@claw-link/gateway-host 0.2.12 → 0.3.0

package/bin/cli.js

@@ -70,6 +70,10 @@ async function main() {
     case 'transport':
       return require('../scripts/transport-test').run();
 
+    case 'p2p-test':
+    case 'p2p':
+      return require('../scripts/p2p-test').run();
+
     case 'rotate':
       console.log([
         'To rotate a Host Token (also how you move an agent to a new machine):',
@@ -98,6 +102,7 @@ async function main() {
         '  version     Show CLI version + the version the service is running',
         '  logs        Tail the background service log (clhost logs [N])',
         '  transport-test  Verify content-addressed Capsule relay (host ⇄ central sync + integrity)',
+        '  p2p-test    Verify the native QUIC P2P transport end-to-end on this machine (loopback)',
         '  start       Start the background service',
         '  stop        Stop the background service',
         '  restart     Restart the background service (apply config changes)',

package/native/index.d.ts

@@ -0,0 +1,55 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/* auto-generated by NAPI-RS */
+
+/** One chunk of a blob: its content id + where it sits in the whole. */
+export interface Chunk {
+  cid: string
+  /** byte offset within the blob (f64 = JS number, exact to 2^53 bytes) */
+  offset: number
+  len: number
+}
+/**
+ * The chunk manifest for a blob — the whole-blob cid plus its ordered chunks. Two hosts exchange
+ * manifests first, then transfer only the chunks the receiver is missing.
+ */
+export interface Manifest {
+  cid: string
+  size: number
+  chunkSize: number
+  chunks: Array<Chunk>
+}
+/** Content-address a whole blob → `b3_<hex>`. */
+export declare function blobCid(bytes: Buffer): string
+/** Split a blob into content-addressed chunks. `chunk_size` is clamped to [64 KiB, 16 MiB]. */
+export declare function chunk(bytes: Buffer, chunkSize?: number | undefined | null): Manifest
+/** Verify a blob/chunk's bytes match an expected content id (integrity check on receive). */
+export declare function verifyBlob(bytes: Buffer, expectedCid: string): boolean
+/**
+ * Reassemble verified chunk bytes (in order) into the full blob, checking the result against the
+ * expected whole-blob cid. Returns the bytes, or an error if integrity fails.
+ */
+export declare function assemble(parts: Array<Buffer>, expectedCid: string): Buffer
+/** Native-core version (so the host can log which acceleration tier is active). */
+export declare function coreVersion(): string
+/**
+ * A QUIC peer-to-peer Capsule-byte transport (AHP H2H data plane).
+ *
+ * Bytes are AEAD-encrypted, content-addressed (`b3_<blake3>`), stored locally, and fetched from a
+ * peer's announced socket address over QUIC. See `transport.rs` for the full design + TLS posture.
+ */
+export declare class Transport {
+  /** Create a transport: bind a QUIC endpoint on an OS-assigned port and start serving. */
+  static create(): Promise<Transport>
+  /** The socket address to announce to peers, e.g. "127.0.0.1:54321". */
+  localAddr(): string
+  /** AEAD-encrypt `bytes` with the 32-byte `key`, store the ciphertext, and return its cid. */
+  add(bytes: Buffer, key: Buffer): string
+  /** Fetch `cid` from `peerAddr` over QUIC, verify integrity, and AEAD-decrypt with `key`. */
+  fetch(cid: string, peerAddr: string, key: Buffer): Promise<Buffer>
+  /** Does the local store hold this cid? */
+  has(cid: string): boolean
+  /** Close the endpoint (stops serving; in-flight transfers drain). */
+  close(): void
+}

