a2acalling 0.6.73 → 0.6.75

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (134) hide show
  1. package/.a2a-manifest.json +2 -2
  2. package/.c8rc.json +16 -0
  3. package/.node-version +1 -0
  4. package/.serena/project.yml +126 -0
  5. package/ARCHITECTURE.md +40 -16
  6. package/CONVENTIONS.md +39 -6
  7. package/biome.json +27 -0
  8. package/coverage/base.css +224 -0
  9. package/coverage/block-navigation.js +87 -0
  10. package/coverage/favicon.png +0 -0
  11. package/coverage/index.html +146 -0
  12. package/coverage/prettify.css +1 -0
  13. package/coverage/prettify.js +2 -0
  14. package/coverage/sort-arrow-sprite.png +0 -0
  15. package/coverage/sorter.js +210 -0
  16. package/coverage/src/index.html +131 -0
  17. package/coverage/src/index.js.html +313 -0
  18. package/coverage/src/lib/agent-card.js.html +418 -0
  19. package/coverage/src/lib/call-monitor.js.html +700 -0
  20. package/coverage/src/lib/callbook.js.html +1183 -0
  21. package/coverage/src/lib/claude-subagent.js.html +2173 -0
  22. package/coverage/src/lib/client.js.html +2134 -0
  23. package/coverage/src/lib/config.js.html +1525 -0
  24. package/coverage/src/lib/conversation-driver.js.html +1909 -0
  25. package/coverage/src/lib/conversations.js.html +2575 -0
  26. package/coverage/src/lib/crypto.js.html +424 -0
  27. package/coverage/src/lib/dashboard-events.js.html +724 -0
  28. package/coverage/src/lib/disclosure.js.html +2461 -0
  29. package/coverage/src/lib/external-ip.js.html +718 -0
  30. package/coverage/src/lib/index.html +506 -0
  31. package/coverage/src/lib/invite-host.js.html +754 -0
  32. package/coverage/src/lib/local-request.js.html +292 -0
  33. package/coverage/src/lib/logger.js.html +2116 -0
  34. package/coverage/src/lib/openclaw-integration.js.html +1102 -0
  35. package/coverage/src/lib/pid-file.js.html +394 -0
  36. package/coverage/src/lib/port-scanner.js.html +334 -0
  37. package/coverage/src/lib/prompt-template.js.html +1150 -0
  38. package/coverage/src/lib/runtime-adapter.js.html +2188 -0
  39. package/coverage/src/lib/summarizer.js.html +553 -0
  40. package/coverage/src/lib/summary-formatter.js.html +589 -0
  41. package/coverage/src/lib/summary-prompt.js.html +694 -0
  42. package/coverage/src/lib/tokens.js.html +2689 -0
  43. package/coverage/src/lib/turn-timeout.js.html +241 -0
  44. package/coverage/src/lib/update-checker.js.html +364 -0
  45. package/coverage/src/lib/update-manager.js.html +1024 -0
  46. package/coverage/src/routes/a2a.js.html +3724 -0
  47. package/coverage/src/routes/callbook.js.html +511 -0
  48. package/coverage/src/routes/dashboard.js.html +4819 -0
  49. package/coverage/src/routes/index.html +146 -0
  50. package/coverage/src/server.js.html +3622 -0
  51. package/coverage/tmp/coverage-1605378-1772576706365-0.json +1 -0
  52. package/coverage/tmp/coverage-1605384-1772576607459-0.json +1 -0
  53. package/coverage/tmp/coverage-1605410-1772576631155-0.json +1 -0
  54. package/coverage/tmp/coverage-1606942-1772576636869-0.json +1 -0
  55. package/coverage/tmp/coverage-1607004-1772576637454-0.json +1 -0
  56. package/coverage/tmp/coverage-1607044-1772576637876-0.json +1 -0
  57. package/coverage/tmp/coverage-1607096-1772576638356-0.json +1 -0
