@ouro.bot/cli 0.1.0-alpha.833 → 0.1.0-alpha.835

package/dist/a2a/sealed-chat.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_CHAT_REPLY = void 0;
+exports.sealChatMessage = sealChatMessage;
+exports.openChatMessage = openChatMessage;
+/**
+ * Sealed agent-to-agent chat over A2A (friends `message` kind).
+ *
+ * Both directions use the same primitive: the text is signed by the sender and
+ * sealed to the recipient inside ONE friends DataPart, so a message is confidential
+ * and tamper-evident over any transport (tailnet, LAN, relay). The network is a
+ * pipe, not the lock.
+ *
+ * - `sealChatMessage` builds the single-DataPart A2A message for a recipient whose
+ *   Ed25519 key the sender already trusts (a pinned DID, or a did:key card).
+ * - `openChatMessage` opens one through the SAME `receiveShare` pipeline every
+ *   friends kind uses (unseal, sender binding, pinned-key signature, replay guard,
+ *   trust floor), pinned to the sender the opener expects. There is no second,
+ *   hand-rolled verification path.
+ */
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+/** What an agent replies when its turn produced no text; sealed like any reply. */
+exports.EMPTY_CHAT_REPLY = "(no reply)";
+/** Seal `text` from `from` to the recipient as a single friends DataPart. Returns
+ * the harness-shaped A2A message; callers add role/messageId/contextId. */
+function sealChatMessage(input) {
+    const text = input.text.trim() === "" ? exports.EMPTY_CHAT_REPLY : input.text.slice(0, friends_1.MAX_MESSAGE_TEXT_CHARS);
+    const prepared = (0, friends_1.prepareMessage)({
+        fromAgentId: input.from.did,
+        text,
+        ...(input.conversationId !== undefined ? { conversationId: input.conversationId } : {}),
+    });
+    /* v8 ignore next -- the text is normalized above and the sender DID comes from a real identity @preserve */
+    if (!prepared.ok)
+        throw new Error(`cannot prepare chat message: ${prepared.status}`);
+    const sealed = (0, a2a_client_1.sealEnvelope)({
+        sodium: input.sodium,
+        envelope: prepared.envelope,
+        friendsKind: "message",
+        fromIdentity: input.from,
+        recipientDid: input.recipientDid,
+        recipientX25519Pub: (0, a2a_client_1.keyAgreementFromDidKey)({ sodium: input.sodium, ed25519Pub: input.recipientEd25519Pub }),
+    });
+    const wrapped = (0, a2a_client_1.wrapInDataPart)({ sealedEnvelope: sealed, recipientDid: input.recipientDid });
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_chat_sealed",
+        message: "sealed an A2A chat message",
+        meta: { recipientDid: input.recipientDid, chars: text.length },
+    });
+    return { parts: wrapped.parts };
+}
+class MemorySeenLedger {
+    seen = new Set();
+    isSeen(nonce) { return this.seen.has(nonce); }
+    markSeen(nonce) { this.seen.add(nonce); }
+}
+/** A `message` receipt imports nothing, so the stores must never be reached. */
+function unreachableStore(name) {
+    return new Proxy({}, { get() { throw new Error(`sealed chat must not touch the ${name}`); } });
+}
+/** Open a sealed chat message from an expected sender through `receiveShare`. */
+async function openChatMessage(input) {
+    const pinStore = new a2a_client_1.MemoryPinStore();
+    (0, a2a_client_1.pinOnFirstContact)({ pinStore, fromAgentId: input.senderDid, did: input.senderDid, ed25519Pub: input.senderEd25519Pub });
+    const result = await (0, a2a_client_1.receiveShare)({
+        sodium: input.sodium,
+        store: unreachableStore("friend store"),
+        missionStore: unreachableStore("mission store"),
+        pinStore,
+        // Only the pre-pinned sender can verify: any other signer resolves to nothing.
