@clawcrony/claw-crony 1.2.3 → 1.3.0

package/dist/index.js

@@ -5,6 +5,7 @@
  * - /a2a/rest                 (REST transport)
  * - gRPC on port+1            (gRPC transport)
  */
+import crypto from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import { AGENT_CARD_PATH } from "@a2a-js/sdk";
@@ -21,11 +22,15 @@ import { runTaskCleanup } from "./src/task-cleanup.js";
 import { FileTaskStore } from "./src/task-store.js";
 import { GatewayTelemetry } from "./src/telemetry.js";
 import { AuditLogger } from "./src/audit.js";
+import { RequestHistoryStore } from "./src/history.js";
 import { PeerHealthManager } from "./src/peer-health.js";
 import { runHubRegistration } from "./src/hub-registration.js";
 import { HubMatchClient } from "./src/hub-match.js";
 import { normalizeAgentCardSkills } from "./src/skill-catalog.js";
 import { parseRoutingRules, matchRule } from "./src/routing-rules.js";
+import { decryptHandshake, encryptHandshake } from "./src/handshake-crypto.js";
+import { isValidEphemeralInboundToken, issueEphemeralInboundToken } from "./src/ephemeral-token.js";
+import { loadIdentity } from "./src/identity-store.js";
 import { validateUri, validateMimeType, } from "./src/file-security.js";
 /** Build a JSON-RPC error response. */
 function jsonRpcError(id, code, message) {
@@ -183,6 +188,9 @@ export function parseConfig(raw, resolvePath) {
             metricsPath: normalizeHttpPath(asString(observability.metricsPath, "/a2a/metrics"), "/a2a/metrics"),
             metricsAuth: (asString(observability.metricsAuth, "none") === "bearer" ? "bearer" : "none"),
             auditLogPath: resolveConfiguredPath(observability.auditLogPath, path.join(os.homedir(), ".openclaw", "a2a-audit.jsonl"), resolvePath),
+            historyEnabled: asBoolean(observability.historyEnabled, true),
+            historyLogPath: resolveConfiguredPath(observability.historyLogPath, path.join(os.homedir(), ".openclaw", "a2a-history.jsonl"), resolvePath),
+            historyIncludeEncryptedPayloads: asBoolean(observability.historyIncludeEncryptedPayloads, false),
         },
         timeouts: {
             agentResponseTimeoutMs: asNumber(timeouts.agentResponseTimeoutMs, 300_000),
@@ -212,6 +220,7 @@ export function parseConfig(raw, resolvePath) {
             username: asString(registration.username, ""),
             email: asString(registration.email, ""),
             password: asString(registration.password, ""),
+            clientId: asString(registration.clientId, ""),
         },
     };
 }
@@ -221,16 +230,60 @@ function normalizeCardPath() {
     }
     return `/${AGENT_CARD_PATH}`;
 }
-function getAdvertisedInboundToken(config, hubClient) {
-    if (config.security.tokens && config.security.tokens.length > 0) {
-        return config.security.tokens[0] ?? null;
+function getAdvertisedAddress(config) {
+    if (config.agentCard.url) {
+        try {
+            const url = new URL(config.agentCard.url);
+            return `${url.hostname}:${url.port || (url.protocol === "https:" ? "443" : "80")}`;
+        }
+        catch {
+            // Ignore invalid configured URL and fall back below.