package/native/index.js

@@ -0,0 +1,320 @@
+/* tslint:disable */
+/* eslint-disable */
+/* prettier-ignore */
+
+/* auto-generated by NAPI-RS */
+
+const { existsSync, readFileSync } = require('fs')
+const { join } = require('path')
+
+const { platform, arch } = process
+
+let nativeBinding = null
+let localFileExisted = false
+let loadError = null
+
+function isMusl() {
+  // For Node 10
+  if (!process.report || typeof process.report.getReport !== 'function') {
+    try {
+      const lddPath = require('child_process').execSync('which ldd').toString().trim()
+      return readFileSync(lddPath, 'utf8').includes('musl')
+    } catch (e) {
+      return true
+    }
+  } else {
+    const { glibcVersionRuntime } = process.report.getReport().header
+    return !glibcVersionRuntime
+  }
+}
+
+switch (platform) {
+  case 'android':
+    switch (arch) {
+      case 'arm64':
+        localFileExisted = existsSync(join(__dirname, 'harness-core.android-arm64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.android-arm64.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-android-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm':
+        localFileExisted = existsSync(join(__dirname, 'harness-core.android-arm-eabi.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.android-arm-eabi.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-android-arm-eabi')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Android ${arch}`)
+    }
+    break
+  case 'win32':
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(
+          join(__dirname, 'harness-core.win32-x64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.win32-x64-msvc.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-win32-x64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'ia32':
+        localFileExisted = existsSync(
+          join(__dirname, 'harness-core.win32-ia32-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.win32-ia32-msvc.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-win32-ia32-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'harness-core.win32-arm64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.win32-arm64-msvc.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-win32-arm64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Windows: ${arch}`)
+    }
+    break
+  case 'darwin':
+    localFileExisted = existsSync(join(__dirname, 'harness-core.darwin-universal.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./harness-core.darwin-universal.node')
+      } else {
+        nativeBinding = require('@claw-link/harness-core-darwin-universal')
+      }
+      break
+    } catch {}
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(join(__dirname, 'harness-core.darwin-x64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.darwin-x64.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-darwin-x64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'harness-core.darwin-arm64.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.darwin-arm64.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-darwin-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on macOS: ${arch}`)
+    }
+    break
+  case 'freebsd':
+    if (arch !== 'x64') {
+      throw new Error(`Unsupported architecture on FreeBSD: ${arch}`)
+    }
+    localFileExisted = existsSync(join(__dirname, 'harness-core.freebsd-x64.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./harness-core.freebsd-x64.node')
+      } else {
+        nativeBinding = require('@claw-link/harness-core-freebsd-x64')
+      }
+    } catch (e) {
+      loadError = e
+    }
+    break
+  case 'linux':
+    switch (arch) {
+      case 'x64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-x64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-x64-musl.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-x64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-x64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-x64-gnu.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-x64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-arm64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-arm64-musl.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-arm64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-arm64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-arm64-gnu.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-arm64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-arm-musleabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-arm-musleabihf.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-arm-musleabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-arm-gnueabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-arm-gnueabihf.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-arm-gnueabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'riscv64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-riscv64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-riscv64-musl.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-riscv64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'harness-core.linux-riscv64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./harness-core.linux-riscv64-gnu.node')
+            } else {
+              nativeBinding = require('@claw-link/harness-core-linux-riscv64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 's390x':
+        localFileExisted = existsSync(
+          join(__dirname, 'harness-core.linux-s390x-gnu.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./harness-core.linux-s390x-gnu.node')
+          } else {
+            nativeBinding = require('@claw-link/harness-core-linux-s390x-gnu')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Linux: ${arch}`)
+    }
+    break
+  default:
+    throw new Error(`Unsupported OS: ${platform}, architecture: ${arch}`)
+}
+
+if (!nativeBinding) {
+  if (loadError) {
+    throw loadError
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+const { blobCid, chunk, verifyBlob, assemble, coreVersion, Transport } = nativeBinding
+
+module.exports.blobCid = blobCid
+module.exports.chunk = chunk
+module.exports.verifyBlob = verifyBlob
+module.exports.assemble = assemble
+module.exports.coreVersion = coreVersion
+module.exports.Transport = Transport

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.12",
+  "version": "0.3.0",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {
@@ -18,6 +18,7 @@
     "bin/",
     "scripts/",
     "src/",
+    "native/",
     "templates/",
     "README.md",
     "SECURITY.md",

