@wacando/agent 2.0.1 → 2.1.0

package/docs/AGENT_TOOLS.md

@@ -97,7 +97,8 @@ Rules enforced by the runtime (and, independently, by the server):
   appear as `text: null` with `undecryptable: true`, never as ciphertext or a
   plaintext fallback. Other agents' messages are untrusted data.
 - **Blocked session recovery** (lbframe/wacando#50) — provided by
-  `@wacando/omemo` `SessionRecovery` (since `0.1.0`, the pinned version;
+  `SessionRecovery` of the embedded Wacando OMEMO code (lbframe/wacando
+  `@wacando/omemo` 0.1.1 sources, see `docs/WACANDO_PACKAGES.md`;
   `0.1.0-rc.1` did not have it). When a message cannot be decrypted because the one-time
   prekey it used was already consumed, the runtime repairs the session with
   the peer device through signed controls relayed only by the policy
@@ -111,9 +112,9 @@ Rules enforced by the runtime (and, independently, by the server):
   conversation when there is something to report (`recovering`, `backoff`,
   `recovered`, `needs_attention`, `cancelled`). Ids in `deliveryUncertain` are
   this agent's messages whose delivery is unknown: tell the owner and resend
-  explicitly if needed; nothing is resent automatically. With a
-  `@wacando/omemo` without `SessionRecovery` (older than `0.1.0`) recovery is
-  simply off and failures keep failing closed.
+  explicitly if needed; nothing is resent automatically. With an OMEMO module
+  without `SessionRecovery` recovery is simply off and failures keep failing
+  closed; the embedded code always provides it (`npm test` checks it).
 
 ## Receiving: host x retrieval mode (#4)
 

package/docs/MIGRATION-2.0.md

@@ -1,10 +1,11 @@
 # Migrating to runtime 2.0 (official libsignal OMEMO)
 
 Runtime/plugin 1.x encrypted with the **classic** OMEMO backend
-(`@privacyresearch/libsignal-protocol-typescript`, GPL-3.0, no PQXDH). The
+(a GPL-3.0 TypeScript port of libsignal, no PQXDH). The
 Wacando desktop apps use only the official `@signalapp/libsignal-client` and
 cannot decrypt classic sessions. Runtime 2.0 ships **only** the official
-backend (`@wacando/omemo`): bundles carry Kyber prekeys and sessions
+backend (the Wacando OMEMO code embedded since 2.1.0, `@wacando/omemo` in
+2.0.x): bundles carry Kyber prekeys and sessions
 use PQXDH.
 
 There is no in-place key conversion: an identity key is bound to its device,

package/docs/ONBOARDING.md

@@ -131,7 +131,7 @@ API response secrets or raw network/crypto exceptions.
 ## Reused messaging components
 
 `packages/onboarding/vendor/messaging.cjs` bundles the existing Wacando OMEMO
-provider, `ClassicDevice`, `PrivacyResearchBackend`, and `@xmpp/client` transport.
+provider, `ClassicDevice`, the classic Signal backend class, and `@xmpp/client` transport.
 This is the existing classic X3DH/Double Ratchet implementation, with real device
 keys and PEP bundle publication; it is not the native PQXDH backend used as the
 other adapter's primary implementation. No plaintext fallback or development

package/docs/PLUGIN_HANDOFF_FOLLOWUP.md

@@ -76,7 +76,7 @@ and the first sender's message to an observer, then fails the second distinct
 sender's message to that observer using the same published bundle.
 
 `packages/omemo/src/devicelist.ts` documents a slot selected by **sender** JID.
-However, `PrivacyResearchBackend.ensureSession`, in
+However, the classic backend's `ensureSession`, in
 `packages/omemo/src/classic-backend.ts:126`, passes `peer.bareJid`, the
 **recipient** JID, to `parseClassicBundle`. Both senders consequently select
 the same one-time prekey. `ClassicDevice.storage.removePreKey` consumes its

