@clawcrony/claw-crony 1.2.4 → 1.3.0

package/dist/index.js

@@ -22,13 +22,14 @@ import { runTaskCleanup } from "./src/task-cleanup.js";
 import { FileTaskStore } from "./src/task-store.js";
 import { GatewayTelemetry } from "./src/telemetry.js";
 import { AuditLogger } from "./src/audit.js";
+import { RequestHistoryStore } from "./src/history.js";
 import { PeerHealthManager } from "./src/peer-health.js";
 import { runHubRegistration } from "./src/hub-registration.js";
 import { HubMatchClient } from "./src/hub-match.js";
 import { normalizeAgentCardSkills } from "./src/skill-catalog.js";
 import { parseRoutingRules, matchRule } from "./src/routing-rules.js";
 import { decryptHandshake, encryptHandshake } from "./src/handshake-crypto.js";
-import { issueEphemeralInboundToken } from "./src/ephemeral-token.js";
+import { isValidEphemeralInboundToken, issueEphemeralInboundToken } from "./src/ephemeral-token.js";
 import { loadIdentity } from "./src/identity-store.js";
 import { validateUri, validateMimeType, } from "./src/file-security.js";
 /** Build a JSON-RPC error response. */
@@ -187,6 +188,9 @@ export function parseConfig(raw, resolvePath) {
             metricsPath: normalizeHttpPath(asString(observability.metricsPath, "/a2a/metrics"), "/a2a/metrics"),
             metricsAuth: (asString(observability.metricsAuth, "none") === "bearer" ? "bearer" : "none"),
             auditLogPath: resolveConfiguredPath(observability.auditLogPath, path.join(os.homedir(), ".openclaw", "a2a-audit.jsonl"), resolvePath),
+            historyEnabled: asBoolean(observability.historyEnabled, true),
+            historyLogPath: resolveConfiguredPath(observability.historyLogPath, path.join(os.homedir(), ".openclaw", "a2a-history.jsonl"), resolvePath),
+            historyIncludeEncryptedPayloads: asBoolean(observability.historyIncludeEncryptedPayloads, false),
         },
         timeouts: {
             agentResponseTimeoutMs: asNumber(timeouts.agentResponseTimeoutMs, 300_000),
@@ -270,7 +274,16 @@ async function waitForHandshakeAnswer(hubClient, matchId, timeoutMs = 45_000) {
     }
     throw new Error(`Timed out waiting for handshake answer for match ${matchId}`);
 }
-async function processPendingHubMatches(api, config, processedMessages) {
+function getHandshakeTokenValidationError(token) {
+    if (isValidEphemeralInboundToken(token)) {
+        return null;
+    }
+    const tokenShape = typeof token === "string"
+        ? `length ${Array.from(token).length}${token.includes("\u2026") ? ", contains U+2026" : ""}`
+        : `type ${typeof token}`;
+    return `invalid ephemeral handshake token: expected 48 lowercase hex characters, got ${tokenShape}`;
+}
+async function processPendingHubMatches(api, config, processedMessages, historyStore) {
     let hubClient;
     try {
         hubClient = await HubMatchClient.create();
@@ -303,12 +316,52 @@ async function processPendingHubMatches(api, config, processedMessages) {
                     continue;
                 }
                 const decrypted = decryptHandshake(message.ciphertext, identity);
+                historyStore?.record({
+                    type: message.messageType === "answer" ? "handshake.answer_received" : "handshake.offer_received",
+                    status: "started",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: message.id,
+                    peer: match.requester?.name ?? `agent-${message.senderAgentId}`,
+                    detail: {
+                        messageType: message.messageType,
+                        senderAgentId: message.senderAgentId,
+                        receiverAgentId: message.receiverAgentId,
+                    },
+                });
+                const tokenValidationError = getHandshakeTokenValidationError(decrypted.token);
+                if (tokenValidationError) {
+                    await hubClient.consumeHandshakeMessage(match.id, message.id);
+                    processedMessages.add(message.id);
+                    historyStore?.record({
+                        type: "handshake.failed",
+                        status: "ignored",
+                        direction: "inbound",
+                        matchId: match.id,
+                        messageId: message.id,
+                        peer: match.requester?.name ?? `agent-${message.senderAgentId}`,
+                        detail: { reason: tokenValidationError },
+                    });
+                    api.logger.warn(`claw-crony: ignored malformed handshake ${message.id} for match ${match.id} - ${tokenValidationError}`);
+                    continue;
+                }
                 await hubClient.consumeHandshakeMessage(match.id, message.id);
                 processedMessages.add(message.id);
                 const remoteName = match.callerRole === "provider"
                     ? (match.requester?.name ?? `agent-${decrypted.fromAgentId}`)
                     : (match.provider?.name ?? `agent-${decrypted.fromAgentId}`);
                 upsertEphemeralPeer(config, remoteName, decrypted.address, decrypted.token);
+                historyStore?.record({
+                    type: "peer.upserted",
+                    status: "success",