+        didResolution: {
+            async resolveAndPin({ fromAgentId }) {
+                const pinned = pinStore.get(fromAgentId);
+                return pinned ? { ed25519Pub: pinned.ed25519Pub } : null;
+            },
+        },
+        seen: new MemorySeenLedger(),
+        a2aMessage: input.message,
+        recipientDid: input.self.did,
+        recipientIdentity: { x25519Priv: input.self.x25519Priv, x25519Pub: input.self.x25519Pub },
+        // The opener chose this sender; the signature, not this level, is the gate.
+        trustOfSource: "family",
+    });
+    if (result.state === "rejected") {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "channels",
+            event: "channel.a2a_chat_open_rejected",
+            message: "refused a sealed A2A chat message",
+            meta: { senderDid: input.senderDid, reason: result.reason },
+        });
+        return { ok: false, reason: result.reason };
+    }
+    /* v8 ignore next -- any other kind reaches a store, and these stores throw: only a message can complete here @preserve */
+    if (result.friendsKind !== "message" || !result.message)
+        return { ok: false, reason: "not_a_message" };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_chat_opened",
+        message: "opened a verified A2A chat message",
+        meta: { senderDid: input.senderDid, chars: result.message.text.length },
+    });
+    return {
+        ok: true,
+        text: result.message.text,
+        ...(result.message.conversationId !== undefined ? { conversationId: result.message.conversationId } : {}),
+        issuedAt: result.message.issuedAt,
+    };
+}

package/dist/a2a/server.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.a2aChatRelationship = a2aChatRelationship;
 exports.startA2AServer = startA2AServer;
 const http = __importStar(require("node:http"));
 const node_crypto_1 = require("node:crypto");
@@ -47,6 +48,8 @@ const pin_store_1 = require("./pin-store");
 const seen_ledger_1 = require("./seen-ledger");
 const did_resolution_1 = require("./did-resolution");
 const inbound_share_1 = require("./inbound-share");
+const sealed_chat_1 = require("./sealed-chat");
+const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const mission_result_wire_1 = require("./mission-result-wire");
 const delegation_stores_1 = require("./delegation-stores");
 const task_store_1 = require("./task-store");
@@ -155,10 +158,24 @@ async function defaultTurnRunner(input) {
             externalId: input.peerAgentId,
             displayName: input.peerName,
         },
+        ...(input.relationshipAuthorization ? { toolContext: { relationshipAuthorization: input.relationshipAuthorization } } : {}),
     });
     return { response: result.response };
 }
 /* v8 ignore stop */
+/** The relationship that scopes a verified friend's A2A chat turn, from the agent's
+ * own capability registry. No registry (or an invalid one) means no relationship,
+ * which Sanctuary's tool selection turns into "no tools" for a remote turn. */
+function a2aChatRelationship(agentRoot, friend, requestId) {
+    let registry;
+    try {
+        registry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
+    }
+    catch {
+        return undefined;
+    }
+    return (0, relationship_authorization_1.createRelationshipAuthorizationEvaluator)({ friend, registry, requestId, requestPhase: "inbound" });
+}
 function accessTokenHash(accessToken) {
     return (0, node_crypto_1.createHash)("sha256").update(accessToken).digest("hex");
 }
@@ -223,9 +240,15 @@ function taskA2AMetadata(task) {
         return {};
     return a2a;
 }
+/** A friends sealed DataPart: opaque ciphertext addressed to one DID, so it is safe
+ * to expose to the task holder (a sealed chat reply travels this way). */
+function isSealedFriendsPart(part) {
+    const data = part.data;
+    return part.kind === "data" && !!data && typeof data === "object" && typeof data.sealed === "object" && data.sealed !== null && typeof data.recipientDid === "string";
+}
 function publicMessage(message, style) {
     const parts = message.parts
-        .filter((part) => part && typeof part === "object" && typeof part.text === "string")
