@lawreneliang/atel-sdk 0.4.1 → 0.4.3

package/bin/atel.mjs

@@ -4,88 +4,86 @@
  * ATEL CLI — Command-line interface for ATEL SDK
  *
  * Commands:
- *   atel init [name]                    Create a new agent identity
- *   atel info                           Show current agent identity
- *   atel start [port]                   Start endpoint and listen for tasks
+ *   atel init [name]                    Create agent identity + default policy
+ *   atel info                           Show identity, capabilities, policy, network
+ *   atel start [port]                   Start endpoint (auto network + auto register)
+ *   atel setup [port]                   Network setup only (detect IP, UPnP, verify)
+ *   atel verify                         Verify port reachability
  *   atel inbox [count]                  Show received messages
  *   atel register [name] [caps] [url]   Register on public registry
  *   atel search <capability>            Search registry for agents
  *   atel handshake <endpoint> [did]     Handshake with a remote agent
  *   atel task <endpoint> <json>         Delegate a task to a remote agent
+ *   atel result <taskId> <json>         Submit execution result (from executor)
  */
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync, appendFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import {
-  AgentIdentity,
-  AgentEndpoint,
-  AgentClient,
-  HandshakeManager,
-  createMessage,
-  RegistryClient,
-  ExecutionTrace,
-  ProofGenerator,
-  SolanaAnchorProvider,
+  AgentIdentity, AgentEndpoint, AgentClient, HandshakeManager,
+  createMessage, RegistryClient, ExecutionTrace, ProofGenerator,
+  SolanaAnchorProvider, autoNetworkSetup, discoverPublicIP, verifyPortReachable,
 } from '@lawreneliang/atel-sdk';
 
 const ATEL_DIR = resolve(process.env.ATEL_DIR || '.atel');
 const IDENTITY_FILE = resolve(ATEL_DIR, 'identity.json');
 const REGISTRY_URL = process.env.ATEL_REGISTRY || 'http://47.251.8.19:8100';
-const WEBHOOK_URL = process.env.ATEL_WEBHOOK || '';
+const EXECUTOR_URL = process.env.ATEL_EXECUTOR_URL || '';
 const INBOX_FILE = resolve(ATEL_DIR, 'inbox.jsonl');
+const POLICY_FILE = resolve(ATEL_DIR, 'policy.json');
+const TASKS_FILE = resolve(ATEL_DIR, 'tasks.json');
+const NETWORK_FILE = resolve(ATEL_DIR, 'network.json');
+
+const DEFAULT_POLICY = { rateLimit: 60, maxPayloadBytes: 1048576, maxConcurrent: 10, allowedDIDs: [], blockedDIDs: [] };
 
 // ─── Helpers ─────────────────────────────────────────────────────
 
-async function notify(event) {
-  appendFileSync(INBOX_FILE, JSON.stringify(event) + '\n');
-  if (WEBHOOK_URL) {
-    try {
-      await fetch(WEBHOOK_URL, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(event),
-      });
-    } catch (e) {
-      console.error(JSON.stringify({ event: 'webhook_failed', error: e.message }));
-    }
+function ensureDir() { if (!existsSync(ATEL_DIR)) mkdirSync(ATEL_DIR, { recursive: true }); }
+function log(event) { ensureDir(); appendFileSync(INBOX_FILE, JSON.stringify(event) + '\n'); console.log(JSON.stringify(event)); }
+
+function saveIdentity(id) { ensureDir(); writeFileSync(IDENTITY_FILE, JSON.stringify({ agent_id: id.agent_id, did: id.did, publicKey: Buffer.from(id.publicKey).toString('hex'), secretKey: Buffer.from(id.secretKey).toString('hex') }, null, 2)); }
+function loadIdentity() { if (!existsSync(IDENTITY_FILE)) return null; const d = JSON.parse(readFileSync(IDENTITY_FILE, 'utf-8')); return new AgentIdentity({ agent_id: d.agent_id, publicKey: Uint8Array.from(Buffer.from(d.publicKey, 'hex')), secretKey: Uint8Array.from(Buffer.from(d.secretKey, 'hex')) }); }
+function requireIdentity() { const id = loadIdentity(); if (!id) { console.error('No identity. Run: atel init'); process.exit(1); } return id; }
+
+function loadCapabilities() { const f = resolve(ATEL_DIR, 'capabilities.json'); if (!existsSync(f)) return []; try { return JSON.parse(readFileSync(f, 'utf-8')); } catch { return []; } }
+function saveCapabilities(c) { ensureDir(); writeFileSync(resolve(ATEL_DIR, 'capabilities.json'), JSON.stringify(c, null, 2)); }
+function loadPolicy() { if (!existsSync(POLICY_FILE)) return { ...DEFAULT_POLICY }; try { return { ...DEFAULT_POLICY, ...JSON.parse(readFileSync(POLICY_FILE, 'utf-8')) }; } catch { return { ...DEFAULT_POLICY }; } }
+function savePolicy(p) { ensureDir(); writeFileSync(POLICY_FILE, JSON.stringify(p, null, 2)); }
+function loadTasks() { if (!existsSync(TASKS_FILE)) return {}; try { return JSON.parse(readFileSync(TASKS_FILE, 'utf-8')); } catch { return {}; } }
+function saveTasks(t) { ensureDir(); writeFileSync(TASKS_FILE, JSON.stringify(t, null, 2)); }
+function loadNetwork() { if (!existsSync(NETWORK_FILE)) return null; try { return JSON.parse(readFileSync(NETWORK_FILE, 'utf-8')); } catch { return null; } }
+function saveNetwork(n) { ensureDir(); writeFileSync(NETWORK_FILE, JSON.stringify(n, null, 2)); }
+
+// ─── Policy Enforcer ─────────────────────────────────────────────
+
+class PolicyEnforcer {
+  constructor(policy) { this.policy = policy; this.requestLog = []; this.activeTasks = 0; }
+  check(message) {
+    const p = this.policy, from = message.from, size = JSON.stringify(message.payload || {}).length, now = Date.now();
+    if (p.blockedDIDs.length > 0 && p.blockedDIDs.includes(from)) return { allowed: false, reason: `DID blocked` };
+    if (p.allowedDIDs.length > 0 && !p.allowedDIDs.includes(from)) return { allowed: false, reason: `DID not in allowlist` };
+    this.requestLog = this.requestLog.filter(t => now - t < 60000);
+    if (this.requestLog.length >= p.rateLimit) return { allowed: false, reason: `Rate limit (${p.rateLimit}/min)` };
+    if (size > p.maxPayloadBytes) return { allowed: false, reason: `Payload too large (${size} > ${p.maxPayloadBytes})` };
+    if (this.activeTasks >= p.maxConcurrent) return { allowed: false, reason: `Max concurrent (${p.maxConcurrent})` };
+    this.requestLog.push(now);
+    return { allowed: true };
   }
+  taskStarted() { this.activeTasks++; }
+  taskFinished() { this.activeTasks = Math.max(0, this.activeTasks - 1); }
 }
 
