@ouro.bot/cli 0.1.0-alpha.671 → 0.1.0-alpha.672

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.672",
+      "changes": [
+        "A2A inbound authentication foundation (friends @ouro.bot/friends alpha.7): the agent mints/loads an Ed25519 did:key self-identity (machine-local vault seed) and serves it on its agent card; an inbound friends sealed DataPart is now unwrapped, unsealed, signature-verified, and replay-checked, and the turn runs keyed on the VERIFIED sender DID at that peer's real trust level (read from the friend store by DID, defaulting to stranger) — replacing the previous unauthenticated-a2a-peer collapse. Adds durable harness-owned PinStore (state/a2a/pins, TOFU + signed-rotation evaluation) and SeenLedger (state/a2a/seen, restart-safe replay defense). The legacy unsigned-text inbound path is behavior-preserved (stranger)."
+      ]
+    },
     {
       "version": "0.1.0-alpha.671",
       "changes": [

package/dist/a2a/card.js

@@ -9,6 +9,7 @@ function buildA2AAgentCard(options) {
         name: options.agentName,
         description: options.description ?? `Ouroboros agent ${options.agentName}`,
         protocolVersion: config_1.A2A_DEFAULT_PROTOCOL_VERSION,
+        ...(options.did ? { did: options.did } : {}),
         url: endpoint,
         preferredTransport: "JSONRPC",
         supportedInterfaces: [{
@@ -50,7 +51,7 @@ function buildA2AAgentCard(options) {
         component: "channels",
         event: "channel.a2a_card_built",
         message: "built A2A agent card",
-        meta: { agentName: options.agentName, endpoint },
+        meta: { agentName: options.agentName, endpoint, ...(options.did ? { did: options.did } : {}) },
     });
     return card;
 }

package/dist/a2a/did-resolution.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeDidResolution = makeDidResolution;
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Build the friends `DidResolution` for did:key peers. `resolveAndPin` is the
+ * verify-and-pin core the inbound bridge consumes:
+ *   parse the did:key → derive the presented Ed25519 key →
+ *     first contact (no pin under `fromAgentId`) → TOFU `pinOnFirstContact`
+ *     already pinned → `evaluateRotation` against the pin:
+ *       unchanged  → pin-hit, return the pinned key
+ *       accepted   → (re-pinned by evaluateRotation) return the NEW key
+ *       rejected   → loud security event, return null
+ *
+ * The pin is keyed by the STABLE `fromAgentId` (NOT the did:key string), so a
+ * rotation is "same `fromAgentId`, new (did, key)". An unparseable or empty DID is
+ * refused (null) and never matchable. The crypto is the friends primitives' — this
+ * only sequences them.
+ */
+function makeDidResolution(input) {
+    const { sodium, rotationProofFor } = input;
+    return {
+        async resolveAndPin(args) {
+            const { fromAgentId, did, pinStore, trustOfSource } = args;
+            // Empty DID is never a matchable key.
+            if (!did) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (empty DID)",
+                    meta: { fromAgentId, reason: "empty_did" },
+                });
+                return null;
+            }
+            const parsed = (0, a2a_client_1.parseDidKey)(did);
+            if (!parsed) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (unparseable did:key)",
+                    meta: { fromAgentId, reason: "parse_failed" },
+                });
+                return null;
+            }
+            const pinned = pinStore.get(fromAgentId);
+            if (!pinned) {
+                // First contact (TOFU): accept + pin the (did, key) under fromAgentId.
+                (0, a2a_client_1.pinOnFirstContact)({ pinStore, fromAgentId, did, ed25519Pub: parsed.ed25519Pub });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_pin_first_contact",
+                    message: "A2A DID pinned on first contact",
+                    meta: { fromAgentId, did },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Already pinned: evaluate the presented key against the pin.
+            const rotationProof = rotationProofFor?.(fromAgentId, did, parsed.ed25519Pub);
+            const decision = (0, a2a_client_1.evaluateRotation)({
+                sodium,
+                pinStore,
+                fromAgentId,
+                trustOfSource,
+                newDid: did,
+                newEd25519Pub: parsed.ed25519Pub,
+                rotationProof,
+            });
+            if (decision.decision === "unchanged") {
+                // Same key — pin-hit. (FileA2APinStore.get already emitted a2a_pin_hit.)
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            if (decision.decision === "accepted") {
+                // evaluateRotation already re-pinned to the new key under fromAgentId.
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_rotation_accepted",
+                    message: "A2A signed key rotation accepted",
+                    meta: { fromAgentId, newDid: did, trustOfSource },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Rejected — loud security signal (carries the reason).
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_rotation_rejected",
+                message: "A2A key rotation rejected",
+                meta: { fromAgentId, newDid: did, trustOfSource, reason: decision.reason },
+            });
+            return null;
+        },
+    };
+}

