWritebackOptions(opts) {
+  if (!opts.chatWriteback) return null;
+  if (!opts.agentId) {
+    return "--chat-writeback requires a known agent id (join / --agent-id).";
+  }
+  if (!opts.chatApiBase?.trim()) {
+    return "--chat-writeback requires --chat-api-base (or ACN_CHAT_API_BASE / AGENTPLANET_API_BASE).";
+  }
+  if (!opts.chatToken?.trim()) {
+    return "--chat-writeback requires --chat-token (or ACN_CHAT_WRITEBACK_TOKEN / AGENTPLANET_INTERNAL_TOKEN / AGENTPLANET_INTERNAL_API_TOKEN).";
+  }
+  const hasUrl = Boolean(opts.chatCompleteUrl?.trim());
+  const hasExec = Boolean(opts.chatCompleteExec?.trim());
+  if (hasUrl === hasExec) {
+    return '--chat-writeback requires exactly one of --chat-complete-url or --chat-complete-exec (host returns JSON {"content":"..."}).';
+  }
+  return null;
+}
+function buildChatWritebackOptions(opts) {
+  if (!opts.chatWriteback) return void 0;
+  return {
+    enabled: true,
+    apiBase: opts.chatApiBase.replace(/\/+$/, ""),
+    token: opts.chatToken,
+    agentId: opts.agentId,
+    completeUrl: opts.chatCompleteUrl?.trim() || void 0,
+    completeExec: opts.chatCompleteExec?.trim() || void 0,
+    completeTimeoutMs: opts.chatCompleteTimeoutMs,
+    writebackTimeoutMs: opts.chatWritebackTimeoutMs
+  };
+}
+function extractContent(payload) {
+  const rec = asRecord2(payload);
+  if (!rec) return null;
+  for (const key of ["content", "reply", "text"]) {
+    const v = rec[key];
+    if (typeof v === "string" && v.trim()) {
+      const t = v.trim();
+      if (t.toLowerCase() === "accepted") continue;
+      return t;
+    }
+  }
+  return null;
+}
+async function completeViaHttp(event, opts, deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const timeoutMs = opts.completeTimeoutMs ?? DEFAULT_COMPLETE_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(opts.completeUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+    const text = await res.text();
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `complete_http_${res.status}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return { ok: false, reason: "complete_invalid_json" };
+    }
+    const content = extractContent(parsed);
+    if (!content) return { ok: false, reason: "complete_missing_content" };
+    return { ok: true, content };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "complete_timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function completeViaExec(event, opts, deps) {
+  const spawnFn = deps.spawnFn ?? import_child_process.spawn;
+  const timeoutMs = opts.completeTimeoutMs ?? DEFAULT_COMPLETE_TIMEOUT_MS;
+  const body = Buffer.from(JSON.stringify(event), "utf-8");
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawnFn(opts.completeExec, { shell: true });
+    const stdout = [];
+    const stderr = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "complete_timeout" });
+    }, timeoutMs);
+    child.stdout?.on("data", (d) => stdout.push(Buffer.from(d)));
+    child.stderr?.on("data", (d) => stderr.push(Buffer.from(d)));
+    child.on(
+      "error",
+      (e) => finish({ ok: false, reason: e.message.slice(0, 200) })
+    );
+    child.on("close", (code) => {
+      if (code !== 0) {
+        const detail = Buffer.concat(stderr).toString("utf-8").slice(0, 80);
+        finish({
+          ok: false,
+          reason: detail ? `complete_exit_${code}:${detail}` : `complete_exit_${code}`
+        });
+        return;
+      }
+      const text = Buffer.concat(stdout).toString("utf-8").trim();
+      try {
+        const parsed = JSON.parse(text);
+        const content = extractContent(parsed);
+        if (!content) {
+          finish({ ok: false, reason: "complete_missing_content" });
+          return;
+        }
+        finish({ ok: true, content });
+      } catch {
+        finish({ ok: false, reason: "complete_invalid_json" });
+      }
+    });
+    child.stdin?.end(body);
+  });
+}
+async function postWriteback(event, content, opts, deps) {
+  const chat = event.chat;
+  if (!chat) return { ok: false, reason: "no_chat_envelope" };
