@wacando/agent 2.0.0-rc.1 → 2.0.2

package/docs/evidence/issue-7/check.txt

@@ -1,381 +0,0 @@
-$ node --version && npm --version
-v22.22.0
-11.11.1
-$ npm ci
-
-added 83 packages in 2s
-$ npm run check
-
-> wacando-agent@2.0.0 check
-> node scripts/check-deps.mjs && npm run check:notices && npm test
-
-Verified 3 pinned Wacando archives from https://github.com/lbframe/wacando @ 5f0f0a1f0ccc20c47383fed6f8e072aca5302486
-
-> wacando-agent@2.0.0 check:notices
-> node scripts/notices.mjs --check
-
-Verified notices and provenance for 83 runtime packages
-
-> wacando-agent@2.0.0 test
-> node --test tests/*.test.mjs
-
-TAP version 13
-# Subtest: cursor checker requires an affirmative parsed payload even when the wrapper says success
-ok 1 - cursor checker requires an affirmative parsed payload even when the wrapper says success
-  ---
-  duration_ms: 2.65577
-  type: 'test'
-  ...
-# Subtest: cursor checker distinguishes clear revocation from a crash, lock error or false connection
-ok 2 - cursor checker distinguishes clear revocation from a crash, lock error or false connection
-  ---
-  duration_ms: 1.34947
-  type: 'test'
-  ...
-# Subtest: codex checker requires an affirmative parsed payload even when the wrapper says success
-ok 3 - codex checker requires an affirmative parsed payload even when the wrapper says success
-  ---
-  duration_ms: 0.494954
-  type: 'test'
-  ...
-# Subtest: codex checker distinguishes clear revocation from a crash, lock error or false connection
-ok 4 - codex checker distinguishes clear revocation from a crash, lock error or false connection
-  ---
-  duration_ms: 0.416783
-  type: 'test'
-  ...
-# Subtest: checker requires verified:true for installation readiness
-ok 5 - checker requires verified:true for installation readiness
-  ---
-  duration_ms: 0.401913
-  type: 'test'
-  ...
-# Subtest: malformed viewer request targets return 400 without losing MCP events
-ok 6 - malformed viewer request targets return 400 without losing MCP events
-  ---
-  duration_ms: 87.176164
-  type: 'test'
-  ...
-# Subtest: MCP shutdown on EOF closes SSE and unfinished HTTP headers
-ok 7 - MCP shutdown on EOF closes SSE and unfinished HTTP headers
-  ---
-  duration_ms: 2048.494643
-  type: 'test'
-  ...
-# Subtest: MCP shutdown on SIGTERM closes SSE and unfinished HTTP headers
-ok 8 - MCP shutdown on SIGTERM closes SSE and unfinished HTTP headers
-  ---
-  duration_ms: 348.349795
-  type: 'test'
-  ...
-# Subtest: HTTP and SSE snapshots use bounded pages and preserve large Unicode events
-ok 9 - HTTP and SSE snapshots use bounded pages and preserve large Unicode events
-  ---
-  duration_ms: 292.115179
-  type: 'test'
-  ...
-# Subtest: SSE client and queue limits isolate slow readers
-ok 10 - SSE client and queue limits isolate slow readers
-  ---
-  duration_ms: 69.699795
-  type: 'test'
-  ...
-# Subtest: legacy negotiation requires valid initialization and the initialized notification
-ok 11 - legacy negotiation requires valid initialization and the initialized notification
-  ---
-  duration_ms: 65.860727
-  type: 'test'
-  ...
-# Subtest: JSON-RPC rejects invalid IDs and parameters without answering responses or notifications
-ok 12 - JSON-RPC rejects invalid IDs and parameters without answering responses or notifications
-  ---
-  duration_ms: 79.676029
-  type: 'test'
-  ...
-# Subtest: tools enforce schemas, preserve Unicode limits, and never claim observed visibility
-ok 13 - tools enforce schemas, preserve Unicode limits, and never claim observed visibility
-  ---
-  duration_ms: 65.199482
-  type: 'test'
-  ...
-# Subtest: event pages obey encoded byte limits and traverse without losing filtered records
-ok 14 - event pages obey encoded byte limits and traverse without losing filtered records
-  ---
-  duration_ms: 12.039959
-  type: 'test'
-  ...
