@silicaclaw/cli 2026.3.20-2 → 2026.3.20-21

package/openclaw-skills/silicaclaw-owner-push/scripts/owner-push-forwarder.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -12,8 +12,11 @@ const OWNER_FORWARD_CMD = String(process.env.OPENCLAW_OWNER_FORWARD_CMD || "").t
 const STATE_PATH = resolve(
   String(process.env.OPENCLAW_OWNER_FORWARD_STATE_PATH || resolve(homedir(), ".openclaw", "workspace", "state", "silicaclaw-owner-push.json"))
 );
+const LOCK_PATH = `${STATE_PATH}.lock`;
+const LATEST_ONLY = String(process.env.OPENCLAW_FORWARD_LATEST_ONLY || "true").trim().toLowerCase() !== "false";
 const ONCE = process.argv.includes("--once");
 const VERBOSE = process.argv.includes("--verbose");
+let lockFd = null;
 
 function parseListEnv(name) {
   return String(process.env[name] || "")
@@ -61,14 +64,24 @@ function loadState() {
     return {
       seen_ids: [],
       pushed_at: {},
+      last_pushed_created_at: 0,
+      last_pushed_message_id: "",
     };
   }
   try {
-    return JSON.parse(readFileSync(STATE_PATH, "utf8"));
+    const parsed = JSON.parse(readFileSync(STATE_PATH, "utf8"));
+    return {
+      seen_ids: Array.isArray(parsed?.seen_ids) ? parsed.seen_ids : [],
+      pushed_at: parsed?.pushed_at && typeof parsed.pushed_at === "object" ? parsed.pushed_at : {},
+      last_pushed_created_at: Number(parsed?.last_pushed_created_at || 0) || 0,
+      last_pushed_message_id: String(parsed?.last_pushed_message_id || ""),
+    };
   } catch {
     return {
       seen_ids: [],
       pushed_at: {},
+      last_pushed_created_at: 0,
+      last_pushed_message_id: "",
     };
   }
 }
@@ -78,6 +91,85 @@ function saveState(state) {
   writeFileSync(STATE_PATH, JSON.stringify(state, null, 2), "utf8");
 }
 
+function isPidRunning(pid) {
+  if (!pid || !Number.isFinite(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function releaseLock() {
+  if (lockFd !== null) {
+    try {
+      closeSync(lockFd);
+    } catch {
+      // ignore
+    }
+    try {
+      rmSync(LOCK_PATH, { force: true });
+    } catch {
+      // ignore
+    }
+    lockFd = null;
+  }
+}
+
+function acquireLock() {
+  mkdirSync(dirname(LOCK_PATH), { recursive: true });
+  try {
+    lockFd = openSync(LOCK_PATH, "wx");
+    writeFileSync(lockFd, JSON.stringify({
+      pid: process.pid,
+      started_at: new Date().toISOString(),
+      state_path: STATE_PATH,
+    }, null, 2), "utf8");
+    process.on("exit", releaseLock);
+    process.on("SIGINT", () => {
+      releaseLock();
+      process.exit(130);
+    });
+    process.on("SIGTERM", () => {
+      releaseLock();
+      process.exit(143);
+    });
+    return;
+  } catch {
+    // fall through
+  }
+
+  try {
+    const existing = JSON.parse(readFileSync(LOCK_PATH, "utf8"));
+    const existingPid = Number(existing?.pid || 0) || 0;
+    if (isPidRunning(existingPid)) {
+      throw new Error(`owner push forwarder already running (pid=${existingPid})`);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("already running")) {
+      throw error;
+    }
+  }
+
+  rmSync(LOCK_PATH, { force: true });
+  lockFd = openSync(LOCK_PATH, "wx");
+  writeFileSync(lockFd, JSON.stringify({
+    pid: process.pid,
+    started_at: new Date().toISOString(),
+    state_path: STATE_PATH,
+  }, null, 2), "utf8");
+  process.on("exit", releaseLock);
+  process.on("SIGINT", () => {
+    releaseLock();
+    process.exit(130);
+  });
+  process.on("SIGTERM", () => {
+    releaseLock();
+    process.exit(143);
+  });
+}
+
 function trimState(state) {
   const recentIds = Array.isArray(state.seen_ids) ? state.seen_ids.slice(-500) : [];
   const pushedEntries = Object.entries(state.pushed_at || {}).slice(-500);
@@ -85,6 +177,22 @@ function trimState(state) {
   state.pushed_at = Object.fromEntries(pushedEntries);
 }
 