+        }
+    }
+    if (config.server.host && config.server.port) {
+        return `${config.server.host}:${config.server.port}`;
+    }
+    return null;
+}
+function upsertEphemeralPeer(config, peerName, address, token) {
+    const normalizedAddress = address.startsWith("http://") || address.startsWith("https://")
+        ? address
+        : `http://${address}`;
+    const agentCardUrl = `${normalizedAddress}/.well-known/agent.json`;
+    const existing = config.peers.find((peer) => peer.name === peerName);
+    if (existing) {
+        existing.agentCardUrl = agentCardUrl;
+        existing.auth = { type: "bearer", token };
+        return;
     }
-    if (config.security.token) {
-        return config.security.token;
+    config.peers.push({
+        name: peerName,
+        agentCardUrl,
+        auth: { type: "bearer", token },
+    });
+}
+async function waitForHandshakeAnswer(hubClient, matchId, timeoutMs = 45_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const pending = await hubClient.getPendingHandshakeMessages(matchId);
+        const answer = pending.find((message) => message.messageType === "answer");
+        if (answer) {
+            return answer;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1_500));
     }
-    return hubClient?.registrationToken ?? null;
+    throw new Error(`Timed out waiting for handshake answer for match ${matchId}`);
 }
-async function processPendingHubMatches(api, config, processedMatches) {
+function getHandshakeTokenValidationError(token) {
+    if (isValidEphemeralInboundToken(token)) {
+        return null;
+    }
+    const tokenShape = typeof token === "string"
+        ? `length ${Array.from(token).length}${token.includes("\u2026") ? ", contains U+2026" : ""}`
+        : `type ${typeof token}`;
+    return `invalid ephemeral handshake token: expected 48 lowercase hex characters, got ${tokenShape}`;
+}
+async function processPendingHubMatches(api, config, processedMessages, historyStore) {
     let hubClient;
     try {
         hubClient = await HubMatchClient.create();
@@ -239,9 +292,9 @@ async function processPendingHubMatches(api, config, processedMatches) {
         api.logger.warn(`claw-crony: pending match polling skipped - ${err instanceof Error ? err.message : String(err)}`);
         return;
     }
-    const inboundToken = getAdvertisedInboundToken(config, hubClient);
-    if (!inboundToken) {
-        api.logger.warn("claw-crony: pending match polling skipped - no inbound token available");
+    const identity = loadIdentity();
+    if (!identity) {
+        api.logger.warn("claw-crony: pending match polling skipped - no local identity available");
         return;
     }
     let matches;
@@ -257,17 +310,107 @@ async function processPendingHubMatches(api, config, processedMatches) {
             continue;
         }
         try {
-            const alreadySubmitted = match.providerTokenSubmitted === true || processedMatches.has(match.id);
-            let currentMatch = match;
-            if (!alreadySubmitted) {
-                currentMatch = await hubClient.submitToken(match.id, inboundToken);
-                processedMatches.add(match.id);
-                api.logger.info(`claw-crony: submitted provider token for hub match ${match.id}`);
-            }
-            if (currentMatch.readyForComplete === true && currentMatch.status === "token_exchange") {
-                await hubClient.completeMatch(match.id, inboundToken);
-                processedMatches.delete(match.id);
-                api.logger.info(`claw-crony: completed hub match ${match.id}`);
+            const pendingMessages = await hubClient.getPendingHandshakeMessages(match.id);
+            for (const message of pendingMessages) {
+                if (processedMessages.has(message.id)) {
+                    continue;
+                }
+                const decrypted = decryptHandshake(message.ciphertext, identity);
+                historyStore?.record({
+                    type: message.messageType === "answer" ? "handshake.answer_received" : "handshake.offer_received",
+                    status: "started",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: message.id,
+                    peer: match.requester?.name ?? `agent-${message.senderAgentId}`,
+                    detail: {
+                        messageType: message.messageType,
+                        senderAgentId: message.senderAgentId,
+                        receiverAgentId: message.receiverAgentId,
+                    },
+                });
+                const tokenValidationError = getHandshakeTokenValidationError(decrypted.token);
+                if (tokenValidationError) {
+                    await hubClient.consumeHandshakeMessage(match.id, message.id);
+                    processedMessages.add(message.id);
+                    historyStore?.record({
+                        type: "handshake.failed",
+                        status: "ignored",
+                        direction: "inbound",
+                        matchId: match.id,
+                        messageId: message.id,
+                        peer: match.requester?.name ?? `agent-${message.senderAgentId}`,
+                        detail: { reason: tokenValidationError },
+                    });