+                    direction: "local",
+                    matchId: match.id,
+                    peer: remoteName,
+                    detail: {
+                        agentCardUrl: config.peers.find((peer) => peer.name === remoteName)?.agentCardUrl,
+                        tokenExpiresAt: decrypted.tokenExpiresAt,
+                    },
+                });
                 if (message.messageType === "offer" && match.callerRole === "provider") {
                     const localAddress = getAdvertisedAddress(config);
                     if (!localAddress) {
@@ -340,6 +393,17 @@ async function processPendingHubMatches(api, config, processedMessages) {
                         ciphertext: encryptHandshake(payload, peerPublicKey),
                         expiresAt: issued.expiresAt,
                     });
+                    historyStore?.record({
+                        type: "handshake.answer_sent",
+                        status: "success",
+                        direction: "outbound",
+                        matchId: match.id,
+                        peer: remoteName,
+                        detail: {
+                            toAgentId: decrypted.fromAgentId,
+                            expiresAt: issued.expiresAt,
+                        },
+                    });
                     await hubClient.markReady(match.id);
                     api.logger.info(`claw-crony: answered encrypted handshake for match ${match.id}`);
                 }
@@ -364,6 +428,10 @@ const plugin = {
             structuredLogs: config.observability.structuredLogs,
         });
         const auditLogger = new AuditLogger(config.observability.auditLogPath);
+        const historyStore = new RequestHistoryStore(config.observability.historyLogPath, {
+            enabled: config.observability.historyEnabled,
+            includeEncryptedPayloads: config.observability.historyIncludeEncryptedPayloads,
+        });
         const client = new A2AClient();
         const taskStore = new FileTaskStore(config.storage.tasksDir);
         const executor = new QueueingAgentExecutor(new OpenClawAgentExecutor(api, config), telemetry, config.limits);
@@ -400,6 +468,13 @@ const plugin = {
         // Wire audit logger for inbound task completion
         telemetry.setTaskAuditCallback((taskId, contextId, state, durationMs) => {
             auditLogger.recordInbound(taskId, contextId, state, durationMs);
+            historyStore.record({
+                type: state === "completed" ? "task.inbound_completed" : "task.inbound_failed",
+                status: state === "completed" ? "success" : "failure",
+                direction: "inbound",
+                durationMs,
+                detail: { taskId, contextId, state },
+            });
         });
         // SDK expects userBuilder(req) -> Promise<User>
         // When bearer auth is configured, validate the Authorization header.
@@ -477,6 +552,304 @@ const plugin = {
         let hubMatchPollingTimer = null;
         const grpcPort = config.server.port + 1;
         const processedHubMessages = new Set();
+        let hubStartupPromise = null;
+        let hubShutdownPromise = null;
+        const startHubLifecycle = (source) => {
+            if (config.hub?.enabled === false) {
+                return Promise.resolve();
+            }
+            if (!hubStartupPromise) {
+                hubStartupPromise = (async () => {
+                    if (config.hub?.registrationEnabled !== false) {
+                        try {
+                            const reg = await runHubRegistration(api, config, config.hub, config.registration ?? {});
+                            if (reg) {
+                                api.logger.info(`claw-crony: registered with hub (agentId=${reg.agentId}, source=${source})`);
+                            }
+                        }
+                        catch (err) {
+                            api.logger.warn(`claw-crony: hub registration failed - ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    try {
+                        const hubClient = await HubMatchClient.create();
+                        await hubClient.updatePresence("online");
+                    }
+                    catch (presenceErr) {
+                        api.logger.warn(`claw-crony: failed to update hub presence - ${presenceErr instanceof Error ? presenceErr.message : String(presenceErr)}`);
+                    }
+                })();
+            }
+            return hubStartupPromise;
+        };
+        const stopHubLifecycle = (source) => {
+            if (config.hub?.enabled === false) {
+                return Promise.resolve();
+            }
+            if (!hubShutdownPromise) {
+                hubShutdownPromise = (async () => {
+                    try {
+                        const hubClient = await HubMatchClient.create();
+                        await hubClient.updatePresence("offline");
+                        api.logger.info(`claw-crony: hub presence set offline (source=${source})`);
+                    }
+                    catch {
+                        // Ignore best-effort presence shutdown failure.