+function messageCreatedAt(item) {
+  const createdAt = Number(item?.created_at || 0);
+  return Number.isFinite(createdAt) && createdAt > 0 ? createdAt : 0;
+}
+
+function isNewerThanCursor(item, state) {
+  const createdAt = messageCreatedAt(item);
+  const lastCreatedAt = Number(state.last_pushed_created_at || 0) || 0;
+  const messageId = String(item?.message_id || "").trim();
+  const lastMessageId = String(state.last_pushed_message_id || "").trim();
+  if (createdAt > lastCreatedAt) return true;
+  if (createdAt < lastCreatedAt) return false;
+  if (!createdAt) return !state.seen_ids.includes(messageId);
+  return Boolean(messageId) && messageId !== lastMessageId && !state.seen_ids.includes(messageId);
+}
+
 function shouldWatchTopic(message) {
   if (!TOPIC_FILTERS.length) return true;
   return TOPIC_FILTERS.includes(String(message?.topic || "global").toLowerCase());
@@ -165,29 +273,60 @@ function dispatchToOwner(route, summary, message) {
 async function pollOnce(state) {
   const payload = await request(`/api/openclaw/bridge/messages?limit=${LIMIT}`);
   const items = Array.isArray(payload?.items) ? payload.items.slice().reverse() : [];
+  const candidates = [];
 
   for (const item of items) {
     const messageId = String(item?.message_id || "").trim();
     if (!messageId) continue;
-    if (state.seen_ids.includes(messageId)) continue;
-
-    state.seen_ids.push(messageId);
+    if (!isNewerThanCursor(item, state)) {
+      if (!state.seen_ids.includes(messageId)) {
+        state.seen_ids.push(messageId);
+      }
+      continue;
+    }
 
     if (!shouldWatchTopic(item)) {
+      state.seen_ids.push(messageId);
       if (VERBOSE) console.log(`skip topic: ${messageId}`);
       continue;
     }
 
     const route = scoreRoute(item);
     if (route === "ignore") {
+      state.seen_ids.push(messageId);
       if (VERBOSE) console.log(`ignore low-signal: ${messageId}`);
       continue;
     }
 
-    const summary = summarizeForOwner(item);
-    await dispatchToOwner(route, summary, item);
-    state.pushed_at[messageId] = new Date().toISOString();
-    if (VERBOSE) console.log(`pushed to owner: ${messageId}`);
+    candidates.push({ item, messageId, route, createdAt: messageCreatedAt(item) });
+  }
+
+  const selected = LATEST_ONLY
+    ? candidates.sort((left, right) => {
+        if (left.createdAt !== right.createdAt) return right.createdAt - left.createdAt;
+        return left.messageId.localeCompare(right.messageId);
+      })[0] || null
+    : null;
+
+  const toPush = LATEST_ONLY ? (selected ? [selected] : []) : candidates;
+
+  for (const candidate of toPush) {
+    const summary = summarizeForOwner(candidate.item);
+    await dispatchToOwner(candidate.route, summary, candidate.item);
+    state.pushed_at[candidate.messageId] = new Date().toISOString();
+    state.last_pushed_created_at = candidate.createdAt || Date.now();
+    state.last_pushed_message_id = candidate.messageId;
+    if (VERBOSE) console.log(`pushed to owner: ${candidate.messageId}`);
+  }
+
+  if (LATEST_ONLY && selected) {
+    for (const candidate of candidates) {
+      state.seen_ids.push(candidate.messageId);
+    }
+  } else {
+    for (const candidate of candidates) {
+      state.seen_ids.push(candidate.messageId);
+    }
   }
 
   trimState(state);
@@ -195,10 +334,13 @@ async function pollOnce(state) {
 }
 
 async function main() {
+  acquireLock();
   const state = loadState();
   if (VERBOSE) {
     console.log(`SilicaClaw owner push watching ${API_BASE}`);
     console.log(`State file: ${STATE_PATH}`);
+    console.log(`Lock file: ${LOCK_PATH}`);
+    console.log(`Latest-only mode: ${LATEST_ONLY ? "on" : "off"}`);
   }
 
   do {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@silicaclaw/cli",
-  "version": "2026.3.20-2",
+  "version": "2026.3.20-21",
   "private": false,
   "publishConfig": {
     "access": "public"

package/packages/core/dist/packages/core/src/index.d.ts

@@ -4,6 +4,8 @@ export * from "./identity";
 export * from "./profile";
 export * from "./presence";
 export * from "./socialMessage";
+export * from "./privateCrypto";
+export * from "./privateMessage";
 export * from "./indexing";
 export * from "./directory";
 export * from "./publicProfileSummary";