package/dist/a2a/identity.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStoredA2ASeed = readStoredA2ASeed;
+exports.loadOrMintA2AIdentity = loadOrMintA2AIdentity;
+const crypto = __importStar(require("node:crypto"));
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+/** The number of raw bytes in an Ed25519 seed. */
+const ED25519_SEED_BYTES = 32;
+/** The machine-config key path for the persisted seed: `a2a.identity.ed25519Seed`. */
+function a2aIdentityConfig(config) {
+    const a2a = config.a2a;
+    if (!a2a || typeof a2a !== "object" || Array.isArray(a2a))
+        return undefined;
+    const identity = a2a.identity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity))
+        return undefined;
+    return identity;
+}
+/** Read the stored Ed25519 seed string from a machine-config object, or undefined. */
+function readStoredA2ASeed(config) {
+    const identity = a2aIdentityConfig(config);
+    const seed = identity?.ed25519Seed;
+    return typeof seed === "string" && seed.length > 0 ? seed : undefined;
+}
+/** Decode + validate a stored seed string into 32 raw bytes. Throws on malformed. */
+function decodeSeed(seedString) {
+    let decoded;
+    try {
+        decoded = Buffer.from(seedString, "base64url");
+    }
+    catch {
+        /* v8 ignore next -- Buffer.from(base64url) does not throw on bad chars; this guards future decoders @preserve */
+        throw new Error("malformed A2A identity seed: not decodable");
+    }
+    // base64url is lenient (it silently drops invalid chars), so the length check is
+    // the real gate: a real Ed25519 seed is exactly 32 bytes.
+    if (decoded.length !== ED25519_SEED_BYTES) {
+        throw new Error(`malformed A2A identity seed: expected ${ED25519_SEED_BYTES}-byte seed, got ${decoded.length}`);
+    }
+    return new Uint8Array(decoded);
+}
+/** Mint a fresh 32-byte Ed25519 seed (Node keygen → JWK `d`, the raw seed). */
+function mintSeed() {
+    const { privateKey } = crypto.generateKeyPairSync("ed25519");
+    const jwk = privateKey.export({ format: "jwk" });
+    /* v8 ignore next -- Node always emits the `d` field for an Ed25519 private JWK; guard protects future runtimes @preserve */
+    if (typeof jwk.d !== "string")
+        throw new Error("failed to mint A2A identity seed: missing JWK d");
+    return decodeSeed(jwk.d);
+}
+/** Derive the full did:key identity from a 32-byte seed (deterministic). */
+function deriveIdentity(sodium, seed) {
+    const keypair = sodium.crypto_sign_seed_keypair(seed);
+    const didIdentity = (0, a2a_client_1.didKeyIdentityFromEd25519)({
+        sodium,
+        ed25519Pub: keypair.publicKey,
+        ed25519Priv: keypair.privateKey,
+    });
+    return { ...didIdentity, seed: Buffer.from(seed).toString("base64url") };
+}
+/**
+ * Load the agent's A2A identity from the machine-local config, or mint + persist
+ * one on first use. A malformed stored seed FAILS FAST (it never silently
+ * re-mints, which would change the agent's DID). The mint path persists the new
+ * seed via `upsert` before deriving; the load path performs no writes.
+ */
+async function loadOrMintA2AIdentity(input) {
+    const stored = readStoredA2ASeed(input.config);
+    if (stored) {
+        // Load path: a malformed seed throws (no re-mint).
+        const seed = decodeSeed(stored);
+        const identity = deriveIdentity(input.sodium, seed);
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_identity_loaded",
+            message: "loaded A2A identity from machine config",
+            meta: { agentName: input.agentName, did: identity.did },
+        });
+        return identity;
+    }
+    // Mint path: generate a seed, persist it under a2a.identity.*, then derive.
+    const seed = mintSeed();
+    const seedString = Buffer.from(seed).toString("base64url");
+    const a2a = (input.config.a2a && typeof input.config.a2a === "object" && !Array.isArray(input.config.a2a)
+        ? input.config.a2a
+        : {});
+    const identityBlock = (a2a.identity && typeof a2a.identity === "object" && !Array.isArray(a2a.identity)
+        ? a2a.identity
+        : {});
+    const nextConfig = {
+        ...input.config,
+        a2a: { ...a2a, identity: { ...identityBlock, ed25519Seed: seedString } },
+    };
+    await input.upsert(nextConfig);
+    const identity = deriveIdentity(input.sodium, seed);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_identity_minted",
+        message: "minted new A2A identity and persisted seed to machine config",
+        meta: { agentName: input.agentName, did: identity.did },
+    });
+    return identity;
+}