package/scripts/p2p-test.js

@@ -0,0 +1,45 @@
+'use strict';
+// `clhost p2p-test` — verify the native H2H QUIC transport end-to-end on THIS machine: two
+// transports, AEAD-encrypted blob transfer + integrity check, all through the native core. Proves
+// the JS↔Rust↔QUIC↔AEAD stack works here before you rely on it across machines.
+const crypto = require('crypto');
+const core = require('../src/transport/core');
+
+async function run() {
+  if (!core.available || !core.Transport) {
+    console.log('Native H2H core is NOT installed for this platform.');
+    console.log('The host works fine — Capsule bytes route through the central relay (no P2P speedup).');
+    console.log('To enable acceleration, install the @claw-link/harness-core binary for your platform.');
+    return;
+  }
+  console.log(`Native H2H core v${core.version} — running QUIC P2P self-test (loopback)…\n`);
+  const a = await core.Transport.create();
+  const b = await core.Transport.create();
+  try {
+    const key = crypto.randomBytes(32);
+    for (const n of [4 * 1024, 1024 * 1024, 8 * 1024 * 1024]) {
+      const data = crypto.randomBytes(n);
+      const cid = a.add(data, key);
+      const t0 = Date.now();
+      const got = await b.fetch(cid, a.localAddr(), key);
+      const ms = Date.now() - t0;
+      if (Buffer.compare(got, data) !== 0) throw new Error(`integrity mismatch at ${n} bytes`);
+      const mib = (n / (1024 * 1024));
+      console.log(`  ${(n / 1024).toFixed(0).padStart(7)} KiB   ${ms.toString().padStart(4)} ms   ${(mib / (ms / 1000)).toFixed(0).padStart(5)} MiB/s   OK`);
+    }
+    const cid = a.add(Buffer.from('secret'), key);
+    let wrongKey = false;
+    try { await b.fetch(cid, a.localAddr(), crypto.randomBytes(32)); } catch { wrongKey = true; }
+    let unknown = false;
+    try { await b.fetch('b3_0000', a.localAddr(), key); } catch { unknown = true; }
+    console.log(`\n  AEAD: wrong key rejected   ${wrongKey ? 'OK' : 'FAIL'}`);
+    console.log(`  integrity: unknown cid rejected   ${unknown ? 'OK' : 'FAIL'}`);
+    if (!wrongKey || !unknown) throw new Error('security checks failed');
+    console.log('\nP2P transport: PASS. Cross-machine transfer is exercised when a harness runs across two connected hosts.');
+  } finally {
+    a.close();
+    b.close();
+  }
+}
+
+module.exports = { run };

package/src/adapters/cli.js

@@ -116,8 +116,13 @@ function makeCliAdapter(cfg) {
       // edit or run shell. permArgs is handed to defaultArgs so each adapter can place
       // it correctly (e.g. Codex must put flags BEFORE its `--` end-of-options).
       // Operator args_template overrides take full control.
-      const scope = job.scope || 'customer';
-      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions) ? cfg.permissions(scope) : [];
+      // Harness nodes do collaborative work (write code/files, run commands), so they get
+      // workspace-write like an admin "configure" turn — even though they're carried on the
+      // 'customer' scope. Real customer chats stay read-only.
+      const writable = !!job.harness || job.scope === 'configure' || job.scope === 'sub_configure';
+      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions)
+        ? cfg.permissions(writable ? 'configure' : (job.scope || 'customer'))
+        : [];
       const argvFor = (rid) => Array.isArray(agent.args_template)
         ? buildArgv(agent.args_template, { prompt: fullPrompt, sessionId: rid || '', systemPrompt })
         : cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin, permArgs);

package/src/bridge.js

@@ -44,6 +44,12 @@ class Bridge {
   // AHP data plane: request short-lived signed URLs to sync content-addressed Capsule bytes.
   capsulePut(path) { return this._post('capsule_put', { path }); }
   capsuleGet(path) { return this._post('capsule_get', { path }); }
+  // H2H peer discovery for the QUIC P2P transport (central relay is the fallback).
+  transportAnnounce(cid, addr) { return this._post('transport_announce', { cid, addr }); }
+  transportResolve(cid) { return this._post('transport_resolve', { cid }); }
+  transportSession(cid, mode, bytes) { return this._post('transport_session', { cid, mode, bytes }); }
+  // DB floor for a transport ref: fetch the inline plaintext for a transport_cid this job may see.
+  capsuleContent(cid, jobId) { return this._post('capsule_content', { cid, job_id: jobId }); }
 }
 
 // Retry wrapper for transient network errors (not auth errors).