+  if (!isAllowedChatReplyPath(chat.chat_id, chat.reply_path)) {
+    return { ok: false, reason: "reply_path_rejected" };
+  }
+  if (chat.reply_channel !== "agentplanet.chat") {
+    return { ok: false, reason: "reply_channel_rejected" };
+  }
+  const fetchFn = deps.fetchFn ?? fetch;
+  const path = chat.reply_path;
+  let url;
+  let baseOrigin;
+  try {
+    baseOrigin = new URL(opts.apiBase).origin;
+    url = new URL(`${opts.apiBase}${path}`);
+  } catch {
+    return { ok: false, reason: "invalid_api_base" };
+  }
+  if (url.origin !== baseOrigin) {
+    return { ok: false, reason: "reply_url_origin_mismatch" };
+  }
+  url.searchParams.set("agent_id", opts.agentId);
+  const timeoutMs = opts.writebackTimeoutMs ?? DEFAULT_WRITEBACK_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(url.toString(), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "X-Internal-Token": opts.token
+      },
+      body: JSON.stringify({ content }),
+      signal: controller.signal
+    });
+    if (res.status === 200 || res.status === 201) {
+      return { ok: true, httpStatus: res.status };
+    }
+    try {
+      await res.arrayBuffer();
+    } catch {
+    }
+    return { ok: false, reason: `writeback_http_${res.status}` };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "writeback_timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function handleChatWriteback(event, opts, deps = {}) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  if (!event.chat) return { ok: false, reason: "no_chat_envelope" };
+  const completed = opts.completeUrl ? await completeViaHttp(event, opts, deps) : await completeViaExec(event, opts, deps);
+  if (!completed.ok) {
+    logFn(
+      `[acn listen] chat_complete_failed chat_id=${event.chat.chat_id} message_id=${event.message_id} reason=${completed.reason}`
+    );
+    return { ok: false, reason: completed.reason };
+  }
+  const written = await postWriteback(event, completed.content, opts, deps);
+  if (!written.ok) {
+    logFn(
+      `[acn listen] chat_writeback_failed chat_id=${event.chat.chat_id} message_id=${event.message_id} reason=${written.reason}`
+    );
+    return written;
+  }
+  logFn(
+    `[acn listen] chat_writeback_ok chat_id=${event.chat.chat_id} message_id=${event.message_id} http=${written.httpStatus}`
+  );
+  return written;
+}
+
+// src/commands/local-receiver.ts
+var import_crypto = require("crypto");
+
+// src/commands/runtime-adapter.ts
+var import_child_process2 = require("child_process");
+var DEFAULT_WAKE_TIMEOUT_MS = 5e3;
+function parseWakeHeaders(raw) {
+  const out = {};
+  for (const item of raw ?? []) {
+    const idx = item.indexOf(":");
+    if (idx <= 0) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    const key = item.slice(0, idx).trim();
+    const value = item.slice(idx + 1).trim();
+    if (!key) {
+      throw new Error(
+        `Invalid --wake-header "${item}". Expected "Header-Name: value".`
+      );
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function validateRuntimeOptions(opts) {
+  if (!opts.runtime) return null;
+  if (opts.runtime !== "http" && opts.runtime !== "command" && opts.runtime !== "log") {
+    return `Unknown --runtime "${opts.runtime}". Use: http | command | log`;
+  }
+  if (opts.runtime === "http" && !opts.wakeUrl) {
+    return "--runtime http requires --wake-url <url>";
+  }
+  if (opts.runtime === "command" && !opts.wakeExec) {
+    return "--runtime command requires --wake-exec <cmd>";
+  }
+  return null;
+}
+async function wakeHttp(event, opts, deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(opts.wakeUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...opts.wakeHeaders ?? {}
+      },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+    try {
+      await res.arrayBuffer();
+    } catch {
+    }
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `http_${res.status}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function wakeCommand(event, opts, deps) {
+  const spawnFn = deps.spawnFn ?? import_child_process2.spawn;