+        .filter((part) => part && typeof part === "object" && (typeof part.text === "string" || isSealedFriendsPart(part)))
         .map((part) => style === "legacy" ? { ...part, kind: part.kind ?? "text" } : part);
     if (style === "latest")
         return { ...message, kind: "message", parts };
@@ -293,14 +316,15 @@ function taskFor(input) {
     const now = new Date().toISOString();
     const history = [...(input.previousTask?.history ?? []), input.inbound];
     const previousA2A = input.previousTask ? taskA2AMetadata(input.previousTask) : {};
-    const responseMessage = input.response
+    const responseParts = input.responseParts ?? (input.response ? [{ text: input.response }] : undefined);
+    const responseMessage = responseParts
         ? {
             kind: "message",
             role: "ROLE_AGENT",
             taskId: input.taskId,
             contextId: input.contextId,
             messageId: (0, node_crypto_1.randomUUID)(),
-            parts: [{ text: input.response }],
+            parts: responseParts,
         }
         : undefined;
     if (responseMessage)
@@ -438,6 +462,7 @@ async function startA2AServer(options) {
                 let verifiedPeerAgentId;
                 let verifiedPeerName;
                 let verifiedShareText;
+                let verifiedChat;
                 if (inbound && inboundShareDeps && messageHasDataPart(inbound)) {
                     const bridged = await (0, inbound_share_1.receiveInboundShare)(inbound, inboundShareDeps);
                     if (bridged.outcome === "rejected") {
@@ -451,7 +476,16 @@ async function startA2AServer(options) {
                     if (bridged.outcome === "completed") {
                         verifiedPeerAgentId = bridged.verifiedDid;
                         verifiedPeerName = bridged.verifiedDid;
-                        verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                        if (bridged.message) {
+                            // Authenticated chat: the signed, sealed text IS the turn.
+                            verifiedShareText = bridged.message.text;
+                            /* v8 ignore next -- a completed chat always has a friend record: an unknown DID reads as stranger and the message is refused @preserve */
+                            verifiedPeerName = bridged.friend?.name ?? bridged.verifiedDid;
+                            verifiedChat = { did: bridged.verifiedDid, friend: bridged.friend };
+                        }
+                        else {
+                            verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                        }
                     }
                 }
                 const text = verifiedShareText ?? textFromMessage(inbound);
@@ -486,14 +520,37 @@ async function startA2AServer(options) {
                 const tokenScope = accessTokenScope(accessToken);
                 const clientTaskId = continuationTask ? taskA2AMetadata(continuationTask).clientTaskId : inbound.taskId;
                 taskStore.put(taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_WORKING", clientTaskId, previousTask: continuationTask ?? undefined }), tokenScope);
+                const relationshipAuthorization = verifiedChat?.friend
+                    ? a2aChatRelationship(agentRoot, verifiedChat.friend, taskId)
+                    : undefined;
                 const turn = await turnRunner({
                     agentName: options.agentName,
                     peerAgentId,
                     peerName,
                     sessionKey: contextId,
                     message: text,
+                    ...(relationshipAuthorization ? { relationshipAuthorization } : {}),
                 });
-                const task = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: turn.response, clientTaskId, previousTask: continuationTask ?? undefined });
+                let responseParts;
+                if (verifiedChat) {
+                    // A verified chat's reply is sealed to the sender and stored sealed, so neither
+                    // the wire nor a later GetTask ever carries the plaintext.