package/dist/a2a/inbound-share.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.receiveInboundShare = receiveInboundShare;
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+/** Whether the inbound message carries a friends data part (kind:"data"). */
+function hasDataPart(message) {
+    return Array.isArray(message.parts) && message.parts.some((p) => p && p.kind === "data");
+}
+/**
+ * Bridge an inbound A2A message through friends' `receiveShare`, keying the result
+ * on the VERIFIED sender DID.
+ *
+ * Ordering (the security-critical trap — `trustOfSource` is read from the store BY
+ * the just-verified DID, never defaulted, never from the envelope):
+ *   1. `unwrapDataPart` — no friends part ⇒ `not-a-share` (caller does text path).
+ *   2. `openSealedEnvelope` (pre-unseal) — extract the SIGNED sender DID. Unseal /
+ *      recipient-mismatch failures ⇒ `rejected` (no turn). (This open does NOT
+ *      verify the signature; the real auth gate is the `DidVerifier` inside
+ *      `receiveShare`, so a forged-high-trust claim here is harmless — the forge is
+ *      rejected by the verifier regardless of the trust we read.)
+ *   3. `findFriendByDid(store, verifiedDid)` — read trust off that record; an
+ *      unknown DID ⇒ `stranger` (never a default-up).
+ *   4. `receiveShare({ ..., trustOfSource })` — re-unseal (deterministic) + resolve
+ *      & pin + run `DidVerifier` (forge fails HERE) + replay-dedup + import.
+ *   5. Map the result. `completed` ⇒ run the turn at `verifiedDid`/`trust`.
+ */
+async function receiveInboundShare(message, deps) {
+    const friendsMessage = message;
+    const payload = (0, a2a_client_1.unwrapDataPart)(friendsMessage);
+    if (!payload) {
+        // No (valid) friends part. If there was a data part at all, it was a malformed
+        // friends attempt → reject; otherwise it's a legacy text message → not-a-share.
+        if (hasDataPart(message)) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_inbound_rejected",
+                message: "rejected malformed inbound A2A data part",
+                meta: { reason: "malformed_message" },
+            });
+            return { outcome: "rejected", reason: "malformed_message" };
+        }
+        return { outcome: "not-a-share" };
+    }
+    const recipientIdentity = {
+        x25519Priv: deps.identity.x25519Priv,
+        x25519Pub: deps.identity.x25519Pub,
+    };
+    // Pre-unseal to learn the SIGNED sender DID before we can read its trust.
+    const opened = (0, a2a_client_1.openSealedEnvelope)({
+        sodium: deps.sodium,
+        sealedEnvelope: { v: payload.v, sealed: payload.sealed },
+        recipientDid: deps.identity.did,
+        recipientIdentity,
+    });
+    if (!opened.ok) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_inbound_rejected",
+            message: "rejected inbound A2A envelope (unseal/recipient)",
+            meta: { reason: opened.error },
+        });
+        return { outcome: "rejected", reason: opened.error };
+    }
+    const verifiedDid = opened.fromAgentId;
+    // Read trust from the friend store BY the verified DID — never defaulted, never
+    // from the envelope. Unknown (or empty) DID ⇒ stranger. `findFriendByDid` itself
+    // refuses a falsy did (never matches a did-less record), so this is safe to call
+    // unconditionally.
+    const record = await (0, friends_1.findFriendByDid)(deps.store, verifiedDid);
+    const trust = record?.trustLevel ?? "stranger";
+    const result = await (0, a2a_client_1.receiveShare)({
+        sodium: deps.sodium,
+        store: deps.store,
+        missionStore: deps.missionStore,
+        pinStore: deps.pinStore,
+        didResolution: deps.didResolution,
+        seen: deps.seen,
+        a2aMessage: friendsMessage,
+        recipientDid: deps.identity.did,
+        recipientIdentity,
+        trustOfSource: trust,
+    });
+    if (result.state === "completed") {
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_inbound_verified",
+            message: "verified inbound A2A share; keying turn on sender DID",
+            meta: { verifiedDid, trust, friendsKind: result.friendsKind, status: result.status },
+        });
+        return {
+            outcome: "completed",
+            verifiedDid,
+            trust,
+            friendsKind: result.friendsKind,
+            status: result.status,
+        };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_inbound_rejected",
+        message: "rejected inbound A2A share",
+        meta: { reason: result.reason, verifiedDid, trust },
+    });
+    return { outcome: "rejected", reason: result.reason };
+}

