@acnlabs/acn-cli 0.14.1 → 1.0.0

package/README.md

@@ -91,11 +91,13 @@ the A2A reply. Dedupe is on by default (`--no-dedupe` to disable).
 
 **Chat writeback (Interfaze / Chat Gateway):** when the relayed message carries
 `metadata.agentplanet.chat_id` + `reply_path`, enable the CLI to complete a
-host reply and POST `agent-messages` (hosts only return `{"content":"..."}`):
+host reply and POST `agent-messages` (hosts only return `{"content":"..."}`).
+Auth uses an **ACN agent JWT** minted from your config `api_key` (no
+AgentPlanet Internal Token):
 
 ```bash
-export AGENTPLANET_API_BASE=https://api.example.com
-export AGENTPLANET_INTERNAL_TOKEN=…   # or AGENTPLANET_INTERNAL_API_TOKEN
+export AGENTPLANET_API_BASE=https://api.agentplanet.org
+# optional: ACN_CHAT_JWT_AUDIENCE=https://api.agentplanet.org
 
 acn listen --runtime http \
   --wake-url http://127.0.0.1:10122/hooks/agent \
@@ -104,8 +106,9 @@ acn listen --runtime http \
 # or: --chat-complete-exec 'python3 /path/to/complete.py'
 ```
 
-Task / Org wakes still use `--wake-url` / `--wake-exec`. Chat envelopes skip
-wake and use the complete → writeback path instead.
+`--chat-token` is deprecated/ignored. Task / Org wakes still use `--wake-url` /
+`--wake-exec`. Chat envelopes skip wake and use the complete → writeback path
+instead.
 
 **Coverage:** only traffic that arrives over the Mode B relay. Open Task Pool
 rows that were never pushed as A2A still need `acn tasks list` / reconcile.

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@acnlabs/acn-cli",
-      version: "0.14.1",
+      version: "1.0.0",
       description: "Official CLI for ACN (Agent Collaboration Network) \u2014 zero-integration agent access",
       main: "dist/index.js",
       bin: {
@@ -469,7 +469,9 @@ function rotateKeyCommand() {
     }
     if (!config.api_key) {
       console.error(
-        "No API key found in ~/.acn/config.json. The CLI rotates with the current agent key; if you have lost the key, recover via the Labs web UI (Auth0-authorised owner-side rotation)."
+        `No API key found in ~/.acn/config.json. The CLI rotates with the current agent key.
+If you have lost the key, sign in to Labs as the agent owner, open /agents/${agentId}, click "Reset API Key", then run:
+  acn config set api_key <new>`
       );
       process.exit(1);
     }
@@ -1539,6 +1541,8 @@ var DedupeStore = class {
 // src/commands/chat-writeback.ts
 var DEFAULT_COMPLETE_TIMEOUT_MS = 12e4;
 var DEFAULT_WRITEBACK_TIMEOUT_MS = 3e4;
+var DEFAULT_CHAT_JWT_AUDIENCE = "https://api.agentplanet.org";
+var cachedJwt = null;
 function asRecord2(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
@@ -1547,26 +1551,30 @@ function validateChatWritebackOptions(opts) {
   if (!opts.agentId) {
     return "--chat-writeback requires a known agent id (join / --agent-id).";
   }
+  if (!opts.apiKey?.trim()) {
+    return "--chat-writeback requires an ACN API key (acn join / config set api-key).";
+  }
   if (!opts.chatApiBase?.trim()) {
     return "--chat-writeback requires --chat-api-base (or ACN_CHAT_API_BASE / AGENTPLANET_API_BASE).";
   }
-  if (!opts.chatToken?.trim()) {
-    return "--chat-writeback requires --chat-token (or ACN_CHAT_WRITEBACK_TOKEN / AGENTPLANET_INTERNAL_TOKEN / AGENTPLANET_INTERNAL_API_TOKEN).";
-  }
   const hasUrl = Boolean(opts.chatCompleteUrl?.trim());
   const hasExec = Boolean(opts.chatCompleteExec?.trim());
   if (hasUrl === hasExec) {
-    return '--chat-writeback requires exactly one of --chat-complete-url or --chat-complete-exec (host returns JSON {"content":"..."}).';
+    return '--chat-writeback requires exactly one of --chat-complete-url or --chat-complete-exec (host returns JSON {"content":"..."} and optional usage).';
   }
   return null;
 }
 function buildChatWritebackOptions(opts) {
   if (!opts.chatWriteback) return void 0;
+  const apiBase = opts.chatApiBase.replace(/\/+$/, "");