-function saveIdentity(identity) {
-  if (!existsSync(ATEL_DIR)) mkdirSync(ATEL_DIR, { recursive: true });
-  writeFileSync(IDENTITY_FILE, JSON.stringify({
-    agent_id: identity.agent_id,
-    did: identity.did,
-    publicKey: Buffer.from(identity.publicKey).toString('hex'),
-    secretKey: Buffer.from(identity.secretKey).toString('hex'),
-  }, null, 2));
-}
-
-function loadIdentity() {
-  if (!existsSync(IDENTITY_FILE)) return null;
-  const data = JSON.parse(readFileSync(IDENTITY_FILE, 'utf-8'));
-  return new AgentIdentity({
-    agent_id: data.agent_id,
-    publicKey: Uint8Array.from(Buffer.from(data.publicKey, 'hex')),
-    secretKey: Uint8Array.from(Buffer.from(data.secretKey, 'hex')),
-  });
-}
-
-function requireIdentity() {
-  const id = loadIdentity();
-  if (!id) { console.error('No identity found. Run: atel init'); process.exit(1); }
-  return id;
-}
-
-// Load registered capabilities from .atel/capabilities.json
-function loadCapabilities() {
-  const capFile = resolve(ATEL_DIR, 'capabilities.json');
-  if (!existsSync(capFile)) return [];
-  try { return JSON.parse(readFileSync(capFile, 'utf-8')); } catch { return []; }
-}
-
-function saveCapabilities(caps) {
-  writeFileSync(resolve(ATEL_DIR, 'capabilities.json'), JSON.stringify(caps, null, 2));
+// ─── On-chain Anchoring ──────────────────────────────────────────
+
+async function anchorOnChain(traceRoot, metadata) {
+  const key = process.env.ATEL_SOLANA_PRIVATE_KEY;
+  if (!key) return null;
+  try {
+    const s = new SolanaAnchorProvider({ rpcUrl: process.env.ATEL_SOLANA_RPC_URL || 'https://api.mainnet-beta.solana.com', privateKey: key });
+    const r = await s.anchor(traceRoot, metadata);
+    log({ event: 'proof_anchored', chain: 'solana', txHash: r.txHash, block: r.blockNumber, trace_root: traceRoot });
+    return r;
+  } catch (e) { log({ event: 'anchor_failed', chain: 'solana', error: e.message }); return null; }
 }
 
 // ─── Commands ────────────────────────────────────────────────────
@@ -94,22 +92,39 @@ async function cmdInit(agentId) {
   const name = agentId || `agent-${Date.now()}`;
   const identity = new AgentIdentity({ agent_id: name });
   saveIdentity(identity);
-  console.log(JSON.stringify({
-    status: 'created',
-    agent_id: identity.agent_id,
-    did: identity.did,
-    next: 'Run: atel register [name] [capabilities] [endpoint]',
-  }, null, 2));
+  savePolicy(DEFAULT_POLICY);
+  console.log(JSON.stringify({ status: 'created', agent_id: identity.agent_id, did: identity.did, policy: POLICY_FILE, next: 'Run: atel start [port] — auto-configures network and registers' }, null, 2));
 }
 
