@vaultysclaw/agent-runtime 0.0.1

package/src/config.ts

@@ -0,0 +1,13 @@
+import type { AgentCapability } from "@vaultysclaw/shared";
+
+export interface AgentRuntimeConfig {
+  name: string;
+  controlPlaneUrl: string;
+  controlPlaneWsUrl?: string;
+  peerjsControlPlaneId?: string;
+  peerjsServerUrl?: string;
+  peerjsServer?: string;
+  vaultysIdPath: string;
+  requestedCapabilities: AgentCapability[];
+  workspaceRoot?: string;
+}

package/src/index.ts

@@ -0,0 +1,8 @@
+export { BaseAgentRuntime } from "./base-agent.js";
+export type { AgentRuntimeConfig } from "./config.js";
+export type { AgentStatus, LogEntry, IntentEntry, AgentInfo } from "./base-agent.js";
+export { PeerManager, peerIdForDid } from "./peer-manager.js";
+export { verifyIntentMessage } from "./intent-verify.js";
+export type { IntentSigningBody } from "./intent-verify.js";
+export { verifyPeerGrant } from "./peer-grant-verify.js";
+export type { PeerGrantPayload } from "./peer-grant-verify.js";

package/src/intent-verify.ts

@@ -0,0 +1,72 @@
+/**
+ * Intent signature verification for the agent controller.
+ *
+ * Agents call verifyIntentMessage() on every incoming intent to confirm it was
+ * signed by the control plane they authenticated against.
+ *
+ * Wire format (identical to delegation certs produced by control-plane):
+ *   base64( 4-byte-LE-bodyLen | msgpack(body) | raw-signature )
+ *
+ * Body:
+ *   { type: "intent", id: string, action: string, agentId: string, timestamp: number }
+ */
+
+import { VaultysId, crypto } from "@vaultys/id";
+import { decode as msgpackDecode } from "@msgpack/msgpack";
+import type { WSMessage } from "@vaultysclaw/shared";
+
+const Buf = crypto.Buffer;
+
+export interface IntentSigningBody {
+  type: string;
+  id: string;
+  action: string;
+  agentId: string;
+  timestamp: number;
+}
+
+/**
+ * Verify a signed WSMessage of type "intent".
+ *
+ * @param message       The incoming WSMessage (must have `.signature`).
+ * @param serverPublicKey  Raw public key bytes from the Challenger auth cert (pk1).
+ * @returns `true` if the signature is valid and the body matches the envelope,
+ *          `false` otherwise.
+ */
+export function verifyIntentMessage(
+  message: WSMessage,
+  serverPublicKey: Buffer
+): boolean {
+  console.log("boom");
+  if (!message.signature) return false;
+
+  try {
+    const combined = Buf.from(message.signature, "base64");
+    if (combined.length < 5) return false;
+
+    const bodyLen = combined.readUInt32LE(0);
+    if (combined.length < 4 + bodyLen) return false;
+
+    const body = combined.subarray(4, 4 + bodyLen);
+    const sig = combined.subarray(4 + bodyLen);
+
+
+    const serverVid = VaultysId.fromId(serverPublicKey);
+    console.log("Verifying intent signature with server public key:", serverVid.did);
+    const valid = serverVid.verifyChallenge(
+      Buf.from(body),
+      Buf.from(sig),
+      false
+    );
+    if (!valid) return false;
+
+    const payload = msgpackDecode(body) as IntentSigningBody;
+    if (payload.type !== "intent") return false;
+    if (payload.id !== message.messageId) return false;
+    if (payload.agentId !== message.agentId) return false;
+
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/peer-grant-verify.ts

@@ -0,0 +1,58 @@
+/**
+ * Peer grant certificate verification for the agent controller.
+ *
+ * Mirrors the control-plane's peer-grant.ts but uses only the agent's
+ * available imports (no server-side dependencies).
+ */
+import { decode as msgpackDecode } from "@msgpack/msgpack";
+import { VaultysId, crypto } from "@vaultys/id";
+
+const Buffer = crypto.Buffer;
+
+export interface PeerGrantPayload {
+  type: "peer_grant";
+  sourceDid: string;
+  targetDid: string;
+  targetName: string;
+  skillDescription: string;
+  capabilities: string[];
+  issuedAt: number;
+  expiresAt?: number;
+}
+
+/**
+ * Verify a peer grant certificate using the server's raw public key bytes.
+ * Returns the decoded payload if valid and not expired, null otherwise.
+ */
+export async function verifyPeerGrant(
+  cert: string,
+  serverPublicKey: Buffer
+): Promise<PeerGrantPayload | null> {
+  try {
+    const combined = Buffer.from(cert, "base64");
+    if (combined.length < 5) return null;
+
+    const bodyLen = combined.readUInt32LE(0);
+    if (combined.length < 4 + bodyLen) return null;
+
+    const body = combined.subarray(4, 4 + bodyLen);
+    const signature = combined.subarray(4 + bodyLen);
+
+    const serverVid = VaultysId.fromId(serverPublicKey);
+    const valid = serverVid.verifyChallenge(
+      Buffer.from(body),
+      Buffer.from(signature),
+      false
+    );
+    if (!valid) return null;
+
+    const payload = msgpackDecode(body) as PeerGrantPayload;
+    if (payload.type !== "peer_grant") return null;
+
+    if (payload.expiresAt && payload.expiresAt < Date.now()) return null;
+
+    return payload;
+  } catch {
+    return null;
+  }
+}