+  const audience = opts.audience?.trim() || DEFAULT_CHAT_JWT_AUDIENCE;
   return {
     enabled: true,
-    apiBase: opts.chatApiBase.replace(/\/+$/, ""),
-    token: opts.chatToken,
+    apiBase,
+    acnBaseUrl: opts.acnBaseUrl.replace(/\/+$/, ""),
+    apiKey: opts.apiKey,
     agentId: opts.agentId,
+    audience,
     completeUrl: opts.chatCompleteUrl?.trim() || void 0,
     completeExec: opts.chatCompleteExec?.trim() || void 0,
     completeTimeoutMs: opts.chatCompleteTimeoutMs,
@@ -1586,6 +1594,84 @@ function extractContent(payload) {
   }
   return null;
 }
+function asNonNegInt(v) {
+  if (typeof v === "number" && Number.isFinite(v) && v >= 0) {
+    return Math.floor(v);
+  }
+  if (typeof v === "string" && v.trim() !== "") {
+    const n = Number(v);
+    if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+  }
+  return null;
+}
+function extractUsage(payload) {
+  const rec = asRecord2(payload);
+  if (!rec) return void 0;
+  const usageRec = asRecord2(rec.usage) ?? rec;
+  const input = asNonNegInt(usageRec.input_tokens) ?? asNonNegInt(usageRec.prompt_tokens);
+  const output2 = asNonNegInt(usageRec.output_tokens) ?? asNonNegInt(usageRec.completion_tokens);
+  if (input === null && output2 === null) return void 0;
+  const out = {
+    input_tokens: input ?? 0,
+    output_tokens: output2 ?? 0
+  };
+  const ms = usageRec.meter_source;
+  if (ms === "peer_self" || ms === "gateway" || ms === "runtime_attested" || ms === "protocol") {
+    out.meter_source = ms;
+  }
+  return out;
+}
+function parseCompletePayload(payload) {
+  const content = extractContent(payload);
+  if (!content) return { ok: false, reason: "complete_missing_content" };
+  const usage = extractUsage(payload);
+  return { ok: true, result: usage ? { content, usage } : { content } };
+}
+async function mintAgentJwt(opts, fetchFn = fetch) {
+  const now = Math.floor(Date.now() / 1e3);
+  if (cachedJwt && cachedJwt.agentId === opts.agentId && cachedJwt.expEpochSec > now + 60) {
+    return { ok: true, token: cachedJwt.token };
+  }
+  const url = `${opts.acnBaseUrl.replace(/\/+$/, "")}/oauth/token`;
+  try {
+    const res = await fetchFn(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "client_credentials",
+        client_id: opts.agentId,
+        client_secret: opts.apiKey,
+        audience: opts.audience
+      })
+    });
+    const text = await res.text();
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, reason: `oauth_http_${res.status}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return { ok: false, reason: "oauth_invalid_json" };
+    }
+    const rec = asRecord2(parsed);
+    const token = typeof rec?.access_token === "string" ? rec.access_token.trim() : "";
+    if (!token) return { ok: false, reason: "oauth_missing_access_token" };
+    const expiresIn = typeof rec?.expires_in === "number" && rec.expires_in > 0 ? rec.expires_in : 1800;
+    cachedJwt = {
+      token,
+      agentId: opts.agentId,
+      expEpochSec: now + expiresIn
+    };
+    return { ok: true, token };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: msg.slice(0, 200) };
+  }
+}
+function clearAgentJwtCache() {
+  cachedJwt = null;
+}
 async function completeViaHttp(event, opts, deps) {
   const fetchFn = deps.fetchFn ?? fetch;
   const timeoutMs = opts.completeTimeoutMs ?? DEFAULT_COMPLETE_TIMEOUT_MS;
@@ -1608,9 +1694,7 @@ async function completeViaHttp(event, opts, deps) {
     } catch {
       return { ok: false, reason: "complete_invalid_json" };
     }
-    const content = extractContent(parsed);
-    if (!content) return { ok: false, reason: "complete_missing_content" };
-    return { ok: true, content };
+    return parseCompletePayload(parsed);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
@@ -1658,12 +1742,7 @@ function completeViaExec(event, opts, deps) {
       const text = Buffer.concat(stdout).toString("utf-8").trim();
       try {
         const parsed = JSON.parse(text);
