@ouro.bot/cli 0.1.0-alpha.833 → 0.1.0-alpha.834

package/changelog.json

@@ -1,6 +1,15 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.834",
+      "changes": [
+        "A2A: authenticated agent chat. A verified friend's message (friends message kind, signed and sealed) becomes the agent's turn under the sender's relationship profile, and the reply is sealed back to the sender and stored sealed, so neither direction travels or persists in plaintext over any transport.",
+        "Sanctuary: remote turns are relationship-scoped. Any Sanctuary turn from outside the host (Telegram, A2A, future senses) without a known capability profile gets no tools; only the Butler's own inner, CLI, and MCP channels keep the unscoped tool set. Adds a sanctuary-agent-peer profile: the owner's chat tools minus host execution and approval-gated restarts.",
+        "CLI: ouro a2a identity mints a file-backed client key (0600, refused if group- or other-readable); ouro a2a message sends a sealed chat to an agent card and prints the verified reply.",
+        "A2A: sealed chat is observable (sealed, opened, and refused events), and a reply sealed as any other friends kind is refused before it can reach a store."
+      ]
+    },
     {
       "version": "0.1.0-alpha.833",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.833",
+  "runtimeVersion": "0.1.0-alpha.834",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/tool-profiles.json

@@ -130,6 +130,75 @@
       "effectScopes": [
         "telegram.owner_event"
       ]
+    },
+    "sanctuary-agent-peer": {
+      "version": 1,
+      "toolNames": [
+        "external_event_disposition",
+        "query_active_work",
+        "save_friend_note",
+        "telegram_contact_manage",
+        "query_cares",
+        "care_manage",
+        "await_condition",
+        "resolve_await",
+        "cancel_await",
+        "list_recent_attachments",
+        "materialize_attachment",
+        "describe_image",
+        "unraid_list_containers",
+        "unraid_get_container_logs",
+        "unraid_get_storage",
+        "sanctuary_get_media_optimization",
+        "sanctuary_search_media_catalog",
+        "unraid_get_disks",
+        "unraid_get_notifications",
+        "unraid_get_system",
+        "sanctuary_get_install_state",
+        "unraid_check_services",
+        "sanctuary_get_download_queue",
+        "sanctuary_resume_download_queue",
+        "steward_policy_manage",
+        "send_message",
+        "ponder",
+        "rest",
+        "settle",
+        "speak",
+        "shell",
+        "shell_status",
+        "shell_tail",
+        "read_file",
+        "write_file",
+        "edit_file",
+        "glob",
+        "grep",
+        "web_search",
+        "search_facts",
+        "consult_diary",
+        "consult_notes",
+        "get_friend_note",
+        "session_summary",
+        "query_session",
+        "set_reasoning_effort",
+        "restart_runtime",
+        "revive_sense",
+        "media_search",
+        "media_request",
+        "media_request_status",
+        "media_diagnose_and_fix",
+        "media_chain_health",
+        "media_play_or_resolve"
+      ],
+      "contextScopes": [
+        "household.status",
+        "household.policy",
+        "household.private"
+      ],
+      "effectScopes": [
+        "telegram.proactive",
+        "telegram.request_return",
+        "telegram.owner_event"
+      ]
     }
   }
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.833</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.834</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/a2a/client.js