+                    api.logger.warn(`claw-crony: ignored malformed handshake ${message.id} for match ${match.id} - ${tokenValidationError}`);
+                    continue;
+                }
+                await hubClient.consumeHandshakeMessage(match.id, message.id);
+                processedMessages.add(message.id);
+                const remoteName = match.callerRole === "provider"
+                    ? (match.requester?.name ?? `agent-${decrypted.fromAgentId}`)
+                    : (match.provider?.name ?? `agent-${decrypted.fromAgentId}`);
+                upsertEphemeralPeer(config, remoteName, decrypted.address, decrypted.token);
+                historyStore?.record({
+                    type: "peer.upserted",
+                    status: "success",
+                    direction: "local",
+                    matchId: match.id,
+                    peer: remoteName,
+                    detail: {
+                        agentCardUrl: config.peers.find((peer) => peer.name === remoteName)?.agentCardUrl,
+                        tokenExpiresAt: decrypted.tokenExpiresAt,
+                    },
+                });
+                if (message.messageType === "offer" && match.callerRole === "provider") {
+                    const localAddress = getAdvertisedAddress(config);
+                    if (!localAddress) {
+                        api.logger.warn(`claw-crony: cannot answer match ${match.id} because no advertised address is configured`);
+                        continue;
+                    }
+                    const issued = issueEphemeralInboundToken(config, match.id, decrypted.fromAgentId);
+                    const payload = {
+                        version: 1,
+                        matchId: match.id,
+                        sessionId: crypto.randomUUID(),
+                        fromAgentId: hubClient.agentId,
+                        toAgentId: decrypted.fromAgentId,
+                        address: localAddress,
+                        agentCardPath: "/.well-known/agent.json",
+                        token: issued.token,
+                        tokenExpiresAt: issued.expiresAt,
+                        protocols: ["jsonrpc", "rest", "grpc"],
+                        createdAt: new Date().toISOString(),
+                        nonce: crypto.randomBytes(12).toString("hex"),
+                    };
+                    const peerPublicKey = match.requester?.publicKey;
+                    if (!peerPublicKey) {
+                        api.logger.warn(`claw-crony: cannot answer match ${match.id} because requester public key is missing`);
+                        continue;
+                    }
+                    await hubClient.sendHandshakeMessage(match.id, {
+                        messageType: "answer",
+                        ciphertext: encryptHandshake(payload, peerPublicKey),
+                        expiresAt: issued.expiresAt,
+                    });
+                    historyStore?.record({
+                        type: "handshake.answer_sent",
+                        status: "success",
+                        direction: "outbound",
+                        matchId: match.id,
+                        peer: remoteName,
+                        detail: {
+                            toAgentId: decrypted.fromAgentId,
+                            expiresAt: issued.expiresAt,
+                        },
+                    });
+                    await hubClient.markReady(match.id);
+                    api.logger.info(`claw-crony: answered encrypted handshake for match ${match.id}`);
+                }
+                else if (message.messageType === "answer") {
+                    await hubClient.markReady(match.id);
+                    api.logger.info(`claw-crony: received encrypted handshake answer for match ${match.id}`);
+                }
             }
         }
         catch (err) {
@@ -285,6 +428,10 @@ const plugin = {
             structuredLogs: config.observability.structuredLogs,
         });
         const auditLogger = new AuditLogger(config.observability.auditLogPath);
+        const historyStore = new RequestHistoryStore(config.observability.historyLogPath, {
+            enabled: config.observability.historyEnabled,
+            includeEncryptedPayloads: config.observability.historyIncludeEncryptedPayloads,
+        });
         const client = new A2AClient();
         const taskStore = new FileTaskStore(config.storage.tasksDir);
         const executor = new QueueingAgentExecutor(new OpenClawAgentExecutor(api, config), telemetry, config.limits);
@@ -321,6 +468,13 @@ const plugin = {
         // Wire audit logger for inbound task completion
         telemetry.setTaskAuditCallback((taskId, contextId, state, durationMs) => {
             auditLogger.recordInbound(taskId, contextId, state, durationMs);
+            historyStore.record({
+                type: state === "completed" ? "task.inbound_completed" : "task.inbound_failed",
+                status: state === "completed" ? "success" : "failure",
+                direction: "inbound",
+                durationMs,
+                detail: { taskId, contextId, state },
+            });
         });
         // SDK expects userBuilder(req) -> Promise<User>
         // When bearer auth is configured, validate the Authorization header.
