a2acalling 0.6.51 → 0.6.53

package/README.md

@@ -149,6 +149,7 @@ Customize tiers in `~/.config/openclaw/a2a-config.json`:
   "tiers": {
     "friends": {
       "topics": ["chat", "web", "files", "calendar"],
+      "allowed_tools": ["Bash(readonly)", "Read", "Grep", "Glob", "WebSearch", "WebFetch"],
       "disclosure": "minimal"
     }
   }

package/bin/cli.js

@@ -646,6 +646,22 @@ async function handleDisclosureSubmit(args, commandLabel = 'onboard') {
     return tierData.topics.map(t => String(t && t.topic || '').trim()).filter(Boolean);
   }
 
+  // Helper to extract allowed tools per tier from the disclosure manifest.
+  function getTierTools(tierData) {
+    if (!tierData || !Array.isArray(tierData.allowed_tools)) return [];
+    const seen = new Set();
+    const out = [];
+    for (const tool of tierData.allowed_tools) {
+      const cleaned = String(tool || '').trim();
+      if (!cleaned) continue;
+      const key = cleaned.toLowerCase();
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(cleaned);
+    }
+    return out;
+  }
+
   const tiersData = manifest.tiers || {};
 
   // Derive goals from disclosure objectives (used in tier config and token creation)
@@ -659,19 +675,32 @@ async function handleDisclosureSubmit(args, commandLabel = 'onboard') {
     : ['grow-network', 'find-collaborators', 'build-in-public'];
 
   try {
-    config.setTier('public', {
+    const publicTools = getTierTools(tiersData.public);
+    const friendsTools = [...publicTools, ...getTierTools(tiersData.friends)];
+    const familyTools = [...friendsTools, ...getTierTools(tiersData.family)];
+
+    const publicTierPatch = {
       topics: getTierTopics(tiersData.public),
       goals: tokenGoals,
       disclosure: 'minimal'
-    });
-    config.setTier('friends', {
+    };
+    if (publicTools.length > 0) publicTierPatch.allowed_tools = publicTools;
+
+    const friendsTierPatch = {
       topics: [...getTierTopics(tiersData.public), ...getTierTopics(tiersData.friends)],
       disclosure: 'standard'
-    });
-    config.setTier('family', {
+    };
+    if (friendsTools.length > 0) friendsTierPatch.allowed_tools = friendsTools;
+
+    const familyTierPatch = {
       topics: [...getTierTopics(tiersData.public), ...getTierTopics(tiersData.friends), ...getTierTopics(tiersData.family)],
       disclosure: 'full'
-    });
+    };
+    if (familyTools.length > 0) familyTierPatch.allowed_tools = familyTools;
+
+    config.setTier('public', publicTierPatch);
+    config.setTier('friends', friendsTierPatch);
+    config.setTier('family', familyTierPatch);
   } catch (err) {
     console.error(`  Warning: could not sync tier config: ${err.message}`);
   }
@@ -702,6 +731,7 @@ async function handleDisclosureSubmit(args, commandLabel = 'onboard') {
   const hostname = config.getAgent().hostname || process.env.A2A_HOSTNAME || 'localhost';
 
   const publicTopics = getTierTopics(tiersData.public);
+  const publicTools = getTierTools(tiersData.public);
 
   const { token } = store.create({
     name: agentName,
@@ -712,6 +742,7 @@ async function handleDisclosureSubmit(args, commandLabel = 'onboard') {
     maxCalls: null,
     allowedTopics: publicTopics,
     allowedGoals: tokenGoals,
+    allowedTools: publicTools.length > 0 ? publicTools : null,
     notify: 'all'
   });
 
@@ -725,6 +756,33 @@ async function handleDisclosureSubmit(args, commandLabel = 'onboard') {
   console.log(`  Disclosure: ${MANIFEST_FILE}`);
   console.log(`  Invite: ${inviteUrl}\n`);
 