+                    }
+                })();
+            }
+            return hubShutdownPromise;
+        };
+        api.on("gateway_start", async () => {
+            await startHubLifecycle("gateway_start");
+        }, { priority: 50 });
+        api.on("gateway_stop", async () => {
+            await stopHubLifecycle("gateway_stop");
+        }, { priority: 50 });
+        const performMatchRequest = async (input) => {
+            const startedAt = Date.now();
+            let hubClient;
+            try {
+                hubClient = await HubMatchClient.create();
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg },
+                });
+                return {
+                    ok: false,
+                    text: `Not registered with hub: ${msg}`,
+                    details: { ok: false, error: msg },
+                };
+            }
+            const identity = loadIdentity();
+            if (!identity) {
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: "identity_missing" },
+                });
+                return {
+                    ok: false,
+                    text: "No local identity found. Restart the plugin and try again.",
+                    details: { ok: false, error: "identity_missing" },
+                };
+            }
+            const localAddress = getAdvertisedAddress(config);
+            if (!localAddress) {
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: "address_missing" },
+                });
+                return {
+                    ok: false,
+                    text: "No advertised address is configured for this agent.",
+                    details: { ok: false, error: "address_missing" },
+                };
+            }
+            let match;
+            try {
+                match = await hubClient.createMatch({
+                    skills: input.skills,
+                    description: input.description,
+                });
+                historyStore.record({
+                    type: "match.created",
+                    status: "success",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: match.provider?.name,
+                    detail: {
+                        skills: input.skills,
+                        description: input.description,
+                        providerAgentId: match.provider?.id,
+                    },
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "match.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, skills: input.skills },
+                });
+                return {
+                    ok: false,
+                    text: `Failed to create match: ${msg}`,
+                    details: { ok: false, error: msg },
+                };
+            }
+            const provider = match.provider;
+            const providerPublicKey = provider?.publicKey;
+            if (!provider || !providerPublicKey) {
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider?.name,
+                    detail: { reason: "provider_public_key_missing" },
+                });
+                return {
+                    ok: false,
+                    text: `Match created (id=${match.id}) but provider public key is missing`,
+                    details: { ok: false, matchId: match.id, error: "provider_public_key_missing" },
+                };
+            }
+            const issued = issueEphemeralInboundToken(config, match.id, provider.id);
+            const localPayload = {
+                version: 1,
+                matchId: match.id,
+                sessionId: crypto.randomUUID(),
+                fromAgentId: hubClient.agentId,
+                toAgentId: provider.id,
+                address: localAddress,
+                agentCardPath: "/.well-known/agent.json",
+                token: issued.token,
+                tokenExpiresAt: issued.expiresAt,
+                protocols: ["jsonrpc", "rest", "grpc"],
+                createdAt: new Date().toISOString(),
+                nonce: crypto.randomBytes(12).toString("hex"),
+            };
+            try {
+                await hubClient.sendHandshakeMessage(match.id, {
+                    messageType: "offer",
+                    ciphertext: encryptHandshake(localPayload, providerPublicKey),
+                    expiresAt: issued.expiresAt,
+                });
+                historyStore.record({
+                    type: "handshake.offer_sent",
+                    status: "success",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    detail: {
+                        toAgentId: provider.id,
+                        address: localAddress,
+                        expiresAt: issued.expiresAt,
+                    },
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "offer" },
+                });
+                return {
+                    ok: false,
+                    text: `Match created (id=${match.id}) but failed to send encrypted handshake offer: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            let answer;
+            try {
+                answer = await waitForHandshakeAnswer(hubClient, match.id);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "inbound",
+                    matchId: match.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "wait_answer" },
+                });
+                return {
+                    ok: false,
+                    text: `Encrypted handshake offer sent for match ${match.id}, but waiting for answer failed: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            let remotePayload;
+            try {
+                remotePayload = decryptHandshake(answer.ciphertext, identity);
+                const tokenValidationError = getHandshakeTokenValidationError(remotePayload.token);
+                if (tokenValidationError) {
+                    throw new Error(tokenValidationError);