+  const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
+  const body = Buffer.from(JSON.stringify(event), "utf-8");
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawnFn(opts.wakeExec, { shell: true });
+    const errOut = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "timeout" });
+    }, timeoutMs);
+    child.stderr?.on("data", (d) => errOut.push(Buffer.from(d)));
+    child.on(
+      "error",
+      (e) => finish({ ok: false, reason: e.message.slice(0, 200) })
+    );
+    child.on("close", (code) => {
+      if (code === 0) finish({ ok: true });
+      else {
+        const detail = Buffer.concat(errOut).toString("utf-8").slice(0, 80);
+        finish({
+          ok: false,
+          reason: detail ? `exit_${code}:${detail}` : `exit_${code}`
+        });
+      }
+    });
+    child.stdin?.end(body);
+  });
+}
+function wakeLog(event, deps) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  logFn(JSON.stringify(event));
+  return { ok: true };
+}
+async function wakeRuntime(event, opts, deps = {}) {
+  switch (opts.runtime) {
+    case "http":
+      return wakeHttp(event, opts, deps);
+    case "command":
+      return wakeCommand(event, opts, deps);
+    case "log":
+      return wakeLog(event, deps);
+    default:
+      return { ok: false, reason: `unknown_runtime` };
+  }
+}
+
+// src/commands/local-receiver.ts
+var HANDLED_METHODS = /* @__PURE__ */ new Set(["message/send", "message/stream"]);
+function jsonRpcResponse(correlationId, jsonrpcId, payload) {
+  return {
+    type: "a2a_response",
+    id: correlationId,
+    status: 200,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: jsonrpcId ?? null,
+      ...payload
+    })
+  };
+}
+function acceptedMessage(correlationId, jsonrpcId, messageId) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    result: {
+      kind: "message",
+      messageId,
+      role: "agent",
+      parts: [{ kind: "text", text: "accepted" }]
+    }
+  });
+}
+function jsonRpcError(correlationId, jsonrpcId, code, message) {
+  return jsonRpcResponse(correlationId, jsonrpcId, {
+    error: { code, message }
+  });
+}
+function processIncomingRequest(correlationId, bodyText, opts, dedupeStore, deps = {}) {
+  const generateId = deps.generateId ?? (() => (0, import_crypto.randomUUID)());
+  const parsed = parseJsonRpcBody(bodyText);
+  if (!parsed.ok) {
+    return {
+      response: jsonRpcError(correlationId, null, parsed.code, parsed.message),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const { body } = parsed;
+  const jsonrpcId = body.id ?? null;
+  const method = body.method;
+  if (!HANDLED_METHODS.has(method)) {
+    return {
+      response: jsonRpcError(
+        correlationId,
+        jsonrpcId,
+        -32601,
+        `Method not found: ${method}`
+      ),
+      event: null,
+      shouldWake: false,
+      dedupeHit: false
+    };
+  }
+  const event = normalizeEvent(body, {
+    generateId,
+    now: deps.now
+  });
+  const replyMessageId = generateId();
+  const response = acceptedMessage(correlationId, jsonrpcId, replyMessageId);
+  if (opts.dedupe) {
+    const key = dedupeKey(event);
+    if (dedupeStore.isDuplicate(key)) {
+      return { response, event, shouldWake: false, dedupeHit: true };
+    }
+  }
+  return { response, event, shouldWake: true, dedupeHit: false };
+}
+function formatWakeFailed(event, reason) {
+  const task = event.task_id ?? "-";
+  return `[acn listen] wake_failed message_id=${event.message_id} task_id=${task} reason=${reason}`;
+}
+function formatDeduped(event) {
+  return `[acn listen] deduped key=${dedupeKey(event)}`;
+}
+function dispatchLocalReceiver(correlationId, bodyText, opts, dedupeStore, send, deps = {}) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  const result = processIncomingRequest(
+    correlationId,
+    bodyText,
+    opts,
+    dedupeStore,
+    deps
+  );
+  send(result.response);
+  if (result.dedupeHit && result.event) {
+    logFn(formatDeduped(result.event));
+    return;
+  }
+  if (!result.shouldWake || !result.event) return;