+  // Native app install should be part of the onboarding tail on macOS so users
+  // don't end up launching the app before a2a setup is complete.
+  if (os.platform() === 'darwin' && !findNativeApp()) {
+    if (isInteractiveShell()) {
+      const installNow = await promptYesNo('Install the native macOS app? [Y/n] ');
+      if (installNow) {
+        const result = installNativeMacApp({ force: false, quiet: false });
+        if (result.success) {
+          if (result.reason === 'already_current') {
+            console.log(`Native app already installed at current version (${result.version}).`);
+            console.log(`Path: ${result.appPath}\n`);
+          } else {
+            console.log(`Native app installed (v${result.version}).`);
+            console.log(`Path: ${result.appPath}\n`);
+          }
+        } else {
+          console.warn(`Native app install failed: ${result.error || 'unknown error'}`);
+          console.warn('You can retry with: a2a app install\n');
+        }
+      } else {
+        console.log('You can install the native app later with: a2a app install\n');
+      }
+    } else {
+      console.log('Install the native macOS app with: a2a app install\n');
+    }
+  }
+
   return true;
 }
 
@@ -787,6 +845,7 @@ const commands = {
 
     // Get tier from --tier or --permissions flag
     const tier = args.flags.tier || args.flags.t || args.flags.permissions || args.flags.p || 'public';
+    const configTier = config.getTiers?.()[tier] || {};
     
     // Get owner from flag or config
     const configAgent = config.getAgent() || {};
@@ -807,6 +866,9 @@ const commands = {
     
     // Get objectives from disclosure
     const objectives = tierTopics.objectives || [];
+    const allowedTools = args.flags.tools
+      ? String(args.flags.tools).split(',').map(t => t.trim()).filter(Boolean)
+      : (Array.isArray(configTier.allowed_tools) ? configTier.allowed_tools : null);
     const timeoutMsRaw = args.flags['timeout-ms'] || args.flags.timeout_ms;
     const timeoutMs = timeoutMsRaw ? Number.parseInt(String(timeoutMsRaw), 10) : null;
 
@@ -820,6 +882,7 @@ const commands = {
       maxCalls,
       allowedTopics,
       allowedGoals: objectives.map(o => o.objective || o),
+      allowedTools,
       timeoutMs
     });
 
@@ -856,6 +919,9 @@ const commands = {
     console.log(`Expires: ${record.expires_at || 'never'}`);
     console.log(`Tier: ${record.tier}`);
     console.log(`Topics: ${record.allowed_topics.join(', ')}`);
+    if (Array.isArray(record.allowed_tools) && record.allowed_tools.length > 0) {
+      console.log(`Tools: ${record.allowed_tools.join(', ')}`);
+    }
     console.log(`Disclosure: ${record.disclosure}`);
     console.log(`Notify: ${record.notify}`);
     console.log(`Max calls: ${record.max_calls || 'unlimited'}`);
@@ -2117,6 +2183,9 @@ a2a add "${inviteUrl}" "${ownerText || 'friend'}" && a2a call "${ownerText || 'f
       });
     } else {
       console.log('  Using existing server.');
+      // Persist detected server port even when reusing an already-running process.
+      // Native app discovery depends on onboarding.server_port as a primary hint.
+      config.setOnboarding({ server_port: serverPort });
     }
     console.log('  ✅ A2A server is running');
 