 async function cmdInfo() {
   const id = requireIdentity();
-  const caps = loadCapabilities();
-  console.log(JSON.stringify({
-    agent_id: id.agent_id,
-    did: id.did,
-    capabilities: caps,
-  }, null, 2));
+  console.log(JSON.stringify({ agent_id: id.agent_id, did: id.did, capabilities: loadCapabilities(), policy: loadPolicy(), network: loadNetwork(), executor: EXECUTOR_URL || 'not configured' }, null, 2));
+}
+
+async function cmdSetup(port) {
+  const p = parseInt(port || '3100');
+  console.log(JSON.stringify({ event: 'network_setup', port: p }));
+  const net = await autoNetworkSetup(p);
+  for (const step of net.steps) console.log(JSON.stringify({ event: 'step', message: step }));
+  if (net.endpoint) {
+    saveNetwork({ publicIP: net.publicIP, port: p, endpoint: net.endpoint, upnp: net.upnpSuccess, reachable: net.reachable, configuredAt: new Date().toISOString() });
+    console.log(JSON.stringify({ status: 'ready', endpoint: net.endpoint }));
+  } else if (net.publicIP) {
+    const ep = `http://${net.publicIP}:${p}`;
+    saveNetwork({ publicIP: net.publicIP, port: p, endpoint: ep, upnp: false, reachable: false, needsManualPortForward: true, configuredAt: new Date().toISOString() });
+    console.log(JSON.stringify({ status: 'needs_port_forward', publicIP: net.publicIP, port: p, instruction: `Forward external TCP port ${p} to this machine's port ${p} on your router. Then run: atel verify` }));
+  } else {
+    console.log(JSON.stringify({ status: 'failed', error: 'Could not determine public IP' }));
+  }
+}
+
+async function cmdVerify() {
+  const net = loadNetwork();
+  if (!net) { console.error('No network config. Run: atel setup'); process.exit(1); }
+  console.log(JSON.stringify({ event: 'verifying', ip: net.publicIP, port: net.port }));
+  const result = await verifyPortReachable(net.publicIP, net.port);
+  console.log(JSON.stringify({ status: result.reachable ? 'reachable' : 'not_reachable', detail: result.detail }));
+  if (result.reachable) { net.reachable = true; net.needsManualPortForward = false; saveNetwork(net); }
 }
 
 async function cmdStart(port) {
@@ -117,138 +132,130 @@ async function cmdStart(port) {
   const p = parseInt(port || '3100');
   const caps = loadCapabilities();
   const capTypes = caps.map(c => c.type || c);
+  const policy = loadPolicy();
+  const enforcer = new PolicyEnforcer(policy);
+  const pendingTasks = loadTasks();
+
+  // ── Network: determine public endpoint ──
+  let publicEndpoint = null;
+  let net = loadNetwork();
+  if (!net) {
+    // Auto network setup
+    log({ event: 'network_setup', status: 'auto-detecting' });
+    const result = await autoNetworkSetup(p);
+    for (const step of result.steps) log({ event: 'network_step', message: step });
+    if (result.publicIP) {
+      publicEndpoint = result.endpoint || `http://${result.publicIP}:${p}`;
+      saveNetwork({ publicIP: result.publicIP, port: p, endpoint: publicEndpoint, upnp: result.upnpSuccess, reachable: result.reachable, configuredAt: new Date().toISOString() });
+    }
+  } else {
+    publicEndpoint = net.endpoint;
+    log({ event: 'network_loaded', endpoint: publicEndpoint });
+  }
+
+  // ── Start endpoint ──
   const endpoint = new AgentEndpoint(id, { port: p, host: '0.0.0.0' });
 
-  endpoint.onTask(async (message, session) => {
-    const payload = message.payload || {};
-    const action = payload.action || payload.type || 'unknown';
+  // Result callback: POST /atel/v1/result (executor calls this when done)
+  endpoint.app?.post?.('/atel/v1/result', async (req, res) => {
+    const { taskId, result, success } = req.body || {};
+    if (!taskId || !pendingTasks[taskId]) { res.status(404).json({ error: 'Unknown taskId' }); return; }
+    const task = pendingTasks[taskId];
+    enforcer.taskFinished();
 
-    const taskEvent = {
-      event: 'task_received',
-      from: message.from,
-      action,
-      payload,
-      encrypted: !!session?.encrypted,
-      timestamp: new Date().toISOString(),
-    };
-    console.log(JSON.stringify(taskEvent));
-    await notify(taskEvent);
-
-    // ── Capability boundary check ──
-    if (capTypes.length > 0 && !capTypes.includes(action) && !capTypes.includes('general')) {
-      const rejectEvent = {
-        event: 'task_rejected',
-        from: message.from,
-        action,
-        reason: `Action "${action}" is outside my capability boundary. My capabilities: [${capTypes.join(', ')}]`,
-        timestamp: new Date().toISOString(),
-      };
-      console.log(JSON.stringify(rejectEvent));
-      await notify(rejectEvent);
-      return {
-        status: 'rejected',
-        error: rejectEvent.reason,
-        capabilities: capTypes,
-      };
-    }
+    const trace = new ExecutionTrace(taskId, id);
+    trace.append('TASK_ACCEPTED', { from: task.from, action: task.action });
+    trace.append('TASK_FORWARDED', { executor_url: EXECUTOR_URL });
+    trace.append('TASK_RESULT', { success: success !== false, result });
+    if (success !== false) trace.finalize(typeof result === 'object' ? result : { result });
+    else trace.fail(new Error(result?.error || 'Execution failed'));
 