-# Subtest: retention is bounded by bytes as well as event count and reports eviction
-ok 15 - retention is bounded by bytes as well as event count and reports eviction
-  ---
-  duration_ms: 1.856943
-  type: 'test'
-  ...
-# Subtest: stdio framing handles split UTF-8, CRLF and escaped newlines with strict byte bounds
-ok 16 - stdio framing handles split UTF-8, CRLF and escaped newlines with strict byte bounds
-  ---
-  duration_ms: 2.605379
-  type: 'test'
-  ...
-# Subtest: an oversized unfinished frame closes the MCP process promptly
-ok 17 - an oversized unfinished frame closes the MCP process promptly
-  ---
-  duration_ms: 1679.419605
-  type: 'test'
-  ...
-# Subtest: SIGTERM exits within a deadline even when the host stops reading stdout
-ok 18 - SIGTERM exits within a deadline even when the host stops reading stdout
-  ---
-  duration_ms: 1134.679158
-  type: 'test'
-  ...
-# Subtest: stdio writes wait for readers and reject stalled or oversized output
-ok 19 - stdio writes wait for readers and reject stalled or oversized output
-  ---
-  duration_ms: 1008.765007
-  type: 'test'
-  ...
-# Subtest: rate limiting admits bursts, rejects excess calls and refills over time
-ok 20 - rate limiting admits bursts, rejects excess calls and refills over time
-  ---
-  duration_ms: 0.406953
-  type: 'test'
-  ...
-# Subtest: MCP tool floods receive actionable rate-limit errors
-ok 21 - MCP tool floods receive actionable rate-limit errors
-  ---
-  duration_ms: 126.460675
-  type: 'test'
-  ...
-# Subtest: live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 22 - live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
-  ---
-  duration_ms: 0.681815
-  type: 'test'
-  ...
-# Subtest: live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 23 - live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
-  ---
-  duration_ms: 0.101911
-  type: 'test'
-  ...
-# Subtest: live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 24 - live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
-  ---
-  duration_ms: 0.09195
-  type: 'test'
-  ...
-# cursor: delayed shutdown released session lock; OMEMO snapshot unchanged
-# Subtest: cursor shutdown waits for session cleanup and releases its own lock without changing keys
-ok 25 - cursor shutdown waits for session cleanup and releases its own lock without changing keys
-  ---
-  duration_ms: 1275.467369
-  type: 'test'
-  ...
-# codex: delayed shutdown released session lock; OMEMO snapshot unchanged
-# Subtest: codex shutdown waits for session cleanup and releases its own lock without changing keys
-ok 26 - codex shutdown waits for session cleanup and releases its own lock without changing keys
-  ---
-  duration_ms: 1351.612221
-  type: 'test'
-  ...
-# Subtest: MCP shutdown finishes saving an in-flight verification response before exiting
-ok 27 - MCP shutdown finishes saving an in-flight verification response before exiting
-  ---
-  duration_ms: 1953.411831
-  type: 'test'
-  ...
-# Subtest: enrollment saves durable credential before XMPP, publishes before callback, and resumes without redemption
-ok 28 - enrollment saves durable credential before XMPP, publishes before callback, and resumes without redemption
-  ---
-  duration_ms: 1403.838277
-  type: 'test'
-  ...
-# Subtest: origins, host identities and installations cannot be substituted
-ok 29 - origins, host identities and installations cannot be substituted
-  ---
-  duration_ms: 169.675815
-  type: 'test'
-  ...
-# Subtest: expiration, replay, wrong installation and revocation return safe actions
-ok 30 - expiration, replay, wrong installation and revocation return safe actions
-  ---
-  duration_ms: 154.704354
-  type: 'test'
-  ...
-# Subtest: background heartbeats preserve the stream and retry outages with bounded backoff and safe diagnostics
-ok 31 - background heartbeats preserve the stream and retry outages with bounded backoff and safe diagnostics
-  ---
-  duration_ms: 206.266035
-  type: 'test'
-  ...
-# Subtest: failed initial connection recovers in background without another redemption and close cancels retries
-ok 32 - failed initial connection recovers in background without another redemption and close cancels retries
-  ---
-  duration_ms: 61.715907
-  type: 'test'
-  ...