@@ -2282,6 +2351,11 @@ a2a add "${inviteUrl}" "${ownerText || 'friend'}" && a2a call "${ownerText || 'f
     }
 
     if (action === 'install') {
+      if (os.platform() === 'darwin' && !force && !isOnboarded()) {
+        console.error('Onboarding not complete. Run `a2a quickstart` first, then install the app.');
+        console.error('Use `a2a app install --force` to bypass this check.');
+        process.exit(1);
+      }
       const result = installNativeMacApp({ force, quiet });
       if (result.skipped === 'not_macos') {
         console.error('Native app install is only available on macOS.');
@@ -2856,6 +2930,7 @@ Commands:
     --expires, -e     Expiration (1h, 1d, 7d, 30d, never)
     --permissions, -p Tier (public, friends, family)
     --topics          Custom topics (comma-separated, overrides tier defaults)
+    --tools           Custom tool allowlist (comma-separated, overrides tier defaults)
     --disclosure, -d  Disclosure level (public, minimal, none)
     --notify          Owner notification (all, summary, none)
     --max-calls       Maximum invocations (default: 100)
@@ -2904,7 +2979,7 @@ Calling:
   app                 Manage native macOS app
     status            Show native app installation status (default)
     install           Install/update native app from GitHub release
-      --force, -f     Reinstall even when current version is present
+      --force, -f     Reinstall/bypass onboarding guard
       --quiet, -q     Suppress download/extract output
     uninstall         Remove native app from ~/Applications
 
@@ -2939,6 +3014,7 @@ Server:
 Examples:
   a2a create --name "bappybot" --owner "Benjamin Pollack" --expires 7d
   a2a create --name "custom" --topics "chat,calendar.read,email.read"
+  a2a create --name "research" --tools "Read,Grep,Glob,WebSearch,WebFetch"
   a2a contacts add a2a://host/fed_xxx --name "Alice" --owner "Alice Chen"
   a2a contacts link Alice tok_abc123
   a2a call Alice "Hello!"

package/docs/protocol.md

@@ -155,11 +155,11 @@ Example filters for `/logs`: `trace_id`, `conversation_id`, `token_id`, `error_c
 
 ## Permission Tiers
 
-| Tier | Default capabilities |
-|------|----------------------|
-| `public` | `context-read` |
-| `friends` | `context-read`, `calendar.read`, `email.read`, `search` |
-| `family` | `context-read`, `calendar`, `email`, `search`, `tools`, `memory` |
+| Tier | Default capabilities | Default `allowed_tools` |
+|------|----------------------|--------------------------|
+| `public` | `context-read` | `Read`, `Grep`, `Glob` |
+| `friends` | `context-read`, `calendar.read`, `email.read`, `search` | `Bash(readonly)`, `Read`, `Grep`, `Glob`, `WebSearch`, `WebFetch` |
+| `family` | `context-read`, `calendar`, `email`, `search`, `tools`, `memory` | `Bash`, `Read`, `Grep`, `Glob`, `WebSearch`, `WebFetch` |
 
 ## Disclosure Levels
 
@@ -184,6 +184,7 @@ Stored in `~/.config/openclaw/a2a.json`:
       "capabilities": ["context-read"],
       "allowed_topics": ["chat"],
       "allowed_goals": [],
+      "allowed_tools": ["Read", "Grep", "Glob"],
       "tier_settings": {},
       "disclosure": "minimal",
       "notify": "all",

package/native/macos/index.html

@@ -62,7 +62,7 @@
         <span class="status-indicator searching"></span>
         Looking for a2a server...
       </p>
-      <p class="port-info" id="port-info">Scanning ports: 3001, 80, 8080, 8443, 9001</p>
+      <p class="port-info" id="port-info">Scanning ports: 80, 3001, 8080, 8443, 9001</p>
     </div>
 
     <div id="status-not-found" style="display:none;">
@@ -86,10 +86,22 @@
   </div>
 
   <script>
-    const { invoke } = window.__TAURI__.core;
+    const tauriCore = window.__TAURI__ && window.__TAURI__.core;
+    const tauriEvents = window.__TAURI__ && window.__TAURI__.event;
+    const legacyInvoke = window.__TAURI_INTERNALS__ && window.__TAURI_INTERNALS__.invoke;
+    const invoke = (tauriCore && tauriCore.invoke)
+      ? tauriCore.invoke
+      : (legacyInvoke ? ((cmd, args) => legacyInvoke(cmd, args)) : null);
 
     async function checkServer() {
       show('status-searching');
+      if (!invoke) {
+        show('status-not-found');
+        const detail = document.getElementById('error-detail');
+        detail.textContent = 'Tauri bridge unavailable. Reinstall with `a2a app install --force`.';
+        detail.style.display = 'block';
+        return;
+      }
       try {
         const result = await invoke('discover_server');
         if (result.port) {
@@ -132,16 +144,16 @@
     checkServer();
 
