@clawcrony/claw-crony 1.2.2 → 1.2.4

package/README.md

@@ -1,95 +1,97 @@
-# Claw Crony
-
-OpenClaw A2A v0.3.0 Gateway — Auto-discovery and secure communication between OpenClaw Agents on different servers.
-
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![A2A v0.3.0](https://img.shields.io/badge/A2A-v0.3.0-green.svg)](https://github.com/google/A2A)
-
-## Key Features
-
-- **A2A Protocol v0.3.0** — JSON-RPC / REST / gRPC with automatic fallback
-- **Hub Matchmaking** — Auto-match peer Agents by skills with token exchange
-- **Smart Routing** — Auto-select targets by message patterns, tags, or peer skills
-- **Secure Auth** — Bearer Token + zero-downtime multi-token rotation
-- **Resilience** — Health checks + exponential backoff + circuit breaker
-- **File Transfer** — URI / base64 / MIME whitelist + SSRF protection
-- **Observability** — JSONL audit logs + Telemetry metrics endpoint
-
+# Claw Crony
+
+OpenClaw A2A v0.3.0 Gateway - Auto-discovery and secure communication between OpenClaw Agents on different servers.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![A2A v0.3.0](https://img.shields.io/badge/A2A-v0.3.0-green.svg)](https://github.com/google/A2A)
+
+## Key Features
+
+- **A2A Protocol v0.3.0** - JSON-RPC / REST / gRPC with automatic fallback
+- **Hub Matchmaking** - Auto-match peer Agents by skills with encrypted handshake relay
+- **Smart Routing** - Auto-select targets by message patterns, tags, or peer skills
+- **Secure Auth** - Bearer Token + zero-downtime multi-token rotation
+- **Private Hub Identity** - Register with `client_id + public_key` instead of publishing long-lived connection secrets
+- **Resilience** - Health checks + exponential backoff + circuit breaker
+- **File Transfer** - URI / base64 / MIME whitelist + SSRF protection
+- **Observability** - JSONL audit logs + Telemetry metrics endpoint
+
 ## Hub Server
 
-Default Hub: `https://www.factormining.cn`
+Default Hub: `https://www.clawcrony.com`
+
+After installation, the plugin auto-registers with the Hub (requires `registrationEnabled: true`). Registration now uses a local `client_id + public_key` identity pair stored under `~/.openclaw`.
 
-After installation, the plugin auto-registers with the Hub (requires `registrationEnabled: true`). Once registered, use the `a2a_match_request` tool to send a matchmaking request, and the Hub will return a matched peer Agent address together with the tokens needed for the current session.
+Once registered, use the `a2a_match_request` tool to send a matchmaking request. The Hub matches a peer by skills, then relays encrypted handshake messages between the two plugins. The handshake returns temporary A2A connection details for the current session without requiring the Hub to persist peer `IP/port/token` in plaintext.
 
 After the user signs in to the Hub web dashboard, they can currently see:
 
-- Their own Agent profile, address, and normalized skill tags
+- Their own Agent profile, public identity, and normalized skill tags
 - A match timeline for requests created by this Agent
 - Per-request request summary, required skills, and current status
-- Matched result details including provider name, provider address, and update time
-- Whether requester/provider tokens have already been submitted for the match
+- Matched result details including peer name, handshake state, and update time
 
 A2A service port: **18800** (default)
-
-## Installation
-
-### Via npm (Recommended)
-
-```bash
-npm install @clawcrony/claw-crony
-```
-
-### Via Git Clone
-
-```bash
-git clone https://github.com/ccccl8/claw-crony.git
-cd claw-crony
-npm install
-openclaw plugins install .
-openclaw gateway restart
-
-# Verify
-curl -s http://localhost:18800/.well-known/agent-card.json
-```
-
-## Adding a Peer
-
-```bash
-openclaw config set plugins.entries.claw-crony.config.peers '[{
-  "name": "Peer Name",
-  "agentCardUrl": "http://<peerIP>:18800/.well-known/agent-card.json",
-  "auth": { "type": "bearer", "token": "<peerToken>" }
-}]'
-openclaw gateway restart
-```
-
+
+## Installation
+
+### Via npm (Recommended)
+
+```bash
+npm install @clawcrony/claw-crony
+```
+
+### Via Git Clone
+
+```bash
+git clone https://github.com/ccccl8/claw-crony.git
+cd claw-crony
+npm install
+openclaw plugins install .
+openclaw gateway restart
+
+# Verify
+curl -s http://localhost:18800/.well-known/agent-card.json
+```
+
+## Adding a Peer
+
+```bash
+openclaw config set plugins.entries.claw-crony.config.peers '[{
+  "name": "Peer Name",
+  "agentCardUrl": "http://<peerIP>:18800/.well-known/agent-card.json",
+  "auth": { "type": "bearer", "token": "<peerToken>" }
+}]'
+openclaw gateway restart
+```
+
 ## Hub Matchmaking (a2a_match_request)
 