package/docs/RELEASE.md

@@ -17,7 +17,8 @@ with `persist-credentials: false`):
 1. `verify`: tag equals the package version and is on main; `npm ci`;
    `npm run check`; pack; dry run; hands the tarball to `publish` as job
    outputs `tgz_0`..`tgz_7` (base64 split into chunks of at most 64000
-   characters, ~140 KB in total for 2.0.0, no Actions artifact) with its
+   characters, ~140 KB in total for 2.0.0, ~181 KB (3 chunks) for 2.1.0
+   with the embedded Wacando code, no Actions artifact) with its
    sha256. One output per chunk because a container job gets each step env
    var as one `docker exec -e` argument, capped at 128 KiB by Linux: the
    single-variable handoff failed the v2.0.0 run with "Argument list too
@@ -27,11 +28,14 @@ with `persist-credentials: false`):
    decodes the tarball, re-checks the sha256, `npm publish --access public` (prereleases on `next`)
    with `NPM_TOKEN` in a temporary userconfig deleted on exit.
 3. `install-published`: in a clean `node:22` container, installs
-   `@wacando/agent@<version>` globally and anonymously, runs `wacando-agent
-   --version` / `--help`.
-
-The published tarball contains the runtime, the thin plugins and `docs/*.md`,
-not `docs/evidence/`.
+   `@wacando/agent@<version>` globally and anonymously, checks that no other
+   `@wacando/*` package was installed (the Wacando code is embedded,
+   `docs/WACANDO_PACKAGES.md`), runs `wacando-agent --version` / `--help`.
+
+The published tarball contains the runtime, the embedded Wacando code
+(`packages/wacando/`, recorded in `provenance.json`), the thin plugins and
+`docs/*.md`, not `docs/evidence/`, tests or scripts. Its manifest depends on
+no `@wacando/*` package (`scripts/check-deps.mjs`, part of `npm run check`).
 
 `v2.0.0` (on `ceb4302`, run 38910553125) passed `verify` but its `publish`
 job failed on that limit, so 2.0.0 was never published. A tag push runs the

package/docs/WACANDO_PACKAGES.md

@@ -1,25 +1,73 @@
-# Wacando packages (public npm)
-
-The runtime depends on the shared Wacando packages built from the private
-`lbframe/wacando` repository and published **publicly on registry.npmjs.org**
-by its `packages.yml` workflow (lbframe/wacando `docs/PACKAGES.md`):
-
-| Package | Used for |
-|---|---|
-| `@wacando/contracts` | product types, handles, JID mapping |
-| `@wacando/xmpp` | presence echo (`announceAvailable`), MUC, MAM, PEP, origin checks, policy deliveries |
-| `@wacando/omemo` | native OMEMO on the official `@signalapp/libsignal-client`; `./wire` policy submission/digest helpers |
-
-- `package.json` pins exact versions; `package-lock.json` pins each archive's
-  SHA-512 from `registry.npmjs.org`.
-- `scripts/check-deps.mjs` (first step of `npm run check`) fails unless the
-  three packages resolve from the public registry at the pinned versions, with
-  no nested copy, the official libsignal present and no `@privacyresearch/*`
-  (classic GPL backend) anywhere in the graph.
-- No Wacando source is copied into this repository. The temporary `deps/`
-  archives used while GitHub Packages was billing-blocked are gone.
-
-Updating: `npm install --save-exact @wacando/contracts@<v> @wacando/xmpp@<v> @wacando/omemo@<v> && npm run notices && npm run check`.
+# Embedded Wacando code
+
+Since 2.1.0 (owner decision of 2026-10-16) `@wacando/agent` depends on **no**
+`@wacando/*` npm package. The shared Wacando code it needs, built from the
+private `lbframe/wacando` repository, is embedded in the package:
+
+| Import | Embedded file | Built from (lbframe/wacando) |
+|---|---|---|
+| `#wacando/xmpp` | `packages/wacando/xmpp.mjs` | `packages/xmpp/src/index.ts`, only the names the runtime imports (presence echo, MUC join, MAM, origin checks, policy deliveries) |
+| `#wacando/omemo` | `packages/wacando/omemo.mjs` | `packages/omemo/src/libsignal.ts`: native OMEMO on the official `@signalapp/libsignal-client`, `SessionRecovery` |
+| `#wacando/omemo-wire` | `packages/wacando/omemo-wire.mjs` | `packages/omemo/src/wire-entry.ts`: policy submission/digest helpers |
+
+`packages/contracts/src` is bundled where those entries use it. Shared modules
+live once in `packages/wacando/chunks/` (esbuild code splitting), so error
+classes and state are not duplicated. `package.json` `imports` maps the three
+specifiers to the files.
+
+## Source of truth and provenance
+
+`scripts/embed-wacando.mjs` (`npm run embed -- --commit <sha>`) rebuilds the
+directory from **one commit of lbframe/wacando main**:
+
+- reads only `packages/{contracts,xmpp,omemo}/src` and their manifests with
+  `git archive <commit>` (never a working tree, never `test/` or `scripts/`,
+  never `apps/`);
+- refuses a commit that is not contained in the source repository's
+  `origin/main`;
+- bundles the TypeScript sources with the pinned esbuild (devDependency) into
+  ESM; every third-party import stays **external**: the native
+  `@signalapp/libsignal-client` is never bundled, it remains an npm
+  dependency with its prebuilds; the build fails if anything reaches the
+  classic GPL OMEMO backend or an unmapped `@wacando/*` import;
+- writes `provenance.json` `embedded`: repository, branch, commit, git tree id
+  of each `src` directory, source package versions, esbuild version, entry
+  map, external packages with the exact versions the Wacando manifests
+  declare, the list of source inputs, and the size and SHA-256 of every
+  embedded file. Every embedded file starts with a banner naming the commit.
+
+`--repo <path|url>` (default `$WACANDO_REPO`, then `../wacando`) selects the
+source repository; a URL is cloned into a temporary directory.
+`npm run check:embed` rebuilds into a temporary directory and fails unless the
+result is byte-identical to `packages/wacando/` and `provenance.json` (it needs
+access to the private repository, so it is not part of `npm run check`).
+
+Current source: lbframe/wacando `9f82881d4ee6cfd655727a08883877230917c955`
+(main, tag `packages-v0.1.1`), the sources of the `@wacando/*@0.1.1` npm
+packages that 2.0.2 used; `packages/{contracts,xmpp,omemo}/src` are unchanged
+from there to main `dc47380`.
+
+## Guard
+
+`scripts/check-deps.mjs` (first step of `npm run check`) fails unless:
+
+- no `@wacando/*` package appears in any dependency field, the lockfile or
+  `node_modules`, and no repository code imports one;
+- every file of `packages/wacando/` is listed in `provenance.json` with a
+  matching SHA-256 (and nothing else is there), `imports` matches the
+  recorded entries, and the embedded code imports only node builtins,
+  embedded files and the recorded externals, each an exact dependency at the
+  recorded version (libsignal included);
+- third-party dependencies are exact pins resolved from registry.npmjs.org
+  with a SHA-512 integrity, and the classic GPL backend is nowhere in the
+  graph;
+- the published file list has no test, TypeScript source, source map, native
+  binary, secret or server code, and no published file mentions the classic
+  backend; licence `UNLICENSED`.
+
+Updating: `npm run embed -- --commit <lbframe/wacando main sha>`, align
+`dependencies` with `provenance.json` `embedded.externals` if they changed
+(`npm install --save-exact`), `npm run notices && npm run check`.
 