@@ -397,7 +551,305 @@ const plugin = {
         let cleanupTimer = null;
         let hubMatchPollingTimer = null;
         const grpcPort = config.server.port + 1;
-        const processedHubMatches = new Set();
+        const processedHubMessages = new Set();
+        let hubStartupPromise = null;
+        let hubShutdownPromise = null;
+        const startHubLifecycle = (source) => {
+            if (config.hub?.enabled === false) {
+                return Promise.resolve();
+            }
+            if (!hubStartupPromise) {
+                hubStartupPromise = (async () => {
+                    if (config.hub?.registrationEnabled !== false) {
+                        try {
+                            const reg = await runHubRegistration(api, config, config.hub, config.registration ?? {});
+                            if (reg) {
+                                api.logger.info(`claw-crony: registered with hub (agentId=${reg.agentId}, source=${source})`);
+                            }
+                        }
+                        catch (err) {
+                            api.logger.warn(`claw-crony: hub registration failed - ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    try {
+                        const hubClient = await HubMatchClient.create();
+                        await hubClient.updatePresence("online");
+                    }
+                    catch (presenceErr) {
+                        api.logger.warn(`claw-crony: failed to update hub presence - ${presenceErr instanceof Error ? presenceErr.message : String(presenceErr)}`);
+                    }
+                })();
+            }
+            return hubStartupPromise;
+        };
+        const stopHubLifecycle = (source) => {
+            if (config.hub?.enabled === false) {
+                return Promise.resolve();
+            }
+            if (!hubShutdownPromise) {
+                hubShutdownPromise = (async () => {
+                    try {
+                        const hubClient = await HubMatchClient.create();
+                        await hubClient.updatePresence("offline");
+                        api.logger.info(`claw-crony: hub presence set offline (source=${source})`);
+                    }
+                    catch {
+                        // Ignore best-effort presence shutdown failure.
+                    }
+                })();
+            }
+            return hubShutdownPromise;
+        };
+        api.on("gateway_start", async () => {
+            await startHubLifecycle("gateway_start");
+        }, { priority: 50 });
+        api.on("gateway_stop", async () => {
+            await stopHubLifecycle("gateway_stop");
+        }, { priority: 50 });
+        const performMatchRequest = async (input) => {
+            const startedAt = Date.now();
+            let hubClient;
+            try {
+                hubClient = await HubMatchClient.create();
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg },
+                });
+                return {
+                    ok: false,
+                    text: `Not registered with hub: ${msg}`,
+                    details: { ok: false, error: msg },
+                };
+            }
+            const identity = loadIdentity();
+            if (!identity) {
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: "identity_missing" },
+                });
+                return {
+                    ok: false,
+                    text: "No local identity found. Restart the plugin and try again.",
+                    details: { ok: false, error: "identity_missing" },
+                };
+            }
+            const localAddress = getAdvertisedAddress(config);
+            if (!localAddress) {
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: "address_missing" },
+                });
+                return {
+                    ok: false,
+                    text: "No advertised address is configured for this agent.",
+                    details: { ok: false, error: "address_missing" },
+                };
+            }
+            let match;
+            try {
+                match = await hubClient.createMatch({
+                    skills: input.skills,
+                    description: input.description,
+                });
+                historyStore.record({
+                    type: "match.created",
+                    status: "success",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: match.provider?.name,
+                    detail: {
+                        skills: input.skills,
+                        description: input.description,
+                        providerAgentId: match.provider?.id,
+                    },
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, skills: input.skills },
+                });
+                return {
+                    ok: false,
+                    text: `Failed to create match: ${msg}`,
+                    details: { ok: false, error: msg },
+                };
+            }
+            const provider = match.provider;
+            const providerPublicKey = provider?.publicKey;
+            if (!provider || !providerPublicKey) {
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider?.name,
+                    detail: { reason: "provider_public_key_missing" },
+                });
+                return {
+                    ok: false,
+                    text: `Match created (id=${match.id}) but provider public key is missing`,
+                    details: { ok: false, matchId: match.id, error: "provider_public_key_missing" },