@@ -1,12 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.cardDid = cardDid;
 exports.endpointForCard = endpointForCard;
 exports.fetchA2AAgentCard = fetchA2AAgentCard;
 exports.sendA2AMessage = sendA2AMessage;
 exports.postA2AMessageEnvelope = postA2AMessageEnvelope;
 exports.getA2ATask = getA2ATask;
+exports.sendSealedA2AChat = sendSealedA2AChat;
 const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const runtime_1 = require("../nerves/runtime");
+const sealed_chat_1 = require("./sealed-chat");
+/** The trimmed `did:key` a card serves, or undefined when the card is did-less. */
+function cardDid(card) {
+    const did = card.did;
+    return typeof did === "string" && did.trim() ? did.trim() : undefined;
+}
 function endpointForCard(card) {
     const jsonRpc = card.supportedInterfaces?.find((entry) => (entry.protocolBinding ?? entry.transport)?.toUpperCase() === "JSONRPC");
     if (jsonRpc?.url)
@@ -178,3 +187,50 @@ async function getA2ATask(input) {
     }
     return rpc.result;
 }
+/**
+ * Talk to an A2A agent as a verified friend: seal `text` to the agent's card DID,
+ * signed by `identity`, send it, and open the sealed reply. The card must serve a
+ * did:key bound to it (the same check onboarding applies), so the reply can only be
+ * accepted from that key. Neither direction ever travels in plaintext.
+ */
+async function sendSealedA2AChat(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const sodium = input.sodium ?? await (0, a2a_client_1.ready)();
+    const card = await fetchA2AAgentCard(input.cardUrl, fetchImpl);
+    const peerDid = cardDid(card);
+    if (!peerDid)
+        throw new Error(`A2A card ${input.cardUrl} serves no DID; sealed chat needs one`);
+    const parsed = (0, a2a_client_1.parseDidKey)(peerDid);
+    if (!parsed || !(0, a2a_client_1.verifyCardDidBinding)({ card: { did: peerDid, url: input.cardUrl }, did: peerDid, didDoc: null })) {
+        throw new Error(`A2A card↔DID binding failed for ${peerDid}`);
+    }
+    const endpointUrl = endpointForCard(card);
+    const conversationId = input.conversationId ?? (0, node_crypto_1.randomUUID)();
+    const sealed = (0, sealed_chat_1.sealChatMessage)({
+        sodium,
+        from: input.identity,
+        recipientDid: peerDid,
+        recipientEd25519Pub: parsed.ed25519Pub,
+        text: input.text,
+        conversationId,
+    });
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "SendMessage",
+        params: { message: { kind: "message", role: "ROLE_USER", messageId: (0, node_crypto_1.randomUUID)(), contextId: conversationId, parts: sealed.parts } },
+    };
+    (0, runtime_1.emitNervesEvent)({ component: "channels", event: "channel.a2a_chat_send_start", message: "sending sealed A2A chat message", meta: { endpointUrl, peerDid } });
+    const rpc = await postJsonRpc(endpointUrl, request, fetchImpl);
+    if ("error" in rpc)
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    const task = rpc.result;
+    const replyMessage = task?.status?.message;
+    if (!replyMessage)
+        throw new Error("A2A chat returned no reply message");
+    const opened = await (0, sealed_chat_1.openChatMessage)({ sodium, self: input.identity, message: replyMessage, senderDid: peerDid, senderEd25519Pub: parsed.ed25519Pub });
+    if (!opened.ok)
+        throw new Error(`A2A chat reply rejected: ${opened.reason}`);
+    (0, runtime_1.emitNervesEvent)({ component: "channels", event: "channel.a2a_chat_send_end", message: "received sealed A2A chat reply", meta: { endpointUrl, peerDid, taskId: task.id } });
+    return { text: opened.text, conversationId, taskId: task.id, peerDid, peerName: card.name };
+}

package/dist/a2a/identity.js

@@ -36,7 +36,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readStoredA2ASeed = readStoredA2ASeed;
 exports.loadOrMintA2AIdentity = loadOrMintA2AIdentity;
 exports.loadSelfA2AIdentity = loadSelfA2AIdentity;
+exports.loadOrMintA2AIdentityFile = loadOrMintA2AIdentityFile;
 const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
 const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
 const runtime_1 = require("../nerves/runtime");
@@ -168,3 +171,34 @@ async function loadSelfA2AIdentity(input) {
         },
     });
 }
+/**
+ * A file-backed A2A identity for a client that is not an ouro agent (for example a
+ * coding harness talking to an agent over A2A). The file holds the Ed25519 seed, so
+ * it is treated like an SSH private key: created 0600 inside a 0700 directory, and
+ * REFUSED if group or other can read it.
+ */
+async function loadOrMintA2AIdentityFile(input) {
+    const sodium = input.sodium ?? await (0, a2a_client_1.ready)();
+    return fs.existsSync(input.filePath) ? readA2AIdentityFile(sodium, input.filePath) : mintA2AIdentityFile(sodium, input.filePath);
+}
+function readA2AIdentityFile(sodium, filePath) {
+    const mode = fs.statSync(filePath).mode & 0o077;
+    if (mode !== 0)
+        throw new Error(`A2A identity file ${filePath} is readable by group or other; chmod 600 it`);
+    const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    if (typeof parsed.seed !== "string")
+        throw new Error(`A2A identity file ${filePath} has no seed`);
+    return deriveIdentity(sodium, decodeSeed(parsed.seed));
+}
+function mintA2AIdentityFile(sodium, filePath) {
+    const identity = deriveIdentity(sodium, mintSeed());
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(filePath, `${JSON.stringify({ version: 1, did: identity.did, seed: identity.seed }, null, 2)}\n`, { mode: 0o600 });
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_client_identity_minted",
+        message: "minted file-backed A2A client identity",
+        meta: { did: identity.did },
+    });
+    return identity;
+}