 Send a matchmaking request to the Hub, which automatically finds registered Agents with the required skills:
-
-```bash
-# Agent calls a2a_match_request tool with params:
-# { skills: ["chat"], description?: "optional description" }
-#
-# Returns: provider address + yourToken + peerToken
-# Both sides configure each other as peers using the returned tokens to communicate
-```
-
-For detailed configuration steps, see [CONFIG.md](CONFIG.md).
-
-## Endpoints
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/.well-known/agent-card.json` | GET | Agent Card (discovery) |
-| `/a2a/jsonrpc` | POST | A2A JSON-RPC |
-| `/a2a/rest` | POST | A2A REST transport |
-| `/a2a/metrics` | GET | Telemetry snapshot (when enabled) |
-
-## License
-
-MIT License
-
-## Acknowledgments
-
-This project is based on [win4r/openclaw-a2a-gateway](https://github.com/win4r/openclaw-a2a-gateway), MIT License.
+
+```bash
+# Agent calls a2a_match_request tool with params:
+# { skills: ["chat"], description?: "optional description" }
+#
+# Returns: temporary peer address + temporary inbound token from encrypted handshake
+# Both sides then communicate directly over A2A without the Hub relaying task payloads
+```
+
+For detailed configuration steps, see [CONFIG.md](CONFIG.md).
+
+## Endpoints
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/.well-known/agent-card.json` | GET | Agent Card (discovery) |
+| `/a2a/jsonrpc` | POST | A2A JSON-RPC |
+| `/a2a/rest` | POST | A2A REST transport |
+| `/a2a/metrics` | GET | Telemetry snapshot (when enabled) |
+
+## License
+
+MIT License
+
+## Acknowledgments
+
+This project is based on [win4r/openclaw-a2a-gateway](https://github.com/win4r/openclaw-a2a-gateway), MIT License.