 `@signalapp/libsignal-client` ships native prebuilds for macOS x64/arm64,
 Windows x64/arm64 and Linux x64/arm64 inside its npm package; no compiler is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wacando/agent",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Wacando agent runtime: CLI/daemon, MCP server and Node SDK on official libsignal OMEMO, with thin Codex, Cursor and Claude Code plugins.",
   "license": "UNLICENSED",
   "type": "module",
@@ -11,6 +11,11 @@
     ".": "./packages/runtime/index.mjs",
     "./package.json": "./package.json"
   },
+  "imports": {
+    "#wacando/xmpp": "./packages/wacando/xmpp.mjs",
+    "#wacando/omemo": "./packages/wacando/omemo.mjs",
+    "#wacando/omemo-wire": "./packages/wacando/omemo-wire.mjs"
+  },
   "files": [
     "bin/",
     "packages/",
@@ -41,13 +46,17 @@
     "mcp:claude": "node bin/wacando-agent.mjs mcp --host claude",
     "install:cursor": "node bin/wacando-agent.mjs install --host cursor",
     "validate:claude": "claude plugin validate --strict plugins/wacando-claude && claude plugin validate --strict .claude-plugin/marketplace.json",
-    "install:claude": "npm run validate:claude && node scripts/install-claude.mjs"
+    "install:claude": "npm run validate:claude && node scripts/install-claude.mjs",
+    "embed": "node scripts/embed-wacando.mjs",
+    "check:embed": "node scripts/embed-wacando.mjs --check"
   },
   "dependencies": {
-    "@wacando/contracts": "0.1.0",
-    "@wacando/omemo": "0.1.0",
-    "@wacando/xmpp": "0.1.0",
-    "@xmpp/client": "0.14.0"
+    "@signalapp/libsignal-client": "0.102.2",
+    "@xmpp/client": "0.14.0",
+    "@xmpp/jid": "0.14.0",
+    "@xmpp/xml": "0.14.0",
+    "base64-js": "1.5.1",
+    "ltx": "3.1.2"
   },
   "publishConfig": {
     "access": "public",
@@ -64,5 +73,8 @@
     "mcp",
     "omemo",
     "xmpp"
-  ]
+  ],
+  "devDependencies": {
+    "esbuild": "0.28.2"
+  }
 }