+                }
+                await hubClient.consumeHandshakeMessage(match.id, answer.id);
+                historyStore.record({
+                    type: "handshake.answer_received",
+                    status: "success",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: answer.id,
+                    peer: provider.name,
+                    detail: {
+                        fromAgentId: answer.senderAgentId,
+                        address: remotePayload.address,
+                        tokenExpiresAt: remotePayload.tokenExpiresAt,
+                    },
+                });
+                upsertEphemeralPeer(config, provider.name, remotePayload.address, remotePayload.token);
+                historyStore.record({
+                    type: "peer.upserted",
+                    status: "success",
+                    direction: "local",
+                    matchId: match.id,
+                    peer: provider.name,
+                    detail: {
+                        agentCardUrl: config.peers.find((peer) => peer.name === provider.name)?.agentCardUrl,
+                        tokenExpiresAt: remotePayload.tokenExpiresAt,
+                    },
+                });
+                await hubClient.markReady(match.id);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                historyStore.record({
+                    type: "handshake.failed",
+                    status: "failure",
+                    direction: "inbound",
+                    matchId: match.id,
+                    messageId: answer.id,
+                    peer: provider.name,
+                    durationMs: Date.now() - startedAt,
+                    detail: { reason: msg, phase: "process_answer" },
+                });
+                return {
+                    ok: false,
+                    text: `Encrypted handshake answer received for match ${match.id}, but processing failed: ${msg}`,
+                    details: { ok: false, matchId: match.id, error: msg },
+                };
+            }
+            return {
+                ok: true,
+                text: `Encrypted handshake ready: match=${match.id}\n` +
+                    `Provider: ${provider.name}\n` +
+                    `Address: ${remotePayload.address}\n` +
+                    `Temporary token: ${remotePayload.token}\n` +
+                    `Token expires at: ${remotePayload.tokenExpiresAt}`,
+                details: {
+                    ok: true,
+                    matchId: match.id,
+                    status: "ready_to_connect",
+                    providerAddress: remotePayload.address,
+                    peerToken: remotePayload.token,
+                    tokenExpiresAt: remotePayload.tokenExpiresAt,
+                },
+            };
+        };
         api.registerGatewayMethod("a2a.metrics", ({ respond }) => {
             respond(true, {
                 metrics: telemetry.snapshot(),
@@ -490,6 +863,49 @@ const plugin = {
                 .then((entries) => respond(true, { entries, count: entries.length }))
                 .catch((error) => respond(false, { error: String(error?.message || error) }));
         });
+        api.registerGatewayMethod("a2a.history", ({ params, respond }) => {
+            const payload = asObject(params);
+            const matchId = asNumber(payload.matchId, Number.NaN);
+            historyStore
+                .tail({
+                count: Math.min(Math.max(1, asNumber(payload.count ?? payload.limit, 50)), 500),
+                type: asString(payload.type, ""),
+                status: asString(payload.status, ""),
+                direction: asString(payload.direction, ""),
+                matchId: Number.isFinite(matchId) ? matchId : undefined,
+                peer: asString(payload.peer, ""),
+            })
+                .then((entries) => respond(true, { entries, count: entries.length }))
+                .catch((error) => respond(false, { error: String(error?.message || error) }));
+        });
+        api.registerGatewayMethod("a2a.peers", ({ respond }) => {
+            const peerStates = healthManager?.getAllStates() ?? new Map();
+            respond(true, {
+                peers: config.peers.map((peer) => ({
+                    name: peer.name,
+                    agentCardUrl: peer.agentCardUrl,
+                    authType: peer.auth?.type,
+                    hasToken: Boolean(peer.auth?.token),
+                    health: peerStates.get(peer.name) ?? null,
+                })),
+            });
+        });
+        api.registerGatewayMethod("a2a.match", ({ params, respond }) => {
+            const payload = asObject(params);
+            const skills = Array.isArray(payload.skills)
+                ? payload.skills.filter((entry) => typeof entry === "string" && entry.trim().length > 0)
+                : [];
+            if (skills.length === 0) {
+                respond(false, { error: "skills must be a non-empty string array" });
+                return;
+            }
+            performMatchRequest({
+                skills,
+                description: asString(payload.description, ""),
+            })
+                .then((result) => respond(result.ok, result.details))
+                .catch((error) => respond(false, { error: String(error?.message || error) }));
+        });
         api.registerGatewayMethod("a2a.send", ({ params, respond }) => {
             const payload = asObject(params);
             const peerName = asString(payload.peer || payload.name, "");
@@ -518,6 +934,16 @@ const plugin = {
                 message.agentId = resolvedAgentId;
             }
             const startedAt = Date.now();
+            historyStore.record({
+                type: "send.started",
+                status: "started",
+                direction: "outbound",