-    // ── Full ATEL execution flow: Trace → Execute → Proof ──
-    const trace = new ExecutionTrace(`task-${Date.now()}`, id);
-    trace.append('TASK_ACCEPTED', { from: message.from, action, payload, encrypted: !!session?.encrypted });
+    const proofGen = new ProofGenerator(trace, id);
+    const proof = proofGen.generate(capTypes.join(',') || 'no-policy', `task-from-${task.from}`, JSON.stringify(result));
+    const anchor = await anchorOnChain(proof.trace_root, { proof_id: proof.proof_id, task_from: task.from, action: task.action, taskId });
 
-    let result;
-    let success = true;
+    log({ event: 'task_completed', taskId, from: task.from, action: task.action, success: success !== false, proof_id: proof.proof_id, anchor_tx: anchor?.txHash || null, timestamp: new Date().toISOString() });
 
-    try {
-      // Default execution: acknowledge and return payload info
-      result = {
-        status: 'executed',
-        agent: id.agent_id,
-        action,
-        received_payload: payload,
-        capabilities: capTypes,
-      };
-      trace.append('TASK_EXECUTED', { action, result });
-    } catch (err) {
-      success = false;
-      result = { status: 'error', error: err.message };
-      trace.fail(err);
+    // Push result back to sender
+    if (task.senderEndpoint) {
+      try {
+        const client = new AgentClient(id);
+        const hsManager = new HandshakeManager(id);
+        await client.handshake(task.senderEndpoint, hsManager, task.from);
+        const msg = createMessage({ type: 'task-result', from: id.did, to: task.from, payload: { taskId, status: success !== false ? 'completed' : 'failed', result, proof: { proof_id: proof.proof_id, trace_root: proof.trace_root }, anchor: anchor ? { chain: 'solana', txHash: anchor.txHash } : null }, secretKey: id.secretKey });
+        await client.sendTask(task.senderEndpoint, msg, hsManager);
+        log({ event: 'result_pushed', taskId, to: task.from });
+      } catch (e) { log({ event: 'result_push_failed', taskId, error: e.message }); }
     }
 
-    if (success && !trace.isFinalized() && !trace.isFailed()) {
-      trace.finalize(typeof result === 'object' ? result : { result });
-    }
+    delete pendingTasks[taskId]; saveTasks(pendingTasks);
+    res.json({ status: 'ok', proof_id: proof.proof_id, anchor_tx: anchor?.txHash || null });
+  });
 
-    // Generate cryptographic proof
-    const proofGen = new ProofGenerator(trace, id);
-    const proof = proofGen.generate(
-      capTypes.join(',') || 'no-policy',
-      `task-from-${message.from}`,
-      JSON.stringify(result),
-    );
-
-    // Anchor proof on-chain (Solana) if configured
-    let anchor = null;
-    const solanaKey = process.env.ATEL_SOLANA_PRIVATE_KEY;
-    if (solanaKey) {
-      try {
-        const solana = new SolanaAnchorProvider({
-          rpcUrl: process.env.ATEL_SOLANA_RPC_URL || 'https://api.mainnet-beta.solana.com',
-          privateKey: solanaKey,
-        });
-        anchor = await solana.anchor(proof.trace_root, {
-          proof_id: proof.proof_id,
-          task_from: message.from,
-          action,
-        });
-        console.log(JSON.stringify({
-          event: 'proof_anchored',
-          chain: 'solana',
-          txHash: anchor.txHash,
-          block: anchor.blockNumber,
-          trace_root: proof.trace_root,
-        }));
-      } catch (e) {
-        console.error(JSON.stringify({ event: 'anchor_failed', chain: 'solana', error: e.message }));
-      }
+  // Task handler
+  endpoint.onTask(async (message, session) => {
+    const payload = message.payload || {};
+    const action = payload.action || payload.type || 'unknown';
+
+    // Policy check
+    const pc = enforcer.check(message);
+    if (!pc.allowed) { log({ event: 'task_rejected', from: message.from, action, reason: pc.reason, timestamp: new Date().toISOString() }); return { status: 'rejected', error: pc.reason }; }
+
+    // Capability check
+    if (capTypes.length > 0 && !capTypes.includes(action) && !capTypes.includes('general')) {
+      log({ event: 'task_rejected', from: message.from, action, reason: `Outside capability: [${capTypes.join(',')}]`, timestamp: new Date().toISOString() });
+      return { status: 'rejected', error: `Action "${action}" outside capability boundary`, capabilities: capTypes };
     }
 