-        const content = extractContent(parsed);
-        if (!content) {
-          finish({ ok: false, reason: "complete_missing_content" });
-          return;
-        }
-        finish({ ok: true, content });
+        finish(parseCompletePayload(parsed));
       } catch {
         finish({ ok: false, reason: "complete_invalid_json" });
       }
@@ -1671,7 +1750,7 @@ function completeViaExec(event, opts, deps) {
     child.stdin?.end(body);
   });
 }
-async function postWriteback(event, content, opts, deps) {
+async function postWriteback(event, complete, opts, deps) {
   const chat = event.chat;
   if (!chat) return { ok: false, reason: "no_chat_envelope" };
   if (!isAllowedChatReplyPath(chat.chat_id, chat.reply_path)) {
@@ -1693,37 +1772,74 @@ async function postWriteback(event, content, opts, deps) {
   if (url.origin !== baseOrigin) {
     return { ok: false, reason: "reply_url_origin_mismatch" };
   }
-  url.searchParams.set("agent_id", opts.agentId);
   const timeoutMs = opts.writebackTimeoutMs ?? DEFAULT_WRITEBACK_TIMEOUT_MS;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetchFn(url.toString(), {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "X-Internal-Token": opts.token
-      },
-      body: JSON.stringify({ content }),
-      signal: controller.signal
-    });
-    if (res.status === 200 || res.status === 201) {
-      return { ok: true, httpStatus: res.status };
-    }
+  const replyToId = chat.gateway_message_id ?? event.message_id;
+  const body = {
+    content: complete.content,
+    reply_to_id: replyToId
+  };
+  if (complete.usage) {
+    body.usage = {
+      input_tokens: complete.usage.input_tokens,
+      output_tokens: complete.usage.output_tokens,
+      meter_source: complete.usage.meter_source ?? "peer_self"
+    };
+  }
+  const postOnce = async (token) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-      await res.arrayBuffer();
-    } catch {
+      const res = await fetchFn(url.toString(), {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (res.status === 200 || res.status === 201) {
+        return { ok: true, status: res.status };
+      }
+      try {
+        await res.arrayBuffer();
+      } catch {
+      }
+      return {
+        ok: false,
+        status: res.status,
+        reason: `writeback_http_${res.status}`
+      };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
+        return { ok: false, status: 0, reason: "writeback_timeout" };
+      }
+      return { ok: false, status: 0, reason: msg.slice(0, 200) };
+    } finally {
+      clearTimeout(timer);
     }
-    return { ok: false, reason: `writeback_http_${res.status}` };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (controller.signal.aborted || /abort|timeout/i.test(msg)) {
-      return { ok: false, reason: "writeback_timeout" };
+  };
+  const minted = await mintAgentJwt(opts, fetchFn);
+  if (!minted.ok) {
+    return { ok: false, reason: minted.reason };
+  }
+  let result = await postOnce(minted.token);
+  if (result.ok) {
+    return { ok: true, httpStatus: result.status };
+  }
+  if (result.status === 401) {
+    clearAgentJwtCache();
+    const reminted = await mintAgentJwt(opts, fetchFn);
+    if (!reminted.ok) {
+      return { ok: false, reason: reminted.reason };
+    }
+    result = await postOnce(reminted.token);
+    if (result.ok) {
+      return { ok: true, httpStatus: result.status };
     }
-    return { ok: false, reason: msg.slice(0, 200) };
-  } finally {
-    clearTimeout(timer);
   }
+  return { ok: false, reason: result.reason };
 }
 async function handleChatWriteback(event, opts, deps = {}) {
   const logFn = deps.logFn ?? ((line) => console.error(line));
@@ -1735,15 +1851,16 @@ async function handleChatWriteback(event, opts, deps = {}) {
     );
     return { ok: false, reason: completed.reason };
   }
-  const written = await postWriteback(event, completed.content, opts, deps);
