@acnlabs/acn-cli 0.14.0 → 0.14.2

package/README.md

@@ -89,6 +89,27 @@ Semantics: CLI answers `message/send` / `message/stream` with a valid A2A
 wake the host. Wake failure is logged (`wake_failed`) and does **not** fail
 the A2A reply. Dedupe is on by default (`--no-dedupe` to disable).
 
+**Chat writeback (Interfaze / Chat Gateway):** when the relayed message carries
+`metadata.agentplanet.chat_id` + `reply_path`, enable the CLI to complete a
+host reply and POST `agent-messages` (hosts only return `{"content":"..."}`).
+Auth uses an **ACN agent JWT** minted from your config `api_key` (no
+AgentPlanet Internal Token):
+
+```bash
+export AGENTPLANET_API_BASE=https://api.agentplanet.org
+# optional: ACN_CHAT_JWT_AUDIENCE=https://api.agentplanet.org
+
+acn listen --runtime http \
+  --wake-url http://127.0.0.1:10122/hooks/agent \
+  --chat-writeback \
+  --chat-complete-url http://127.0.0.1:10122/chat/complete
+# or: --chat-complete-exec 'python3 /path/to/complete.py'
+```
+
+`--chat-token` is deprecated/ignored. Task / Org wakes still use `--wake-url` /
+`--wake-exec`. Chat envelopes skip wake and use the complete → writeback path
+instead.
+
 **Coverage:** only traffic that arrives over the Mode B relay. Open Task Pool
 rows that were never pushed as A2A still need `acn tasks list` / reconcile.
 

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@acnlabs/acn-cli",
-      version: "0.14.0",
+      version: "0.14.2",
       description: "Official CLI for ACN (Agent Collaboration Network) \u2014 zero-integration agent access",
       main: "dist/index.js",
       bin: {
@@ -469,7 +469,9 @@ function rotateKeyCommand() {
     }
     if (!config.api_key) {
       console.error(
-        "No API key found in ~/.acn/config.json. The CLI rotates with the current agent key; if you have lost the key, recover via the Labs web UI (Auth0-authorised owner-side rotation)."
+        `No API key found in ~/.acn/config.json. The CLI rotates with the current agent key.
+If you have lost the key, sign in to Labs as the agent owner, open /agents/${agentId}, click "Reset API Key", then run:
+  acn config set api_key <new>`
       );
       process.exit(1);
     }
@@ -608,6 +610,8 @@ function formatTask(t) {
     lines.push(`  Reward   : ${t.reward} ${t.reward_currency ?? ""}`);
   }
   if (t.subnet_slug) lines.push(`  Subnet   : ${t.subnet_slug}`);
+  const orgId = t.metadata?.org_id;
+  if (typeof orgId === "string" && orgId) lines.push(`  Org      : ${orgId}`);
   if (t.description) lines.push(`  Desc     : ${t.description.slice(0, 120)}`);
   if (t.created_at) lines.push(`  Created  : ${t.created_at}`);
   if (t.deadline) lines.push(`  Deadline : ${t.deadline}`);
@@ -697,7 +701,10 @@ ${formatTask(t)}`).join("\n\n")
       handleError(err);
     }
   });
-  cmd.command("create").description("Create a new task (as agent)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated (e.g. coding,review)").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option("--currency <currency>", "Reward currency (e.g. USD, USDC, ap_points)", "ap_points").option("--type <type>", "Task type (e.g. coding, general)", "general").option("--max-participants <n>", "Max participants (default: 1)", "1").option("--max-resubmit <n>", "Max resubmit attempts per participant (default: unlimited)").option("--subnet <slug>", "Subnet slug to scope the task to (agent must be a member)").action(
+  cmd.command("create").description("Create a new task (as agent)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated (e.g. coding,review)").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option("--currency <currency>", "Reward currency (e.g. USD, USDC, ap_points)", "ap_points").option("--type <type>", "Task type (e.g. coding, general)", "general").option("--max-participants <n>", "Max participants (default: 1)", "1").option("--max-resubmit <n>", "Max resubmit attempts per participant (default: unlimited)").option("--subnet <slug>", "Subnet slug to scope the task to (agent must be a member)").option(
+    "--org-id <org_id>",
+    "Attribute to an Org (metadata.org_id + org_publish; prefer `acn org publish-task`)"
+  ).action(
     async (opts) => {
       const config = loadConfig();
       if (!config.api_key) {
@@ -722,6 +729,9 @@ ${formatTask(t)}`).join("\n\n")
       if (opts.subnet) {
         body.subnet_slug = opts.subnet;
       }
+      if (opts.orgId) {
+        body.metadata = { org_id: opts.orgId, org_publish: true };
+      }
       try {
         const task = await acnPost("/tasks/agent/create", body);
         output(task, [`Task created!