package/dist/a2a/pin-store.js

@@ -0,0 +1,132 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileA2APinStore = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+function pinFileName(fromAgentId) {
+    return `${(0, node_crypto_1.createHash)("sha256").update(fromAgentId).digest("hex")}.json`;
+}
+class FileA2APinStore {
+    dir;
+    cache = new Map();
+    constructor(agentRoot) {
+        this.dir = path.join(agentRoot, "state", "a2a", "pins");
+        fs.mkdirSync(this.dir, { recursive: true });
+        this.loadExisting();
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_pin_store_init",
+            message: "initialized durable A2A pin store",
+            meta: { dir: this.dir, pins: this.cache.size },
+        });
+    }
+    get size() {
+        return this.cache.size;
+    }
+    get(fromAgentId) {
+        if (!fromAgentId)
+            return undefined;
+        const pinned = this.cache.get(fromAgentId);
+        if (!pinned)
+            return undefined;
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_pin_hit",
+            message: "A2A pin hit",
+            meta: { fromAgentId, did: pinned.did },
+        });
+        return pinned;
+    }
+    set(fromAgentId, pinned) {
+        // An empty-string DID is never a matchable key (security: it can never index a
+        // pin). Stay inert rather than writing an unkeyed pin file.
+        if (!fromAgentId)
+            return;
+        const existed = this.cache.has(fromAgentId);
+        // Faithfully persist the pinned identity's DID (which may differ from
+        // fromAgentId after a rotation), not fromAgentId itself.
+        const stored = {
+            fromAgentId,
+            did: pinned.did,
+            pinnedKey: (0, a2a_client_1.base58btcEncode)(pinned.ed25519Pub),
+        };
+        fs.writeFileSync(path.join(this.dir, pinFileName(fromAgentId)), `${JSON.stringify(stored, null, 2)}\n`, "utf-8");
+        this.cache.set(fromAgentId, { did: pinned.did, ed25519Pub: pinned.ed25519Pub });
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_pin_set",
+            message: "set durable A2A pin",
+            meta: { fromAgentId, did: pinned.did, rotated: existed },
+        });
+    }
+    /** Reload every persisted pin from disk into the in-memory cache (the restart
+     * replay). Corrupt/undecodable files are skipped so one bad file can never
+     * wedge the store. */
+    loadExisting() {
+        let entries;
+        try {
+            entries = fs.readdirSync(this.dir);
+        }
+        catch {
+            /* v8 ignore next -- the constructor mkdirSync's the dir before this runs; unreadable dir is unreachable in practice @preserve */
+            return;
+        }
+        for (const name of entries) {
+            if (!name.endsWith(".json"))
+                continue;
+            let stored;
+            try {
+                stored = JSON.parse(fs.readFileSync(path.join(this.dir, name), "utf-8"));
+            }
+            catch {
+                continue;
+            }
+            // `fromAgentId` is the cache key; fall back to `did` for any pre-rotation
+            // file written before the key/did split (back-compat).
+            const key = stored.fromAgentId ?? stored.did;
+            if (!key || !stored.did || !stored.pinnedKey)
+                continue;
+            const ed25519Pub = (0, a2a_client_1.base58btcDecode)(stored.pinnedKey);
+            if (!ed25519Pub)
+                continue;
+            this.cache.set(key, { did: stored.did, ed25519Pub });
+        }
+    }
+}
+exports.FileA2APinStore = FileA2APinStore;

