@claw-link/gateway-host 0.2.8 → 0.2.9

package/bin/cli.js

@@ -48,6 +48,10 @@ async function main() {
     case 'status':
       return require('../scripts/install').status();
 
+    case 'transport-test':
+    case 'transport':
+      return require('../scripts/transport-test').run();
+
     case 'rotate':
       console.log([
         'To rotate a Host Token (also how you move an agent to a new machine):',
@@ -72,6 +76,7 @@ async function main() {
         '  retoken     Re-enter a new Host Token for an existing agent (clhost retoken <id>)',
         '  agents      List mapped agents',
         '  status      Show bridge, service state, and mapped agents',
+        '  transport-test  Verify content-addressed Capsule relay (host ⇄ central sync + integrity)',
         '  start       Start the background service',
         '  stop        Stop the background service',
         '  restart     Restart the background service (apply config changes)',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/scripts/transport-test.js

@@ -0,0 +1,41 @@
+// `clhost transport-test` — proves the AHP content-addressed relay works end to end:
+// generates random bytes, content-addresses them, uploads to central Storage via a signed
+// URL, fetches them back, and verifies the bytes are byte-identical and the cid matches.
+// Isolated from the harness run loop — safe to run any time against a connected agent.
+'use strict';
+
+const crypto = require('crypto');
+const config = require('../src/config');
+const { Bridge } = require('../src/bridge');
+const { cidOf, putBlob, getBlob } = require('../src/transport/relay');
+
+async function run() {
+  const cfg = config.load();
+  const agent = (cfg.agents || [])[0];
+  if (!agent || !agent.host_token) {
+    console.error('No agent configured. Run: clhost add-agent');
+    process.exit(1);
+  }
+  const bridge = new Bridge(cfg.bridge_url, agent, cfg.instance_id);
+  const sizeKB = Number(process.argv[3]) || 64;
+  const payload = crypto.randomBytes(sizeKB * 1024);
+  const expectCid = cidOf(payload);
+
+  console.log(`→ ${(payload.length / 1024).toFixed(0)} KB, cid ${expectCid.slice(0, 18)}…`);
+  try {
+    const t0 = Date.now();
+    const put = await putBlob(bridge, 'selftest', payload);
+    console.log(`  uploaded → ${put.path}  (${Date.now() - t0}ms)`);
+    const t1 = Date.now();
+    const got = await getBlob(bridge, put.path, expectCid);
+    const ok = got.length === payload.length && Buffer.compare(got, payload) === 0;
+    console.log(`  fetched + verified  (${Date.now() - t1}ms)`);
+    if (!ok) throw new Error('round-trip mismatch');
+    console.log('✓ content-addressed relay OK — host ⇄ central sync + integrity verified.');
+  } catch (e) {
+    console.error(`✗ transport-test failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+module.exports = { run };

package/src/bridge.js

@@ -41,6 +41,9 @@ class Bridge {
   stream(jobId, seq, type, content) { return this._post('stream', { job_id: jobId, seq, type, content }); }
   complete(jobId, finalContent, metadata) { return this._post('complete', { job_id: jobId, final_content: finalContent, metadata: metadata || {} }); }
   fail(jobId, error) { return this._post('fail', { job_id: jobId, error: String(error).slice(0, 1000) }); }
+  // AHP data plane: request short-lived signed URLs to sync content-addressed Capsule bytes.
+  capsulePut(path) { return this._post('capsule_put', { path }); }
+  capsuleGet(path) { return this._post('capsule_get', { path }); }
 }
 
 // Retry wrapper for transient network errors (not auth errors).

package/src/transport/relay.js

@@ -0,0 +1,51 @@
+// AHP data plane — Phase 1 (content-addressed central relay, pure JS).
+//
+// A Capsule's bytes are content-addressed (cid = sha256) and synced to central Storage
+// via short-lived signed URLs requested over the host's existing outbound bridge — no
+// inbound port, no extra dependency (Node built-in crypto + global fetch). Every fetch is
+// re-hashed and verified against the cid, so a tampered/corrupt object is rejected. This is
+// the relay rung of the fetch ladder and the foundation the Rust P2P core later accelerates;
+// if any step fails the caller falls back to the inline path — never worse than today.
+'use strict';
+
+const crypto = require('crypto');
+
+/** Content address: a stable, self-verifying id derived from the bytes. */
+function cidOf(buf) {
+  return 'blob_' + crypto.createHash('sha256').update(buf).digest('hex');
+}
+
+/** Upload bytes to central Storage under <namespace>/<cid>; returns {cid, path, size}. */
+async function putBlob(bridge, namespace, buf) {
+  const data = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
+  const cid = cidOf(data);
+  const r = await bridge.capsulePut(`${namespace}/${cid}`);
+  if (!r || !r.signed_url) throw new Error('capsule_put: no signed url');
+  const res = await fetch(r.signed_url, {
+    method: 'PUT',
+    headers: {
+      'content-type': 'application/octet-stream',
+      'x-upsert': 'true', // content-addressed → re-uploading the same cid is idempotent
+      ...(r.token ? { authorization: `Bearer ${r.token}` } : {}),
+    },
+    body: data,
+  });
+  if (!res.ok && res.status !== 409) throw new Error(`capsule upload failed (${res.status})`);
+  return { cid, path: r.path, size: data.length };
+}
+
+/** Fetch bytes by storage path and VERIFY them against expectedCid before returning. */
+async function getBlob(bridge, path, expectedCid) {
+  const r = await bridge.capsuleGet(path);
+  if (!r || !r.url) throw new Error('capsule_get: no signed url');
+  const res = await fetch(r.url);
+  if (!res.ok) throw new Error(`capsule download failed (${res.status})`);
+  const buf = Buffer.from(await res.arrayBuffer());
+  const got = cidOf(buf);
+  if (expectedCid && got !== expectedCid) {
+    throw new Error(`integrity check failed: ${got} != ${expectedCid}`);
+  }
+  return buf;
+}
+
+module.exports = { cidOf, putBlob, getBlob };