@@ -1375,10 +1385,14 @@ ${formatPolicy(res)}`);
 
 // src/commands/listen.ts
 var import_commander10 = require("commander");
-var import_child_process2 = require("child_process");
+var import_child_process3 = require("child_process");
 var import_ws = __toESM(require("ws"));
 
+// src/commands/chat-writeback.ts
+var import_child_process = require("child_process");
+
 // src/commands/normalize-event.ts
+var CHAT_REPLY_CHANNEL = "agentplanet.chat";
 function asRecord(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
@@ -1430,6 +1444,44 @@ function extractFromAgent(message) {
   if (!metadata) return null;
   return asNonEmptyString(metadata.from_agent) ?? asNonEmptyString(metadata.fromAgent);
 }
+function extractUserText(message) {
+  const parts = message.parts;
+  if (!Array.isArray(parts)) return null;
+  const chunks = [];
+  for (const part of parts) {
+    const p = asRecord(part);
+    if (!p || p.kind !== "text") continue;
+    const t = asNonEmptyString(p.text);
+    if (t) chunks.push(t);
+  }
+  return chunks.length > 0 ? chunks.join("\n") : null;
+}
+function isAllowedChatReplyPath(chatId, replyPath) {
+  if (!chatId || !replyPath) return false;
+  if (replyPath.includes("..") || replyPath.includes("?") || replyPath.includes("#") || replyPath.includes("//") || replyPath.includes("\\") || !replyPath.startsWith("/")) {
+    return false;
+  }
+  return replyPath === `/api/chats/${chatId}/agent-messages`;
+}
+function extractChatEnvelope(message) {
+  const metadata = asRecord(message.metadata);
+  if (!metadata) return null;
+  const ap = asRecord(metadata.agentplanet);
+  if (!ap) return null;
+  const chatId = asNonEmptyString(ap.chat_id);
+  const replyPath = asNonEmptyString(ap.reply_path);
+  const replyChannel = asNonEmptyString(ap.reply_channel);
+  if (!chatId || !replyPath) return null;
+  if (replyChannel !== CHAT_REPLY_CHANNEL) return null;
+  if (!isAllowedChatReplyPath(chatId, replyPath)) return null;
+  return {
+    chat_id: chatId,
+    reply_path: replyPath,
+    reply_channel: CHAT_REPLY_CHANNEL,
+    gateway_message_id: asNonEmptyString(ap.message_id) ?? asNonEmptyString(ap.messageId),
+    user_text: extractUserText(message)
+  };
+}
 function normalizeEvent(body, opts = {}) {
   const generateId = opts.generateId ?? (() => crypto.randomUUID());
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -1441,11 +1493,16 @@ function normalizeEvent(body, opts = {}) {
     message_id: extractMessageId(message, generateId),
     context_id: extractContextId(message),
     from_agent: extractFromAgent(message),
+    chat: extractChatEnvelope(message),
     received_at: now().toISOString(),
     raw: body
   };
 }
 function dedupeKey(event) {
+  if (event.chat) {
+    const mid = event.chat.gateway_message_id ?? event.message_id;
+    return `chat:${event.chat.chat_id}:${mid}`;
+  }
   return event.task_id ?? event.message_id;
 }
 var DedupeStore = class {
@@ -1481,11 +1538,299 @@ var DedupeStore = class {
   }
 };
 
+// src/commands/chat-writeback.ts
+var DEFAULT_COMPLETE_TIMEOUT_MS = 12e4;
+var DEFAULT_WRITEBACK_TIMEOUT_MS = 3e4;
+var DEFAULT_CHAT_JWT_AUDIENCE = "https://api.agentplanet.org";
+var cachedJwt = null;
+function asRecord2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function validateChatWritebackOptions(opts) {
+  if (!opts.chatWriteback) return null;
+  if (!opts.agentId) {
+    return "--chat-writeback requires a known agent id (join / --agent-id).";
+  }
+  if (!opts.apiKey?.trim()) {
+    return "--chat-writeback requires an ACN API key (acn join / config set api-key).";
+  }
+  if (!opts.chatApiBase?.trim()) {
+    return "--chat-writeback requires --chat-api-base (or ACN_CHAT_API_BASE / AGENTPLANET_API_BASE).";
+  }
+  const hasUrl = Boolean(opts.chatCompleteUrl?.trim());
+  const hasExec = Boolean(opts.chatCompleteExec?.trim());