     // Listen for server disconnect/reconnect from Tauri backend
-    const { listen } = window.__TAURI__.event;
-
-    listen('server-status', (event) => {
-      const { connected, port } = event.payload;
-      if (!connected) {
-        showReconnectionOverlay();
-      } else {
-        hideReconnectionOverlay();
-      }
-    });
+    if (tauriEvents && tauriEvents.listen) {
+      tauriEvents.listen('server-status', (event) => {
+        const { connected } = event.payload;
+        if (!connected) {
+          showReconnectionOverlay();
+        } else {
+          hideReconnectionOverlay();
+        }
+      });
+    }
 
     function showReconnectionOverlay() {
       if (document.getElementById('reconnect-overlay')) return;

package/native/macos/package-lock.json

@@ -0,0 +1,232 @@
+{
+  "name": "a2a-callbook-macos",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "a2a-callbook-macos",
+      "version": "0.1.0",
+      "devDependencies": {
+        "@tauri-apps/cli": "^2.10.0"
+      }
+    },
+    "node_modules/@tauri-apps/cli": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.10.0.tgz",
+      "integrity": "sha512-ZwT0T+7bw4+DPCSWzmviwq5XbXlM0cNoleDKOYPFYqcZqeKY31KlpoMW/MOON/tOFBPgi31a2v3w9gliqwL2+Q==",
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "bin": {
+        "tauri": "tauri.js"
+      },
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/tauri"
+      },
+      "optionalDependencies": {
+        "@tauri-apps/cli-darwin-arm64": "2.10.0",
+        "@tauri-apps/cli-darwin-x64": "2.10.0",
+        "@tauri-apps/cli-linux-arm-gnueabihf": "2.10.0",
+        "@tauri-apps/cli-linux-arm64-gnu": "2.10.0",
+        "@tauri-apps/cli-linux-arm64-musl": "2.10.0",
+        "@tauri-apps/cli-linux-riscv64-gnu": "2.10.0",
+        "@tauri-apps/cli-linux-x64-gnu": "2.10.0",
+        "@tauri-apps/cli-linux-x64-musl": "2.10.0",
+        "@tauri-apps/cli-win32-arm64-msvc": "2.10.0",
+        "@tauri-apps/cli-win32-ia32-msvc": "2.10.0",
+        "@tauri-apps/cli-win32-x64-msvc": "2.10.0"
+      }
+    },
+    "node_modules/@tauri-apps/cli-darwin-arm64": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.10.0.tgz",
+      "integrity": "sha512-avqHD4HRjrMamE/7R/kzJPcAJnZs0IIS+1nkDP5b+TNBn3py7N2aIo9LIpy+VQq0AkN8G5dDpZtOOBkmWt/zjA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-darwin-x64": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.10.0.tgz",