package/dist/a2a/seen-ledger.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileA2ASeenLedger = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+function nonceFileName(nonce) {
+    return `${(0, node_crypto_1.createHash)("sha256").update(nonce).digest("hex")}.json`;
+}
+class FileA2ASeenLedger {
+    dir;
+    cache = new Set();
+    constructor(agentRoot) {
+        this.dir = path.join(agentRoot, "state", "a2a", "seen");
+        fs.mkdirSync(this.dir, { recursive: true });
+        this.loadExisting();
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_seen_ledger_init",
+            message: "initialized durable A2A seen ledger",
+            meta: { dir: this.dir, seen: this.cache.size },
+        });
+    }
+    get size() {
+        return this.cache.size;
+    }
+    isSeen(nonce) {
+        if (!nonce)
+            return false;
+        const seen = this.cache.has(nonce);
+        if (seen) {
+            // A nonce we already processed is arriving again — for a seal nonce this is
+            // a replay. Loud security signal.
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_replay_rejected",
+                message: "A2A replay rejected (nonce already seen)",
+                meta: { nonceHash: nonceFileName(nonce).slice(0, 16) },
+            });
+        }
+        return seen;
+    }
+    markSeen(nonce) {
+        // An empty-string nonce is never a matchable key — stay inert.
+        if (!nonce)
+            return;
+        if (this.cache.has(nonce))
+            return;
+        fs.writeFileSync(path.join(this.dir, nonceFileName(nonce)), `${JSON.stringify({ nonce, markedAt: new Date().toISOString() }, null, 2)}\n`, "utf-8");
+        this.cache.add(nonce);
+        (0, runtime_1.emitNervesEvent)({
+            component: "channels",
+            event: "channel.a2a_seen_marked",
+            message: "marked A2A seal nonce as seen (first sight)",
+            meta: { nonceHash: nonceFileName(nonce).slice(0, 16) },
+        });
+    }
+    /** Reload every persisted nonce from disk into the in-memory set (the restart
+     * replay defense). Corrupt/unreadable artifacts are skipped so one bad file can
+     * never reopen the replay window for the rest. */
+    loadExisting() {
+        let entries;
+        try {
+            entries = fs.readdirSync(this.dir);
+        }
+        catch {
+            /* v8 ignore next -- the constructor mkdirSync's the dir before this runs; unreadable dir is unreachable in practice @preserve */
+            return;
+        }
+        for (const name of entries) {
+            if (!name.endsWith(".json"))
+                continue;
+            let record;
+            try {
+                record = JSON.parse(fs.readFileSync(path.join(this.dir, name), "utf-8"));
+            }
+            catch {
+                continue;
+            }
+            if (typeof record.nonce === "string" && record.nonce.length > 0) {
+                this.cache.add(record.nonce);
+            }
+        }
+    }
+}
+exports.FileA2ASeenLedger = FileA2ASeenLedger;