+  if (hasUrl === hasExec) {
+    return '--chat-writeback requires exactly one of --chat-complete-url or --chat-complete-exec (host returns JSON {"content":"..."}).';
+  }
+  return null;
+}
+function buildChatWritebackOptions(opts) {
+  if (!opts.chatWriteback) return void 0;
+  const apiBase = opts.chatApiBase.replace(/\/+$/, "");
+  const audience = opts.audience?.trim() || DEFAULT_CHAT_JWT_AUDIENCE;
+  return {
+    enabled: true,
+    apiBase,
+    acnBaseUrl: opts.acnBaseUrl.replace(/\/+$/, ""),
+    apiKey: opts.apiKey,
+    agentId: opts.agentId,
+    audience,
+    completeUrl: opts.chatCompleteUrl?.trim() || void 0,
+    completeExec: opts.chatCompleteExec?.trim() || void 0,
+    completeTimeoutMs: opts.chatCompleteTimeoutMs,
+    writebackTimeoutMs: opts.chatWritebackTimeoutMs
+  };
+}
+function extractContent(payload) {
+  const rec = asRecord2(payload);
+  if (!rec) return null;
+  for (const key of ["content", "reply", "text"]) {
+    const v = rec[key];
+    if (typeof v === "string" && v.trim()) {
+      const t = v.trim();
+      if (t.toLowerCase() === "accepted") continue;
+      return t;
+    }
+  }
+  return null;
+}
+async function mintAgentJwt(opts, fetchFn = fetch) {
+  const now = Math.floor(Date.now() / 1e3);
+  if (cachedJwt && cachedJwt.agentId === opts.agentId && cachedJwt.expEpochSec > now + 60) {
+    return { ok: true, token: cachedJwt.token };
+  }
+  const url = `${opts.acnBaseUrl.replace(/\/+$/, "")}/oauth/token`;
+  try {
+    const res = await fetchFn(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "client_credentials",
+        client_id: opts.agentId,
+        client_secret: opts.apiKey,
+        audience: opts.audience
+      })
+    });
+    const text = await res.text();
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `oauth_http_${res.status}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return { ok: false, reason: "oauth_invalid_json" };
+    }
+    const rec = asRecord2(parsed);
+    const token = typeof rec?.access_token === "string" ? rec.access_token.trim() : "";
+    if (!token) return { ok: false, reason: "oauth_missing_access_token" };
+    const expiresIn = typeof rec?.expires_in === "number" && rec.expires_in > 0 ? rec.expires_in : 1800;
+    cachedJwt = {
+      token,
+      agentId: opts.agentId,
+      expEpochSec: now + expiresIn
+    };
+    return { ok: true, token };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: msg.slice(0, 200) };
+  }
+}
+function clearAgentJwtCache() {
+  cachedJwt = null;
+}
+async function completeViaHttp(event, opts, deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const timeoutMs = opts.completeTimeoutMs ?? DEFAULT_COMPLETE_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(opts.completeUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(event),
+      signal: controller.signal
+    });
+    const text = await res.text();
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `complete_http_${res.status}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return { ok: false, reason: "complete_invalid_json" };
+    }
+    const content = extractContent(parsed);
+    if (!content) return { ok: false, reason: "complete_missing_content" };
+    return { ok: true, content };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+      return { ok: false, reason: "complete_timeout" };
+    }
+    return { ok: false, reason: msg.slice(0, 200) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function completeViaExec(event, opts, deps) {
+  const spawnFn = deps.spawnFn ?? import_child_process.spawn;
+  const timeoutMs = opts.completeTimeoutMs ?? DEFAULT_COMPLETE_TIMEOUT_MS;
+  const body = Buffer.from(JSON.stringify(event), "utf-8");
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawnFn(opts.completeExec, { shell: true });