+      "integrity": "sha512-keDmlvJRStzVFjZTd0xYkBONLtgBC9eMTpmXnBXzsHuawV2q9PvDo2x6D5mhuoMVrJ9QWjgaPKBBCFks4dK71Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.10.0.tgz",
+      "integrity": "sha512-e5u0VfLZsMAC9iHaOEANumgl6lfnJx0Dtjkd8IJpysZ8jp0tJ6wrIkto2OzQgzcYyRCKgX72aKE0PFgZputA8g==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm64-gnu": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.10.0.tgz",
+      "integrity": "sha512-YrYYk2dfmBs5m+OIMCrb+JH/oo+4FtlpcrTCgiFYc7vcs6m3QDd1TTyWu0u01ewsCtK2kOdluhr/zKku+KP7HA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm64-musl": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.10.0.tgz",
+      "integrity": "sha512-GUoPdVJmrJRIXFfW3Rkt+eGK9ygOdyISACZfC/bCSfOnGt8kNdQIQr5WRH9QUaTVFIwxMlQyV3m+yXYP+xhSVA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.10.0.tgz",
+      "integrity": "sha512-JO7s3TlSxshwsoKNCDkyvsx5gw2QAs/Y2GbR5UE2d5kkU138ATKoPOtxn8G1fFT1aDW4LH0rYAAfBpGkDyJJnw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-x64-gnu": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.10.0.tgz",
+      "integrity": "sha512-Uvh4SUUp4A6DVRSMWjelww0GnZI3PlVy7VS+DRF5napKuIehVjGl9XD0uKoCoxwAQBLctvipyEK+pDXpJeoHng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-x64-musl": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.10.0.tgz",
+      "integrity": "sha512-AP0KRK6bJuTpQ8kMNWvhIpKUkQJfcPFeba7QshOQZjJ8wOS6emwTN4K5g/d3AbCMo0RRdnZWwu67MlmtJyxC1Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-arm64-msvc": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.10.0.tgz",
+      "integrity": "sha512-97DXVU3dJystrq7W41IX+82JEorLNY+3+ECYxvXWqkq7DBN6FsA08x/EFGE8N/b0LTOui9X2dvpGGoeZKKV08g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-ia32-msvc": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.10.0.tgz",
+      "integrity": "sha512-EHyQ1iwrWy1CwMalEm9z2a6L5isQ121pe7FcA2xe4VWMJp+GHSDDGvbTv/OPdkt2Lyr7DAZBpZHM6nvlHXEc4A==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-x64-msvc": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.10.0.tgz",
+      "integrity": "sha512-NTpyQxkpzGmU6ceWBTY2xRIEaS0ZLbVx1HE1zTA3TY/pV3+cPoPPOs+7YScr4IMzXMtOw7tLw5LEXo5oIG3qaQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    }
+  }
+}