package/packages/core/dist/packages/core/src/index.js

@@ -20,6 +20,8 @@ __exportStar(require("./identity"), exports);
 __exportStar(require("./profile"), exports);
 __exportStar(require("./presence"), exports);
 __exportStar(require("./socialMessage"), exports);
+__exportStar(require("./privateCrypto"), exports);
+__exportStar(require("./privateMessage"), exports);
 __exportStar(require("./indexing"), exports);
 __exportStar(require("./directory"), exports);
 __exportStar(require("./publicProfileSummary"), exports);

package/packages/core/dist/packages/core/src/privateCrypto.d.ts

@@ -0,0 +1,17 @@
+import { PrivateEncryptionKeyPair } from "./types";
+export declare function createPrivateEncryptionKeyPair(now?: number): PrivateEncryptionKeyPair;
+export declare function encryptPrivatePayload(input: {
+    plaintext: string;
+    recipient_public_key: string;
+    sender_keypair?: PrivateEncryptionKeyPair | null;
+}): {
+    ciphertext: string;
+    nonce: string;
+    sender_encryption_public_key: string;
+};
+export declare function decryptPrivatePayload(input: {
+    ciphertext: string;
+    nonce: string;
+    sender_encryption_public_key: string;
+    recipient_private_key: string;
+}): string | null;

package/packages/core/dist/packages/core/src/privateCrypto.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPrivateEncryptionKeyPair = createPrivateEncryptionKeyPair;
+exports.encryptPrivatePayload = encryptPrivatePayload;
+exports.decryptPrivatePayload = decryptPrivatePayload;
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const crypto_1 = require("./crypto");
+function createPrivateEncryptionKeyPair(now = Date.now()) {
+    const pair = tweetnacl_1.default.box.keyPair();
+    return {
+        public_key: (0, crypto_1.toBase64)(pair.publicKey),
+        private_key: (0, crypto_1.toBase64)(pair.secretKey),
+        created_at: now,
+    };
+}
+function encryptPrivatePayload(input) {
+    const sender = input.sender_keypair || createPrivateEncryptionKeyPair();
+    const nonce = tweetnacl_1.default.randomBytes(tweetnacl_1.default.box.nonceLength);
+    const message = Buffer.from(String(input.plaintext || ""), "utf8");
+    const ciphertext = tweetnacl_1.default.box(new Uint8Array(message), nonce, (0, crypto_1.fromBase64)(input.recipient_public_key), (0, crypto_1.fromBase64)(sender.private_key));
+    return {
+        ciphertext: (0, crypto_1.toBase64)(ciphertext),
+        nonce: (0, crypto_1.toBase64)(nonce),
+        sender_encryption_public_key: sender.public_key,
+    };
+}
+function decryptPrivatePayload(input) {
+    try {
+        const opened = tweetnacl_1.default.box.open((0, crypto_1.fromBase64)(input.ciphertext), (0, crypto_1.fromBase64)(input.nonce), (0, crypto_1.fromBase64)(input.sender_encryption_public_key), (0, crypto_1.fromBase64)(input.recipient_private_key));
+        if (!opened)
+            return null;
+        return Buffer.from(opened).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}

package/packages/core/dist/packages/core/src/privateMessage.d.ts

@@ -0,0 +1,23 @@
+import { AgentIdentity, PrivateMessageReceiptRecord, PrivateMessageRecord } from "./types";
+export declare function signPrivateMessage(input: {
+    identity: AgentIdentity;
+    message_id: string;
+    conversation_id: string;
+    to_agent_id: string;
+    sender_encryption_public_key: string;
+    recipient_encryption_public_key: string;
+    ciphertext: string;
+    nonce: string;
+    created_at?: number;
+}): PrivateMessageRecord;
+export declare function verifyPrivateMessage(record: PrivateMessageRecord): boolean;
+export declare function signPrivateMessageReceipt(input: {
+    identity: AgentIdentity;
+    receipt_id: string;
+    message_id: string;
+    conversation_id: string;
+    to_agent_id: string;
+    status: "received" | "read";
+    created_at?: number;
+}): PrivateMessageReceiptRecord;
+export declare function verifyPrivateMessageReceipt(record: PrivateMessageReceiptRecord): boolean;