-    const completionEvent = {
-      event: 'task_completed',
-      from: message.from,
-      action,
-      success,
-      proof_id: proof.proof_id,
-      trace_root: proof.trace_root,
-      timestamp: new Date().toISOString(),
-    };
-    console.log(JSON.stringify(completionEvent));
-    await notify(completionEvent);
-
-    return { status: success ? 'completed' : 'failed', result, proof, anchor };
+    const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    enforcer.taskStarted();
+
+    // Lookup sender endpoint for result push-back
+    let senderEndpoint = null;
+    try { const r = await fetch(`${REGISTRY_URL}/registry/v1/agent/${encodeURIComponent(message.from)}`); if (r.ok) senderEndpoint = (await r.json()).endpoint; } catch {}
+
+    pendingTasks[taskId] = { from: message.from, action, payload, senderEndpoint, encrypted: !!session?.encrypted, acceptedAt: new Date().toISOString() };
+    saveTasks(pendingTasks);
+    log({ event: 'task_accepted', taskId, from: message.from, action, encrypted: !!session?.encrypted, timestamp: new Date().toISOString() });
+
+    // Forward to executor or echo
+    if (EXECUTOR_URL) {
+      fetch(EXECUTOR_URL, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ taskId, from: message.from, action, payload, encrypted: !!session?.encrypted }) }).catch(e => log({ event: 'executor_forward_failed', taskId, error: e.message }));
+      return { status: 'accepted', taskId, message: 'Task accepted. Result will be pushed when ready.' };
+    } else {
+      // Echo mode
+      enforcer.taskFinished();
+      const trace = new ExecutionTrace(taskId, id);
+      trace.append('TASK_ACCEPTED', { from: message.from, action, payload });
+      const result = { status: 'no_executor', agent: id.agent_id, action, received_payload: payload };
+      trace.append('TASK_ECHO', { result }); trace.finalize(result);
+      const proofGen = new ProofGenerator(trace, id);
+      const proof = proofGen.generate(capTypes.join(',') || 'no-policy', `task-from-${message.from}`, JSON.stringify(result));
+      const anchor = await anchorOnChain(proof.trace_root, { proof_id: proof.proof_id, task_from: message.from, action, taskId });
+      delete pendingTasks[taskId]; saveTasks(pendingTasks);
+      log({ event: 'task_completed', taskId, from: message.from, action, mode: 'echo', proof_id: proof.proof_id, anchor_tx: anchor?.txHash || null, timestamp: new Date().toISOString() });
+      return { status: 'completed', taskId, result, proof, anchor };
+    }
   });
 
-  endpoint.onProof(async (message, session) => {
-    const proofEvent = {
-      event: 'proof_received',
-      from: message.from,
-      payload: message.payload,
-      timestamp: new Date().toISOString(),
-    };
-    console.log(JSON.stringify(proofEvent));
-    await notify(proofEvent);
-  });
+  endpoint.onProof(async (message) => { log({ event: 'proof_received', from: message.from, payload: message.payload, timestamp: new Date().toISOString() }); });
 
   await endpoint.start();
+
+  // Auto-register to Registry
+  if (publicEndpoint && capTypes.length > 0) {
+    try {
+      const regClient = new RegistryClient({ registryUrl: REGISTRY_URL });
+      await regClient.register({ name: id.agent_id, capabilities: caps, endpoint: publicEndpoint }, id);
+      log({ event: 'auto_registered', registry: REGISTRY_URL, endpoint: publicEndpoint });
+    } catch (e) { log({ event: 'auto_register_failed', error: e.message }); }
+  }
+
   console.log(JSON.stringify({
-    status: 'listening',
-    agent_id: id.agent_id,
-    did: id.did,
-    endpoint: endpoint.getEndpointUrl(),
-    port: p,
-    capabilities: capTypes,
-    inbox: INBOX_FILE,
-    webhook: WEBHOOK_URL || 'not configured (set ATEL_WEBHOOK)',
+    status: 'listening', agent_id: id.agent_id, did: id.did,
+    endpoint: publicEndpoint || `http://0.0.0.0:${p}`, port: p, capabilities: capTypes,
+    policy: { rateLimit: policy.rateLimit, maxPayloadBytes: policy.maxPayloadBytes, maxConcurrent: policy.maxConcurrent, allowedDIDs: policy.allowedDIDs.length, blockedDIDs: policy.blockedDIDs.length },
+    executor: EXECUTOR_URL || 'echo mode', inbox: INBOX_FILE,
   }, null, 2));
 
   process.on('SIGINT', async () => { await endpoint.stop(); process.exit(0); });
@@ -257,10 +264,7 @@ async function cmdStart(port) {
 
 async function cmdInbox(count) {
   const n = parseInt(count || '20');
-  if (!existsSync(INBOX_FILE)) {
-    console.log(JSON.stringify({ messages: [], count: 0 }));
-    return;
-  }
+  if (!existsSync(INBOX_FILE)) { console.log(JSON.stringify({ messages: [], count: 0 })); return; }
   const lines = readFileSync(INBOX_FILE, 'utf-8').trim().split('\n').filter(Boolean);
   const messages = lines.slice(-n).map(l => JSON.parse(l));
   console.log(JSON.stringify({ messages, count: messages.length, total: lines.length }, null, 2));
@@ -268,24 +272,14 @@ async function cmdInbox(count) {
 
 async function cmdRegister(name, capabilities, endpointUrl) {
   const id = requireIdentity();
-  const client = new RegistryClient({ registryUrl: REGISTRY_URL });
-  const caps = (capabilities || 'general').split(',').map(c => ({
-    type: c.trim(), description: c.trim(),
-  }));
-  // Save capabilities locally for boundary checking
+  const caps = (capabilities || 'general').split(',').map(c => ({ type: c.trim(), description: c.trim() }));
   saveCapabilities(caps);
-  const entry = await client.register({
-    name: name || id.agent_id,
-    capabilities: caps,
-    endpoint: endpointUrl || `http://localhost:3100`,
-  }, id);
-  console.log(JSON.stringify({
-    status: 'registered',
-    did: entry.did,
-    name: entry.name,
-    capabilities: caps.map(c => c.type),
-    registry: REGISTRY_URL,
-  }, null, 2));
+  // If no endpoint provided, use saved network config
+  let ep = endpointUrl;
+  if (!ep) { const net = loadNetwork(); ep = net?.endpoint || 'http://localhost:3100'; }
+  const client = new RegistryClient({ registryUrl: REGISTRY_URL });
+  const entry = await client.register({ name: name || id.agent_id, capabilities: caps, endpoint: ep }, id);
+  console.log(JSON.stringify({ status: 'registered', did: entry.did, name: entry.name, capabilities: caps.map(c => c.type), endpoint: ep, registry: REGISTRY_URL }, null, 2));
 }
 