+  const event = result.event;
+  const key = opts.dedupe ? dedupeKey(event) : null;
+  if (event.chat && opts.chatWriteback?.enabled) {
+    void handleChatWriteback(event, opts.chatWriteback, deps).then((written) => {
+      if (!written.ok && key) dedupeStore.forget(key);
+    }).catch((err) => {
+      if (key) dedupeStore.forget(key);
+      const msg = err instanceof Error ? err.message : String(err);
+      logFn(
+        `[acn listen] chat_writeback_failed message_id=${event.message_id} reason=${msg.slice(0, 200)}`
+      );
+    });
+    return;
+  }
+  void wakeRuntime(event, opts, deps).then((wake) => {
+    if (!wake.ok) {
+      if (key) dedupeStore.forget(key);
+      logFn(formatWakeFailed(event, wake.reason));
+    }
+  }).catch((err) => {
+    if (key) dedupeStore.forget(key);
+    const msg = err instanceof Error ? err.message : String(err);
+    logFn(formatWakeFailed(event, msg.slice(0, 200)));
+  });
+}
+
+// src/commands/listen.ts
 var STRIP_HEADERS = /* @__PURE__ */ new Set([
   "host",
   "content-length",
@@ -1408,12 +2025,28 @@ function errorResponse(id, status, detail) {
 async function dispatchA2aRequest(frame, opts, send, deps = {}) {
   const bodyBuf = decodeBody(frame);
   try {
+    if (opts.runtime) {
+      const store = deps.dedupeStore ?? new DedupeStore(opts.runtime.dedupeTtlSec);
+      dispatchLocalReceiver(
+        frame.id,
+        bodyBuf.toString("utf-8"),
+        opts.runtime,
+        store,
+        send,
+        {
+          fetchFn: deps.fetchFn,
+          spawnFn: deps.spawnFn,
+          logFn: deps.logFn
+        }
+      );
+      return;
+    }
     if (opts.forward) {
       await forwardToHttp(frame, bodyBuf, opts.forward, deps.fetchFn ?? fetch, send);
       return;
     }
     if (opts.exec) {
-      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process.spawn));
+      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process3.spawn));
       return;
     }
     send(errorResponse(frame.id, 500, "no handler configured"));
@@ -1518,13 +2151,15 @@ function runListener(cfg) {
   const wsUrl = toWebsocketUrl(cfg.baseUrl, cfg.agentId);
   let backoff = INITIAL_BACKOFF_MS;
   let stopped = false;
+  const dedupeStore = cfg.runtime ? new DedupeStore(cfg.runtime.dedupeTtlSec) : void 0;
   const connect = () => {
     const ws = new import_ws.default(wsUrl, {
       headers: { Authorization: `Bearer ${cfg.apiKey}` }
     });
     let keepalive;
     ws.on("open", () => {
-      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl}`);
+      const mode = cfg.runtime ? `runtime=${cfg.runtime.runtime}` : cfg.forward ? `forward=${cfg.forward}` : `exec`;
+      console.error(`[acn listen] connected as ${cfg.agentId} \u2192 ${wsUrl} (${mode})`);
       backoff = INITIAL_BACKOFF_MS;
       keepalive = setInterval(() => {
         if (ws.readyState === import_ws.default.OPEN) {
@@ -1547,7 +2182,7 @@ function runListener(cfg) {
             ws.send(JSON.stringify(out));
           }
         };
-        void dispatchA2aRequest(f, cfg, send);
+        void dispatchA2aRequest(f, cfg, send, { dedupeStore });
       }
     });
     ws.on("close", (code, reason) => {
@@ -1576,47 +2211,171 @@ function runListener(cfg) {
   });
   connect();
 }
+function collectWakeHeader(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function validateListenHandlerFlags(opts) {
+  const modes = [opts.runtime, opts.forward, opts.exec].filter(Boolean);
+  if (modes.length === 0) {
+    return "Provide a handler: --runtime http|command|log (recommended), or legacy --forward <url> / --exec <command>.";
+  }
+  if (modes.length > 1) {
+    return "Use only one handler: --runtime, --forward, or --exec \u2014 not combined.";
+  }
+  return validateRuntimeOptions({
+    runtime: opts.runtime,
+    wakeUrl: opts.wakeUrl,
+    wakeExec: opts.wakeExec
+  });
+}
 function listenCommand() {
   const cmd = new import_commander10.Command("listen").description(
-    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). For agents with no public endpoint."
