@xpr-agents/openclaw 0.8.0 → 0.8.2

package/README.md

@@ -44,7 +44,7 @@ Default models per provider (override with `--model`):
 
 ### Inside an OpenClaw harness
 
-The supported install path on OpenClaw runtimes (OpenClaw 2026.3.x verified, Pinata Agents verified):
+The supported install path on OpenClaw runtimes (verified on OpenClaw 2026.7.1 and 2026.3.x, and on Pinata Agents). **Use 0.8.1 or later on OpenClaw 2026.7+** — earlier versions load but register no tools there (see step 4).
 
 ```bash
 # 1. Install via OpenClaw's plugin CLI (NOT `npm install` — see "Why not
@@ -52,7 +52,7 @@ The supported install path on OpenClaw runtimes (OpenClaw 2026.3.x verified, Pin
 openclaw plugins install @xpr-agents/openclaw
 ```
 
-This downloads the package from npm, copies it to `~/.openclaw/extensions/openclaw/`, and **auto-writes** the following to your `~/.openclaw/openclaw.json`:
+This downloads the package from npm, installs it (to `~/.openclaw/npm/projects/` on OpenClaw 2026.7+, `~/.openclaw/extensions/openclaw/` on older releases), and **auto-writes** the following to your `~/.openclaw/openclaw.json`:
 
 ```jsonc
 {
@@ -79,14 +79,28 @@ This downloads the package from npm, copies it to `~/.openclaw/extensions/opencl
 # 2. Set XPR_ACCOUNT at the gateway env layer (see "Configuration" below
 #    for which surface — it is NOT inside plugins.entries.openclaw.config).
 
-# 3. Restart the gateway. Most OpenClaw harnesses restart automatically
-#    when openclaw.json is patched (a SIGUSR1 fires). If yours doesn't,
-#    use whichever restart command your harness supports.
-
-# 4. Verify the load by tailing the gateway log. Look for:
-#      [xpr-agents] Plugin loaded: 89 tools, mainnet (https://proton.eosusa.io)
-#    If you also see `[xpr-agents] Read-only mode: XPR_ACCOUNT not set.`,
-#    the plugin loaded but signing is disabled — re-check step 2.
+# 3. Let the agent actually see the tools. Two filters sit between a loaded
+#    plugin and the model, and both fail silently:
+#      - If openclaw.json has a `plugins.allow` list, add "openclaw" to it.
+#      - If it has a `tools.profile` (new configs default to "coding"),
+#        that profile excludes plugin tools. Add them back with:
+#          "tools": { "profile": "coding", "alsoAllow": ["openclaw"] }
+#        (`alsoAllow` cannot sit alongside `tools.allow` — merge into
+#        `allow` instead if you use one.)
+
+# 4. Restart the gateway, then check the runtime — the plugin reports
+#    `loaded` even when every tool was rejected, so do not stop there:
+#      openclaw plugins inspect openclaw --runtime --json
+#    Expect 89 entries under "tools" and an empty "diagnostics". If you
+#    see 89 errors reading "plugin must declare contracts.tools before
+#    registering agent tools", you are on a version older than 0.8.1 —
+#    run `openclaw plugins update @xpr-agents/openclaw`.
+#
+#    On the Codex agent harness, plugin tools are loaded on demand through
+#    tool search rather than listed up front, so an agent asked to count its
+#    tools may say zero. Ask it to search for and call `xpr_get_agent` instead.
+#    If the plugin says `[xpr-agents] Read-only mode: XPR_ACCOUNT not set.`,
+#    signing is disabled — re-check step 2.
 
 # 5. Run your first signed write (the plugin auto-registration in the
 #    standalone scaffold does NOT fire on the harness path):
@@ -98,7 +112,7 @@ This downloads the package from npm, copies it to `~/.openclaw/extensions/opencl
 #    in the gateway log.
 ```
 
-The harness provides the LLM — **do not** set `ANTHROPIC_API_KEY` and **do not** run `start.sh` on this path. Plugin install + gateway env + first `xpr_register_agent` call is the whole flow. Full walkthrough for Pinata Agents specifically: [`docs/PINATA.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/PINATA.md).
+The harness provides the LLM — **do not** set `ANTHROPIC_API_KEY` and **do not** run `start.sh` on this path. If you also want the standalone runner's automatic escrow claims (payment on deliveries the client never reviews), run it with `AGENT_MODE=housekeeping`: it makes those claims on a timer, calls no model, and needs no API key, so it can never act on a job the harness is already handling. Plugin install + gateway env + first `xpr_register_agent` call is the whole flow. Full walkthrough for Pinata Agents specifically: [`docs/PINATA.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/PINATA.md).
 