 async function cmdSearch(capability) {
@@ -299,64 +293,56 @@ async function cmdHandshake(remoteEndpoint, remoteDid) {
   const client = new AgentClient(id);
   const hsManager = new HandshakeManager(id);
   let did = remoteDid;
-  if (!did) {
-    const health = await client.health(remoteEndpoint);
-    did = health.did;
-  }
+  if (!did) { const h = await client.health(remoteEndpoint); did = h.did; }
   const session = await client.handshake(remoteEndpoint, hsManager, did);
-  console.log(JSON.stringify({
-    status: 'handshake_complete',
-    sessionId: session.sessionId,
-    remoteDid: did,
-    encrypted: session.encrypted,
-  }, null, 2));
-  const sessFile = resolve(ATEL_DIR, 'sessions.json');
-  let sessions = {};
-  if (existsSync(sessFile)) sessions = JSON.parse(readFileSync(sessFile, 'utf-8'));
+  console.log(JSON.stringify({ status: 'handshake_complete', sessionId: session.sessionId, remoteDid: did, encrypted: session.encrypted }, null, 2));
+  const sf = resolve(ATEL_DIR, 'sessions.json');
+  let sessions = {}; if (existsSync(sf)) sessions = JSON.parse(readFileSync(sf, 'utf-8'));
   sessions[remoteEndpoint] = { did, sessionId: session.sessionId, encrypted: session.encrypted };
-  writeFileSync(sessFile, JSON.stringify(sessions, null, 2));
+  writeFileSync(sf, JSON.stringify(sessions, null, 2));
 }
 
 async function cmdTask(remoteEndpoint, taskJson) {
   const id = requireIdentity();
   const client = new AgentClient(id);
   const hsManager = new HandshakeManager(id);
-  const sessFile = resolve(ATEL_DIR, 'sessions.json');
+  const sf = resolve(ATEL_DIR, 'sessions.json');
   let remoteDid;
-  if (existsSync(sessFile)) {
-    const sessions = JSON.parse(readFileSync(sessFile, 'utf-8'));
-    if (sessions[remoteEndpoint]) remoteDid = sessions[remoteEndpoint].did;
-  }
+  if (existsSync(sf)) { const s = JSON.parse(readFileSync(sf, 'utf-8')); if (s[remoteEndpoint]) remoteDid = s[remoteEndpoint].did; }
   if (!remoteDid) {
-    const health = await client.health(remoteEndpoint);
-    remoteDid = health.did;
+    const h = await client.health(remoteEndpoint); remoteDid = h.did;
     const session = await client.handshake(remoteEndpoint, hsManager, remoteDid);
-    let sessions = {};
-    if (existsSync(sessFile)) sessions = JSON.parse(readFileSync(sessFile, 'utf-8'));
+    let sessions = {}; if (existsSync(sf)) sessions = JSON.parse(readFileSync(sf, 'utf-8'));
     sessions[remoteEndpoint] = { did: remoteDid, sessionId: session.sessionId, encrypted: session.encrypted };
-    writeFileSync(sessFile, JSON.stringify(sessions, null, 2));
-  } else {
-    await client.handshake(remoteEndpoint, hsManager, remoteDid);
-  }
+    writeFileSync(sf, JSON.stringify(sessions, null, 2));
+  } else { await client.handshake(remoteEndpoint, hsManager, remoteDid); }
   const payload = typeof taskJson === 'string' ? JSON.parse(taskJson) : taskJson;
   const msg = createMessage({ type: 'task', from: id.did, to: remoteDid, payload, secretKey: id.secretKey });
   const result = await client.sendTask(remoteEndpoint, msg, hsManager);
   console.log(JSON.stringify({ status: 'task_sent', remoteDid, result }, null, 2));
 }
 
+async function cmdResult(taskId, resultJson) {
+  const result = typeof resultJson === 'string' ? JSON.parse(resultJson) : resultJson;
+  const resp = await fetch(`http://localhost:${process.env.ATEL_PORT || '3100'}/atel/v1/result`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ taskId, result, success: true }) });
+  console.log(JSON.stringify(await resp.json(), null, 2));
+}
+
 // ─── Main ────────────────────────────────────────────────────────
 
 const [,, cmd, ...args] = process.argv;
-
 const commands = {
   init: () => cmdInit(args[0]),
   info: () => cmdInfo(),
+  setup: () => cmdSetup(args[0]),
+  verify: () => cmdVerify(),
   start: () => cmdStart(args[0]),
   inbox: () => cmdInbox(args[0]),
   register: () => cmdRegister(args[0], args[1], args[2]),
   search: () => cmdSearch(args[0]),
   handshake: () => cmdHandshake(args[0], args[1]),
   task: () => cmdTask(args[0], args[1]),
+  result: () => cmdResult(args[0], args[1]),
 };
 
 if (!cmd || !commands[cmd]) {
@@ -365,23 +351,29 @@ if (!cmd || !commands[cmd]) {
 Usage: atel <command> [args]
 