package/dist/a2a/inbound-share.js

@@ -95,6 +95,9 @@ async function receiveInboundShare(message, deps) {
             trust,
             friendsKind: result.friendsKind,
             status: result.status,
+            ...(result.message ? { message: result.message } : {}),
+            /* v8 ignore next -- a completed receipt implies a trusted friend record: an unknown DID reads as stranger and is refused @preserve */
+            ...(record ? { friend: record } : {}),
         };
     }
     (0, runtime_1.emitNervesEvent)({

package/dist/a2a/onboarding.js

@@ -52,11 +52,6 @@ function urlAgentId(cardUrl) {
     parsed.hash = "";
     return parsed.toString();
 }
-/** The trimmed `did:key` a card serves, or undefined when the card is did-less. */
-function cardDid(card) {
-    const did = card.did;
-    return typeof did === "string" && did.trim() ? did.trim() : undefined;
-}
 async function onboardA2APeer(options) {
     // HTTP/URL glue stays harness-side: fetch the agent card, resolve its JSON-RPC
     // endpoint, and derive the stable agentId. The record-shaping (mint/update the
@@ -77,7 +72,7 @@ async function onboardA2APeer(options) {
     // an inbound envelope, so onboarding it would silently break the resolve later). A
     // card whose DID is unparseable or fails the binding is REFUSED (no record
     // written) — never TOFU-trust a mis-bound or malformed card.
-    const did = cardDid(card);
+    const did = (0, client_1.cardDid)(card);
     if (did) {
         const parsed = (0, a2a_client_1.parseDidKey)(did);
         const bound = parsed !== null && (0, a2a_client_1.verifyCardDidBinding)({ card: { did, url: options.cardUrl }, did, didDoc: null });