-# Subtest: failed XMPP ping closes only the broken stream and obtains a fresh grant on automatic retry
-ok 33 - failed XMPP ping closes only the broken stream and obtains a fresh grant on automatic retry
-  ---
-  duration_ms: 120.923834
-  type: 'test'
-  ...
-# Subtest: shutdown waits for a background grant request and prevents a new session after closing
-ok 34 - shutdown waits for a background grant request and prevents a new session after closing
-  ---
-  duration_ms: 253.289892
-  type: 'test'
-  ...
-# Subtest: failed OMEMO registration preserves credential, suppresses connected callback, and resumes
-ok 35 - failed OMEMO registration preserves credential, suppresses connected callback, and resumes
-  ---
-  duration_ms: 1119.517586
-  type: 'test'
-  ...
-# Subtest: lost redemption and failed persistence never claim success
-ok 36 - lost redemption and failed persistence never claim success
-  ---
-  duration_ms: 77.407802
-  type: 'test'
-  ...
-# Subtest: unsafe permissions, symlinks and concurrent writes fail closed
-ok 37 - unsafe permissions, symlinks and concurrent writes fail closed
-  ---
-  duration_ms: 3.062512
-  type: 'test'
-  ...
-# Subtest: HTTP policy rejects non-loopback cleartext, URL credentials and redirects
-ok 38 - HTTP policy rejects non-loopback cleartext, URL credentials and redirects
-  ---
-  duration_ms: 20.389721
-  type: 'test'
-  ...
-# Subtest: existing native OMEMO identity survives reload; corrupt state is never regenerated
-ok 39 - existing native OMEMO identity survives reload; corrupt state is never regenerated
-  ---
-  duration_ms: 41.758989
-  type: 'test'
-  ...
-# Subtest: unsafe native OMEMO state permissions fail closed
-ok 40 - unsafe native OMEMO state permissions fail closed
-  ---
-  duration_ms: 4.823516
-  type: 'test'
-  ...
-# Subtest: a 1.x classic OMEMO identity is refused with re-enrollment guidance and left untouched
-ok 41 - a 1.x classic OMEMO identity is refused with re-enrollment guidance and left untouched
-  ---
-  duration_ms: 0.975417
-  type: 'test'
-  ...
-# Subtest: installed MCP tools verify via HTTP and never expose response credentials
-ok 42 - installed MCP tools verify via HTTP and never expose response credentials
-  ---
-  duration_ms: 216.128158
-  type: 'test'
-  ...
-# Subtest: cursor packaged MCP rejects a locally revoked identity without crashing or reporting connection
-ok 43 - cursor packaged MCP rejects a locally revoked identity without crashing or reporting connection
-  ---
-  duration_ms: 785.252075
-  type: 'test'
-  ...
-# Subtest: codex packaged MCP rejects a locally revoked identity without crashing or reporting connection
-ok 44 - codex packaged MCP rejects a locally revoked identity without crashing or reporting connection
-  ---
-  duration_ms: 140.427218
-  type: 'test'
-  ...
-# Subtest: release version matches all manifests
-ok 45 - release version matches all manifests
-  ---
-  duration_ms: 5.264819
-  type: 'test'
-  ...
-# Subtest: npm tarball installs the runtime with official libsignal and its thin plugins start it
-ok 46 - npm tarball installs the runtime with official libsignal and its thin plugins start it
-  ---
-  duration_ms: 7229.1955
-  type: 'test'
-  ...
-# Subtest: codex plugin is a thin wrapper that starts this runtime and records its own provider
-ok 47 - codex plugin is a thin wrapper that starts this runtime and records its own provider
-  ---
-  duration_ms: 1548.057324
-  type: 'test'
-  ...
-# Subtest: cursor plugin is a thin wrapper that starts this runtime and records its own provider
-ok 48 - cursor plugin is a thin wrapper that starts this runtime and records its own provider
-  ---
-  duration_ms: 267.536468
-  type: 'test'
-  ...
-# Subtest: claude plugin is a thin wrapper that starts this runtime and records its own provider
-ok 49 - claude plugin is a thin wrapper that starts this runtime and records its own provider
-  ---
-  duration_ms: 189.33055
-  type: 'test'
-  ...
-# Subtest: Claude, Cursor and Codex MCP processes have independent stores and ports
-ok 50 - Claude, Cursor and Codex MCP processes have independent stores and ports
-  ---
-  duration_ms: 69.973938
-  type: 'test'
-  ...