package/dist/index.js

@@ -5,6 +5,7 @@
  * - /a2a/rest                 (REST transport)
  * - gRPC on port+1            (gRPC transport)
  */
+import crypto from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import { AGENT_CARD_PATH } from "@a2a-js/sdk";
@@ -26,6 +27,9 @@ import { runHubRegistration } from "./src/hub-registration.js";
 import { HubMatchClient } from "./src/hub-match.js";
 import { normalizeAgentCardSkills } from "./src/skill-catalog.js";
 import { parseRoutingRules, matchRule } from "./src/routing-rules.js";
+import { decryptHandshake, encryptHandshake } from "./src/handshake-crypto.js";
+import { issueEphemeralInboundToken } from "./src/ephemeral-token.js";
+import { loadIdentity } from "./src/identity-store.js";
 import { validateUri, validateMimeType, } from "./src/file-security.js";
 /** Build a JSON-RPC error response. */
 function jsonRpcError(id, code, message) {
@@ -204,7 +208,7 @@ export function parseConfig(raw, resolvePath) {
             },
         },
         hub: {
-            url: asString(hub.url, "https://www.factormining.cn"),
+            url: asString(hub.url, "https://www.clawcrony.com"),
             enabled: asBoolean(hub.enabled, true),
             registrationEnabled: asBoolean(hub.registrationEnabled, true),
         },
@@ -212,6 +216,7 @@ export function parseConfig(raw, resolvePath) {
             username: asString(registration.username, ""),
             email: asString(registration.email, ""),
             password: asString(registration.password, ""),
+            clientId: asString(registration.clientId, ""),
         },
     };
 }
@@ -221,16 +226,51 @@ function normalizeCardPath() {
     }
     return `/${AGENT_CARD_PATH}`;
 }
-function getAdvertisedInboundToken(config, hubClient) {
-    if (config.security.tokens && config.security.tokens.length > 0) {
-        return config.security.tokens[0] ?? null;
+function getAdvertisedAddress(config) {
+    if (config.agentCard.url) {
+        try {
+            const url = new URL(config.agentCard.url);
+            return `${url.hostname}:${url.port || (url.protocol === "https:" ? "443" : "80")}`;
+        }
+        catch {
+            // Ignore invalid configured URL and fall back below.
+        }
     }
-    if (config.security.token) {
-        return config.security.token;
+    if (config.server.host && config.server.port) {
+        return `${config.server.host}:${config.server.port}`;
     }
-    return hubClient?.registrationToken ?? null;
+    return null;
 }
-async function processPendingHubMatches(api, config, processedMatches) {
+function upsertEphemeralPeer(config, peerName, address, token) {
+    const normalizedAddress = address.startsWith("http://") || address.startsWith("https://")
+        ? address
+        : `http://${address}`;
+    const agentCardUrl = `${normalizedAddress}/.well-known/agent.json`;
+    const existing = config.peers.find((peer) => peer.name === peerName);
+    if (existing) {
+        existing.agentCardUrl = agentCardUrl;
+        existing.auth = { type: "bearer", token };
+        return;
+    }
+    config.peers.push({
+        name: peerName,
+        agentCardUrl,
+        auth: { type: "bearer", token },
+    });
+}
+async function waitForHandshakeAnswer(hubClient, matchId, timeoutMs = 45_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const pending = await hubClient.getPendingHandshakeMessages(matchId);
+        const answer = pending.find((message) => message.messageType === "answer");
+        if (answer) {
+            return answer;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1_500));
+    }
+    throw new Error(`Timed out waiting for handshake answer for match ${matchId}`);
+}
+async function processPendingHubMatches(api, config, processedMessages) {
     let hubClient;
     try {
         hubClient = await HubMatchClient.create();
@@ -239,9 +279,9 @@ async function processPendingHubMatches(api, config, processedMatches) {
         api.logger.warn(`claw-crony: pending match polling skipped - ${err instanceof Error ? err.message : String(err)}`);
         return;
     }
-    const inboundToken = getAdvertisedInboundToken(config, hubClient);
-    if (!inboundToken) {
-        api.logger.warn("claw-crony: pending match polling skipped - no inbound token available");
+    const identity = loadIdentity();
+    if (!identity) {
+        api.logger.warn("claw-crony: pending match polling skipped - no local identity available");
         return;
     }
     let matches;
@@ -257,17 +297,56 @@ async function processPendingHubMatches(api, config, processedMatches) {
             continue;
         }
         try {
-            const alreadySubmitted = match.providerTokenSubmitted === true || processedMatches.has(match.id);
-            let currentMatch = match;
-            if (!alreadySubmitted) {
-                currentMatch = await hubClient.submitToken(match.id, inboundToken);
-                processedMatches.add(match.id);
-                api.logger.info(`claw-crony: submitted provider token for hub match ${match.id}`);
-            }
-            if (currentMatch.readyForComplete === true && currentMatch.status === "token_exchange") {
-                await hubClient.completeMatch(match.id, inboundToken);
-                processedMatches.delete(match.id);
-                api.logger.info(`claw-crony: completed hub match ${match.id}`);
+            const pendingMessages = await hubClient.getPendingHandshakeMessages(match.id);
+            for (const message of pendingMessages) {
+                if (processedMessages.has(message.id)) {
+                    continue;
+                }
+                const decrypted = decryptHandshake(message.ciphertext, identity);
+                await hubClient.consumeHandshakeMessage(match.id, message.id);
+                processedMessages.add(message.id);
+                const remoteName = match.callerRole === "provider"
+                    ? (match.requester?.name ?? `agent-${decrypted.fromAgentId}`)
+                    : (match.provider?.name ?? `agent-${decrypted.fromAgentId}`);
+                upsertEphemeralPeer(config, remoteName, decrypted.address, decrypted.token);
+                if (message.messageType === "offer" && match.callerRole === "provider") {
+                    const localAddress = getAdvertisedAddress(config);
+                    if (!localAddress) {
+                        api.logger.warn(`claw-crony: cannot answer match ${match.id} because no advertised address is configured`);
+                        continue;
+                    }
+                    const issued = issueEphemeralInboundToken(config, match.id, decrypted.fromAgentId);