+  const written = await postWriteback(event, completed.result, opts, deps);
   if (!written.ok) {
     logFn(
       `[acn listen] chat_writeback_failed chat_id=${event.chat.chat_id} message_id=${event.message_id} reason=${written.reason}`
     );
     return written;
   }
+  const usageNote = completed.result.usage ? ` usage_in=${completed.result.usage.input_tokens} usage_out=${completed.result.usage.output_tokens}` : "";
   logFn(
-    `[acn listen] chat_writeback_ok chat_id=${event.chat.chat_id} message_id=${event.message_id} http=${written.httpStatus}`
+    `[acn listen] chat_writeback_ok chat_id=${event.chat.chat_id} message_id=${event.message_id} http=${written.httpStatus}${usageNote}`
   );
   return written;
 }
@@ -2255,13 +2372,13 @@ function listenCommand() {
     "Compat: shell per request; stdout must be a full A2A JSON-RPC response"
   ).option(
     "--chat-writeback",
-    "On Chat Gateway envelopes: complete host reply then POST agent-messages (requires --runtime)"
+    "On Chat Gateway envelopes: complete host reply then POST agent-messages with ACN agent JWT (requires --runtime; uses config api-key)"
   ).option(
     "--chat-api-base <url>",
     "Chat Gateway origin for writeback (env: ACN_CHAT_API_BASE or AGENTPLANET_API_BASE)"
   ).option(
     "--chat-token <token>",
-    "X-Internal-Token for agent-messages (env: ACN_CHAT_WRITEBACK_TOKEN, AGENTPLANET_INTERNAL_TOKEN, or AGENTPLANET_INTERNAL_API_TOKEN)"
+    "Deprecated/ignored: writeback now mints ACN agent JWT from api-key"
   ).option(
     "--chat-complete-url <url>",
     'POST NormalizedEvent \u2192 JSON {"content":"..."} (mutually exclusive with --chat-complete-exec)'
@@ -2301,20 +2418,24 @@ function listenCommand() {
         process.exit(1);
       }
       const chatApiBase = opts.chatApiBase?.trim() || process.env.ACN_CHAT_API_BASE?.trim() || process.env.AGENTPLANET_API_BASE?.trim();
-      const chatToken = opts.chatToken?.trim() || process.env.ACN_CHAT_WRITEBACK_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_API_TOKEN?.trim();
       const chatCompleteUrl = opts.chatCompleteUrl?.trim() || process.env.ACN_CHAT_COMPLETE_URL?.trim();
       const chatCompleteExec = opts.chatCompleteExec?.trim();
       if (opts.chatWriteback && !opts.runtime) {
         console.error("--chat-writeback requires --runtime http|command|log.");
         process.exit(1);
       }
+      if (opts.chatWriteback && (opts.chatToken?.trim() || process.env.ACN_CHAT_WRITEBACK_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_TOKEN?.trim() || process.env.AGENTPLANET_INTERNAL_API_TOKEN?.trim())) {
+        console.error(
+          "[acn listen] warning: --chat-token / AGENTPLANET_INTERNAL_TOKEN is ignored; writeback authenticates with ACN agent JWT minted from your api-key."
+        );
+      }
       const chatErr = validateChatWritebackOptions({
         chatWriteback: opts.chatWriteback,
         chatApiBase,
-        chatToken,
         chatCompleteUrl,
         chatCompleteExec,
-        agentId
+        agentId,
+        apiKey
       });
       if (chatErr) {
         console.error(chatErr);
@@ -2350,11 +2471,13 @@ function listenCommand() {
       const chatWriteback = buildChatWritebackOptions({
         chatWriteback: opts.chatWriteback,
         chatApiBase,
-        chatToken,
+        acnBaseUrl: config.base_url,
+        apiKey,
         chatCompleteUrl,
         chatCompleteExec,
         chatCompleteTimeoutMs: opts.chatWriteback ? chatCompleteTimeoutMs : void 0,
-        agentId
+        agentId,
+        audience: process.env.ACN_CHAT_JWT_AUDIENCE?.trim() || process.env.AGENTPLANET_JWT_AUDIENCE?.trim()
       });
       runListener({
         agentId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acnlabs/acn-cli",
-  "version": "0.14.1",
+  "version": "1.0.0",
   "description": "Official CLI for ACN (Agent Collaboration Network) — zero-integration agent access",
   "main": "dist/index.js",
   "bin": {