+                peer: peer.name,
+                detail: {
+                    resolvedAgentId: message.agentId,
+                    hasParts: Array.isArray(message.parts),
+                },
+            });
             const sendOptions = {
                 healthManager: healthManager ?? undefined,
                 retryConfig: config.resilience.retry,
@@ -534,6 +960,17 @@ const plugin = {
                 const outDuration = Date.now() - startedAt;
                 telemetry.recordOutboundRequest(peer.name, result.ok, result.statusCode, outDuration);
                 auditLogger.recordOutbound(peer.name, result.ok, result.statusCode, outDuration);
+                historyStore.record({
+                    type: result.ok ? "send.completed" : "send.failed",
+                    status: result.ok ? "success" : "failure",
+                    direction: "outbound",
+                    peer: peer.name,
+                    durationMs: outDuration,
+                    detail: {
+                        statusCode: result.statusCode,
+                        response: result.ok ? undefined : result.response,
+                    },
+                });
                 if (result.ok) {
                     respond(true, {
                         statusCode: result.statusCode,
@@ -550,6 +987,14 @@ const plugin = {
                 const errDuration = Date.now() - startedAt;
                 telemetry.recordOutboundRequest(peer.name, false, 500, errDuration);
                 auditLogger.recordOutbound(peer.name, false, 500, errDuration);
+                historyStore.record({
+                    type: "send.failed",
+                    status: "failure",
+                    direction: "outbound",
+                    peer: peer.name,
+                    durationMs: errDuration,
+                    detail: { error: String(error?.message || error) },
+                });
                 respond(false, { error: String(error?.message || error) });
             });
         });
@@ -577,64 +1022,103 @@ const plugin = {
                 label: "A2A Send File",
                 parameters: sendFileParams,
                 async execute(toolCallId, params) {
-                    const peer = config.peers.find((p) => p.name === params.peer);
+                    const input = params;
+                    const peer = config.peers.find((p) => p.name === input.peer);
                     if (!peer) {
                         const available = config.peers.map((p) => p.name).join(", ") || "(none)";
                         return {
-                            content: [{ type: "text", text: `Peer not found: "${params.peer}". Available peers: ${available}` }],
+                            content: [{ type: "text", text: `Peer not found: "${input.peer}". Available peers: ${available}` }],
                             details: { ok: false },
                         };
                     }
                     // Security checks: SSRF, MIME, file size
-                    const uriCheck = await validateUri(params.uri, config.security);
+                    const uriCheck = await validateUri(input.uri, config.security);
                     if (!uriCheck.ok) {
                         return {
                             content: [{ type: "text", text: `URI rejected: ${uriCheck.reason}` }],
                             details: { ok: false, reason: uriCheck.reason },
                         };
                     }
-                    if (params.mimeType && !validateMimeType(params.mimeType, config.security.allowedMimeTypes)) {
+                    if (input.mimeType && !validateMimeType(input.mimeType, config.security.allowedMimeTypes)) {
                         return {
-                            content: [{ type: "text", text: `MIME type rejected: "${params.mimeType}" is not in the allowed list` }],
+                            content: [{ type: "text", text: `MIME type rejected: "${input.mimeType}" is not in the allowed list` }],
                             details: { ok: false },
                         };
                     }
                     const parts = [];
-                    if (params.text) {
-                        parts.push({ kind: "text", text: params.text });
+                    if (input.text) {
+                        parts.push({ kind: "text", text: input.text });
                     }
                     parts.push({
                         kind: "file",
                         file: {
-                            uri: params.uri,
-                            ...(params.name ? { name: params.name } : {}),
-                            ...(params.mimeType ? { mimeType: params.mimeType } : {}),
+                            uri: input.uri,
+                            ...(input.name ? { name: input.name } : {}),
+                            ...(input.mimeType ? { mimeType: input.mimeType } : {}),
                         },
                     });
                     try {
                         const message = { parts };
-                        if (params.agentId) {
-                            message.agentId = params.agentId;
+                        if (input.agentId) {
+                            message.agentId = input.agentId;
                         }
+                        const startedAt = Date.now();
+                        historyStore.record({
+                            type: "send_file.started",
+                            status: "started",
+                            direction: "outbound",
+                            peer: peer.name,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                agentId: input.agentId,
+                            },
+                        });
                         const result = await client.sendMessage(peer, message, {