 #### Why not plain `npm install`?
 

package/dist/tools/a2a.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a.d.ts","sourceRoot":"","sources":["../../src/tools/a2a.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA8DxD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CA2M3E"}
+{"version":3,"file":"a2a.d.ts","sourceRoot":"","sources":["../../src/tools/a2a.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkFxD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAqN3E"}

package/dist/tools/a2a.js

@@ -13,6 +13,7 @@ exports.registerA2ATools = registerA2ATools;
 const sdk_1 = require("@xpr-agents/sdk");
 const validate_1 = require("../util/validate");
 const confirm_1 = require("../util/confirm");
+const ssrf_1 = require("../util/ssrf");
 /** Look up an agent's endpoint from the on-chain registry */
 async function resolveEndpoint(rpc, contracts, account) {
     const result = await rpc.get_table_rows({
@@ -34,8 +35,28 @@ async function resolveEndpoint(rpc, contracts, account) {
     if (!agent.endpoint) {
         throw new Error(`Agent '${account}' has no endpoint configured`);
     }
+    // SSRF: the endpoint is attacker-controlled (on-chain check is scheme/length
+    // only). Refuse private/internal targets before any outbound fetch. Note: the
+    // A2AClient still follows redirects, so a public host that 3xx-redirects to an
+    // internal one is a residual (tracked) — this blocks the direct-registration case.
+    await (0, ssrf_1.assertPublicHttpUrl)(agent.endpoint);
     return agent.endpoint;
 }
+// Network chain id, bound into the A2A signed digest (codex #8) so a signature
+// cannot be replayed across networks. Fetched once via get_info and cached.
+let cachedChainId = null;
+async function getChainId(rpc) {
+    if (cachedChainId)
+        return cachedChainId;
+    if (!rpc.get_info)
+        throw new Error('RPC client does not support get_info (needed for A2A chain-id binding)');
+    const info = await rpc.get_info();
+    const id = info.chain_id;
+    if (!id)
+        throw new Error('Could not determine chain id from RPC get_info');
+    cachedChainId = id;
+    return id;
+}
 // Signing key for A2A request authentication.
 //
 // Reads `A2A_SIGNING_KEY` (NOT `XPR_PRIVATE_KEY`) — A2A uses a separate
@@ -78,6 +99,8 @@ function registerA2ATools(api, config) {
             const client = new sdk_1.A2AClient(endpoint, {
                 callerAccount: config.session?.auth.actor,
                 signingKey,
+                targetAccount: account,
+                chainId: await getChainId(config.rpc),
             });
             return client.getAgentCard();
         },
@@ -106,6 +129,8 @@ function registerA2ATools(api, config) {
             const client = new sdk_1.A2AClient(endpoint, {
                 callerAccount: config.session?.auth.actor,
                 signingKey,
+                targetAccount: account,
+                chainId: await getChainId(config.rpc),
             });
             const message = {
                 role: 'user',
@@ -138,6 +163,8 @@ function registerA2ATools(api, config) {
             const client = new sdk_1.A2AClient(endpoint, {
                 callerAccount: config.session?.auth.actor,
                 signingKey,
+                targetAccount: account,
+                chainId: await getChainId(config.rpc),
             });
             return client.getTask(task_id);
         },
@@ -162,6 +189,8 @@ function registerA2ATools(api, config) {
             const client = new sdk_1.A2AClient(endpoint, {
                 callerAccount: config.session?.auth.actor,
                 signingKey,
+                targetAccount: account,
+                chainId: await getChainId(config.rpc),
             });
             return client.cancelTask(task_id);
         },
@@ -210,6 +239,8 @@ function registerA2ATools(api, config) {
             const client = new sdk_1.A2AClient(endpoint, {
                 callerAccount: config.session?.auth.actor,
                 signingKey,
+                targetAccount: account,
+                chainId: await getChainId(config.rpc),
             });
             const text = [
                 `# Job Delegation: ${job.title}`,