package/dist/a2a/sealed-chat.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_CHAT_REPLY = void 0;
+exports.sealChatMessage = sealChatMessage;
+exports.openChatMessage = openChatMessage;
+/**
+ * Sealed agent-to-agent chat over A2A (friends `message` kind).
+ *
+ * Both directions use the same primitive: the text is signed by the sender and
+ * sealed to the recipient inside ONE friends DataPart, so a message is confidential
+ * and tamper-evident over any transport (tailnet, LAN, relay). The network is a
+ * pipe, not the lock.
+ *
+ * - `sealChatMessage` builds the single-DataPart A2A message for a recipient whose
+ *   Ed25519 key the sender already trusts (a pinned DID, or a did:key card).
+ * - `openChatMessage` opens one through the SAME `receiveShare` pipeline every
+ *   friends kind uses (unseal, sender binding, pinned-key signature, replay guard,
+ *   trust floor), pinned to the sender the opener expects. There is no second,
+ *   hand-rolled verification path.
+ */
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+/** What an agent replies when its turn produced no text; sealed like any reply. */
+exports.EMPTY_CHAT_REPLY = "(no reply)";
+/** Seal `text` from `from` to the recipient as a single friends DataPart. Returns
+ * the harness-shaped A2A message; callers add role/messageId/contextId. */
+function sealChatMessage(input) {
+    const text = input.text.trim() === "" ? exports.EMPTY_CHAT_REPLY : input.text.slice(0, friends_1.MAX_MESSAGE_TEXT_CHARS);
+    const prepared = (0, friends_1.prepareMessage)({
+        fromAgentId: input.from.did,
+        text,
+        ...(input.conversationId !== undefined ? { conversationId: input.conversationId } : {}),
+    });
+    /* v8 ignore next -- the text is normalized above and the sender DID comes from a real identity @preserve */
+    if (!prepared.ok)
+        throw new Error(`cannot prepare chat message: ${prepared.status}`);
+    const sealed = (0, a2a_client_1.sealEnvelope)({
+        sodium: input.sodium,
+        envelope: prepared.envelope,
+        friendsKind: "message",
+        fromIdentity: input.from,
+        recipientDid: input.recipientDid,
+        recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium: input.sodium, ed25519Pub: input.recipientEd25519Pub }),
+    });
+    const wrapped = (0, a2a_client_1.wrapInDataPart)({ sealedEnvelope: sealed, recipientDid: input.recipientDid });
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_chat_sealed",
+        message: "sealed an A2A chat message",
+        meta: { recipientDid: input.recipientDid, chars: text.length },
+    });
+    return { parts: wrapped.parts };
+}
+class MemorySeenLedger {
+    seen = new Set();
+    isSeen(nonce) { return this.seen.has(nonce); }
+    markSeen(nonce) { this.seen.add(nonce); }
+}
+/** A `message` receipt imports nothing, so the stores must never be reached. */
+function unreachableStore(name) {
+    return new Proxy({}, { get() { throw new Error(`sealed chat must not touch the ${name}`); } });
+}
+/** Open a sealed chat message from an expected sender through `receiveShare`. */
+async function openChatMessage(input) {
+    const pinStore = new a2a_client_1.MemoryPinStore();
+    (0, a2a_client_1.pinOnFirstContact)({ pinStore, fromAgentId: input.senderDid, did: input.senderDid, ed25519Pub: input.senderEd25519Pub });
+    const result = await (0, a2a_client_1.receiveShare)({
+        sodium: input.sodium,
+        store: unreachableStore("friend store"),
+        missionStore: unreachableStore("mission store"),
+        pinStore,
+        // Only the pre-pinned sender can verify: any other signer resolves to nothing.
+        didResolution: {
+            async resolveAndPin({ fromAgentId }) {
+                const pinned = pinStore.get(fromAgentId);
+                return pinned ? { ed25519Pub: pinned.ed25519Pub } : null;
+            },
+        },
+        seen: new MemorySeenLedger(),
+        a2aMessage: input.message,
+        recipientDid: input.self.did,
+        recipientIdentity: { x25519Priv: input.self.x25519Priv, x25519Pub: input.self.x25519Pub },
+        // The opener chose this sender; the signature, not this level, is the gate.
+        trustOfSource: "family",
+    });
+    if (result.state === "rejected") {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "channels",
+            event: "channel.a2a_chat_open_rejected",
+            message: "refused a sealed A2A chat message",
+            meta: { senderDid: input.senderDid, reason: result.reason },
+        });
+        return { ok: false, reason: result.reason };
+    }
+    /* v8 ignore next -- any other kind reaches a store, and these stores throw: only a message can complete here @preserve */
+    if (result.friendsKind !== "message" || !result.message)
+        return { ok: false, reason: "not_a_message" };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_chat_opened",
+        message: "opened a verified A2A chat message",
+        meta: { senderDid: input.senderDid, chars: result.message.text.length },
+    });
+    return {
+        ok: true,
+        text: result.message.text,
+        ...(result.message.conversationId !== undefined ? { conversationId: result.message.conversationId } : {}),
+        issuedAt: result.message.issuedAt,
+    };
+}