                             healthManager: healthManager ?? undefined,
                             retryConfig: config.resilience.retry,
                         });
+                        historyStore.record({
+                            type: result.ok ? "send_file.completed" : "send_file.failed",
+                            status: result.ok ? "success" : "failure",
+                            direction: "outbound",
+                            peer: peer.name,
+                            durationMs: Date.now() - startedAt,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                response: result.ok ? undefined : result.response,
+                            },
+                        });
                         if (result.ok) {
                             return {
-                                content: [{ type: "text", text: `File sent to ${params.peer} via A2A.\nURI: ${params.uri}\nResponse: ${JSON.stringify(result.response)}` }],
+                                content: [{ type: "text", text: `File sent to ${input.peer} via A2A.\nURI: ${input.uri}\nResponse: ${JSON.stringify(result.response)}` }],
                                 details: { ok: true, response: result.response },
                             };
                         }
                         return {
-                            content: [{ type: "text", text: `Failed to send file to ${params.peer}: ${JSON.stringify(result.response)}` }],
+                            content: [{ type: "text", text: `Failed to send file to ${input.peer}: ${JSON.stringify(result.response)}` }],
                             details: { ok: false, response: result.response },
                         };
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
+                        historyStore.record({
+                            type: "send_file.failed",
+                            status: "failure",
+                            direction: "outbound",
+                            peer: peer.name,
+                            detail: {
+                                uri: input.uri,
+                                name: input.name,
+                                mimeType: input.mimeType,
+                                error: msg,
+                            },
+                        });
                         return {
-                            content: [{ type: "text", text: `Error sending file to ${params.peer}: ${msg}` }],
+                            content: [{ type: "text", text: `Error sending file to ${input.peer}: ${msg}` }],
                             details: { ok: false, error: msg },
                         };
                     }
@@ -667,124 +1151,11 @@ const plugin = {
                     },
                 },
                 async execute(toolCallId, params) {
-                    let hubClient;
-                    try {
-                        hubClient = await HubMatchClient.create();
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Not registered with hub: ${msg}` }],
-                            details: { ok: false, error: msg },
-                        };
-                    }
-                    const identity = loadIdentity();
-                    if (!identity) {
-                        return {
-                            content: [{ type: "text", text: "No local identity found. Restart the plugin and try again." }],
-                            details: { ok: false, error: "identity_missing" },
-                        };
-                    }
-                    const localAddress = getAdvertisedAddress(config);
-                    if (!localAddress) {
-                        return {
-                            content: [{ type: "text", text: "No advertised address is configured for this agent." }],
-                            details: { ok: false, error: "address_missing" },
-                        };
-                    }
-                    let match;
-                    try {
-                        match = await hubClient.createMatch({
-                            skills: params.skills,
-                            description: params.description,
-                        });
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Failed to create match: ${msg}` }],
-                            details: { ok: false, error: msg },
-                        };
-                    }
-                    const provider = match.provider;
-                    const providerPublicKey = provider?.publicKey;
-                    if (!provider || !providerPublicKey) {
-                        return {
-                            content: [{ type: "text", text: `Match created (id=${match.id}) but provider public key is missing` }],
-                            details: { ok: false, matchId: match.id, error: "provider_public_key_missing" },
-                        };
-                    }
-                    const issued = issueEphemeralInboundToken(config, match.id, provider.id);
-                    const localPayload = {
-                        version: 1,
-                        matchId: match.id,
-                        sessionId: crypto.randomUUID(),
-                        fromAgentId: hubClient.agentId,
-                        toAgentId: provider.id,
-                        address: localAddress,
-                        agentCardPath: "/.well-known/agent.json",
-                        token: issued.token,
-                        tokenExpiresAt: issued.expiresAt,
-                        protocols: ["jsonrpc", "rest", "grpc"],
-                        createdAt: new Date().toISOString(),
-                        nonce: crypto.randomBytes(12).toString("hex"),
-                    };
-                    try {
-                        await hubClient.sendHandshakeMessage(match.id, {
-                            messageType: "offer",