  58. package/coverage/tmp/coverage-1607145-1772576638777-0.json +1 -0
  59. package/coverage/tmp/coverage-1607201-1772576639277-0.json +1 -0
  60. package/coverage/tmp/coverage-1607247-1772576639755-0.json +1 -0
  61. package/coverage/tmp/coverage-1607317-1772576640083-0.json +1 -0
  62. package/coverage/tmp/coverage-1607381-1772576640465-0.json +1 -0
  63. package/coverage/tmp/coverage-1607446-1772576640868-0.json +1 -0
  64. package/coverage/tmp/coverage-1607501-1772576641662-0.json +1 -0
  65. package/coverage/tmp/coverage-1607534-1772576641565-0.json +1 -0
  66. package/coverage/tmp/coverage-1607627-1772576641871-0.json +1 -0
  67. package/coverage/tmp/coverage-1607665-1772576642172-0.json +1 -0
  68. package/coverage/tmp/coverage-1607714-1772576642577-0.json +1 -0
  69. package/coverage/tmp/coverage-1607788-1772576643466-0.json +1 -0
  70. package/coverage/tmp/coverage-1607924-1772576644678-0.json +1 -0
  71. package/coverage/tmp/coverage-1607978-1772576645154-0.json +1 -0
  72. package/coverage/tmp/coverage-1608035-1772576645564-0.json +1 -0
  73. package/coverage/tmp/coverage-1608106-1772576645967-0.json +1 -0
  74. package/coverage/tmp/coverage-1608179-1772576648656-0.json +1 -0
  75. package/coverage/tmp/coverage-1608196-1772576647367-0.json +1 -0
  76. package/coverage/tmp/coverage-1608217-1772576648557-0.json +1 -0
  77. package/coverage/tmp/coverage-1608256-1772576651378-0.json +1 -0
  78. package/coverage/tmp/coverage-1608265-1772576650058-0.json +1 -0
  79. package/coverage/tmp/coverage-1608289-1772576651358-0.json +1 -0
  80. package/coverage/tmp/coverage-1608591-1772576660465-0.json +1 -0
  81. package/coverage/tmp/coverage-1608648-1772576659272-0.json +1 -0
  82. package/coverage/tmp/coverage-1608665-1772576660374-0.json +1 -0
  83. package/coverage/tmp/coverage-1608677-1772576661268-0.json +1 -0
  84. package/coverage/tmp/coverage-1608684-1772576663968-0.json +1 -0
  85. package/coverage/tmp/coverage-1608692-1772576662575-0.json +1 -0
  86. package/coverage/tmp/coverage-1608701-1772576663873-0.json +1 -0
  87. package/coverage/tmp/coverage-1608718-1772576666674-0.json +1 -0
  88. package/coverage/tmp/coverage-1608725-1772576665463-0.json +1 -0
  89. package/coverage/tmp/coverage-1608738-1772576666577-0.json +1 -0
  90. package/coverage/tmp/coverage-1608753-1772576669664-0.json +1 -0
  91. package/coverage/tmp/coverage-1608763-1772576668275-0.json +1 -0
  92. package/coverage/tmp/coverage-1608771-1772576669563-0.json +1 -0
  93. package/coverage/tmp/coverage-1608828-1772576676574-0.json +1 -0
  94. package/coverage/tmp/coverage-1609244-1772576675272-0.json +1 -0
  95. package/coverage/tmp/coverage-1609342-1772576676478-0.json +1 -0
  96. package/coverage/tmp/coverage-1609450-1772576686954-0.json +1 -0
  97. package/coverage/tmp/coverage-1609841-1772576685466-0.json +1 -0
  98. package/coverage/tmp/coverage-1609925-1772576686855-0.json +1 -0
  99. package/coverage/tmp/coverage-1610399-1772576692469-0.json +1 -0
  100. package/coverage/tmp/coverage-1611283-1772576703062-0.json +1 -0
  101. package/coverage/tmp/coverage-1611294-1772576703755-0.json +1 -0
  102. package/docs/assessments/2026-02-27-google-a2a-protocol-assessment.md +292 -0
  103. package/docs/plans/2026-03-01-a2a-68-openclaw-integration-tests.md +676 -0