+    const stdout = [];
+    const stderr = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish({ ok: false, reason: "complete_timeout" });
+    }, timeoutMs);
+    child.stdout?.on("data", (d) => stdout.push(Buffer.from(d)));
+    child.stderr?.on("data", (d) => stderr.push(Buffer.from(d)));
+    child.on(
+      "error",
+      (e) => finish({ ok: false, reason: e.message.slice(0, 200) })
+    );
+    child.on("close", (code) => {
+      if (code !== 0) {
+        const detail = Buffer.concat(stderr).toString("utf-8").slice(0, 80);
+        finish({
+          ok: false,
+          reason: detail ? `complete_exit_${code}:${detail}` : `complete_exit_${code}`
+        });
+        return;
+      }
+      const text = Buffer.concat(stdout).toString("utf-8").trim();
+      try {
+        const parsed = JSON.parse(text);
+        const content = extractContent(parsed);
+        if (!content) {
+          finish({ ok: false, reason: "complete_missing_content" });
+          return;
+        }
+        finish({ ok: true, content });
+      } catch {
+        finish({ ok: false, reason: "complete_invalid_json" });
+      }
+    });
+    child.stdin?.end(body);
+  });
+}
+async function postWriteback(event, content, opts, deps) {
+  const chat = event.chat;
+  if (!chat) return { ok: false, reason: "no_chat_envelope" };
+  if (!isAllowedChatReplyPath(chat.chat_id, chat.reply_path)) {
+    return { ok: false, reason: "reply_path_rejected" };
+  }
+  if (chat.reply_channel !== "agentplanet.chat") {
+    return { ok: false, reason: "reply_channel_rejected" };
+  }
+  const fetchFn = deps.fetchFn ?? fetch;
+  const path = chat.reply_path;
+  let url;
+  let baseOrigin;
+  try {
+    baseOrigin = new URL(opts.apiBase).origin;
+    url = new URL(`${opts.apiBase}${path}`);
+  } catch {
+    return { ok: false, reason: "invalid_api_base" };
+  }
+  if (url.origin !== baseOrigin) {
+    return { ok: false, reason: "reply_url_origin_mismatch" };
+  }
+  const timeoutMs = opts.writebackTimeoutMs ?? DEFAULT_WRITEBACK_TIMEOUT_MS;
+  const postOnce = async (token) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetchFn(url.toString(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify({ content }),
+        signal: controller.signal
+      });
+      if (res.status === 200 || res.status === 201) {
+        return { ok: true, status: res.status };
+      }
+      try {
+        await res.arrayBuffer();
+      } catch {
+      }
+      return {
+        ok: false,
+        status: res.status,
+        reason: `writeback_http_${res.status}`
+      };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+        return { ok: false, status: 0, reason: "writeback_timeout" };
+      }
+      return { ok: false, status: 0, reason: msg.slice(0, 200) };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const minted = await mintAgentJwt(opts, fetchFn);
+  if (!minted.ok) {
+    return { ok: false, reason: minted.reason };
+  }
+  let result = await postOnce(minted.token);
+  if (result.ok) {
+    return { ok: true, httpStatus: result.status };
+  }
+  if (result.status === 401) {
+    clearAgentJwtCache();
+    const reminted = await mintAgentJwt(opts, fetchFn);
+    if (!reminted.ok) {
+      return { ok: false, reason: reminted.reason };
+    }
+    result = await postOnce(reminted.token);
+    if (result.ok) {
+      return { ok: true, httpStatus: result.status };
+    }
+  }
+  return { ok: false, reason: result.reason };
+}
+async function handleChatWriteback(event, opts, deps = {}) {
+  const logFn = deps.logFn ?? ((line) => console.error(line));
+  if (!event.chat) return { ok: false, reason: "no_chat_envelope" };
+  const completed = opts.completeUrl ? await completeViaHttp(event, opts, deps) : await completeViaExec(event, opts, deps);
+  if (!completed.ok) {