package/dist/a2a/server.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.a2aChatRelationship = a2aChatRelationship;
 exports.startA2AServer = startA2AServer;
 const http = __importStar(require("node:http"));
 const node_crypto_1 = require("node:crypto");
@@ -47,6 +48,8 @@ const pin_store_1 = require("./pin-store");
 const seen_ledger_1 = require("./seen-ledger");
 const did_resolution_1 = require("./did-resolution");
 const inbound_share_1 = require("./inbound-share");
+const sealed_chat_1 = require("./sealed-chat");
+const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const mission_result_wire_1 = require("./mission-result-wire");
 const delegation_stores_1 = require("./delegation-stores");
 const task_store_1 = require("./task-store");
@@ -155,10 +158,24 @@ async function defaultTurnRunner(input) {
             externalId: input.peerAgentId,
             displayName: input.peerName,
         },
+        ...(input.relationshipAuthorization ? { toolContext: { relationshipAuthorization: input.relationshipAuthorization } } : {}),
     });
     return { response: result.response };
 }
 /* v8 ignore stop */
+/** The relationship that scopes a verified friend's A2A chat turn, from the agent's
+ * own capability registry. No registry (or an invalid one) means no relationship,
+ * which Sanctuary's tool selection turns into "no tools" for a remote turn. */
+function a2aChatRelationship(agentRoot, friend, requestId) {
+    let registry;
+    try {
+        registry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
+    }
+    catch {
+        return undefined;
+    }
+    return (0, relationship_authorization_1.createRelationshipAuthorizationEvaluator)({ friend, registry, requestId, requestPhase: "inbound" });
+}
 function accessTokenHash(accessToken) {
     return (0, node_crypto_1.createHash)("sha256").update(accessToken).digest("hex");
 }
@@ -223,9 +240,15 @@ function taskA2AMetadata(task) {
         return {};
     return a2a;
 }
+/** A friends sealed DataPart: opaque ciphertext addressed to one DID, so it is safe
+ * to expose to the task holder (a sealed chat reply travels this way). */
+function isSealedFriendsPart(part) {
+    const data = part.data;
+    return part.kind === "data" && !!data && typeof data === "object" && typeof data.sealed === "object" && data.sealed !== null && typeof data.recipientDid === "string";
+}
 function publicMessage(message, style) {
     const parts = message.parts
-        .filter((part) => part && typeof part === "object" && typeof part.text === "string")
+        .filter((part) => part && typeof part === "object" && (typeof part.text === "string" || isSealedFriendsPart(part)))
         .map((part) => style === "legacy" ? { ...part, kind: part.kind ?? "text" } : part);
     if (style === "latest")
         return { ...message, kind: "message", parts };
@@ -293,14 +316,15 @@ function taskFor(input) {
     const now = new Date().toISOString();
     const history = [...(input.previousTask?.history ?? []), input.inbound];
     const previousA2A = input.previousTask ? taskA2AMetadata(input.previousTask) : {};
-    const responseMessage = input.response
+    const responseParts = input.responseParts ?? (input.response ? [{ text: input.response }] : undefined);
+    const responseMessage = responseParts
         ? {
             kind: "message",
             role: "ROLE_AGENT",
             taskId: input.taskId,
             contextId: input.contextId,
             messageId: (0, node_crypto_1.randomUUID)(),
-            parts: [{ text: input.response }],
+            parts: responseParts,
         }
         : undefined;
     if (responseMessage)
@@ -438,6 +462,7 @@ async function startA2AServer(options) {
                 let verifiedPeerAgentId;
                 let verifiedPeerName;
                 let verifiedShareText;
+                let verifiedChat;
                 if (inbound && inboundShareDeps && messageHasDataPart(inbound)) {
                     const bridged = await (0, inbound_share_1.receiveInboundShare)(inbound, inboundShareDeps);
                     if (bridged.outcome === "rejected") {
@@ -451,7 +476,16 @@ async function startA2AServer(options) {
                     if (bridged.outcome === "completed") {
                         verifiedPeerAgentId = bridged.verifiedDid;
                         verifiedPeerName = bridged.verifiedDid;
-                        verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                        if (bridged.message) {
+                            // Authenticated chat: the signed, sealed text IS the turn.
+                            verifiedShareText = bridged.message.text;
+                            /* v8 ignore next -- a completed chat always has a friend record: an unknown DID reads as stranger and the message is refused @preserve */
+                            verifiedPeerName = bridged.friend?.name ?? bridged.verifiedDid;
+                            verifiedChat = { did: bridged.verifiedDid, friend: bridged.friend };
+                        }
+                        else {
+                            verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                        }
                     }
                 }
                 const text = verifiedShareText ?? textFromMessage(inbound);
@@ -486,14 +520,37 @@ async function startA2AServer(options) {
                 const tokenScope = accessTokenScope(accessToken);
                 const clientTaskId = continuationTask ? taskA2AMetadata(continuationTask).clientTaskId : inbound.taskId;
                 taskStore.put(taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_WORKING", clientTaskId, previousTask: continuationTask ?? undefined }), tokenScope);
+                const relationshipAuthorization = verifiedChat?.friend
+                    ? a2aChatRelationship(agentRoot, verifiedChat.friend, taskId)
+                    : undefined;
                 const turn = await turnRunner({
                     agentName: options.agentName,
                     peerAgentId,
                     peerName,
                     sessionKey: contextId,
                     message: text,
+                    ...(relationshipAuthorization ? { relationshipAuthorization } : {}),
                 });
-                const task = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: turn.response, clientTaskId, previousTask: continuationTask ?? undefined });
+                let responseParts;
+                if (verifiedChat) {
+                    // A verified chat's reply is sealed to the sender and stored sealed, so neither
+                    // the wire nor a later GetTask ever carries the plaintext.
+                    const pinned = inboundShareDeps.pinStore.get(verifiedChat.did);
+                    /* v8 ignore next 4 -- receiveShare pins the verified sender before it reports a completed chat; refuse rather than reply in plaintext @preserve */
+                    if (!pinned) {
+                        writeJson(res, 200, errorResponse(rpc.id, -32003, "A2A chat reply cannot be sealed to the sender"));
+                        return;
+                    }
+                    responseParts = (0, sealed_chat_1.sealChatMessage)({
+                        sodium: inboundShareDeps.sodium,
+                        from: options.identity,
+                        recipientDid: verifiedChat.did,
+                        recipientEd25519Pub: pinned.ed25519Pub,
+                        text: turn.response,
+                        conversationId: contextId,
+                    }).parts;
+                }
+                const task = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: turn.response, responseParts, clientTaskId, previousTask: continuationTask ?? undefined });
                 taskStore.put(task, tokenScope);
                 writeJson(res, 200, jsonResponse(rpc.id, publicTask(task, accessToken, responseStyle, true)));
                 return;