+                    const pinned = inboundShareDeps.pinStore.get(verifiedChat.did);
+                    /* v8 ignore next 4 -- receiveShare pins the verified sender before it reports a completed chat; refuse rather than reply in plaintext @preserve */
+                    if (!pinned) {
+                        writeJson(res, 200, errorResponse(rpc.id, -32003, "A2A chat reply cannot be sealed to the sender"));
+                        return;
+                    }
+                    responseParts = (0, sealed_chat_1.sealChatMessage)({
+                        sodium: inboundShareDeps.sodium,
+                        from: options.identity,
+                        recipientDid: verifiedChat.did,
+                        recipientEd25519Pub: pinned.ed25519Pub,
+                        text: turn.response,
+                        conversationId: contextId,
+                    }).parts;
+                }
+                const task = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: turn.response, responseParts, clientTaskId, previousTask: continuationTask ?? undefined });
                 taskStore.put(task, tokenScope);
                 writeJson(res, 200, jsonResponse(rpc.id, publicTask(task, accessToken, responseStyle, true)));
                 return;

package/dist/heart/daemon/cli-exec.js

@@ -6062,6 +6062,29 @@ async function executeFriendCommand(command, store) {
         return `identity not linked: ${command.provider}:${command.externalId}`;
     return `unlinked ${command.provider}:${command.externalId} from ${command.friendId}`;
 }
+async function executeA2AClientCommand(command, deps) {
+    const { loadOrMintA2AIdentityFile } = await Promise.resolve().then(() => __importStar(require("../../a2a/identity")));
+    /* v8 ignore next -- production CLI keeps the client key under the home dir; tests pass an explicit file @preserve */
+    const identityFile = command.identityFile ?? path.join(os.homedir(), ".ouro-cli", "a2a", "client-identity.json");
+    const identity = await loadOrMintA2AIdentityFile({ filePath: identityFile });
+    if (command.kind === "a2a.identity") {
+        const message = command.json ? JSON.stringify({ did: identity.did, identityFile }) : `did: ${identity.did}\nidentity file: ${identityFile}`;
+        deps.writeStdout(message);
+        return message;
+    }
+    const { sendSealedA2AChat } = await Promise.resolve().then(() => __importStar(require("../../a2a/client")));
+    const reply = await sendSealedA2AChat({
+        cardUrl: command.to,
+        text: command.text,
+        ...(command.conversationId ? { conversationId: command.conversationId } : {}),
+        identity,
+        /* v8 ignore next -- production CLI uses global fetch; tests inject fetch for a hermetic peer @preserve */
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    });
+    const message = command.json ? JSON.stringify(reply) : `${reply.peerName}: ${reply.text}\n[conversation: ${reply.conversationId}]`;
+    deps.writeStdout(message);
+    return message;
+}
 async function executeA2ACommand(command, deps) {
     if (command.kind === "a2a.card") {
         const { buildA2AAgentCard } = await Promise.resolve().then(() => __importStar(require("../../a2a/card")));
@@ -7132,6 +7155,10 @@ async function runOuroCli(args, deps = (0, cli_defaults_1.createDefaultOuroCliDe
         deps.writeStdout(message);
         return message;
     }
+    // ── a2a client commands (this machine talks to an agent as a verified friend; no agent, no daemon) ──
+    if (command.kind === "a2a.identity" || command.kind === "a2a.message") {
+        return executeA2AClientCommand(command, deps);
+    }
     // ── versions command (local install list + published update truth, no daemon socket needed) ──
     if (command.kind === "versions") {
         const versions = deps.listCliVersions?.() ?? [];

package/dist/heart/daemon/cli-parse.js

@@ -152,6 +152,8 @@ function usage() {
         "  ouro a2a card [--agent <name>] [--base-url <url>] [--json]",
         "  ouro a2a onboard [--agent <name>] --card-url <url> [--trust <level>] [--name <name>]",
         "  ouro a2a serve [--agent <name>] [--host <host>] [--port <port>] [--base-url <url>] [--path <path>]",
+        "  ouro a2a identity [--identity-file <path>] [--json]",
+        "  ouro a2a message --to <card-url> --text <text> [--context <id>] [--identity-file <path>] [--json]",