package/src/transport/core.js

@@ -0,0 +1,41 @@
+'use strict';
+// Optional native H2H data-plane core (@claw-link/harness-core): content-addressing + chunking,
+// and — from H1 — direct host-to-host QUIC transport. ACCELERATION, NEVER A DEPENDENCY: if no
+// prebuilt binary exists for this platform (or the package isn't installed), every function is null
+// and the caller falls back to the central relay (host-bridge capsule_put/capsule_get). Loaded once.
+
+let native = null;
+// The native H2H core is compiled and BUNDLED inside this package at native/ (one package, no
+// separate dependency). Load the bundle for the running platform; fall back to a monorepo source
+// build for dev; else null → central relay floor. (The native/ binary is produced at release time
+// by scripts/release-host.sh / CI from packages/harness-core.)
+const path = require('path');
+for (const id of [path.join(__dirname, '..', '..', 'native'), path.join(__dirname, '..', '..', '..', 'harness-core')]) {
+  try {
+    // eslint-disable-next-line global-require, import/no-unresolved, import/no-dynamic-require
+    native = require(id);
+    if (native && typeof native.blobCid === 'function') break;
+    native = null;
+  } catch {
+    native = null; // no bundled binary for this platform → central relay floor
+  }
+}
+
+const available = !!(native && typeof native.blobCid === 'function');
+
+module.exports = {
+  /** true when the native core is loaded and usable on this platform. */
+  available,
+  /** native core version, or null. */
+  version: available && typeof native.coreVersion === 'function' ? native.coreVersion() : null,
+  /** Buffer -> "b3_<hex>" content id, or null when unavailable. */
+  blobCid: available ? native.blobCid : null,
+  /** Buffer -> chunk manifest { cid, size, chunkSize, chunks[] }, or null. */
+  chunk: available ? native.chunk : null,
+  /** (Buffer, cid) -> bool integrity check, or null. */
+  verifyBlob: available ? native.verifyBlob : null,
+  /** (Buffer[], cid) -> Buffer reassembled+verified blob, or null. */
+  assemble: available ? native.assemble : null,
+  /** The native QUIC P2P Transport class (H1), or null. Static factory: Transport.create(). */
+  Transport: native && native.Transport ? native.Transport : null,
+};

package/src/transport/p2p.js

@@ -0,0 +1,75 @@
+'use strict';
+// Host-side H2H transport orchestration: wraps the native QUIC Transport (when a prebuilt core is
+// present) with central-relay discovery + fallback. ACCELERATION, NEVER A DEPENDENCY — if the core
+// is absent or a P2P fetch fails, callers fall back to host-bridge capsule_put/capsule_get.
+//
+// Flow:
+//   producer:  cid = await p2p.offer(bridge, plaintext, key)   // encrypt+store locally, announce
+//   consumer:  buf = await p2p.fetch(bridge, cid, key)         // resolve a peer + P2P fetch, else null
+//
+// `key` is a 32-byte Buffer (the per-transfer AEAD key, derived from the capsule's authorization).
+const core = require('./core');
+
+class P2P {
+  constructor(logger) {
+    this.logger = logger || { info() {}, warn() {} };
+    this.node = null;
+    this.starting = null;
+  }
+
+  available() {
+    return !!(core.available && core.Transport);
+  }
+
+  /** Start the native QUIC node once (idempotent). Returns the local transport addr, or null. */
+  async start() {
+    if (!this.available()) return null;
+    if (this.node) return this.node.localAddr();
+    if (!this.starting) {
+      this.starting = core.Transport.create()
+        .then((n) => { this.node = n; this.logger.info(`p2p transport up (core ${core.version}) at ${n.localAddr()}`); return n; })
+        .catch((e) => { this.logger.warn('p2p transport start failed (using central relay):', e.message); this.node = null; return null; });
+    }
+    await this.starting;
+    return this.node ? this.node.localAddr() : null;
+  }
+
+  /** Offer a blob for P2P fetch: AEAD-encrypt + store locally, announce cid→addr. Returns cid|null. */
+  async offer(bridge, plaintext, key) {
+    const addr = await this.start();
+    if (!addr || !this.node) return null;
+    let cid;
+    try { cid = this.node.add(plaintext, key); } catch (e) { this.logger.warn('p2p add failed:', e.message); return null; }
+    try { await bridge.transportAnnounce(cid, addr); } catch (e) { this.logger.warn('p2p announce failed:', e.message); }
+    return cid;
+  }
+
+  /** Fetch a blob by cid via P2P (resolve peer → fetch). Returns the plaintext Buffer, or null to
+   *  signal the caller should fall back to the central relay. */
+  async fetch(bridge, cid, key) {
+    if (!this.available()) return null;
+    await this.start();
+    if (!this.node) return null;
+    let peer = null;
+    try { const r = await bridge.transportResolve(cid); peer = r && r.peer; } catch { peer = null; }
+    if (!peer || !peer.addr) return null; // no P2P source → relay
+    try {
+      const t0 = Date.now();
+      const buf = await this.node.fetch(cid, peer.addr, key);
+      const ms = Date.now() - t0;
+      this.logger.info(`p2p fetch ${cid.slice(0, 14)}… ${buf.length}B from ${peer.addr} in ${ms}ms`);
+      bridge.transportSession(cid, 'p2p', buf.length).catch(() => {});
+      return buf;
+    } catch (e) {
+      this.logger.warn('p2p fetch failed, falling back to relay:', e.message);
+      return null;
+    }
+  }
+
+  close() {
+    if (this.node) { try { this.node.close(); } catch { /* ignore */ } this.node = null; }
+    this.starting = null;
+  }
+}
+
+module.exports = { P2P };