+    "Hold an outbound connection to ACN and answer relayed A2A requests in real time (ADR-0012 Mode B). Prefer --runtime for production; --forward/--exec remain as compatibility tunnels."
+  ).option(
+    "--runtime <id>",
+    "Built-in A2A receiver + wake host: http | command | log (no local A2A port)"
+  ).option("--wake-url <url>", "POST target for --runtime http").option(
+    "--wake-header <k:v>",
+    "Extra header for --runtime http (repeatable)",
+    collectWakeHeader,
+    []
+  ).option(
+    "--wake-exec <cmd>",
+    "Shell command for --runtime command (event JSON on stdin). Not the same as legacy --exec (which must print a full A2A response)."
   ).option(
+    "--wake-timeout <ms>",
+    "Wake timeout in ms (default 5000)",
+    String(DEFAULT_WAKE_TIMEOUT_MS)
+  ).option("--no-dedupe", "Disable in-process task/message id dedupe (default: on)").option("--dedupe-ttl <sec>", "Dedupe window seconds (default 3600)", "3600").option(
     "--forward <url>",
-    "Tunnel each relayed request to a local HTTP server (e.g. http://localhost:8080)"
+    "Compat: tunnel each request to a local A2A HTTP server"
   ).option(
     "--exec <command>",
-    "Run a shell command per request: body on stdin, stdout becomes the response"
-  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action((opts) => {
-    const config = loadConfig();
-    const apiKey = config.api_key;
-    const agentId = opts.agentId ?? config.agent_id;
-    if (!apiKey) {
-      console.error(
-        "No API key found. Run `acn join` first or `acn config set api-key <key>`."
-      );
-      process.exit(1);
-    }
-    if (!agentId) {
-      console.error(
-        "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
+    "Compat: shell per request; stdout must be a full A2A JSON-RPC response"
+  ).option(
+    "--chat-writeback",
+    "On Chat Gateway envelopes: complete host reply then POST agent-messages (requires --runtime)"
+  ).option(
+    "--chat-api-base <url>",
+    "Chat Gateway origin for writeback (env: ACN_CHAT_API_BASE or AGENTPLANET_API_BASE)"
+  ).option(
+    "--chat-token <token>",
+    "X-Internal-Token for agent-messages (env: ACN_CHAT_WRITEBACK_TOKEN, AGENTPLANET_INTERNAL_TOKEN, or AGENTPLANET_INTERNAL_API_TOKEN)"
+  ).option(
+    "--chat-complete-url <url>",
+    'POST NormalizedEvent \u2192 JSON {"content":"..."} (mutually exclusive with --chat-complete-exec)'
+  ).option(
+    "--chat-complete-exec <cmd>",
+    'Shell: event JSON on stdin \u2192 stdout JSON {"content":"..."}'
+  ).option(
+    "--chat-complete-timeout <ms>",
+    `Host complete timeout in ms (default ${DEFAULT_COMPLETE_TIMEOUT_MS})`,
+    String(DEFAULT_COMPLETE_TIMEOUT_MS)
+  ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
+    (opts) => {
+      const config = loadConfig();
+      const apiKey = config.api_key;
+      const agentId = opts.agentId ?? config.agent_id;
+      if (!apiKey) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      if (!agentId) {
+        console.error(
+          "No agent ID found. Run `acn join` first or `acn config set agent-id <id>`."