+    logFn(
+      `[acn listen] chat_complete_failed chat_id=${event.chat.chat_id} message_id=${event.message_id} reason=${completed.reason}`
+    );
+    return { ok: false, reason: completed.reason };
+  }
+  const written = await postWriteback(event, completed.content, opts, deps);
+  if (!written.ok) {
+    logFn(
+      `[acn listen] chat_writeback_failed chat_id=${event.chat.chat_id} message_id=${event.message_id} reason=${written.reason}`
+    );
+    return written;
+  }
+  logFn(
+    `[acn listen] chat_writeback_ok chat_id=${event.chat.chat_id} message_id=${event.message_id} http=${written.httpStatus}`
+  );
+  return written;
+}
+
 // src/commands/local-receiver.ts
 var import_crypto = require("crypto");
 
 // src/commands/runtime-adapter.ts
-var import_child_process = require("child_process");
+var import_child_process2 = require("child_process");
 var DEFAULT_WAKE_TIMEOUT_MS = 5e3;
 function parseWakeHeaders(raw) {
   const out = {};
@@ -1554,7 +1899,7 @@ async function wakeHttp(event, opts, deps) {
   }
 }
 function wakeCommand(event, opts, deps) {
-  const spawnFn = deps.spawnFn ?? import_child_process.spawn;
+  const spawnFn = deps.spawnFn ?? import_child_process2.spawn;
   const timeoutMs = opts.wakeTimeoutMs ?? DEFAULT_WAKE_TIMEOUT_MS;
   const body = Buffer.from(JSON.stringify(event), "utf-8");
   return new Promise((resolve) => {
@@ -1702,6 +2047,18 @@ function dispatchLocalReceiver(correlationId, bodyText, opts, dedupeStore, send,
   if (!result.shouldWake || !result.event) return;
   const event = result.event;
   const key = opts.dedupe ? dedupeKey(event) : null;
+  if (event.chat && opts.chatWriteback?.enabled) {
+    void handleChatWriteback(event, opts.chatWriteback, deps).then((written) => {
+      if (!written.ok && key) dedupeStore.forget(key);
+    }).catch((err) => {
+      if (key) dedupeStore.forget(key);
+      const msg = err instanceof Error ? err.message : String(err);
+      logFn(
+        `[acn listen] chat_writeback_failed message_id=${event.message_id} reason=${msg.slice(0, 200)}`
+      );
+    });
+    return;
+  }
   void wakeRuntime(event, opts, deps).then((wake) => {
     if (!wake.ok) {
       if (key) dedupeStore.forget(key);
@@ -1767,7 +2124,7 @@ async function dispatchA2aRequest(frame, opts, send, deps = {}) {
       return;
     }
     if (opts.exec) {
-      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process2.spawn));
+      send(await runExec(frame, bodyBuf, opts.exec, deps.spawnFn ?? import_child_process3.spawn));
       return;
     }
     send(errorResponse(frame.id, 500, "no handler configured"));
@@ -1974,6 +2331,25 @@ function listenCommand() {
   ).option(
     "--exec <command>",
     "Compat: shell per request; stdout must be a full A2A JSON-RPC response"
+  ).option(
+    "--chat-writeback",
+    "On Chat Gateway envelopes: complete host reply then POST agent-messages with ACN agent JWT (requires --runtime; uses config api-key)"
+  ).option(
+    "--chat-api-base <url>",
+    "Chat Gateway origin for writeback (env: ACN_CHAT_API_BASE or AGENTPLANET_API_BASE)"
+  ).option(
+    "--chat-token <token>",
+    "Deprecated/ignored: writeback now mints ACN agent JWT from api-key"
+  ).option(
+    "--chat-complete-url <url>",
+    'POST NormalizedEvent \u2192 JSON {"content":"..."} (mutually exclusive with --chat-complete-exec)'
+  ).option(
+    "--chat-complete-exec <cmd>",
+    'Shell: event JSON on stdin \u2192 stdout JSON {"content":"..."}'
+  ).option(
+    "--chat-complete-timeout <ms>",
+    `Host complete timeout in ms (default ${DEFAULT_COMPLETE_TIMEOUT_MS})`,
+    String(DEFAULT_COMPLETE_TIMEOUT_MS)
   ).option("-i, --agent-id <id>", "Agent ID (defaults to config)").action(
     (opts) => {
       const config = loadConfig();
@@ -2002,6 +2378,30 @@ function listenCommand() {