+                };
+            }
+            const issued = issueEphemeralInboundToken(config, match.id, provider.id);
+            const localPayload = {
+                version: 1,
+                matchId: match.id,
+                sessionId: crypto.randomUUID(),
+                fromAgentId: hubClient.agentId,
+                toAgentId: provider.id,
+                address: localAddress,
+                agentCardPath: "/.well-known/agent.json",
+                token: issued.token,
+                tokenExpiresAt: issued.expiresAt,
+                protocols: ["jsonrpc", "rest", "grpc"],
+                createdAt: new Date().toISOString(),
+                nonce: crypto.randomBytes(12).toString("hex"),
+            };
+            try {
+                await hubClient.sendHandshakeMessage(match.id, {
+                    messageType: "offer",
+                    ciphertext: encryptHandshake(localPayload, providerPublicKey),
+                    expiresAt: issued.expiresAt,
+                });
+                historyStore.record({
+                    type: "handshake.offer_sent",
+                    status: "success",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    detail: {
+                        toAgentId: provider.id,
+                        address: localAddress,
+                        expiresAt: issued.expiresAt,
+                    },
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "offer" },
+                });
+                return {
+                    ok: false,
+                    text: `Match created (id=${match.id}) but failed to send encrypted handshake offer: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            let answer;
+            try {
+                answer = await waitForHandshakeAnswer(hubClient, match.id);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "inbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "wait_answer" },
+                });
+                return {
+                    ok: false,
+                    text: `Encrypted handshake offer sent for match ${match.id}, but waiting for answer failed: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            let remotePayload;
+            try {
+                remotePayload = decryptHandshake(answer.ciphertext, identity);
+                const tokenValidationError = getHandshakeTokenValidationError(remotePayload.token);
+                if (tokenValidationError) {
+                    throw new Error(tokenValidationError);
+                }
+                await hubClient.consumeHandshakeMessage(match.id, answer.id);
+                historyStore.record({
+                    type: "handshake.answer_received",
+                    status: "success",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: answer.id,
+                    peer: provider.name,
+                    detail: {
+                        fromAgentId: answer.senderAgentId,
+                        address: remotePayload.address,
+                        tokenExpiresAt: remotePayload.tokenExpiresAt,
+                    },
+                });
+                upsertEphemeralPeer(config, provider.name, remotePayload.address, remotePayload.token);
+                historyStore.record({
+                    type: "peer.upserted",
+                    status: "success",
+                    direction: "local",
+                    matchId: match.id,
+                    peer: provider.name,
+                    detail: {
+                        agentCardUrl: config.peers.find((peer) => peer.name === provider.name)?.agentCardUrl,
+                        tokenExpiresAt: remotePayload.tokenExpiresAt,
+                    },
+                });
+                await hubClient.markReady(match.id);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: answer.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "process_answer" },
+                });
+                return {
+                    ok: false,
+                    text: `Encrypted handshake answer received for match ${match.id}, but processing failed: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            return {
+                ok: true,
+                text: `Encrypted handshake ready: match=${match.id}\n` +
+                    `Provider: ${provider.name}\n` +
+                    `Address: ${remotePayload.address}\n` +
+                    `Temporary token: ${remotePayload.token}\n` +
+                    `Token expires at: ${remotePayload.tokenExpiresAt}`,
+                details: {
+                    ok: true,
+                    matchId: match.id,
+                    status: "ready_to_connect",
+                    providerAddress: remotePayload.address,
+                    peerToken: remotePayload.token,
+                    tokenExpiresAt: remotePayload.tokenExpiresAt,
+                },
+            };
+        };
         api.registerGatewayMethod("a2a.metrics", ({ respond }) => {
             respond(true, {
                 metrics: telemetry.snapshot(),
@@ -411,6 +863,49 @@ const plugin = {
                 .then((entries) => respond(true, { entries, count: entries.length }))
                 .catch((error) => respond(false, { error: String(error?.message || error) }));
         });
+        api.registerGatewayMethod("a2a.history", ({ params, respond }) => {
+            const payload = asObject(params);
+            const matchId = asNumber(payload.matchId, Number.NaN);
+            historyStore
+                .tail({