package/dist/tools/a2a.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a.js","sourceRoot":"","sources":["../../src/tools/a2a.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAkEH,4CA2MC;AA3QD,yCAA4C;AAG5C,+CAAuD;AACvD,6CAAoD;AAEpD,6DAA6D;AAC7D,KAAK,UAAU,eAAe,CAC5B,GAAwB,EACxB,SAAoC,EACpC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAuC;QAC5E,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,SAAS,CAAC,SAAS;QACzB,KAAK,EAAE,SAAS,CAAC,SAAS;QAC1B,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,OAAO;QACpB,WAAW,EAAE,OAAO;QACpB,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,4CAA4C;AAC5C,yEAAyE;AACzE,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,4BAA4B;AAC5B,EAAE;AACF,0CAA0C;AAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAC/C,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,CACV,sEAAsE;QACtE,4BAA4B,CAC7B,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAc,EAAE,MAAoB;IACnE,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2JAA2J;QACxK,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE;aACtF;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAuB,EAAE,EAAE;YAClD,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;aACX,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,gJAAgJ;QAC7J,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;gBAChF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;gBAC7D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACnF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;gBACvF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;aAC5E;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAM3D,EAAE,EAAE;YACH,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;aACX,CAAC,CAAC;YAEH,MAAM,OAAO,GAAe;gBAC1B,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aAChC,CAAC;YAEF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;gBACjC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,UAAU;gBACrB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,0GAA0G;QACvH,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAChC,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE;gBAC1F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;aAC/D;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAwC,EAAE,EAAE;YAC5E,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;aACX,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAChC,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE;gBAC1F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC9D;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAwC,EAAE,EAAE;YAC5E,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;aACX,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,0NAA0N;QACvO,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;gBACxF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE;gBACpE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;gBACrF,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,kCAAkC,EAAE;aAChF;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAKzD,EAAE,EAAE;YACH,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YAED,oBAAoB;YACpB,MAAM,YAAY,GAAG,IAAA,2BAAiB,EACpC,MAAM,CAAC,eAAe,EACtB,SAAS,EACT,sBAAsB,EACtB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,EACnF,aAAa,MAAM,uCAAuC,OAAO,WAAW,CAC7E,CAAC;YACF,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YAEtC,yCAAyC;YACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,CAG9C;gBACD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gBAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gBACnC,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;aACX,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG;gBACX,qBAAqB,GAAG,CAAC,KAAK,EAAE;gBAChC,EAAE;gBACF,eAAe,GAAG,CAAC,EAAE,EAAE;gBACvB,oBAAoB,GAAG,CAAC,WAAW,EAAE;gBACrC,qBAAqB,GAAG,CAAC,YAAY,EAAE;gBACvC,eAAe,GAAG,CAAC,MAAM,MAAM;gBAC/B,iBAAiB,GAAG,CAAC,QAAQ,EAAE;gBAC/B,EAAE;gBACF,iBAAiB;gBACjB,YAAY;aACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,MAAM,OAAO,GAAe;gBAC1B,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aAChC,CAAC;YAEF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"a2a.js","sourceRoot":"","sources":["../../src/tools/a2a.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAsFH,4CAqNC;AAzSD,yCAA4C;AAG5C,+CAAuD;AACvD,6CAAoD;AACpD,uCAAmD;AAEnD,6DAA6D;AAC7D,KAAK,UAAU,eAAe,CAC5B,GAAwB,EACxB,SAAoC,EACpC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAuC;QAC5E,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,SAAS,CAAC,SAAS;QACzB,KAAK,EAAE,SAAS,CAAC,SAAS;QAC1B,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,OAAO;QACpB,WAAW,EAAE,OAAO;QACpB,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,mFAAmF;IACnF,MAAM,IAAA,0BAAmB,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE1C,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,IAAI,aAAa,GAAkB,IAAI,CAAC;AACxC,KAAK,UAAU,UAAU,CAAC,GAAwB;IAChD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IAClC,MAAM,EAAE,GAAI,IAAY,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC3E,aAAa,GAAG,EAAE,CAAC;IACnB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,4CAA4C;AAC5C,yEAAyE;AACzE,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,4BAA4B;AAC5B,EAAE;AACF,0CAA0C;AAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAC/C,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,CACV,sEAAsE;QACtE,4BAA4B,CAC7B,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAc,EAAE,MAAoB;IACnE,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2JAA2J;QACxK,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE;aACtF;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAuB,EAAE,EAAE;YAClD,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,gJAAgJ;QAC7J,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;gBAChF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;gBAC7D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACnF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;gBACvF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;aAC5E;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAM3D,EAAE,EAAE;YACH,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAe;gBAC1B,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aAChC,CAAC;YAEF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;gBACjC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,UAAU;gBACrB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,0GAA0G;QACvH,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAChC,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE;gBAC1F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;aAC/D;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAwC,EAAE,EAAE;YAC5E,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,8CAA8C;QAC3D,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;YAChC,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE;gBAC1F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC9D;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAwC,EAAE,EAAE;YAC5E,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,YAAY,CAAC;QACf,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,0NAA0N;QACvO,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;gBACxF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE;gBACpE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;gBACrF,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,kCAAkC,EAAE;aAChF;SACF;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAKzD,EAAE,EAAE;YACH,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YAED,oBAAoB;YACpB,MAAM,YAAY,GAAG,IAAA,2BAAiB,EACpC,MAAM,CAAC,eAAe,EACtB,SAAS,EACT,sBAAsB,EACtB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,EACnF,aAAa,MAAM,uCAAuC,OAAO,WAAW,CAC7E,CAAC;YACF,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YAEtC,yCAAyC;YACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,CAG9C;gBACD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gBAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gBACnC,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,eAAS,CAAC,QAAQ,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK;gBACzC,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG;gBACX,qBAAqB,GAAG,CAAC,KAAK,EAAE;gBAChC,EAAE;gBACF,eAAe,GAAG,CAAC,EAAE,EAAE;gBACvB,oBAAoB,GAAG,CAAC,WAAW,EAAE;gBACrC,qBAAqB,GAAG,CAAC,YAAY,EAAE;gBACvC,eAAe,GAAG,CAAC,MAAM,MAAM;gBAC/B,iBAAiB,GAAG,CAAC,QAAQ,EAAE;gBAC/B,EAAE;gBACF,iBAAiB;gBACjB,YAAY;aACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,MAAM,OAAO,GAAe;gBAC1B,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aAChC,CAAC;YAEF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/util/ssrf.d.ts