package/dist/heart/daemon/cli-exec.js

@@ -6062,6 +6062,29 @@ async function executeFriendCommand(command, store) {
         return `identity not linked: ${command.provider}:${command.externalId}`;
     return `unlinked ${command.provider}:${command.externalId} from ${command.friendId}`;
 }
+async function executeA2AClientCommand(command, deps) {
+    const { loadOrMintA2AIdentityFile } = await Promise.resolve().then(() => __importStar(require("../../a2a/identity")));
+    /* v8 ignore next -- production CLI keeps the client key under the home dir; tests pass an explicit file @preserve */
+    const identityFile = command.identityFile ?? path.join(os.homedir(), ".ouro-cli", "a2a", "client-identity.json");
+    const identity = await loadOrMintA2AIdentityFile({ filePath: identityFile });
+    if (command.kind === "a2a.identity") {
+        const message = command.json ? JSON.stringify({ did: identity.did, identityFile }) : `did: ${identity.did}\nidentity file: ${identityFile}`;
+        deps.writeStdout(message);
+        return message;
+    }
+    const { sendSealedA2AChat } = await Promise.resolve().then(() => __importStar(require("../../a2a/client")));
+    const reply = await sendSealedA2AChat({
+        cardUrl: command.to,
+        text: command.text,
+        ...(command.conversationId ? { conversationId: command.conversationId } : {}),
+        identity,
+        /* v8 ignore next -- production CLI uses global fetch; tests inject fetch for a hermetic peer @preserve */
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    });
+    const message = command.json ? JSON.stringify(reply) : `${reply.peerName}: ${reply.text}\n[conversation: ${reply.conversationId}]`;
+    deps.writeStdout(message);
+    return message;
+}
 async function executeA2ACommand(command, deps) {
     if (command.kind === "a2a.card") {
         const { buildA2AAgentCard } = await Promise.resolve().then(() => __importStar(require("../../a2a/card")));
@@ -7132,6 +7155,10 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         deps.writeStdout(message);
         return message;
     }
+    // ── a2a client commands (this machine talks to an agent as a verified friend; no agent, no daemon) ──
+    if (command.kind === "a2a.identity" || command.kind === "a2a.message") {
+        return executeA2AClientCommand(command, deps);
+    }
     // ── versions command (local install list + published update truth, no daemon socket needed) ──
     if (command.kind === "versions") {
         const versions = deps.listCliVersions?.() ?? [];