         console.error(flagErr);
         process.exit(1);
       }
+      const chatApiBase = opts.chatApiBase?.trim() || process.env.ACN_CHAT_API_BASE?.trim() || process.env.AGENTPLANET_API_BASE?.trim();
+      const chatCompleteUrl = opts.chatCompleteUrl?.trim() || process.env.ACN_CHAT_COMPLETE_URL?.trim();
+      const chatCompleteExec = opts.chatCompleteExec?.trim();
+      if (opts.chatWriteback && !opts.runtime) {
+        console.error("--chat-writeback requires --runtime http|command|log.");
+        process.exit(1);
+      }
+      if (opts.chatWriteback && (opts.chatToken?.trim() || process.env.ACN_CHAT_WRITEBACK_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_API_TOKEN?.trim())) {
+        console.error(
+          "[acn listen] warning: --chat-token / AGENTPLANET_INTERNAL_TOKEN is ignored; writeback authenticates with ACN agent JWT minted from your api-key."
+        );
+      }
+      const chatErr = validateChatWritebackOptions({
+        chatWriteback: opts.chatWriteback,
+        chatApiBase,
+        chatCompleteUrl,
+        chatCompleteExec,
+        agentId,
+        apiKey
+      });
+      if (chatErr) {
+        console.error(chatErr);
+        process.exit(1);
+      }
       let wakeHeaders;
       if (opts.runtime === "http") {
         try {
@@ -2013,6 +2413,10 @@ function listenCommand() {
       }
       const wakeTimeoutMs = Number.parseInt(opts.wakeTimeout ?? "", 10);
       const dedupeTtlSec = Number.parseInt(opts.dedupeTtl ?? "", 10);
+      const chatCompleteTimeoutMs = Number.parseInt(
+        opts.chatCompleteTimeout ?? "",
+        10
+      );
       if (opts.runtime && (!Number.isFinite(wakeTimeoutMs) || wakeTimeoutMs <= 0)) {
         console.error("--wake-timeout must be a positive integer (ms).");
         process.exit(1);
@@ -2021,6 +2425,21 @@ function listenCommand() {
         console.error("--dedupe-ttl must be a positive integer (seconds).");
         process.exit(1);
       }
+      if (opts.chatWriteback && (!Number.isFinite(chatCompleteTimeoutMs) || chatCompleteTimeoutMs <= 0)) {
+        console.error("--chat-complete-timeout must be a positive integer (ms).");
+        process.exit(1);
+      }
+      const chatWriteback = buildChatWritebackOptions({
+        chatWriteback: opts.chatWriteback,
+        chatApiBase,
+        acnBaseUrl: config.base_url,
+        apiKey,
+        chatCompleteUrl,
+        chatCompleteExec,
+        chatCompleteTimeoutMs: opts.chatWriteback ? chatCompleteTimeoutMs : void 0,
+        agentId,
+        audience: process.env.ACN_CHAT_JWT_AUDIENCE?.trim() || process.env.AGENTPLANET_JWT_AUDIENCE?.trim()
+      });
       runListener({
         agentId,
         apiKey,
@@ -2035,7 +2454,8 @@ function listenCommand() {
           wakeTimeoutMs,
           // commander: --no-dedupe sets dedupe=false; default true
           dedupe: opts.dedupe !== false,
-          dedupeTtlSec
+          dedupeTtlSec,
+          chatWriteback
         } : void 0
       });
     }
@@ -3146,6 +3566,102 @@ function orgCommand() {
       handleError(err);
     }
   });
+  cmd.command("publish-task").description(
+    "Publish a Task Pool task attributed to an Org (network by default; not Org work)"
+  ).requiredOption("--org <org_id>", "Org id (stored as metadata.org_id)").requiredOption("-t, --title <title>", "Task title (min 3 chars)").requiredOption("-d, --description <text>", "Task description (min 10 chars)").requiredOption("--tags <tags>", "Required skill tags, comma-separated").option("--deadline <hours>", "Deadline in hours (default: 48)", "48").option("--reward <amount>", "Reward amount (default: 0)", "0").option(
+    "--pay-from <source>",
+    "Who pays: agent (default, attribution only) | org (Org wallet + credits escrow)",
+    "agent"