+                    const payload = {
+                        version: 1,
+                        matchId: match.id,
+                        sessionId: crypto.randomUUID(),
+                        fromAgentId: hubClient.agentId,
+                        toAgentId: decrypted.fromAgentId,
+                        address: localAddress,
+                        agentCardPath: "/.well-known/agent.json",
+                        token: issued.token,
+                        tokenExpiresAt: issued.expiresAt,
+                        protocols: ["jsonrpc", "rest", "grpc"],
+                        createdAt: new Date().toISOString(),
+                        nonce: crypto.randomBytes(12).toString("hex"),
+                    };
+                    const peerPublicKey = match.requester?.publicKey;
+                    if (!peerPublicKey) {
+                        api.logger.warn(`claw-crony: cannot answer match ${match.id} because requester public key is missing`);
+                        continue;
+                    }
+                    await hubClient.sendHandshakeMessage(match.id, {
+                        messageType: "answer",
+                        ciphertext: encryptHandshake(payload, peerPublicKey),
+                        expiresAt: issued.expiresAt,
+                    });
+                    await hubClient.markReady(match.id);
+                    api.logger.info(`claw-crony: answered encrypted handshake for match ${match.id}`);
+                }
+                else if (message.messageType === "answer") {
+                    await hubClient.markReady(match.id);
+                    api.logger.info(`claw-crony: received encrypted handshake answer for match ${match.id}`);
+                }
             }
         }
         catch (err) {
@@ -397,7 +476,7 @@ const plugin = {
         let cleanupTimer = null;
         let hubMatchPollingTimer = null;
         const grpcPort = config.server.port + 1;
-        const processedHubMatches = new Set();
+        const processedHubMessages = new Set();
         api.registerGatewayMethod("a2a.metrics", ({ respond }) => {
             respond(true, {
                 metrics: telemetry.snapshot(),
@@ -563,14 +642,13 @@ const plugin = {
             });
             // ------------------------------------------------------------------
             // Agent tool: a2a_match_request
-            // Creates a match request on the hub and submits this agent's token.
-            // Returns provider address + yourToken + peerToken for A2A communication.
+            // Creates a match request on the hub and performs encrypted connection-info handshake.
             // ------------------------------------------------------------------
             api.registerTool({
                 name: "a2a_match_request",
                 description: "Request a match with another agent via the hub. " +
                     "The hub finds a provider agent with matching skills, creates a match record, " +
-                    "and returns the provider's address along with tokens for secure A2A communication. " +
+                    "and relays encrypted handshake messages so both agents can exchange temporary A2A connection details. " +
                     "Use this to discover and connect with peer agents through the hub's registry.",
                 label: "A2A Match Request",
                 parameters: {
@@ -589,9 +667,9 @@ const plugin = {
                     },
                 },
                 async execute(toolCallId, params) {
-                    let client;
+                    let hubClient;
                     try {
-                        client = await HubMatchClient.create();
+                        hubClient = await HubMatchClient.create();
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
@@ -600,12 +678,25 @@ const plugin = {
                             details: { ok: false, error: msg },
                         };
                     }
+                    const identity = loadIdentity();
+                    if (!identity) {
+                        return {
+                            content: [{ type: "text", text: "No local identity found. Restart the plugin and try again." }],
+                            details: { ok: false, error: "identity_missing" },
+                        };
+                    }
+                    const localAddress = getAdvertisedAddress(config);
+                    if (!localAddress) {
+                        return {
+                            content: [{ type: "text", text: "No advertised address is configured for this agent." }],
+                            details: { ok: false, error: "address_missing" },
+                        };
+                    }
                     let match;
                     try {
-                        match = await client.createMatch({
+                        match = await hubClient.createMatch({
                             skills: params.skills,
                             description: params.description,
-                            token: getAdvertisedInboundToken(config, client) ?? client.registrationToken,
                         });
                     }
                     catch (err) {
@@ -615,38 +706,84 @@ const plugin = {
                             details: { ok: false, error: msg },
                         };
                     }
-                    // Submit our token
-                    let updatedMatch;
+                    const provider = match.provider;
+                    const providerPublicKey = provider?.publicKey;
+                    if (!provider || !providerPublicKey) {
+                        return {
+                            content: [{ type: "text", text: `Match created (id=${match.id}) but provider public key is missing` }],
+                            details: { ok: false, matchId: match.id, error: "provider_public_key_missing" },
+                        };
+                    }
+                    const issued = issueEphemeralInboundToken(config, match.id, provider.id);
+                    const localPayload = {
+                        version: 1,
+                        matchId: match.id,
+                        sessionId: crypto.randomUUID(),
+                        fromAgentId: hubClient.agentId,
+                        toAgentId: provider.id,
+                        address: localAddress,
+                        agentCardPath: "/.well-known/agent.json",
+                        token: issued.token,
+                        tokenExpiresAt: issued.expiresAt,
+                        protocols: ["jsonrpc", "rest", "grpc"],