-                            ciphertext: encryptHandshake(localPayload, providerPublicKey),
-                            expiresAt: issued.expiresAt,
-                        });
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Match created (id=${match.id}) but failed to send encrypted handshake offer: ${msg}` }],
-                            details: { ok: false, matchId: match.id, error: msg },
-                        };
-                    }
-                    let answer;
-                    try {
-                        answer = await waitForHandshakeAnswer(hubClient, match.id);
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Encrypted handshake offer sent for match ${match.id}, but waiting for answer failed: ${msg}` }],
-                            details: { ok: false, matchId: match.id, error: msg },
-                        };
-                    }
-                    let remotePayload;
-                    try {
-                        remotePayload = decryptHandshake(answer.ciphertext, identity);
-                        await hubClient.consumeHandshakeMessage(match.id, answer.id);
-                        upsertEphemeralPeer(config, provider.name, remotePayload.address, remotePayload.token);
-                        await hubClient.markReady(match.id);
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        return {
-                            content: [{ type: "text", text: `Encrypted handshake answer received for match ${match.id}, but processing failed: ${msg}` }],
-                            details: { ok: false, matchId: match.id, error: msg },
-                        };
-                    }
+                    const input = params;
+                    const result = await performMatchRequest(input);
                     return {
-                        content: [{
-                                type: "text",
-                                text: `Encrypted handshake ready: match=${match.id}\n` +
-                                    `Provider: ${provider.name}\n` +
-                                    `Address: ${remotePayload.address}\n` +
-                                    `Temporary token: ${remotePayload.token}\n` +
-                                    `Token expires at: ${remotePayload.tokenExpiresAt}`,
-                            }],
-                        details: {
-                            ok: true,
-                            matchId: match.id,
-                            status: "ready_to_connect",
-                            providerAddress: remotePayload.address,
-                            peerToken: remotePayload.token,
-                            tokenExpiresAt: remotePayload.tokenExpiresAt,
-                        },
+                        content: [{ type: "text", text: result.text }],
+                        details: result.details,
                     };
                 },
             });
@@ -799,26 +1170,7 @@ const plugin = {
                 if (server) {
                     return;
                 }
-                // Hub registration (runs before server starts)
-                if (config.hub?.enabled !== false && config.hub?.registrationEnabled !== false) {
-                    try {
-                        const reg = await runHubRegistration(api, config, config.hub, config.registration ?? {});
-                        if (reg) {
-                            api.logger.info(`claw-crony: registered with hub (agentId=${reg.agentId})`);
-                            try {
-                                const hubClient = await HubMatchClient.create();
-                                await hubClient.updatePresence("online");
-                            }
-                            catch (presenceErr) {
-                                api.logger.warn(`claw-crony: failed to update hub presence - ${presenceErr instanceof Error ? presenceErr.message : String(presenceErr)}`);
-                            }
-                        }
-                    }
-                    catch (err) {
-                        api.logger.warn(`claw-crony: hub registration failed — ${err instanceof Error ? err.message : String(err)}`);
-                        // Continue startup anyway — hub is optional
-                    }
-                }
+                await startHubLifecycle("service");
                 // Start peer health checks
                 healthManager?.start();
                 // Start HTTP server (JSON-RPC + REST)
@@ -886,7 +1238,7 @@ const plugin = {
                 if (config.hub?.enabled !== false) {
                     const pollingIntervalMs = Math.max(5_000, config.resilience.healthCheck.intervalMs);
                     const pollHubMatches = () => {
-                        void processPendingHubMatches(api, config, processedHubMessages);
+                        void processPendingHubMatches(api, config, processedHubMessages, historyStore);
                     };
                     pollHubMatches();
                     hubMatchPollingTimer = setInterval(pollHubMatches, pollingIntervalMs);
@@ -898,15 +1250,8 @@ const plugin = {
                 // Stop peer health checks
                 healthManager?.stop();
                 auditLogger.close();
-                if (config.hub?.enabled !== false) {
-                    try {
-                        const hubClient = await HubMatchClient.create();
-                        await hubClient.updatePresence("offline");
-                    }
-                    catch {
-                        // Ignore best-effort presence shutdown failure.
-                    }
-                }
+                historyStore.close();
+                await stopHubLifecycle("service");
                 // Stop task cleanup timer
                 if (cleanupTimer) {
                     clearInterval(cleanupTimer);