         "  ouro whoami [--agent <name>]",
         "  ouro session list [--agent <name>]",
         "  ouro mcp list",
@@ -1450,6 +1452,56 @@ function parseA2ACommand(args) {
         }
         return { kind: "a2a.card", ...(agent ? { agent } : {}), ...(baseUrl ? { baseUrl } : {}), ...(json ? { json: true } : {}) };
     }
+    if (sub === "identity") {
+        let identityFile;
+        let json = false;
+        for (let i = 0; i < rest.length; i += 1) {
+            if (rest[i] === "--identity-file" && rest[i + 1]) {
+                identityFile = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--json") {
+                json = true;
+                continue;
+            }
+            throw new Error("Usage: ouro a2a identity [--identity-file <path>] [--json]");
+        }
+        return { kind: "a2a.identity", ...(identityFile ? { identityFile } : {}), ...(json ? { json: true } : {}) };
+    }
+    if (sub === "message") {
+        const usageText = "Usage: ouro a2a message --to <card-url> --text <text> [--context <id>] [--identity-file <path>] [--json]";
+        let to;
+        let text;
+        let conversationId;
+        let identityFile;
+        let json = false;
+        for (let i = 0; i < rest.length; i += 1) {
+            if (rest[i] === "--to" && rest[i + 1]) {
+                to = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--text" && rest[i + 1]) {
+                text = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--context" && rest[i + 1]) {
+                conversationId = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--identity-file" && rest[i + 1]) {
+                identityFile = rest[++i];
+                continue;
+            }
+            if (rest[i] === "--json") {
+                json = true;
+                continue;
+            }
+            throw new Error(usageText);
+        }
+        if (!to || !text)
+            throw new Error(usageText);
+        return { kind: "a2a.message", to, text, ...(conversationId ? { conversationId } : {}), ...(identityFile ? { identityFile } : {}), ...(json ? { json: true } : {}) };
+    }
     if (sub === "onboard") {
         let cardUrl;
         let trustLevel;

package/dist/heart/daemon/sanctuary-authority-epoch.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readSanctuaryAuthorityEpoch = readSanctuaryAuthorityEpoch;
 exports.prepareSanctuaryAuthorityEpoch = prepareSanctuaryAuthorityEpoch;
 exports.releaseSanctuaryAuthorityToken = releaseSanctuaryAuthorityToken;
+exports.rebindSanctuaryAuthorityEpochPackage = rebindSanctuaryAuthorityEpochPackage;
 exports.retireSanctuaryAuthorityEpoch = retireSanctuaryAuthorityEpoch;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
@@ -238,6 +239,30 @@ function releaseSanctuaryAuthorityToken(root, options) {
         fs.unlinkSync(epoch.tokenPath);
     syncRoot(root);
 }
+/**
+ * Move a live epoch to a new reviewed package without replacing its token, issuer
+ * or cursor. An in-place upgrade (and its rollback) rebinds the package the epoch
+ * trusts; the gateway still refuses any config whose package differs from the epoch's.
+ */
+function rebindSanctuaryAuthorityEpochPackage(root, options) {
+    if (!DIGEST.test(options.from) || !DIGEST.test(options.to))
+        throw new Error("Sanctuary authority package rebind is invalid");
+    const epochPath = path.join(root, "epoch.json");
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        const epoch = readSanctuaryAuthorityEpoch(root, options);
+        if (epoch.state !== "prepared")
+            throw new Error("Sanctuary authority epoch is retired");
+        if (epoch.packageDigest === options.to)
+            return epoch;
+        if (epoch.packageDigest !== options.from)
+            throw new Error("Sanctuary authority epoch package changed");
+        const rebound = { ...epoch, packageDigest: options.to };
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, rebound, { lease, expectedRevision: transaction.revision });
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_epoch_package_rebound", message: "Sanctuary authority epoch rebound to a reviewed package", meta: { epochId: epoch.epochId, from: options.from, to: options.to } });
+        return rebound;
+    });
+}
 function retireSanctuaryAuthorityEpoch(root, options) {
     if (options.quiescent !== true)
         throw new Error("Sanctuary authority execution state is not quiescent");