package/packages/core/dist/packages/core/src/privateMessage.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signPrivateMessage = signPrivateMessage;
+exports.verifyPrivateMessage = verifyPrivateMessage;
+exports.signPrivateMessageReceipt = signPrivateMessageReceipt;
+exports.verifyPrivateMessageReceipt = verifyPrivateMessageReceipt;
+const crypto_1 = require("./crypto");
+function unsignedPrivateMessage(record) {
+    const { signature: _signature, ...rest } = record;
+    return rest;
+}
+function unsignedPrivateMessageReceipt(record) {
+    const { signature: _signature, ...rest } = record;
+    return rest;
+}
+function signPrivateMessage(input) {
+    const payload = {
+        type: "private.message",
+        message_id: input.message_id,
+        conversation_id: input.conversation_id,
+        from_agent_id: input.identity.agent_id,
+        to_agent_id: input.to_agent_id,
+        sender_public_key: input.identity.public_key,
+        sender_encryption_public_key: input.sender_encryption_public_key,
+        recipient_encryption_public_key: input.recipient_encryption_public_key,
+        cipher_scheme: "nacl-box-v1",
+        ciphertext: input.ciphertext,
+        nonce: input.nonce,
+        created_at: input.created_at ?? Date.now(),
+    };
+    return {
+        ...payload,
+        signature: (0, crypto_1.signPayload)(payload, input.identity.private_key),
+    };
+}
+function verifyPrivateMessage(record) {
+    try {
+        if ((0, crypto_1.hashPublicKey)((0, crypto_1.fromBase64)(record.sender_public_key)) !== record.from_agent_id) {
+            return false;
+        }
+        return (0, crypto_1.verifyPayload)(unsignedPrivateMessage(record), record.signature, record.sender_public_key);
+    }
+    catch {
+        return false;
+    }
+}
+function signPrivateMessageReceipt(input) {
+    const payload = {
+        type: "private.message.receipt",
+        receipt_id: input.receipt_id,
+        message_id: input.message_id,
+        conversation_id: input.conversation_id,
+        from_agent_id: input.identity.agent_id,
+        to_agent_id: input.to_agent_id,
+        sender_public_key: input.identity.public_key,
+        status: input.status,
+        created_at: input.created_at ?? Date.now(),
+    };
+    return {
+        ...payload,
+        signature: (0, crypto_1.signPayload)(payload, input.identity.private_key),
+    };
+}
+function verifyPrivateMessageReceipt(record) {
+    try {
+        if ((0, crypto_1.hashPublicKey)((0, crypto_1.fromBase64)(record.sender_public_key)) !== record.from_agent_id) {
+            return false;
+        }
+        return (0, crypto_1.verifyPayload)(unsignedPrivateMessageReceipt(record), record.signature, record.sender_public_key);
+    }
+    catch {
+        return false;
+    }
+}

package/packages/core/dist/packages/core/src/profile.js

@@ -15,6 +15,7 @@ function signProfile(input, identity) {
         bio: input.bio,
         tags: input.tags,
         avatar_url: input.avatar_url,
+        private_encryption_public_key: input.private_encryption_public_key,
         public_enabled: input.public_enabled,
         updated_at: Date.now(),
     };
@@ -34,6 +35,7 @@ function createDefaultProfileInput(agentId) {
         bio: "",
         tags: [],
         avatar_url: "",
+        private_encryption_public_key: "",
         public_enabled: false,
     };
 }

package/packages/core/dist/packages/core/src/publicProfileSummary.d.ts

@@ -7,9 +7,11 @@ export type ProfileVisibility = {
 };
 export type PublicProfileSummary = {
     agent_id: string;
+    is_self: boolean;
     display_name: string;
     bio: string;
     avatar_url?: string;
+    private_encryption_public_key?: string;
     public_enabled: boolean;
     updated_at: number;
     online: boolean;
@@ -30,6 +32,7 @@ export type PublicProfileSummary = {
         display_name: string;
         bio: string;
         avatar_url?: string;
+        private_encryption_public_key?: string;
         tags: string[];
         public_enabled: boolean;
         profile_version: string;
@@ -57,6 +60,7 @@ export type PublicProfileSummary = {
 export declare function deriveCapabilitiesSummary(tags: string[]): string[];
 export declare function buildPublicProfileSummary(args: {
     profile: PublicProfile;
+    is_self?: boolean;
     online: boolean;
     last_seen_at: number | null;
     network_mode?: string;

package/packages/core/dist/packages/core/src/publicProfileSummary.js

@@ -53,9 +53,11 @@ function buildPublicProfileSummary(args) {
     ].filter((field) => Boolean(field));
     return {
         agent_id: args.profile.agent_id,
+        is_self: Boolean(args.is_self),
         display_name: args.profile.display_name,
         bio: args.profile.bio,
         avatar_url: args.profile.avatar_url,
+        private_encryption_public_key: args.profile.private_encryption_public_key,
         public_enabled: args.profile.public_enabled,
         updated_at: args.profile.updated_at,
         online: args.online,
@@ -76,6 +78,7 @@ function buildPublicProfileSummary(args) {
             display_name: args.profile.display_name,
             bio: args.profile.bio,
             avatar_url: args.profile.avatar_url,
+            private_encryption_public_key: args.profile.private_encryption_public_key,
             tags,
             public_enabled: args.profile.public_enabled,
             profile_version: args.profile_version ?? "v1",