package/dist/a2a/server.js

@@ -36,11 +36,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.startA2AServer = startA2AServer;
 const http = __importStar(require("node:http"));
 const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
 const shared_turn_1 = require("../senses/shared-turn");
 const card_1 = require("./card");
 const config_1 = require("./config");
+const pin_store_1 = require("./pin-store");
+const seen_ledger_1 = require("./seen-ledger");
+const did_resolution_1 = require("./did-resolution");
+const inbound_share_1 = require("./inbound-share");
 const task_store_1 = require("./task-store");
 const MAX_A2A_REQUEST_BYTES = 128 * 1024;
 const MAX_A2A_MESSAGE_TEXT_CHARS = 16_000;
@@ -160,6 +166,21 @@ function accessTokenScope(accessToken) {
 function untrustedTurnPeerExternalId() {
     return "unauthenticated-a2a-peer";
 }
+/** Whether an inbound message carries a friends sealed DataPart (`kind:"data"`). */
+function messageHasDataPart(message) {
+    /* v8 ignore next -- defensive: callers pass a parsed inbound whose `parts` is always an array; guards malformed direct input @preserve */
+    if (!Array.isArray(message.parts))
+        return false;
+    return message.parts.some((part) => part && part.kind === "data");
+}
+/** Map a friends `receiveShare` rejection reason → a JSON-RPC error code.
+ * Malformed-shape reasons map to invalid-params (-32602); auth/trust/replay
+ * rejections map to a dedicated A2A "rejected" code (-32003). */
+function rejectionErrorCode(reason) {
+    if (reason === "malformed_message" || reason === "malformed_plaintext")
+        return -32602;
+    return -32003;
+}
 function senderHintFromMessage(req, inbound) {
     const idHint = metadataString(inbound, "senderAgentId")
         ?? metadataString(inbound, "senderCardUrl")
@@ -315,9 +336,26 @@ async function startA2AServer(options) {
     const port = options.port ?? (0, config_1.defaultA2APort)(options.agentName);
     const a2aPath = (0, config_1.normalizeA2APath)(options.path);
     /* v8 ignore next -- foreground CLI/default daemon paths own the ambient agent-root fallback; protocol tests inject an isolated root @preserve */
-    const taskStore = new task_store_1.FileA2ATaskStore(options.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName));
+    const agentRoot = options.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
+    const taskStore = new task_store_1.FileA2ATaskStore(agentRoot);
     /* v8 ignore next -- default runner crosses into the full live agent pipeline; shared-turn covers that pipeline and server tests inject a deterministic runner @preserve */
     const turnRunner = options.turnRunner ?? defaultTurnRunner;
+    // The inbound friends-DataPart bridge is available only when the agent has a
+    // cryptographic identity (its did:key + X25519 unseal keys). Build its durable
+    // stores once at start; without an identity, inbound stays on the text path.
+    let inboundShareDeps;
+    if (options.identity) {
+        const friendsDir = `${agentRoot}/friends`;
+        inboundShareDeps = {
+            sodium: await (0, a2a_client_1.ready)(),
+            store: new friends_1.FileFriendStore(friendsDir),
+            missionStore: new friends_1.FileMissionStore((0, friends_1.missionsDirFor)(friendsDir)),
+            pinStore: new pin_store_1.FileA2APinStore(agentRoot),
+            seen: new seen_ledger_1.FileA2ASeenLedger(agentRoot),
+            didResolution: (0, did_resolution_1.makeDidResolution)({ sodium: await (0, a2a_client_1.ready)() }),
+            identity: options.identity,
+        };
+    }
     let publicBaseUrl = options.baseUrl;
     const server = http.createServer(async (req, res) => {
         /* v8 ignore next -- Node always supplies url/host for accepted HTTP requests; fallback keeps malformed local calls safe @preserve */
@@ -325,7 +363,12 @@ async function startA2AServer(options) {
         /* v8 ignore next -- host fallback is defensive for malformed local requests; publicBaseUrl/default host branches are covered @preserve */
         const currentBaseUrl = publicBaseUrl ?? `http://${req.headers.host ?? `${host}:${port}`}`;
         if (req.method === "GET" && (requestUrl.pathname === "/.well-known/agent-card.json" || requestUrl.pathname === "/agent-card.json")) {
-            writeJson(res, 200, (0, card_1.buildA2AAgentCard)({ agentName: options.agentName, baseUrl: currentBaseUrl, path: a2aPath }));
+            writeJson(res, 200, (0, card_1.buildA2AAgentCard)({
+                agentName: options.agentName,
+                baseUrl: currentBaseUrl,
+                path: a2aPath,
+                ...(options.identity ? { did: options.identity.did } : {}),
+            }));
             return;
         }
         if (req.method !== "POST" || requestUrl.pathname !== a2aPath) {
@@ -350,7 +393,30 @@ async function startA2AServer(options) {
                 const responseStyle = rpc.method === "message/send" ? "legacy" : "latest";
                 const parsedInbound = messageFromParams(rpc.params);
                 const inbound = parsedInbound ? { ...parsedInbound, kind: parsedInbound.kind ?? "message" } : null;
-                const text = textFromMessage(inbound);
+                // Inbound friends-DataPart branch (runs BEFORE the legacy text path). A
+                // sealed DataPart is unwrapped + verified through the bridge; the turn is
+                // then keyed on the VERIFIED sender DID (replacing the unauthenticated
+                // sentinel). A non-friends (text) message falls through unchanged.
+                let verifiedPeerAgentId;
+                let verifiedPeerName;
+                let verifiedShareText;
+                if (inbound && inboundShareDeps && messageHasDataPart(inbound)) {
+                    const bridged = await (0, inbound_share_1.receiveInboundShare)(inbound, inboundShareDeps);
+                    if (bridged.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(bridged.reason), `A2A share rejected: ${bridged.reason}`));
+                        return;
+                    }
+                    // A message with a data part always resolves to completed|rejected — the
+                    // bridge only returns "not-a-share" when there is NO data part, which the
+                    // `messageHasDataPart` gate above excludes. So this is the completed path.
+                    /* v8 ignore next -- "not-a-share" is unreachable here (gated by messageHasDataPart) @preserve */
+                    if (bridged.outcome === "completed") {
+                        verifiedPeerAgentId = bridged.verifiedDid;
+                        verifiedPeerName = bridged.verifiedDid;
+                        verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                    }
+                }
+                const text = verifiedShareText ?? textFromMessage(inbound);
                 if (!inbound || !text) {
                     writeJson(res, 200, errorResponse(rpc.id, -32602, "SendMessage requires a text message"));
                     return;
@@ -360,8 +426,10 @@ async function startA2AServer(options) {
                     return;
                 }
                 const senderHint = senderHintFromMessage(req, inbound);
-                const peerAgentId = untrustedTurnPeerExternalId();
-                const peerName = senderHint.name;
+                // The verified DID wins as the turn's peer identity; otherwise the legacy
+                // unauthenticated sentinel (text path, behavior-preserved).
+                const peerAgentId = verifiedPeerAgentId ?? untrustedTurnPeerExternalId();
+                const peerName = verifiedPeerName ?? senderHint.name;
                 const continuationToken = accessTokenFromParams(rpc.params);
                 const continuationTask = inbound.taskId && continuationToken
                     ? taskStore.get(inbound.taskId, accessTokenScope(continuationToken))