  104. package/docs/plans/2026-03-01-a2a-77-invoke-security-tests.md +661 -0
  105. package/docs/plans/2026-03-03-a2a-91-macos-packaging-plan.md +144 -0
  106. package/docs/signing-setup.md +49 -0
  107. package/eslint.config.js +16 -0
  108. package/knip.json +17 -0
  109. package/native/macos/certs/appldevcert.cer +0 -0
  110. package/native/macos/src-tauri/binaries/.gitkeep +0 -0
  111. package/native/macos/src-tauri/capabilities/default.json +11 -1
  112. package/native/macos/src-tauri/entitlements.plist +14 -0
  113. package/native/macos/src-tauri/src/discovery.rs +14 -3
  114. package/native/macos/src-tauri/src/health.rs +4 -0
  115. package/native/macos/src-tauri/src/lib.rs +52 -11
  116. package/native/macos/src-tauri/src/server.rs +262 -26
  117. package/native/macos/src-tauri/tauri.conf.json +13 -4
  118. package/package.json +16 -2
  119. package/pkg.config.json +14 -0
  120. package/scripts/build-standalone.sh +106 -0
  121. package/scripts/install-openclaw.js +3 -5
  122. package/scripts/smoke-test-standalone.sh +101 -0
  123. package/scripts/sync-version.sh +28 -0
  124. package/scripts/verify-app-bundle.sh +34 -0
  125. package/src/lib/agent-card.js +111 -0
  126. package/src/lib/client.js +290 -49
  127. package/src/lib/conversations.js +2 -0
  128. package/src/lib/local-request.js +69 -0
  129. package/src/lib/logger.js +2 -0
  130. package/src/lib/runtime-adapter.js +41 -1
  131. package/src/routes/a2a.js +393 -66
  132. package/src/routes/dashboard.js +1 -27
  133. package/src/server.js +19 -0
  134. package/.maestro/inbox/release-workflow-spam.md +0 -25
@@ -1,6 +1,6 @@
1
1
  {
2
- "version": "0.6.73",
3
- "installed_at": "2026-02-27T06:20:51.170Z",
2
+ "version": "0.6.75",
3
+ "installed_at": "2026-03-05T03:06:09.478Z",
4
4
  "files": [
5
5
  {
6
6
  "path": "CLAUDE.md",
package/.c8rc.json ADDED
@@ -0,0 +1,16 @@
1
+ {
2
+ "all": true,
3
+ "src": ["src/"],
4
+ "exclude": [
5
+ "test/**",
6
+ "node_modules/**",
7
+ "native/**",
8
+ "a2atesting/**",
9
+ "scripts/**",
10
+ "bin/**",
11
+ "docs/**",
12
+ "src/dashboard/public/**"
13
+ ],
14
+ "reporter": ["text", "html"],
15
+ "report-dir": "coverage"
16
+ }
package/.node-version ADDED
@@ -0,0 +1 @@
1
+ 20
@@ -0,0 +1,126 @@
1
+
2
+ # list of tool names to exclude. We recommend not excluding any tools, see the readme for more details.
3
+ # Below is the complete list of tools for convenience.
4
+ # To make sure you have the latest list of tools, and to view their descriptions,
5
+ # execute `uv run scripts/print_tool_overview.py`.
6
+ #
7
+ # * `activate_project`: Activates a project by name.
8
+ # * `check_onboarding_performed`: Checks whether project onboarding was already performed.
9
+ # * `create_text_file`: Creates/overwrites a file in the project directory.
10
+ # * `delete_lines`: Deletes a range of lines within a file.
11
+ # * `delete_memory`: Deletes a memory from Serena's project-specific memory store.
12
+ # * `execute_shell_command`: Executes a shell command.
13
+ # * `find_referencing_code_snippets`: Finds code snippets in which the symbol at the given location is referenced.
14
+ # * `find_referencing_symbols`: Finds symbols that reference the symbol at the given location (optionally filtered by type).