package/packages/core/dist/packages/core/src/types.d.ts

@@ -4,12 +4,18 @@ export type AgentIdentity = {
     private_key: string;
     created_at: number;
 };
+export type PrivateEncryptionKeyPair = {
+    public_key: string;
+    private_key: string;
+    created_at: number;
+};
 export type PublicProfile = {
     agent_id: string;
     display_name: string;
     bio: string;
     tags: string[];
     avatar_url?: string;
+    private_encryption_public_key?: string;
     public_enabled: boolean;
     updated_at: number;
     signature: string;
@@ -51,6 +57,40 @@ export type SocialMessageObservationRecord = {
     observed_at: number;
     signature: string;
 };
+export type PrivateMessageRecord = {
+    type: "private.message";
+    message_id: string;
+    conversation_id: string;
+    from_agent_id: string;
+    to_agent_id: string;
+    sender_public_key: string;
+    sender_encryption_public_key: string;
+    recipient_encryption_public_key: string;
+    cipher_scheme: "nacl-box-v1";
+    ciphertext: string;
+    nonce: string;
+    created_at: number;
+    signature: string;
+};
+export type PrivateMessageReceiptRecord = {
+    type: "private.message.receipt";
+    receipt_id: string;
+    message_id: string;
+    conversation_id: string;
+    from_agent_id: string;
+    to_agent_id: string;
+    sender_public_key: string;
+    status: "received" | "read";
+    created_at: number;
+    signature: string;
+};
+export type PrivateConversationSummary = {
+    conversation_id: string;
+    peer_agent_id: string;
+    last_message_at: number | null;
+    last_message_preview: string;
+    unread_count: number;
+};
 export type DirectoryState = {
     profiles: Record<string, PublicProfile>;
     presence: Record<string, number>;

package/packages/core/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@silicaclaw/core",
   "version": "0.1.0",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "dist/packages/core/src/index.js",
+  "types": "dist/packages/core/src/index.d.ts",
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "check": "tsc -p tsconfig.json --noEmit"

package/packages/core/src/index.ts

@@ -4,6 +4,8 @@ export * from "./identity";
 export * from "./profile";
 export * from "./presence";
 export * from "./socialMessage";
+export * from "./privateCrypto";
+export * from "./privateMessage";
 export * from "./indexing";
 export * from "./directory";
 export * from "./publicProfileSummary";

package/packages/core/src/privateCrypto.ts

@@ -0,0 +1,57 @@
+import nacl from "tweetnacl";
+import { fromBase64, toBase64 } from "./crypto";
+import { PrivateEncryptionKeyPair } from "./types";
+
+export function createPrivateEncryptionKeyPair(now = Date.now()): PrivateEncryptionKeyPair {
+  const pair = nacl.box.keyPair();
+  return {
+    public_key: toBase64(pair.publicKey),
+    private_key: toBase64(pair.secretKey),
+    created_at: now,
+  };
+}
+
+export function encryptPrivatePayload(input: {
+  plaintext: string;
+  recipient_public_key: string;
+  sender_keypair?: PrivateEncryptionKeyPair | null;
+}): {
+  ciphertext: string;
+  nonce: string;
+  sender_encryption_public_key: string;
+} {
+  const sender = input.sender_keypair || createPrivateEncryptionKeyPair();
+  const nonce = nacl.randomBytes(nacl.box.nonceLength);
+  const message = Buffer.from(String(input.plaintext || ""), "utf8");
+  const ciphertext = nacl.box(
+    new Uint8Array(message),
+    nonce,
+    fromBase64(input.recipient_public_key),
+    fromBase64(sender.private_key),
+  );
+  return {
+    ciphertext: toBase64(ciphertext),
+    nonce: toBase64(nonce),
+    sender_encryption_public_key: sender.public_key,
+  };
+}
+
+export function decryptPrivatePayload(input: {
+  ciphertext: string;
+  nonce: string;
+  sender_encryption_public_key: string;
+  recipient_private_key: string;
+}): string | null {
+  try {
+    const opened = nacl.box.open(
+      fromBase64(input.ciphertext),
+      fromBase64(input.nonce),
+      fromBase64(input.sender_encryption_public_key),
+      fromBase64(input.recipient_private_key),
+    );
+    if (!opened) return null;
+    return Buffer.from(opened).toString("utf8");
+  } catch {
+    return null;
+  }
+}