package/dist/senses/a2a-entry.js

@@ -53,11 +53,41 @@ const runtime_1 = require("../nerves/runtime");
     message: "booting A2A entrypoint",
     meta: { entry: "a2a", agentName },
 });
-Promise.resolve().then(() => __importStar(require("../a2a/server"))).then(async ({ startA2AServer }) => {
+Promise.all([
+    Promise.resolve().then(() => __importStar(require("../a2a/server"))),
+    Promise.resolve().then(() => __importStar(require("../a2a/identity"))),
+    Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))),
+    Promise.resolve().then(() => __importStar(require("../heart/machine-identity"))),
+    Promise.resolve().then(() => __importStar(require("@ouro.bot/friends/a2a-client"))),
+])
+    .then(async ([{ startA2AServer }, { loadOrMintA2AIdentity }, { waitForRuntimeCredentialBootstrap, readMachineRuntimeCredentialConfig, upsertMachineRuntimeCredentialConfig }, { loadOrCreateMachineIdentity }, { ready },]) => {
+    const os = await Promise.resolve().then(() => __importStar(require("node:os")));
+    // Wait for the daemon to deliver the machine-local runtime config (carrying the
+    // a2a identity seed) into the in-memory cache before we read or mint identity.
+    const bootstrapped = await waitForRuntimeCredentialBootstrap(agentName);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.a2a_bootstrap_waited",
+        message: "awaited runtime-credential bootstrap before A2A identity load",
+        meta: { entry: "a2a", agentName, bootstrapped },
+    });
+    const sodium = await ready();
+    const machineId = loadOrCreateMachineIdentity({ homeDir: os.homedir() }).machineId;
+    const machineConfigRead = readMachineRuntimeCredentialConfig(agentName);
+    const machineConfig = machineConfigRead.ok ? machineConfigRead.config : {};
+    const identity = await loadOrMintA2AIdentity({
+        agentName,
+        sodium,
+        config: machineConfig,
+        upsert: async (next) => {
+            await upsertMachineRuntimeCredentialConfig(agentName, machineId, next);
+        },
+    });
     const rawPort = argValue("--port");
     const port = rawPort ? Number.parseInt(rawPort, 10) : undefined;
     await startA2AServer({
         agentName,
+        identity,
         ...(argValue("--host") ? { host: argValue("--host") } : {}),
         ...(Number.isInteger(port) ? { port } : {}),
         ...(argValue("--base-url") ? { baseUrl: argValue("--base-url") } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.671",
+  "version": "0.1.0-alpha.672",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",
@@ -50,7 +50,6 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.78.0",
-    "@ouro.bot/friends": "git+https://github.com/ourostack/friends.git#250d1a4bbbad5cd50687975afc463e60e3ff8366",
     "@azure/identity": "^4.13.0",
     "@azure/storage-blob": "^12.31.0",
     "@microsoft/teams.api": "2.0.11",
@@ -59,6 +58,7 @@
     "@microsoft/teams.common": "2.0.11",
     "@microsoft/teams.dev": "2.0.11",
     "@microsoft/teams.graph": "2.0.11",
+    "@ouro.bot/friends": "0.1.0-alpha.7",
     "@types/react": "^17.0.91",
     "@types/ws": "^8.18.1",
     "fast-glob": "^3.3.3",