-# Subtest: installer refuses to overwrite an existing installation
-ok 51 - installer refuses to overwrite an existing installation
-  ---
-  duration_ms: 85.632553
-  type: 'test'
-  ...
-# Subtest: store validates messages, orders events and bounds retention
-ok 52 - store validates messages, orders events and bounds retention
-  ---
-  duration_ms: 2.68943
-  type: 'test'
-  ...
-# Subtest: loopback viewer serves assets and blocks cross-origin writes and traversal
-ok 53 - loopback viewer serves assets and blocks cross-origin writes and traversal
-  ---
-  duration_ms: 46.340583
-  type: 'test'
-  ...
-# Subtest: SSE delivers snapshot and live message, reconnect recovers snapshot
-ok 54 - SSE delivers snapshot and live message, reconnect recovers snapshot
-  ---
-  duration_ms: 261.199481
-  type: 'test'
-  ...
-# Subtest: MCP starts HTTP, records events and shuts down on stdin EOF
-ok 55 - MCP starts HTTP, records events and shuts down on stdin EOF
-  ---
-  duration_ms: 62.176779
-  type: 'test'
-  ...
-# Subtest: late history pages cannot duplicate live events, resurrect evictions or replace a new connection
-ok 56 - late history pages cannot duplicate live events, resurrect evictions or replace a new connection
-  ---
-  duration_ms: 1.774133
-  type: 'test'
-  ...
-# Subtest: history loading pins the snapshot sequence, follows cursors and respects cancellation
-ok 57 - history loading pins the snapshot sequence, follows cursors and respects cancellation
-  ---
-  duration_ms: 1.020178
-  type: 'test'
-  ...
-# Subtest: rate-limited history loading resumes from the same page instead of restarting the stream
-ok 58 - rate-limited history loading resumes from the same page instead of restarting the stream
-  ---
-  duration_ms: 1001.920706
-  type: 'test'
-  ...
-1..58
-# tests 58
-# suites 0
-# pass 55
-# fail 0
-# cancelled 0
-# skipped 3
-# todo 0
-# duration_ms 7297.569426

package/docs/evidence/issue-7/live.txt

@@ -1,23 +0,0 @@
-$ WACANDO_LIVE_TEST_ORIGIN=http://localhost:43001 node --test tests/onboarding-live.test.mjs
-# Subtest: live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 1 - live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-# Subtest: live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 2 - live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-# Subtest: live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-ok 3 - live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
-# tests 3
-# suites 0
-# pass 3
-# fail 0
-# cancelled 0
-# skipped 0
-# todo 0
-# duration_ms 4115.907774
-$ WACANDO_LIVE_TEST_ORIGIN=http://localhost:43001 node scripts/check-daemon-live.mjs
-enrolled @daemon_962d3aa864c8/bot for host "cli" (synthetic owner)
-status: [{"agentId":"agt_354244b5-6fee-449d-9243-5f946f3c89a1","handle":"@daemon_962d3aa864c8/bot","origin":"http://localhost:43001","mode":"human","revoked":false,"connection":"disconnected"}]
-daemon: connected (grant, native OMEMO publication, presence echo, API callback) and running
-second daemon on the same identity: refused by the identity lock
-daemon: SIGTERM -> clean exit 0, lock released
-daemon restarted on the same saved identity and keys: connected again
-exit=0

package/docs/evidence/issue-8/README.md

@@ -1,56 +0,0 @@
-# lbframe/wacando-agent#8, #3, #4 — pairing and consent-aware conversations
-
-Branch `feat/8-pairing-consent` (on top of `feat/7-generic-runtime`, PR #11).
-Linux x64, Node.js 22.22.0, npm 10.9.4.
-
-## Real local stack (nothing mocked)
-
-- Postgres container `wacando-issue10-postgres` (127.0.0.1:15432), own database
-  `wacando_agentside`, migrations from lbframe/wacando main (`drizzle-kit migrate`).
-- ejabberd `ejabberd/ecs:26.07`, own container `wacando-agentside-ejabberd`
-  (127.0.0.1:45222/45280/45347), configured with lbframe/wacando
-  `infra/ejabberd/ci-up.sh`: CI config + compiled `mod_wacando_guard` (#102).