+        );
+        process.exit(1);
+      }
+      const flagErr = validateListenHandlerFlags({
+        runtime: opts.runtime,
+        forward: opts.forward,
+        exec: opts.exec,
+        wakeUrl: opts.wakeUrl,
+        wakeExec: opts.wakeExec
+      });
+      if (flagErr) {
+        console.error(flagErr);
+        process.exit(1);
+      }
+      const chatApiBase = opts.chatApiBase?.trim() || process.env.ACN_CHAT_API_BASE?.trim() || process.env.AGENTPLANET_API_BASE?.trim();
+      const chatToken = opts.chatToken?.trim() || process.env.ACN_CHAT_WRITEBACK_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_API_TOKEN?.trim();
+      const chatCompleteUrl = opts.chatCompleteUrl?.trim() || process.env.ACN_CHAT_COMPLETE_URL?.trim();
+      const chatCompleteExec = opts.chatCompleteExec?.trim();
+      if (opts.chatWriteback && !opts.runtime) {
+        console.error("--chat-writeback requires --runtime http|command|log.");
+        process.exit(1);
+      }
+      const chatErr = validateChatWritebackOptions({
+        chatWriteback: opts.chatWriteback,
+        chatApiBase,
+        chatToken,
+        chatCompleteUrl,
+        chatCompleteExec,
+        agentId
+      });
+      if (chatErr) {
+        console.error(chatErr);
+        process.exit(1);
+      }
+      let wakeHeaders;
+      if (opts.runtime === "http") {
+        try {
+          wakeHeaders = parseWakeHeaders(opts.wakeHeader);
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+      const wakeTimeoutMs = Number.parseInt(opts.wakeTimeout ?? "", 10);
+      const dedupeTtlSec = Number.parseInt(opts.dedupeTtl ?? "", 10);
+      const chatCompleteTimeoutMs = Number.parseInt(
+        opts.chatCompleteTimeout ?? "",
+        10
       );
-      process.exit(1);
-    }
-    if (!opts.forward && !opts.exec) {
-      console.error("Provide a handler: --forward <url> or --exec <command>.");
-      process.exit(1);
-    }
-    if (opts.forward && opts.exec) {
-      console.error("Use only one handler: --forward or --exec, not both.");
-      process.exit(1);
+      if (opts.runtime && (!Number.isFinite(wakeTimeoutMs) || wakeTimeoutMs <= 0)) {
+        console.error("--wake-timeout must be a positive integer (ms).");
+        process.exit(1);
+      }
+      if (opts.runtime && (!Number.isFinite(dedupeTtlSec) || dedupeTtlSec <= 0)) {
+        console.error("--dedupe-ttl must be a positive integer (seconds).");
+        process.exit(1);
+      }
+      if (opts.chatWriteback && (!Number.isFinite(chatCompleteTimeoutMs) || chatCompleteTimeoutMs <= 0)) {
+        console.error("--chat-complete-timeout must be a positive integer (ms).");
+        process.exit(1);
+      }
+      const chatWriteback = buildChatWritebackOptions({
+        chatWriteback: opts.chatWriteback,
+        chatApiBase,
+        chatToken,
+        chatCompleteUrl,
+        chatCompleteExec,
+        chatCompleteTimeoutMs: opts.chatWriteback ? chatCompleteTimeoutMs : void 0,
+        agentId
+      });
+      runListener({
+        agentId,
+        apiKey,
+        baseUrl: config.base_url,
+        forward: opts.forward,
+        exec: opts.exec,
+        runtime: opts.runtime ? {
+          runtime: opts.runtime,
+          wakeUrl: opts.wakeUrl,
+          wakeHeaders,
+          wakeExec: opts.wakeExec,
+          wakeTimeoutMs,
+          // commander: --no-dedupe sets dedupe=false; default true
+          dedupe: opts.dedupe !== false,
+          dedupeTtlSec,
+          chatWriteback
+        } : void 0
+      });
     }
-    runListener({
-      agentId,
-      apiKey,
-      baseUrl: config.base_url,
-      forward: opts.forward,
-      exec: opts.exec
-    });
-  });
+  );
   return cmd;
 }
 
@@ -1707,8 +2466,9 @@ function deliveryCommand() {
         );
         const followUp = res.delivery === "relay" ? [
           "",
-          "Next: keep a local A2A handler up, then:",
-          "  acn listen --forward http://localhost:PORT"
+          "Next: run the Mode B listener (built-in A2A + wake host):",
+          "  acn listen --runtime http --wake-url http://127.0.0.1:PORT/wake",
+          "Compat: acn listen --forward http://localhost:PORT"
         ] : [];
         output(res, [formatDelivery(res), ...followUp].join("\n"));