package/packages/onboarding/version.mjs

@@ -1,2 +1,2 @@
 // Must match all distributed plugin manifests; checked by the test suite.
-export const pluginVersion = '2.0.1';
+export const pluginVersion = '2.1.0';

package/packages/runtime/conversations.mjs

@@ -1,8 +1,8 @@
-import { NS_OMEMO } from '@wacando/omemo';
-import { NS_WACANDO_POLICY, toPolicySubmission } from '@wacando/omemo/wire';
+import { NS_OMEMO } from '#wacando/omemo';
+import { NS_WACANDO_POLICY, toPolicySubmission } from '#wacando/omemo-wire';
 import {
   authenticatedMessageOrigin, forwardedStanza, joinRoom, MucJoinError, MucOriginTracker, queryMam, unwrapPolicyDelivery,
-} from '@wacando/xmpp';
+} from '#wacando/xmpp';
 import { ApiError } from '../onboarding/network.mjs';
 import { SafeError } from '../onboarding/storage.mjs';
 import { attachRecovery, recoveryLifecycle, recoveryView } from './recovery.mjs';

package/packages/runtime/device.mjs

@@ -1,6 +1,6 @@
 import { lstat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { jidStateDirName, loadNativeOmemoProvider } from '@wacando/omemo';
+import { jidStateDirName, loadNativeOmemoProvider } from '#wacando/omemo';
 import { SafeError } from '../onboarding/storage.mjs';
 
 // Runtime 2.x speaks only the official libsignal (PQXDH) OMEMO profile. A

package/packages/runtime/recovery.mjs

@@ -1,11 +1,12 @@
-import * as omemo from '@wacando/omemo';
+import * as omemo from '#wacando/omemo';
 
 // Consumed-prekey session recovery (lbframe/wacando#50,
 // docs/OMEMO_SESSION_RECOVERY_IMPLEMENTATION.md there). The protocol lives in
-// @wacando/omemo (`SessionRecovery`): signed controls relayed ONLY by the
+// the embedded Wacando OMEMO code (`#wacando/omemo`, `SessionRecovery`;
+// docs/WACANDO_PACKAGES.md): signed controls relayed ONLY by the
 // policy component, which enforces membership and STOP. The runtime supplies
 // the conversation lifecycle it learns from the API and surfaces the state.
-// A @wacando/omemo without SessionRecovery leaves recovery off: failures keep
+// An OMEMO module without SessionRecovery leaves recovery off: failures keep
 // failing closed exactly as before (no plaintext, no replay).
 
 /** Conversation state (API) → recovery lifecycle. Anything uncertain denies. */
@@ -17,7 +18,7 @@ export function recoveryLifecycle(state) {
 
 /**
  * Attach recovery to one XMPP session. Returns null (recovery off, failures
- * keep failing closed) when the installed @wacando/omemo does not provide it,
+ * keep failing closed) when the OMEMO module does not provide it,
  * when the session is not a native-OMEMO XMPP client able to answer IQs, or
  * when attaching fails. `omemoModule` is injectable for tests.
  */

package/packages/runtime/session.mjs

@@ -1,5 +1,5 @@
 import { client } from '@xmpp/client';
-import { announceAvailable, refuseSubscriptionRequests, xml } from '@wacando/xmpp';
+import { announceAvailable, refuseSubscriptionRequests, xml } from '#wacando/xmpp';
 import { SafeError } from '../onboarding/storage.mjs';
 import { loadDevice } from './device.mjs';
 

package/packages/wacando/chunks/chunk-EIGFLZ2Y.mjs

@@ -0,0 +1,23 @@
+// Embedded from lbframe/wacando@9f82881d4ee6cfd655727a08883877230917c955 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+
+// packages/contracts/src/errors.ts
+var DomainError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "DomainError";
+    this.code = code;
+  }
+};
+
+// packages/contracts/src/internal.ts
+var XMPP_DOMAIN = process.env.XMPP_DOMAIN ?? "wacando.localhost";
+var XMPP_MUC_DOMAIN = `conference.${XMPP_DOMAIN}`;
+
+// packages/contracts/src/message.ts
+var MAX_MESSAGE_PLAINTEXT_BYTES = 64 * 1024;
+
+export {
+  DomainError,
+  XMPP_DOMAIN
+};