-- API (:43001) and policy component (:43002) from lbframe/wacando main
-  `50b9d26` (includes #60 pairing, #98 consent, #102 guard), `tsx src/index.ts`;
-  then a second stack: main `f21f742` + #108 + #109 (fresh DB `wacando_agentside_int`).
-- Desktop observer: `apps/desktop/src/main/observer-hub.ts` (main-process,
-  official `@signalapp/libsignal-client`), one hub per owner.
-
-## Results
-
-| File | What | Result |
-|---|---|---|
-| `check.txt` | `npm run check` | deps + notices verified; 73 tests: 70 pass, 0 fail, 3 opt-in live skipped. Also: recipient discovery validation (fail closed), a replaced session never reconnects. New: pairing proofs equal the API's RFC 8032 interoperability vectors byte for byte; key saved before redeem; refusal/expiry leave no file; resume after interruption; 5 s polling + Retry-After; recipient set, accepted-only views, content-free refusals |
-| `check-mcp.txt` | `npm run check:mcp` | official MCP Inspector 2.7.0: 13 tools, 3 hosts |
-| `e2e-desktop-observer.txt` | `scripts/e2e-desktop-observer.mts` with the desktop fix lbframe/wacando#109 | **18/18 PASS** (below) |
-| `e2e-desktop-observer-main-without-109.txt` | same run with main's desktop hub | steps 1–14 pass, then the owners' desktop shows the 2 relayed messages as undecryptable: the gap fixed by lbframe/wacando#109 |
-| `live-regression.txt` | live onboarding (3 hosts) + CLI daemon qualification | 3/3 pass; daemon connected, lock refusal, SIGTERM exit 0, restart |
-| `e2e-desktop-observer-human-devices.txt` | same E2E on lbframe/wacando main `f21f742` (+#105, #106 one session per agent) with PR #108 (per-installation human devices) and #109 merged locally; ejabberd reconfigured from that tree | **18/18 PASS**: each owner's desktop enrolls a `dev_…` installation (password re-auth, device-bound grant, activation after bundle publication); the runtime discovers recipients before every send and both `dev_` observers decrypt all 3 messages |
-| `live-regression-human-devices.txt` | live onboarding + daemon on that stack | 3/3 pass; daemon pass |
-
-E2E steps (`e2e-desktop-observer.txt`):
-1. two owners; 2. CLI `wacando-agent pair` (service bot), owner confirms after
-seeing the key fingerprint; 3. MCP `wacando_pair` (human, Codex host), resumed by
-a second call; 4. contact accepted; 5. both runtimes connected through the SDK
-(native OMEMO device, presence echo); 6. `propose` creates the request and
-refuses the first message fail-closed while the owners have no device;
-7. recipient agent sees nothing before acceptance; 8. both owners' desktop hubs
-publish devices and observe; 9. first message **held**, status visible to the
-agent; 10. owner A recomputes the digest locally from the held ciphertext and
-approves; 11. owner B sees it in the consent inbox and accepts; 12. recipient
-(human, member) decrypts the first message from MAM; 13. human reply sent
-freely, service agent decrypts it from a policy delivery; 14. service message
-held, nothing reaches the recipient before approval, then delivered;
-15–16. **both owners' desktop ObserverHubs decrypt all 3 messages**; 17. STOP:
-both agents refused; 18. canary absent from ejabberd storage (MAM, offline,
-pubsub, logs), API/policy logs and runtime CLI/MCP output.
-
-## Not tested
-
-- Real Codex/Cursor/Claude hosts driving the MCP tools (the MCP process is
-  driven over stdio by the test); macOS/Windows.
-- A `service`-mode recipient (it cannot receive the first message by design of
-  the server, documented in `docs/AGENT_TOOLS.md`).
-- Direct 1:1 refusal by the guard (covered in lbframe/wacando #102); the runtime
-  never sends `chat` stanzas and ignores incoming ones.
-- Pairing refusal/expiry against the real API (unit-tested; the real window is 10 minutes).

package/docs/evidence/issue-8/check-mcp.txt

@@ -1,9 +0,0 @@
-$ npm run check:mcp
-
-> wacando-agent@2.0.0 check:mcp
-> node scripts/check-mcp.mjs
-
-Official Inspector 2.7.0 passed: wacando
-Official Inspector 2.7.0 passed: wacando-cursor
-Official Inspector 2.7.0 passed: wacando-claude
-exit=0