package/src/worker.js

@@ -5,11 +5,13 @@
 // Each job runs the agent's runtime adapter; output is streamed back chunk-by-chunk.
 
 const path = require('path');
+const crypto = require('crypto');
 const logger = require('./logger');
 const config = require('./config');
 const { Bridge, withRetry } = require('./bridge');
 const { getAdapter } = require('./adapters');
 const { detectRuntimes } = require('./detect');
+const { P2P } = require('./transport/p2p');
 
 const VERSION = (() => { try { return require('../package.json').version; } catch { return '0.0.0'; } })();
 
@@ -17,12 +19,41 @@ const VERSION = (() => { try { return require('../package.json').version; } catc
 // Generous (matches the server's 15-min reaper) so legitimate long generations,
 // which keep producing output, are never the ones that hit it.
 const JOB_MAX_MS = Number(process.env.CLAWHOST_JOB_MAX_MS) || 15 * 60 * 1000;
+// Offer outputs larger than this over P2P (matches the engine's TRANSPORT_MIN_BYTES).
+const TRANSPORT_MIN_BYTES = 32 * 1024;
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 let stopping = false;
 
-async function processJob(bridge, agentCfg, job) {
+// Replace ⟦clawlink:transport:CID⟧ markers in an inbound job's content with the actual upstream
+// bytes — fetched P2P from the producing host, falling back to the inline DB copy. Mutates job.content.
+async function resolveTransport(bridge, p2p, job) {
+  const refs = Array.isArray(job.transport_refs) ? job.transport_refs : [];
+  if (!refs.length || !job.content) return;
+  for (const ref of refs) {
+    const marker = `⟦clawlink:transport:${ref.cid}⟧`;
+    if (!job.content.includes(marker)) continue;
+    let text = null;
+    if (p2p && p2p.available()) {
+      try {
+        const buf = await p2p.fetch(bridge, ref.cid, Buffer.from(ref.key, 'hex'));
+        if (buf) text = buf.toString('utf8');
+      } catch (e) { logger.warn(`p2p resolve ${ref.cid.slice(0, 14)}… failed: ${e.message}`); }
+    }
+    if (text == null) {
+      // Floor: the inline DB copy (always present). Records a 'relay' transfer for metrics.
+      try { const r = await bridge.capsuleContent(ref.cid, job.id); text = r && r.content != null ? r.content : null; } catch { text = null; }
+      if (text != null) bridge.transportSession(ref.cid, 'relay', text.length).catch(() => {});
+    }
+    if (text != null) job.content = job.content.split(marker).join(text);
+    else logger.warn(`transport ref ${ref.cid.slice(0, 14)}… unresolved — leaving marker`);
+  }
+}
+
+async function processJob(bridge, agentCfg, job, p2p) {
   logger.info(`job ${job.id} claimed (${agentCfg.runtime})`);
+  // H2H: pull in any large upstream bytes (P2P, DB floor) before the runtime sees the prompt.
+  await resolveTransport(bridge, p2p, job);
   const adapter = getAdapter(agentCfg.runtime);
   let seq = 0;
   let finalText = '';
@@ -37,15 +68,28 @@ async function processJob(bridge, agentCfg, job) {
       try { await bridge.stream(job.id, seq++, evt.type, String(evt.content ?? '')); }
       catch (e) { logger.warn(`stream seq ${seq} failed: ${e.message}`); }
     }
-    await withRetry(() => bridge.complete(job.id, finalText, toolCalls.length ? { tool_calls: toolCalls } : {}));