+                count: Math.min(Math.max(1, asNumber(payload.count ?? payload.limit, 50)), 500),
+                type: asString(payload.type, ""),
+                status: asString(payload.status, ""),
+                direction: asString(payload.direction, ""),
+                matchId: Number.isFinite(matchId) ? matchId : undefined,
+                peer: asString(payload.peer, ""),
+            })
+                .then((entries) => respond(true, { entries, count: entries.length }))
+                .catch((error) => respond(false, { error: String(error?.message || error) }));
+        });
+        api.registerGatewayMethod("a2a.peers", ({ respond }) => {
+            const peerStates = healthManager?.getAllStates() ?? new Map();
+            respond(true, {
+                peers: config.peers.map((peer) => ({
+                    name: peer.name,
+                    agentCardUrl: peer.agentCardUrl,
+                    authType: peer.auth?.type,
+                    hasToken: Boolean(peer.auth?.token),
+                    health: peerStates.get(peer.name) ?? null,
+                })),
+            });
+        });
+        api.registerGatewayMethod("a2a.match", ({ params, respond }) => {
+            const payload = asObject(params);
+            const skills = Array.isArray(payload.skills)
+                ? payload.skills.filter((entry) => typeof entry === "string" && entry.trim().length > 0)
+                : [];
+            if (skills.length === 0) {
+                respond(false, { error: "skills must be a non-empty string array" });
+                return;
+            }
+            performMatchRequest({
+                skills,
+                description: asString(payload.description, ""),
+            })
+                .then((result) => respond(result.ok, result.details))
+                .catch((error) => respond(false, { error: String(error?.message || error) }));
+        });
         api.registerGatewayMethod("a2a.send", ({ params, respond }) => {
             const payload = asObject(params);
             const peerName = asString(payload.peer || payload.name, "");
@@ -439,6 +934,16 @@ const plugin = {
                 message.agentId = resolvedAgentId;
             }
             const startedAt = Date.now();
+            historyStore.record({
+                type: "send.started",
+                status: "started",
+                direction: "outbound",
+                peer: peer.name,
+                detail: {
+                    resolvedAgentId: message.agentId,
+                    hasParts: Array.isArray(message.parts),
+                },
+            });
             const sendOptions = {
                 healthManager: healthManager ?? undefined,
                 retryConfig: config.resilience.retry,
@@ -455,6 +960,17 @@ const plugin = {
                 const outDuration = Date.now() - startedAt;
                 telemetry.recordOutboundRequest(peer.name, result.ok, result.statusCode, outDuration);
                 auditLogger.recordOutbound(peer.name, result.ok, result.statusCode, outDuration);
+                historyStore.record({
+                    type: result.ok ? "send.completed" : "send.failed",
+                    status: result.ok ? "success" : "failure",
+                    direction: "outbound",
+                    peer: peer.name,
+                    durationMs: outDuration,
+                    detail: {
+                        statusCode: result.statusCode,
+                        response: result.ok ? undefined : result.response,
+                    },
+                });
                 if (result.ok) {
                     respond(true, {
                         statusCode: result.statusCode,
@@ -471,6 +987,14 @@ const plugin = {
                 const errDuration = Date.now() - startedAt;
                 telemetry.recordOutboundRequest(peer.name, false, 500, errDuration);
                 auditLogger.recordOutbound(peer.name, false, 500, errDuration);
+                historyStore.record({
+                    type: "send.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    peer: peer.name,
+                    durationMs: errDuration,
+                    detail: { error: String(error?.message || error) },
+                });
                 respond(false, { error: String(error?.message || error) });
             });
         });
@@ -498,64 +1022,103 @@ const plugin = {
                 label: "A2A Send File",
                 parameters: sendFileParams,
                 async execute(toolCallId, params) {
-                    const peer = config.peers.find((p) => p.name === params.peer);
+                    const input = params;
+                    const peer = config.peers.find((p) => p.name === input.peer);
                     if (!peer) {
                         const available = config.peers.map((p) => p.name).join(", ") || "(none)";
                         return {
-                            content: [{ type: "text", text: `Peer not found: "${params.peer}". Available peers: ${available}` }],
+                            content: [{ type: "text", text: `Peer not found: "${input.peer}". Available peers: ${available}` }],
                             details: { ok: false },
                         };
                     }
                     // Security checks: SSRF, MIME, file size
-                    const uriCheck = await validateUri(params.uri, config.security);
+                    const uriCheck = await validateUri(input.uri, config.security);
                     if (!uriCheck.ok) {
                         return {