package/dist/heart/daemon/cli-parse.js

@@ -152,6 +152,8 @@ function usage() {
         "  ouro a2a card [--agent <name>] [--base-url <url>] [--json]",
         "  ouro a2a onboard [--agent <name>] --card-url <url> [--trust <level>] [--name <name>]",
         "  ouro a2a serve [--agent <name>] [--host <host>] [--port <port>] [--base-url <url>] [--path <path>]",
+        "  ouro a2a identity [--identity-file <path>] [--json]",
+        "  ouro a2a message --to <card-url> --text <text> [--context <id>] [--identity-file <path>] [--json]",
         "  ouro whoami [--agent <name>]",
         "  ouro session list [--agent <name>]",
         "  ouro mcp list",
@@ -1450,6 +1452,56 @@ function parseA2ACommand(args) {
         }
         return { kind: "a2a.card", ...(agent ? { agent } : {}), ...(baseUrl ? { baseUrl } : {}), ...(json ? { json: true } : {}) };
     }
+    if (sub === "identity") {
+        let identityFile;
+        let json = false;
+        for (let i = 0; i < rest.length; i += 1) {
+            if (rest[i] === "--identity-file" && rest[i + 1]) {
+                identityFile = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--json") {
+                json = true;
+                continue;
+            }
+            throw new Error("Usage: ouro a2a identity [--identity-file <path>] [--json]");
+        }
+        return { kind: "a2a.identity", ...(identityFile ? { identityFile } : {}), ...(json ? { json: true } : {}) };
+    }
+    if (sub === "message") {
+        const usageText = "Usage: ouro a2a message --to <card-url> --text <text> [--context <id>] [--identity-file <path>] [--json]";
+        let to;
+        let text;
+        let conversationId;
+        let identityFile;
+        let json = false;
+        for (let i = 0; i < rest.length; i += 1) {
+            if (rest[i] === "--to" && rest[i + 1]) {
+                to = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--text" && rest[i + 1]) {
+                text = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--context" && rest[i + 1]) {
+                conversationId = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--identity-file" && rest[i + 1]) {
+                identityFile = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--json") {
+                json = true;
+                continue;
+            }
+            throw new Error(usageText);
+        }
+        if (!to || !text)
+            throw new Error(usageText);
+        return { kind: "a2a.message", to, text, ...(conversationId ? { conversationId } : {}), ...(identityFile ? { identityFile } : {}), ...(json ? { json: true } : {}) };
+    }
     if (sub === "onboard") {
         let cardUrl;
         let trustLevel;