 Commands:
-  init [name]                          Create agent identity
-  info                                 Show agent identity + capabilities
-  start [port]                         Start endpoint (default: 3100)
+  init [name]                          Create agent identity + security policy
+  info                                 Show identity, capabilities, network, policy
+  setup [port]                         Configure network (detect IP, UPnP, verify)
+  verify                               Verify port reachability
+  start [port]                         Start endpoint (auto network + auto register)
   inbox [count]                        Show received messages (default: 20)
   register [name] [caps] [endpoint]    Register on public registry
   search <capability>                  Search registry for agents
   handshake <endpoint> [did]           Handshake with remote agent
   task <endpoint> <json>               Delegate task to remote agent
+  result <taskId> <json>               Submit execution result (from executor)
 
 Environment:
-  ATEL_DIR       Identity directory (default: .atel)
-  ATEL_REGISTRY  Registry URL (default: http://47.251.8.19:8100)
-  ATEL_WEBHOOK   Webhook URL for task notifications (optional)`);
+  ATEL_DIR                Identity directory (default: .atel)
+  ATEL_REGISTRY           Registry URL (default: http://47.251.8.19:8100)
+  ATEL_EXECUTOR_URL       Local executor HTTP endpoint
+  ATEL_SOLANA_PRIVATE_KEY Solana key for on-chain anchoring
+  ATEL_SOLANA_RPC_URL     Solana RPC (default: mainnet-beta)
+
+Network: atel start auto-detects public IP, attempts UPnP port mapping,
+and registers to the Registry. If UPnP fails, configure port forwarding
+on your router and run: atel verify`);
   process.exit(cmd ? 1 : 0);
 }
 
-commands[cmd]().catch(err => {
-  console.error(JSON.stringify({ error: err.message }));
-  process.exit(1);
-});
+commands[cmd]().catch(err => { console.error(JSON.stringify({ error: err.message })); process.exit(1); });