package/native/macos/src-tauri/src/discovery.rs

@@ -2,7 +2,7 @@ use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 use std::time::Duration;
 
-const DEFAULT_PORTS: &[u16] = &[3001, 80, 8080, 8443, 9001];
+const DEFAULT_PORTS: &[u16] = &[80, 3001, 8080, 8443, 9001];
 const PROBE_TIMEOUT: Duration = Duration::from_millis(800);
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -14,15 +14,57 @@ pub struct DiscoveryResult {
 #[derive(Debug, Deserialize)]
 struct A2AConfig {
     onboarding: Option<OnboardingConfig>,
+    agent: Option<AgentConfig>,
 }
 
 #[derive(Debug, Deserialize)]
 struct OnboardingConfig {
+    #[serde(alias = "serverPort")]
     server_port: Option<u16>,
 }
 
-/// Read port from ~/.config/openclaw/a2a-config.json
-pub fn read_config_port() -> Option<u16> {
+#[derive(Debug, Deserialize)]
+struct AgentConfig {
+    hostname: Option<String>,
+}
+
+fn parse_port_from_hostname(hostname: &str) -> Option<u16> {
+    let trimmed = hostname.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    // Allow values like:
+    // - 149.28.213.47:3007
+    // - localhost:3007
+    // - http://localhost:3007
+    // - [::1]:3007
+    let without_scheme = trimmed.split("://").nth(1).unwrap_or(trimmed);
+    let host_segment = without_scheme.split('/').next().unwrap_or(without_scheme);
+
+    if host_segment.starts_with('[') {
+        let end = host_segment.find(']')?;
+        let remainder = &host_segment[end + 1..];
+        let port_str = remainder.strip_prefix(':')?;
+        return port_str.parse::<u16>().ok();
+    }
+
+    // Bare IPv6 literals contain multiple colons and no explicit port delimiter.
+    if host_segment.matches(':').count() > 1 {
+        return None;
+    }
+
+    let (_, port_str) = host_segment.rsplit_once(':')?;
+    if !port_str.chars().all(|ch| ch.is_ascii_digit()) {
+        return None;
+    }
+
+    port_str.parse::<u16>().ok()
+}
+
+/// Read likely server ports from ~/.config/openclaw/a2a-config.json.
+/// We prefer explicit onboarding server_port, then agent.hostname port.
+pub fn read_config_ports() -> Vec<u16> {
     let config_dir = std::env::var("A2A_CONFIG_DIR")
         .or_else(|_| std::env::var("OPENCLAW_CONFIG_DIR"))
         .map(PathBuf::from)
@@ -34,14 +76,36 @@ pub fn read_config_port() -> Option<u16> {
         });
 
     let config_path = config_dir.join("a2a-config.json");
-    let content = std::fs::read_to_string(config_path).ok()?;
-    let config: A2AConfig = serde_json::from_str(&content).ok()?;
-    config.onboarding?.server_port
+    let content = match std::fs::read_to_string(config_path) {
+        Ok(data) => data,
+        Err(_) => return vec![],
+    };
+    let config: A2AConfig = match serde_json::from_str(&content) {
+        Ok(parsed) => parsed,
+        Err(_) => return vec![],
+    };
+
+    let mut ports = Vec::new();
+
+    if let Some(port) = config.onboarding.and_then(|ob| ob.server_port) {
+        ports.push(port);
+    }
+
+    if let Some(port) = config
+        .agent
+        .and_then(|agent| agent.hostname)
+        .and_then(|hostname| parse_port_from_hostname(&hostname))
+    {
+        if !ports.contains(&port) {
+            ports.push(port);
+        }
+    }
+
+    ports
 }
 
 /// Probe a single port — returns true if a2a server responds
 async fn probe_port(port: u16) -> bool {
-    let url = format!("http://127.0.0.1:{}/api/a2a/ping", port);
     let client = reqwest::Client::builder()
         .timeout(PROBE_TIMEOUT)
         .build();
@@ -51,16 +115,36 @@ async fn probe_port(port: u16) -> bool {
         Err(_) => return false,
     };
 
-    match client.get(&url).send().await {
-        Ok(resp) => resp.status().is_success(),
-        Err(_) => false,
+    for host in ["127.0.0.1", "localhost"] {
+        let url = format!("http://{}:{}/api/a2a/ping", host, port);
+        let ok = match client.get(&url).send().await {
+            Ok(resp) => {
+                if !resp.status().is_success() {
+                    false
+                } else {
+                    match resp.text().await {
+                        Ok(body) => body.contains("\"pong\":true"),
+                        Err(_) => false,
+                    }
+                }
+            }
+            Err(_) => false,
+        };
+
+        if ok {
+            return true;
+        }
     }
+
+    false
 }
 
 /// Discover the running a2a server
 pub async fn discover_server() -> DiscoveryResult {
-    // 1. Try config port first
-    if let Some(port) = read_config_port() {
+    let config_ports = read_config_ports();
+
+    // 1. Try config-derived ports first
+    for &port in &config_ports {
         if probe_port(port).await {
             return DiscoveryResult {
                 port: Some(port),
@@ -69,8 +153,11 @@ pub async fn discover_server() -> DiscoveryResult {
         }
     }
 
-    // 2. Scan default ports
+    // 2. Scan default ports (skip those already checked from config)
     for &port in DEFAULT_PORTS {
+        if config_ports.contains(&port) {
+            continue;
+        }
         if probe_port(port).await {
             return DiscoveryResult {
                 port: Some(port),