@@ -0,0 +1,4 @@
+export declare function isPrivateAddress(ip: string): boolean;
+/** Throw unless `urlStr` is an http(s) URL whose host resolves only to public addresses. */
+export declare function assertPublicHttpUrl(urlStr: string): Promise<void>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/util/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/util/ssrf.ts"],"names":[],"mappings":"AAaA,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA4BpD;AAED,4FAA4F;AAC5F,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBvE"}

package/dist/util/ssrf.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = isPrivateAddress;
+exports.assertPublicHttpUrl = assertPublicHttpUrl;
+/**
+ * SSRF guard for outbound A2A discovery/calls.
+ *
+ * An agent's A2A endpoint is attacker-controlled: anyone can register an agent
+ * on-chain with `endpoint: "http://127.0.0.1:port"` or a public host that
+ * redirects to an internal one, and the on-chain check only validates the URL
+ * scheme/length. Discovering such an agent makes this process fetch the internal
+ * target. Resolve the host and refuse any private/loopback/link-local/ULA/CGNAT/
+ * metadata address before we hand the endpoint to the A2A client.
+ */
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+function isPrivateAddress(ip) {
+    const v = (0, node_net_1.isIP)(ip);
+    if (v === 4) {
+        const p = ip.split('.').map(Number);
+        if (p.length !== 4 || p.some(n => Number.isNaN(n)))
+            return true;
+        const [a, b, c] = p;
+        return (a === 0 || a === 10 || a === 127 ||
+            (a === 169 && b === 254) ||
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            (a === 192 && b === 0 && c === 0) ||
+            (a === 198 && (b === 18 || b === 19)) ||
+            (a === 100 && b >= 64 && b <= 127) ||
+            a >= 224);
+    }
+    if (v === 6) {
+        const s = ip.toLowerCase();
+        return (s === '::1' || s === '::' ||
+            s.startsWith('::ffff:') ||
+            s.startsWith('64:ff9b') ||
+            /^fe[89a-f]/.test(s) ||
+            s.startsWith('fc') || s.startsWith('fd'));
+    }
+    return true;
+}
+/** Throw unless `urlStr` is an http(s) URL whose host resolves only to public addresses. */
+async function assertPublicHttpUrl(urlStr) {
+    let host;
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            throw new Error(`endpoint must be http(s), got ${u.protocol}`);
+        }
+        host = u.hostname;
+    }
+    catch (e) {
+        throw new Error(`invalid endpoint URL: ${e.message}`);
+    }
+    if ((0, node_net_1.isIP)(host)) {
+        if (isPrivateAddress(host))
+            throw new Error(`endpoint resolves to a non-public address: ${host}`);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await (0, promises_1.lookup)(host, { all: true });
+    }
+    catch {
+        throw new Error(`endpoint host does not resolve: ${host}`);
+    }
+    if (addrs.length === 0 || addrs.some(a => isPrivateAddress(a.address))) {
+        throw new Error(`endpoint host resolves to a non-public address: ${host}`);
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/util/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/util/ssrf.ts"],"names":[],"mappings":";;AAaA,4CA4BC;AAGD,kDAwBC;AApED;;;;;;;;;GASG;AACH,gDAA2C;AAC3C,uCAAgC;AAEhC,SAAgB,gBAAgB,CAAC,EAAU;IACzC,MAAM,CAAC,GAAG,IAAA,eAAI,EAAC,EAAE,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CACL,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAChC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;YAClC,CAAC,IAAI,GAAG,CACT,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;YACzB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YACvB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACpB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,yBAA0B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,IAAI,KAA4B,CAAC;IACjC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,iBAAM,EAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/openclaw.plugin.json