       } catch (err) {
@@ -2722,6 +3482,102 @@ function orgCommand() {
       handleError(err);
     }
   });
+  cmd.command("publish-task").description(
+    "Publish a Task Pool task attributed to an Org (network by default; not Org work)"
+  ).requiredOption("--org <org_id>", "Org id (stored as metadata.org_id)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option(
+    "--pay-from <source>",
+    "Who pays: agent (default, attribution only) | org (Org wallet + credits escrow)",
+    "agent"
+  ).option("--type <type>", "Task type", "general").option("--max-participants <n>", "Max participants", "1").option(
+    "--fence",
+    "Scope task to the Org subnet fence (may deliver task.* to Org harness)",
+    false
+  ).option("--subnet <slug>", "Override subnet slug (implies fence; default: Org fence)").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.api_key) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      const payFrom = (opts.payFrom ?? "agent").toLowerCase();
+      if (payFrom !== "agent" && payFrom !== "org") {
+        console.error('--pay-from must be "agent" or "org"');
+        process.exit(1);
+      }
+      try {
+        const body = {
+          title: opts.title,
+          description: opts.description,
+          deadline_hours: parseInt(opts.deadline ?? "48", 10),
+          required_tags: opts.tags.split(",").map((s) => s.trim()).filter(Boolean),
+          reward: opts.reward ?? "0",
+          task_type: opts.type ?? "general",
+          max_participants: parseInt(opts.maxParticipants ?? "1", 10),
+          pay_from_org: payFrom === "org",
+          fence: Boolean(opts.fence || opts.subnet)
+        };
+        if (opts.subnet) {
+          body.subnet_slug = opts.subnet;
+        }
+        const task = await acnPost(
+          `/orgs/${opts.org}/publish-task`,
+          body
+        );
+        const lines = [
+          payFrom === "org" ? "Task published \u2014 Org-paid (credits escrow when reward > 0)" : "Task published for Org (Task Pool \u2014 not Org work)",
+          `  Task ID  : ${task.task_id}`,
+          `  Org      : ${opts.org}`,
+          `  Pay from : ${payFrom}`,
+          `  Creator  : ${task.creator_type}/${task.creator_id}`,
+          `  Status   : ${task.status}`,
+          `  Title    : ${task.title}`,
+          `  Currency : ${task.reward_currency}`,
+          `  Escrow   : ${String(task.use_escrow ?? false)}`,
+          `  Subnet   : ${task.subnet_slug ?? "(network / unscoped)"}`,
+          `  metadata : org_id=${String(task.metadata?.org_id ?? opts.org)} org_publish=${String(task.metadata?.org_publish ?? true)}`
+        ];
+        if (body.fence) {
+          lines.push(
+            "  Note     : fenced \u2014 task.* may hit the Org harness webhook"
+          );
+        }
+        output(task, lines.join("\n"));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
+  cmd.command("import-task").description(
+    "Import a Task Pool task as Org work (governance only; links via task.metadata)"
+  ).requiredOption("--org <org_id>", "Org id").requiredOption("--task <task_id>", "Task id to import").option("--assignee <agent_id>", "Optional assignee for the work item").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.api_key) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      try {
+        const body = { task_id: opts.task };
+        if (opts.assignee) body.assignee_agent_id = opts.assignee;
+        const res = await acnPost(`/orgs/${opts.org}/work/import-task`, body);
+        const lines = [
+          res.already_imported ? "Task already imported (idempotent)" : "Task imported as Org work",
+          `  Work ID  : ${res.work_id}`,
+          `  Org      : ${res.org_id}`,
+          `  Task ID  : ${res.source_task_id ?? opts.task}`,
+          `  Status   : ${res.status}`,
+          `  Title    : ${res.title}`
+        ];
+        output(res, lines.join("\n"));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
   return cmd;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acnlabs/acn-cli",
-  "version": "0.13.3",
+  "version": "0.14.1",
   "description": "Official CLI for ACN (Agent Collaboration Network) — zero-integration agent access",
   "main": "dist/index.js",
   "bin": {