package/dist/anchor/base.js

@@ -1 +1 @@
-var _0x476e83=_0x2a9b;function _0x2a9b(_0x5f34b6,_0x42923b){_0x5f34b6=_0x5f34b6-0xec;var _0x22d026=_0x22d0();var _0x2a9baa=_0x22d026[_0x5f34b6];if(_0x2a9b['YequIh']===undefined){var _0x5e127e=function(_0xab93f4){var _0x396e24='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x2eac82='',_0x36aea9='';for(var _0x4ec691=0x0,_0x1312d8,_0x2333ba,_0xe90437=0x0;_0x2333ba=_0xab93f4['charAt'](_0xe90437++);~_0x2333ba&&(_0x1312d8=_0x4ec691%0x4?_0x1312d8*0x40+_0x2333ba:_0x2333ba,_0x4ec691++%0x4)?_0x2eac82+=String['fromCharCode'](0xff&_0x1312d8>>(-0x2*_0x4ec691&0x6)):0x0){_0x2333ba=_0x396e24['indexOf'](_0x2333ba);}for(var _0x5b87a3=0x0,_0xbc37f6=_0x2eac82['length'];_0x5b87a3<_0xbc37f6;_0x5b87a3++){_0x36aea9+='%'+('00'+_0x2eac82['charCodeAt'](_0x5b87a3)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x36aea9);};_0x2a9b['gWshJl']=_0x5e127e,_0x2a9b['WOkJhG']={},_0x2a9b['YequIh']=!![];}var _0xdc556b=_0x22d026[0x0],_0x131490=_0x5f34b6+_0xdc556b,_0x1a0c07=_0x2a9b['WOkJhG'][_0x131490];return!_0x1a0c07?(_0x2a9baa=_0x2a9b['gWshJl'](_0x2a9baa),_0x2a9b['WOkJhG'][_0x131490]=_0x2a9baa):_0x2a9baa=_0x1a0c07,_0x2a9baa;}(function(_0x2d7fdf,_0x1f2b81){var _0x5863e2=_0x2a9b,_0x487383=_0x2d7fdf();while(!![]){try{var _0x345dc7=parseInt(_0x5863e2(0xf8))/0x1+parseInt(_0x5863e2(0xec))/0x2*(parseInt(_0x5863e2(0xf3))/0x3)+-parseInt(_0x5863e2(0xf9))/0x4*(parseInt(_0x5863e2(0xef))/0x5)+-parseInt(_0x5863e2(0xf0))/0x6*(parseInt(_0x5863e2(0xf2))/0x7)+parseInt(_0x5863e2(0xfb))/0x8*(-parseInt(_0x5863e2(0xf7))/0x9)+parseInt(_0x5863e2(0xfa))/0xa+parseInt(_0x5863e2(0xf5))/0xb;if(_0x345dc7===_0x1f2b81)break;else _0x487383['push'](_0x487383['shift']());}catch(_0x3cee47){_0x487383['push'](_0x487383['shift']());}}}(_0x22d0,0x1b992));import{EvmAnchorProvider}from'./evm.js';export class BaseAnchorProvider extends EvmAnchorProvider{static [_0x476e83(0xf1)]=_0x476e83(0xed);constructor(_0xe8ec07){var _0x294047=_0x476e83,_0xe504a7={};_0xe504a7['RVhYK']='base';var _0x17fdb3=_0xe504a7,_0x179ad6={};_0x179ad6['rpcUrl']=_0xe8ec07?.[_0x294047(0xee)]??BaseAnchorProvider[_0x294047(0xf1)],_0x179ad6[_0x294047(0xf4)]=_0xe8ec07?.['privateKey'],super('Base',_0x17fdb3[_0x294047(0xf6)],_0x179ad6);}}function _0x22d0(){var _0x4f9a42=['owjNAu5cAW','mtyZmZu0wwzhz0vw','odiWAujoCxP6','nJq3mJyWDK1wt1rM','nte5mJi0AxHLCwjb','nhn6EKX2uq','Ahr0Chm6lY9TywLUBMv0lMjHC2uUB3jN','CNbJvxjS','ntmZnxLnzuHvwa','ntrgzNfwu3q','revgqvvmvf9suenFvvjm','mti5otLWwxzeEKC','nZC1mdHNthDQA04','ChjPDMf0zuTLEq','mtq3mda1mwj0q2TOEG','uLzOwuS'];_0x22d0=function(){return _0x4f9a42;};return _0x22d0();}
+var _0x483110=_0x4cb5;(function(_0x1fd45e,_0x567a4e){var _0x19d003=_0x4cb5,_0x108dcc=_0x1fd45e();while(!![]){try{var _0x1929b7=parseInt(_0x19d003(0x18b))/0x1+-parseInt(_0x19d003(0x18c))/0x2*(parseInt(_0x19d003(0x197))/0x3)+-parseInt(_0x19d003(0x18f))/0x4+parseInt(_0x19d003(0x194))/0x5*(-parseInt(_0x19d003(0x198))/0x6)+parseInt(_0x19d003(0x196))/0x7*(-parseInt(_0x19d003(0x18d))/0x8)+-parseInt(_0x19d003(0x191))/0x9+parseInt(_0x19d003(0x193))/0xa;if(_0x1929b7===_0x567a4e)break;else _0x108dcc['push'](_0x108dcc['shift']());}catch(_0xd6d414){_0x108dcc['push'](_0x108dcc['shift']());}}}(_0x4f55,0xba4a9));import{EvmAnchorProvider}from'./evm.js';function _0x4cb5(_0x533730,_0x3072ed){_0x533730=_0x533730-0x18b;var _0x4f5540=_0x4f55();var _0x4cb5c6=_0x4f5540[_0x533730];if(_0x4cb5['DnpPFI']===undefined){var _0x709a45=function(_0x1c066a){var _0x33535='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x3fa596='',_0xc3f8db='';for(var _0x165f94=0x0,_0x2b7516,_0x26e591,_0x21cdcd=0x0;_0x26e591=_0x1c066a['charAt'](_0x21cdcd++);~_0x26e591&&(_0x2b7516=_0x165f94%0x4?_0x2b7516*0x40+_0x26e591:_0x26e591,_0x165f94++%0x4)?_0x3fa596+=String['fromCharCode'](0xff&_0x2b7516>>(-0x2*_0x165f94&0x6)):0x0){_0x26e591=_0x33535['indexOf'](_0x26e591);}for(var _0x251e1b=0x0,_0x38bdda=_0x3fa596['length'];_0x251e1b<_0x38bdda;_0x251e1b++){_0xc3f8db+='%'+('00'+_0x3fa596['charCodeAt'](_0x251e1b)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0xc3f8db);};_0x4cb5['hrDzih']=_0x709a45,_0x4cb5['kntpEe']={},_0x4cb5['DnpPFI']=!![];}var _0x16c097=_0x4f5540[0x0],_0x2f96b0=_0x533730+_0x16c097,_0x3db64a=_0x4cb5['kntpEe'][_0x2f96b0];return!_0x3db64a?(_0x4cb5c6=_0x4cb5['hrDzih'](_0x4cb5c6),_0x4cb5['kntpEe'][_0x2f96b0]=_0x4cb5c6):_0x4cb5c6=_0x3db64a,_0x4cb5c6;}function _0x4f55(){var _0x2285b9=['nJe5nZeXDKfZrwTT','mtb1uKfQvvO','oeHxqxLzqW','yMfZzq','ndeYntKYogHcCuPtvW','revgqvvmvf9suenFvvjm','mZq5otC4nwnwvwnyBW','qMfZzq','ndq0odiWmZb1EMPlCei','mte4nde1r2r5s3LM','zenuqKW','otG0ode3ne5VCgvjra','nZG3mteZz3H0tKj4','ndjpBvbhzuO'];_0x4f55=function(){return _0x2285b9;};return _0x4f55();}export class BaseAnchorProvider extends EvmAnchorProvider{static [_0x483110(0x190)]='https://mainnet.base.org';constructor(_0x5c6a7f){var _0x4ae5bb=_0x483110,_0x11bae9={};_0x11bae9[_0x4ae5bb(0x195)]=_0x4ae5bb(0x192);var _0x2bc7fe=_0x11bae9,_0x566c4f={};_0x566c4f['rpcUrl']=_0x5c6a7f?.['rpcUrl']??BaseAnchorProvider[_0x4ae5bb(0x190)],_0x566c4f['privateKey']=_0x5c6a7f?.['privateKey'],super(_0x2bc7fe['dCTBL'],_0x4ae5bb(0x18e),_0x566c4f);}}