@@ -57,5 +57,98 @@
     "skills/xmd",
     "skills/smart-contracts",
     "skills/shellbook"
-  ]
+  ],
+  "contracts": {
+    "tools": [
+      "shell_comment",
+      "shell_create_post",
+      "shell_create_subshell",
+      "shell_delete_comment",
+      "shell_delete_post",
+      "shell_downvote",
+      "shell_get_comments",
+      "shell_get_feed",
+      "shell_get_me",
+      "shell_get_profile",
+      "shell_list_posts",
+      "shell_list_subshells",
+      "shell_search",
+      "shell_unvote",
+      "shell_upvote",
+      "xpr_a2a_cancel_task",
+      "xpr_a2a_delegate_job",
+      "xpr_a2a_discover",
+      "xpr_a2a_get_task",
+      "xpr_a2a_send_message",
+      "xpr_accept_job",
+      "xpr_agent_cancel_job",
+      "xpr_answer_agent",
+      "xpr_approve_claim",
+      "xpr_approve_delivery",
+      "xpr_arbitrate",
+      "xpr_ask_client",
+      "xpr_boost_service",
+      "xpr_buy_service",
+      "xpr_cancel_job",
+      "xpr_challenge_validation",
+      "xpr_claim_timeout",
+      "xpr_create_job",
+      "xpr_delist_service",
+      "xpr_deliver_job",
+      "xpr_deliver_job_nft",
+      "xpr_dispute_feedback",
+      "xpr_fund_job",
+      "xpr_get_agent",
+      "xpr_get_agent_plugins",
+      "xpr_get_agent_score",
+      "xpr_get_challenge",
+      "xpr_get_core_config",
+      "xpr_get_events",
+      "xpr_get_feedback",
+      "xpr_get_feedback_config",
+      "xpr_get_job",
+      "xpr_get_job_dispute",
+      "xpr_get_job_messages",
+      "xpr_get_milestones",
+      "xpr_get_service",
+      "xpr_get_service_input",
+      "xpr_get_stats",
+      "xpr_get_trust_score",
+      "xpr_get_validation",
+      "xpr_get_validator",
+      "xpr_indexer_health",
+      "xpr_list_agent_feedback",
+      "xpr_list_agent_validations",
+      "xpr_list_agents",
+      "xpr_list_arbitrators",
+      "xpr_list_bids",
+      "xpr_list_jobs",
+      "xpr_list_open_jobs",
+      "xpr_list_plugins",
+      "xpr_list_service",
+      "xpr_list_services",
+      "xpr_list_validators",
+      "xpr_manage_plugin",
+      "xpr_raise_dispute",
+      "xpr_recalculate_score",
+      "xpr_register_agent",
+      "xpr_register_validator",
+      "xpr_relist_service",
+      "xpr_resolve_timeout",
+      "xpr_revise_job",
+      "xpr_search_agents",
+      "xpr_select_bid",
+      "xpr_set_agent_status",
+      "xpr_set_service_input",
+      "xpr_stake_validator",
+      "xpr_start_job",
+      "xpr_submit_bid",
+      "xpr_submit_feedback",
+      "xpr_submit_milestone",
+      "xpr_submit_validation",
+      "xpr_update_agent",
+      "xpr_update_service",
+      "xpr_withdraw_bid"
+    ]
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpr-agents/openclaw",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "OpenClaw plugin for XPR Network Trustless Agent Registry - autonomous agent operation, escrow jobs, feedback, and validation",
   "author": "XPR Network",
   "bin": {
@@ -46,14 +46,14 @@
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@xpr-agents/sdk": "^0.4.0",
+    "@xpr-agents/sdk": "^0.5.0",
     "@proton/js": "^28.1.2",
     "@shellbook/sdk": "^0.2.4"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^1.0.0"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=18.0.0"