                             content: [{ type: "text", text: `URI rejected: ${uriCheck.reason}` }],
                             details: { ok: false, reason: uriCheck.reason },
                         };
                     }
-                    if (params.mimeType && !validateMimeType(params.mimeType, config.security.allowedMimeTypes)) {
+                    if (input.mimeType && !validateMimeType(input.mimeType, config.security.allowedMimeTypes)) {
                         return {
-                            content: [{ type: "text", text: `MIME type rejected: "${params.mimeType}" is not in the allowed list` }],
+                            content: [{ type: "text", text: `MIME type rejected: "${input.mimeType}" is not in the allowed list` }],
                             details: { ok: false },
                         };
                     }
                     const parts = [];
-                    if (params.text) {
-                        parts.push({ kind: "text", text: params.text });
+                    if (input.text) {
+                        parts.push({ kind: "text", text: input.text });
                     }
                     parts.push({
                         kind: "file",
                         file: {
-                            uri: params.uri,
-                            ...(params.name ? { name: params.name } : {}),
-                            ...(params.mimeType ? { mimeType: params.mimeType } : {}),
+                            uri: input.uri,
+                            ...(input.name ? { name: input.name } : {}),
+                            ...(input.mimeType ? { mimeType: input.mimeType } : {}),
                         },
                     });
                     try {
                         const message = { parts };
-                        if (params.agentId) {
-                            message.agentId = params.agentId;
+                        if (input.agentId) {
+                            message.agentId = input.agentId;
                         }
+                        const startedAt = Date.now();
+                        historyStore.record({
+                            type: "send_file.started",
+                            status: "started",
+                            direction: "outbound",
+                            peer: peer.name,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                agentId: input.agentId,
+                            },
+                        });
                         const result = await client.sendMessage(peer, message, {
                             healthManager: healthManager ?? undefined,
                             retryConfig: config.resilience.retry,
                         });
+                        historyStore.record({
+                            type: result.ok ? "send_file.completed" : "send_file.failed",
+                            status: result.ok ? "success" : "failure",
+                            direction: "outbound",
+                            peer: peer.name,
+                            durationMs: Date.now() - startedAt,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                response: result.ok ? undefined : result.response,
+                            },
+                        });
                         if (result.ok) {
                             return {
-                                content: [{ type: "text", text: `File sent to ${params.peer} via A2A.\nURI: ${params.uri}\nResponse: ${JSON.stringify(result.response)}` }],
+                                content: [{ type: "text", text: `File sent to ${input.peer} via A2A.\nURI: ${input.uri}\nResponse: ${JSON.stringify(result.response)}` }],
                                 details: { ok: true, response: result.response },
                             };
                         }
                         return {
-                            content: [{ type: "text", text: `Failed to send file to ${params.peer}: ${JSON.stringify(result.response)}` }],
+                            content: [{ type: "text", text: `Failed to send file to ${input.peer}: ${JSON.stringify(result.response)}` }],
                             details: { ok: false, response: result.response },
                         };
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
+                        historyStore.record({
+                            type: "send_file.failed",
+                            status: "failure",
+                            direction: "outbound",
+                            peer: peer.name,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                error: msg,
+                            },
+                        });
                         return {
-                            content: [{ type: "text", text: `Error sending file to ${params.peer}: ${msg}` }],
+                            content: [{ type: "text", text: `Error sending file to ${input.peer}: ${msg}` }],
                             details: { ok: false, error: msg },
                         };
                     }
@@ -563,14 +1126,13 @@ const plugin = {
             });
             // ------------------------------------------------------------------
             // Agent tool: a2a_match_request
-            // Creates a match request on the hub and submits this agent's token.
-            // Returns provider address + yourToken + peerToken for A2A communication.
+            // Creates a match request on the hub and performs encrypted connection-info handshake.