-    logger.info(`job ${job.id} done (${finalText.length} chars)`);
+    // H2H: offer a large result for P2P fetch by the next node's host (inline copy stays the floor).
+    let transport;
+    try {
+      const buf = Buffer.from(finalText, 'utf8');
+      if (p2p && p2p.available() && job.harness && buf.length > TRANSPORT_MIN_BYTES) {
+        const key = crypto.randomBytes(32);
+        const cid = await p2p.offer(bridge, buf, key);
+        if (cid) transport = { cid, key: key.toString('hex'), size: buf.length };
+      }
+    } catch (e) { logger.warn(`p2p offer failed: ${e.message}`); }
+    const meta = {};
+    if (toolCalls.length) meta.tool_calls = toolCalls;
+    if (transport) meta.transport = transport;
+    await withRetry(() => bridge.complete(job.id, finalText, meta));
+    logger.info(`job ${job.id} done (${finalText.length} chars${transport ? `, P2P-offered ${transport.cid.slice(0, 14)}…` : ''})`);
   } catch (e) {
     logger.error(`job ${job.id} failed: ${e.message}`);
     try { await bridge.fail(job.id, e.message); } catch { /* ignore */ }
   }
 }
 
-async function runAgentLoop(agentCfg, cfg) {
+async function runAgentLoop(agentCfg, cfg, p2p) {
   const bridge = new Bridge(cfg.bridge_url, agentCfg, cfg.instance_id);
   logger.addSecret(agentCfg.host_token);
   if (agentCfg.local_gateway_token) logger.addSecret(agentCfg.local_gateway_token);
@@ -91,7 +135,7 @@ async function runAgentLoop(agentCfg, cfg) {
         // Watchdog: guarantees the slot is reclaimed and the job is failed back even
         // if the adapter never settles (no per-adapter timeout by default).
         const watchdog = new Promise((resolve) => setTimeout(() => resolve('__watchdog__'), JOB_MAX_MS).unref());
-        Promise.race([processJob(bridge, agentCfg, job), watchdog])
+        Promise.race([processJob(bridge, agentCfg, job, p2p), watchdog])
           .then(async (r) => {
             if (r === '__watchdog__') {
               logger.error(`job ${job.id} exceeded ${JOB_MAX_MS}ms — reclaiming slot`);
@@ -120,16 +164,25 @@ async function startWorker() {
 
   logger.info(`ClawLink Host Gateway v${VERSION} — ${agents.length} agent(s): ${agents.map((a) => `${(a.agent_id || 'pending').slice(0, 8)}…(${a.runtime || 'resolving'})`).join(', ')}`);
 
+  // H2H data plane: bring up the native QUIC transport once per host (shared by all agents). If no
+  // prebuilt native core exists for this platform, every transfer routes through the central relay.
+  const p2p = new P2P(logger);
+  const p2pAddr = await p2p.start();
+  logger.info(p2pAddr
+    ? `H2H transport: native P2P active (${p2pAddr})`
+    : 'H2H transport: central relay (no native core for this platform — install acceleration later)');
+
   const onStop = (sig) => {
     if (stopping) return;
     stopping = true;
     logger.info(`${sig} received — draining in-flight jobs…`);
+    try { p2p.close(); } catch { /* ignore */ }
     setTimeout(() => process.exit(0), 8000).unref();
   };
   process.on('SIGINT', () => onStop('SIGINT'));
   process.on('SIGTERM', () => onStop('SIGTERM'));
 
-  await Promise.all(agents.map((a) => runAgentLoop(a, raw)));
+  await Promise.all(agents.map((a) => runAgentLoop(a, raw, p2p)));
 }
 
 module.exports = { startWorker };