+  ).option("--type <type>", "Task type", "general").option("--max-participants <n>", "Max participants", "1").option(
+    "--fence",
+    "Scope task to the Org subnet fence (may deliver task.* to Org harness)",
+    false
+  ).option("--subnet <slug>", "Override subnet slug (implies fence; default: Org fence)").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.api_key) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      const payFrom = (opts.payFrom ?? "agent").toLowerCase();
+      if (payFrom !== "agent" && payFrom !== "org") {
+        console.error('--pay-from must be "agent" or "org"');
+        process.exit(1);
+      }
+      try {
+        const body = {
+          title: opts.title,
+          description: opts.description,
+          deadline_hours: parseInt(opts.deadline ?? "48", 10),
+          required_tags: opts.tags.split(",").map((s) => s.trim()).filter(Boolean),
+          reward: opts.reward ?? "0",
+          task_type: opts.type ?? "general",
+          max_participants: parseInt(opts.maxParticipants ?? "1", 10),
+          pay_from_org: payFrom === "org",
+          fence: Boolean(opts.fence || opts.subnet)
+        };
+        if (opts.subnet) {
+          body.subnet_slug = opts.subnet;
+        }
+        const task = await acnPost(
+          `/orgs/${opts.org}/publish-task`,
+          body
+        );
+        const lines = [
+          payFrom === "org" ? "Task published \u2014 Org-paid (credits escrow when reward > 0)" : "Task published for Org (Task Pool \u2014 not Org work)",
+          `  Task ID  : ${task.task_id}`,
+          `  Org      : ${opts.org}`,
+          `  Pay from : ${payFrom}`,
+          `  Creator  : ${task.creator_type}/${task.creator_id}`,
+          `  Status   : ${task.status}`,
+          `  Title    : ${task.title}`,
+          `  Currency : ${task.reward_currency}`,
+          `  Escrow   : ${String(task.use_escrow ?? false)}`,
+          `  Subnet   : ${task.subnet_slug ?? "(network / unscoped)"}`,
+          `  metadata : org_id=${String(task.metadata?.org_id ?? opts.org)} org_publish=${String(task.metadata?.org_publish ?? true)}`
+        ];
+        if (body.fence) {
+          lines.push(
+            "  Note     : fenced \u2014 task.* may hit the Org harness webhook"
+          );
+        }
+        output(task, lines.join("\n"));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
+  cmd.command("import-task").description(
+    "Import a Task Pool task as Org work (governance only; links via task.metadata)"
+  ).requiredOption("--org <org_id>", "Org id").requiredOption("--task <task_id>", "Task id to import").option("--assignee <agent_id>", "Optional assignee for the work item").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.api_key) {
+        console.error(
+          "No API key found. Run `acn join` first or `acn config set api-key <key>`."
+        );
+        process.exit(1);
+      }
+      try {
+        const body = { task_id: opts.task };
+        if (opts.assignee) body.assignee_agent_id = opts.assignee;
+        const res = await acnPost(`/orgs/${opts.org}/work/import-task`, body);
+        const lines = [
+          res.already_imported ? "Task already imported (idempotent)" : "Task imported as Org work",
+          `  Work ID  : ${res.work_id}`,
+          `  Org      : ${res.org_id}`,
+          `  Task ID  : ${res.source_task_id ?? opts.task}`,
+          `  Status   : ${res.status}`,
+          `  Title    : ${res.title}`
+        ];
+        output(res, lines.join("\n"));
+      } catch (err) {
+        handleError(err);
+      }
+    }
+  );
   return cmd;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acnlabs/acn-cli",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Official CLI for ACN (Agent Collaboration Network) — zero-integration agent access",
   "main": "dist/index.js",
   "bin": {