package/dist/repertoire/tools.js

@@ -74,6 +74,8 @@ exports.SANCTUARY_MCP_PROVIDED_TOOLS = new Set([
     "media_search", "media_request", "media_request_status",
     "media_diagnose_and_fix", "media_chain_health", "media_play_or_resolve",
 ]);
+/** Channels a Sanctuary turn can arrive on from the host itself, not from a remote party. */
+const SANCTUARY_LOCAL_CHANNELS = new Set(["inner", "cli", "mcp"]);
 exports.SANCTUARY_OWNER_ADDITIONS = new Set([
     "shell", "shell_status", "shell_tail", "read_file", "write_file", "edit_file", "glob", "grep",
     "web_search", "search_facts", "consult_diary", "consult_notes", "get_friend_note",
@@ -125,10 +127,20 @@ function applyPreference(tool, pref) {
 function selectToolsForChannel(capabilities, toolPreferences, _context, providerCapabilities, mcpManager, _chatModel, context) {
     const relationship = context?.relationshipAuthorization;
     const profileId = relationship?.profileId;
-    const sanctuary = (context?.agentName === "sanctuary" && (relationship !== undefined || capabilities?.channel === "telegram"))
+    // Every Sanctuary turn that reaches the agent from outside the host (Telegram, A2A,
+    // any future remote sense) is relationship-scoped: without a known capability
+    // profile it gets no tools at all. Only the Butler's own local channels (its inner
+    // loop and the host-local CLI/MCP) keep the unscoped tool set.
+    const channel = capabilities?.channel;
+    const remote = channel !== undefined && !SANCTUARY_LOCAL_CHANNELS.has(channel);
+    const sanctuary = (context?.agentName === "sanctuary" && (relationship !== undefined || remote))
         || profileId?.startsWith("sanctuary-") === true;
     const owner = profileId === "sanctuary-owner";
-    const knownSanctuaryProfile = relationship !== undefined && (owner || profileId === "sanctuary-household" || profileId === "sanctuary-event");
+    // A trusted peer agent acting for the owner gets the owner's chat tool menu. Host
+    // execution and approval-gated routine actions stay Telegram-owner-only: the host
+    // tool is only ever added on the Telegram channel, and the peer profile omits them.
+    const ownerLike = owner || profileId === "sanctuary-agent-peer";
+    const knownSanctuaryProfile = relationship !== undefined && (ownerLike || profileId === "sanctuary-household" || profileId === "sanctuary-event");
     const mcp = mcpManager ? (0, mcp_tools_1.mcpToolsAsDefinitions)(mcpManager) : [];
     const native = [...tools_base_1.baseToolDefinitions, ...additionalDefinitions];
     assertUniqueToolSchemas([
@@ -140,8 +152,8 @@ function selectToolsForChannel(capabilities, toolPreferences, _context, provider
         ordinary = knownSanctuaryProfile
             ? [
                 ...tools_base_1.baseToolDefinitions.filter((definition) => SANCTUARY_RELATIONSHIP_BASE_TOOLS.has(definition.tool.function.name)
-                    || (owner && exports.SANCTUARY_OWNER_ADDITIONS.has(definition.tool.function.name))),
-                ...tools_unraid_1.unraidToolDefinitions, tools_steward_policy_1.stewardPolicyToolDefinition, ...(owner ? mcp : []),
+                    || (ownerLike && exports.SANCTUARY_OWNER_ADDITIONS.has(definition.tool.function.name))),
+                ...tools_unraid_1.unraidToolDefinitions, tools_steward_policy_1.stewardPolicyToolDefinition, ...(ownerLike ? mcp : []),
             ]
             : [];
     }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.833",
+  "version": "0.1.0-alpha.834",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.833",
+      "version": "0.1.0-alpha.834",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",
@@ -18,7 +18,7 @@
         "@microsoft/teams.common": "2.0.11",
         "@microsoft/teams.dev": "2.0.11",
         "@microsoft/teams.graph": "2.0.11",
-        "@ouro.bot/friends": "0.1.0-alpha.10",
+        "@ouro.bot/friends": "0.1.0-alpha.12",
         "@types/react": "^17.0.91",
         "@types/ws": "^8.18.1",
         "ajv": "^8.20.0",
@@ -1357,9 +1357,9 @@
       }
     },
     "node_modules/@ouro.bot/friends": {
-      "version": "0.1.0-alpha.10",
-      "resolved": "https://registry.npmjs.org/@ouro.bot/friends/-/friends-0.1.0-alpha.10.tgz",
-      "integrity": "sha512-HxKCXDv74pWnVPcyEYyWn4L1Okg4otanHo3o80J1yofN2ycb56Nreimj+IPSTf7d3lthIsoSbksgIpDyE11OGw==",
+      "version": "0.1.0-alpha.12",
+      "resolved": "https://registry.npmjs.org/@ouro.bot/friends/-/friends-0.1.0-alpha.12.tgz",
+      "integrity": "sha512-pzV2PQvi1eUkcog3iDDHIvwSBDwpsB8/ykrJpoZQ/wB84qQa0xGKJSDnTt45r8H4j/68Cc5LU6vcjlwI5GG47g==",
       "license": "Apache-2.0",
       "dependencies": {
         "libsodium-wrappers": "0.8.4"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.833",
+  "version": "0.1.0-alpha.834",
   "engines": {
     "node": ">=22"
   },
@@ -65,7 +65,7 @@
     "@microsoft/teams.common": "2.0.11",
     "@microsoft/teams.dev": "2.0.11",
     "@microsoft/teams.graph": "2.0.11",
-    "@ouro.bot/friends": "0.1.0-alpha.10",
+    "@ouro.bot/friends": "0.1.0-alpha.12",
     "@types/react": "^17.0.91",
     "@types/ws": "^8.18.1",
     "ajv": "^8.20.0",