             // ------------------------------------------------------------------
             api.registerTool({
                 name: "a2a_match_request",
                 description: "Request a match with another agent via the hub. " +
                     "The hub finds a provider agent with matching skills, creates a match record, " +
-                    "and returns the provider's address along with tokens for secure A2A communication. " +
+                    "and relays encrypted handshake messages so both agents can exchange temporary A2A connection details. " +
                     "Use this to discover and connect with peer agents through the hub's registry.",
                 label: "A2A Match Request",
                 parameters: {
@@ -589,65 +1151,11 @@ const plugin = {
                     },
                 },
                 async execute(toolCallId, params) {
-                    let client;
-                    try {
-                        client = await HubMatchClient.create();
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Not registered with hub: ${msg}` }],
-                            details: { ok: false, error: msg },
-                        };
-                    }
-                    let match;
-                    try {
-                        match = await client.createMatch({
-                            skills: params.skills,
-                            description: params.description,
-                            token: getAdvertisedInboundToken(config, client) ?? client.registrationToken,
-                        });
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Failed to create match: ${msg}` }],
-                            details: { ok: false, error: msg },
-                        };
-                    }
-                    // Submit our token
-                    let updatedMatch;
-                    try {
-                        updatedMatch = await client.submitToken(match.id, getAdvertisedInboundToken(config, client) ?? client.registrationToken);
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Match created (id=${match.id}) but failed to submit token: ${msg}` }],
-                            details: { ok: false, matchId: match.id, error: msg },
-                        };
-                    }
-                    const provider = updatedMatch.provider;
-                    const providerAddress = provider?.address ?? "(unknown)";
-                    const providerAccessToken = updatedMatch.yourToken ?? "(none)";
-                    const requesterInboundToken = updatedMatch.peerToken ?? "(none)";
-                    const status = updatedMatch.status;
+                    const input = params;
+                    const result = await performMatchRequest(input);
                     return {
-                        content: [{
-                                type: "text",
-                                text: `Match ${status}: id=${updatedMatch.id}\n` +
-                                    `Provider: ${provider?.name ?? "(unknown)"} at ${providerAddress}\n` +
-                                    `Provider access token (use to contact provider): ${providerAccessToken}\n` +
-                                    `Requester inbound token (provider uses this to contact you): ${requesterInboundToken}`,
-                            }],
-                        details: {
-                            ok: true,
-                            matchId: updatedMatch.id,
-                            status: updatedMatch.status,
-                            providerAddress,
-                            yourToken: providerAccessToken,
-                            peerToken: requesterInboundToken,
-                        },
+                        content: [{ type: "text", text: result.text }],
+                        details: result.details,
                     };
                 },
             });
@@ -662,19 +1170,7 @@ const plugin = {
                 if (server) {
                     return;
                 }
-                // Hub registration (runs before server starts)
-                if (config.hub?.enabled !== false && config.hub?.registrationEnabled !== false) {
-                    try {
-                        const reg = await runHubRegistration(api, config, config.hub, config.registration ?? {});
-                        if (reg) {
-                            api.logger.info(`claw-crony: registered with hub (agentId=${reg.agentId})`);
-                        }
-                    }
-                    catch (err) {
-                        api.logger.warn(`claw-crony: hub registration failed — ${err instanceof Error ? err.message : String(err)}`);
-                        // Continue startup anyway — hub is optional
-                    }
-                }
+                await startHubLifecycle("service");
                 // Start peer health checks
                 healthManager?.start();
                 // Start HTTP server (JSON-RPC + REST)
@@ -742,7 +1238,7 @@ const plugin = {
                 if (config.hub?.enabled !== false) {
                     const pollingIntervalMs = Math.max(5_000, config.resilience.healthCheck.intervalMs);
                     const pollHubMatches = () => {
-                        void processPendingHubMatches(api, config, processedHubMatches);
+                        void processPendingHubMatches(api, config, processedHubMessages, historyStore);
                     };
                     pollHubMatches();
                     hubMatchPollingTimer = setInterval(pollHubMatches, pollingIntervalMs);
@@ -754,6 +1250,8 @@ const plugin = {
                 // Stop peer health checks
                 healthManager?.stop();
                 auditLogger.close();
+                historyStore.close();
+                await stopHubLifecycle("service");
                 // Stop task cleanup timer
                 if (cleanupTimer) {
                     clearInterval(cleanupTimer);