+                        createdAt: new Date().toISOString(),
+                        nonce: crypto.randomBytes(12).toString("hex"),
+                    };
+                    try {
+                        await hubClient.sendHandshakeMessage(match.id, {
+                            messageType: "offer",
+                            ciphertext: encryptHandshake(localPayload, providerPublicKey),
+                            expiresAt: issued.expiresAt,
+                        });
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        return {
+                            content: [{ type: "text", text: `Match created (id=${match.id}) but failed to send encrypted handshake offer: ${msg}` }],
+                            details: { ok: false, matchId: match.id, error: msg },
+                        };
+                    }
+                    let answer;
+                    try {
+                        answer = await waitForHandshakeAnswer(hubClient, match.id);
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        return {
+                            content: [{ type: "text", text: `Encrypted handshake offer sent for match ${match.id}, but waiting for answer failed: ${msg}` }],
+                            details: { ok: false, matchId: match.id, error: msg },
+                        };
+                    }
+                    let remotePayload;
                     try {
-                        updatedMatch = await client.submitToken(match.id, getAdvertisedInboundToken(config, client) ?? client.registrationToken);
+                        remotePayload = decryptHandshake(answer.ciphertext, identity);
+                        await hubClient.consumeHandshakeMessage(match.id, answer.id);
+                        upsertEphemeralPeer(config, provider.name, remotePayload.address, remotePayload.token);
+                        await hubClient.markReady(match.id);
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
                         return {
-                            content: [{ type: "text", text: `Match created (id=${match.id}) but failed to submit token: ${msg}` }],
+                            content: [{ type: "text", text: `Encrypted handshake answer received for match ${match.id}, but processing failed: ${msg}` }],
                             details: { ok: false, matchId: match.id, error: msg },
                         };
                     }
-                    const provider = updatedMatch.provider;
-                    const providerAddress = provider?.address ?? "(unknown)";
-                    const providerAccessToken = updatedMatch.yourToken ?? "(none)";
-                    const requesterInboundToken = updatedMatch.peerToken ?? "(none)";
-                    const status = updatedMatch.status;
                     return {
                         content: [{
                                 type: "text",
-                                text: `Match ${status}: id=${updatedMatch.id}\n` +
-                                    `Provider: ${provider?.name ?? "(unknown)"} at ${providerAddress}\n` +
-                                    `Provider access token (use to contact provider): ${providerAccessToken}\n` +
-                                    `Requester inbound token (provider uses this to contact you): ${requesterInboundToken}`,
+                                text: `Encrypted handshake ready: match=${match.id}\n` +
+                                    `Provider: ${provider.name}\n` +
+                                    `Address: ${remotePayload.address}\n` +
+                                    `Temporary token: ${remotePayload.token}\n` +
+                                    `Token expires at: ${remotePayload.tokenExpiresAt}`,
                             }],
                         details: {
                             ok: true,
-                            matchId: updatedMatch.id,
-                            status: updatedMatch.status,
-                            providerAddress,
-                            yourToken: providerAccessToken,
-                            peerToken: requesterInboundToken,
+                            matchId: match.id,
+                            status: "ready_to_connect",
+                            providerAddress: remotePayload.address,
+                            peerToken: remotePayload.token,
+                            tokenExpiresAt: remotePayload.tokenExpiresAt,
                         },
                     };
                 },
@@ -668,6 +805,13 @@ const plugin = {
                         const reg = await runHubRegistration(api, config, config.hub, config.registration ?? {});
                         if (reg) {
                             api.logger.info(`claw-crony: registered with hub (agentId=${reg.agentId})`);
+                            try {
+                                const hubClient = await HubMatchClient.create();
+                                await hubClient.updatePresence("online");
+                            }
+                            catch (presenceErr) {
+                                api.logger.warn(`claw-crony: failed to update hub presence - ${presenceErr instanceof Error ? presenceErr.message : String(presenceErr)}`);
+                            }
                         }
                     }
                     catch (err) {
@@ -742,7 +886,7 @@ const plugin = {
                 if (config.hub?.enabled !== false) {
                     const pollingIntervalMs = Math.max(5_000, config.resilience.healthCheck.intervalMs);
                     const pollHubMatches = () => {
-                        void processPendingHubMatches(api, config, processedHubMatches);
+                        void processPendingHubMatches(api, config, processedHubMessages);
                     };
                     pollHubMatches();
                     hubMatchPollingTimer = setInterval(pollHubMatches, pollingIntervalMs);
@@ -754,6 +898,15 @@ const plugin = {
                 // Stop peer health checks
                 healthManager?.stop();
                 auditLogger.close();
+                if (config.hub?.enabled !== false) {
+                    try {
+                        const hubClient = await HubMatchClient.create();
+                        await hubClient.updatePresence("offline");
+                    }
+                    catch {
+                        // Ignore best-effort presence shutdown failure.
+                    }
+                }
                 // Stop task cleanup timer
                 if (cleanupTimer) {
                     clearInterval(cleanupTimer);

package/dist/src/ephemeral-token.d.ts

@@ -0,0 +1,5 @@
+import type { GatewayConfig } from "./types.js";
+export declare function issueEphemeralInboundToken(config: GatewayConfig, matchId: number, peerAgentId: number, ttlMs?: number): {
+    token: string;
+    expiresAt: string;
+};

package/dist/src/ephemeral-token.js

@@ -0,0 +1,12 @@
+import crypto from "node:crypto";
+export function issueEphemeralInboundToken(config, matchId, peerAgentId, ttlMs = 5 * 60_000) {
+    const token = `match-${matchId}-peer-${peerAgentId}-${crypto.randomBytes(18).toString("hex")}`;
+    config.security.validTokens.add(token);
+    setTimeout(() => {
+        config.security.validTokens.delete(token);
+    }, ttlMs).unref?.();
+    return {
+        token,
+        expiresAt: new Date(Date.now() + ttlMs).toISOString(),
+    };
+}

package/dist/src/handshake-crypto.d.ts

@@ -0,0 +1,3 @@
+import type { HandshakePayload, IdentityData } from "./types.js";
+export declare function encryptHandshake(payload: HandshakePayload, recipientPublicKeyPem: string): string;
+export declare function decryptHandshake(ciphertext: string, identity: IdentityData): HandshakePayload;

package/dist/src/handshake-crypto.js

@@ -0,0 +1,58 @@
+import crypto from "node:crypto";
+function toBase64(value) {
+    return Buffer.from(value instanceof Buffer ? value : new Uint8Array(value)).toString("base64");
+}
+function fromBase64(value) {
+    return Buffer.from(value, "base64");
+}
+function exportPublicPem(key) {
+    return key.export({ format: "pem", type: "spki" }).toString();
+}
+function hkdf(secret, salt, info) {
+    return Buffer.from(crypto.hkdfSync("sha256", secret, salt, Buffer.from(info, "utf-8"), 32));
+}
+const HANDSHAKE_INFO = "claw-crony:handshake:v1";
+export function encryptHandshake(payload, recipientPublicKeyPem) {
+    const recipientPublicKey = crypto.createPublicKey(recipientPublicKeyPem);
+    const ephemeral = crypto.generateKeyPairSync("x25519");
+    const sharedSecret = crypto.diffieHellman({
+        privateKey: ephemeral.privateKey,
+        publicKey: recipientPublicKey,
+    });
+    const iv = crypto.randomBytes(12);
+    const key = hkdf(sharedSecret, iv, HANDSHAKE_INFO);
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+    const plaintext = Buffer.from(JSON.stringify(payload), "utf-8");
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const encrypted = {
+        version: 1,
+        algorithm: "x25519-aes-256-gcm",
+        senderPublicKey: exportPublicPem(ephemeral.publicKey),
+        iv: toBase64(iv),
+        ciphertext: toBase64(ciphertext),
+        authTag: toBase64(authTag),
+    };
+    return JSON.stringify(encrypted);
+}
+export function decryptHandshake(ciphertext, identity) {
+    const envelope = JSON.parse(ciphertext);
+    if (envelope.algorithm !== "x25519-aes-256-gcm") {
+        throw new Error(`Unsupported handshake algorithm: ${envelope.algorithm}`);
+    }
+    const privateKey = crypto.createPrivateKey(identity.privateKey);
+    const senderPublicKey = crypto.createPublicKey(envelope.senderPublicKey);
+    const iv = fromBase64(envelope.iv);
+    const sharedSecret = crypto.diffieHellman({
+        privateKey,
+        publicKey: senderPublicKey,
+    });
+    const key = hkdf(sharedSecret, iv, HANDSHAKE_INFO);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(fromBase64(envelope.authTag));
+    const plaintext = Buffer.concat([
+        decipher.update(fromBase64(envelope.ciphertext)),
+        decipher.final(),
+    ]);
+    return JSON.parse(plaintext.toString("utf-8"));
+}