15
+ # * `find_symbol`: Performs a global (or local) search for symbols with/containing a given name/substring (optionally filtered by type).
16
+ # * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes.
17
+ # * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file.
18
+ # * `initial_instructions`: Gets the initial instructions for the current project.
19
+ # Should only be used in settings where the system prompt cannot be set,
20
+ # e.g. in clients you have no control over, like Claude Desktop.
21
+ # * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol.
22
+ # * `insert_at_line`: Inserts content at a given line in a file.
23
+ # * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol.
24
+ # * `list_dir`: Lists files and directories in the given directory (optionally with recursion).
25
+ # * `list_memories`: Lists memories in Serena's project-specific memory store.
26
+ # * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building).
27
+ # * `prepare_for_new_conversation`: Provides instructions for preparing for a new conversation (in order to continue with the necessary context).
28
+ # * `read_file`: Reads a file within the project directory.
29
+ # * `read_memory`: Reads the memory with the given name from Serena's project-specific memory store.
30
+ # * `remove_project`: Removes a project from the Serena configuration.
31
+ # * `replace_lines`: Replaces a range of lines within a file with new content.
32
+ # * `replace_symbol_body`: Replaces the full definition of a symbol.
33
+ # * `restart_language_server`: Restarts the language server, may be necessary when edits not through Serena happen.
34
+ # * `search_for_pattern`: Performs a search for a pattern in the project.
35
+ # * `summarize_changes`: Provides instructions for summarizing the changes made to the codebase.
36
+ # * `switch_modes`: Activates modes by providing a list of their names
37
+ # * `think_about_collected_information`: Thinking tool for pondering the completeness of collected information.
38
+ # * `think_about_task_adherence`: Thinking tool for determining whether the agent is still on track with the current task.
39
+ # * `think_about_whether_you_are_done`: Thinking tool for determining whether the task is truly completed.
40
+ # * `write_memory`: Writes a named memory (for future reference) to Serena's project-specific memory store.
41
+ excluded_tools: []
42
+
43
+ # list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default)
44
+ included_optional_tools: []
45
+
46
+ # fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
47
+ # This cannot be combined with non-empty excluded_tools or included_optional_tools.
48
+ fixed_tools: []
49
+
50
+ # list of mode names to that are always to be included in the set of active modes
51
+ # The full set of modes to be activated is base_modes + default_modes.
52
+ # If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
53
+ # Otherwise, this setting overrides the global configuration.
54
+ # Set this to [] to disable base modes for this project.
55
+ # Set this to a list of mode names to always include the respective modes for this project.
56
+ base_modes:
57
+
58
+ # list of mode names that are to be activated by default.
59
+ # The full set of modes to be activated is base_modes + default_modes.
60
+ # If the setting is undefined, the default_modes from the global configuration (serena_config.yml) apply.
61
+ # Otherwise, this overrides the setting from the global configuration (serena_config.yml).
62
+ # This setting can, in turn, be overridden by CLI parameters (--mode).
63
+ default_modes:
64
+
65
+ # time budget (seconds) per tool call for the retrieval of additional symbol information
66
+ # such as docstrings or parameter information.
67
+ # This overrides the corresponding setting in the global configuration; see the documentation there.
68
+ # If null or missing, use the setting from the global configuration.
69
+ symbol_info_budget:
70
+
71
+ # The language backend to use for this project.
72
+ # If not set, the global setting from serena_config.yml is used.
73
+ # Valid values: LSP, JetBrains
74
+ # Note: the backend is fixed at startup. If a project with a different backend
75
+ # is activated post-init, an error will be returned.
76
+ language_backend:
77
+
78
+ # list of additional paths to ignore in this project.
79
+ # Same syntax as gitignore, so you can use * and **.
80
+ # Note: global ignored_paths from serena_config.yml are also applied additively.
81
+ ignored_paths: []
82
+
83
+ # whether the project is in read-only mode
84
+ # If set to true, all editing tools will be disabled and attempts to use them will result in an error
85
+ # Added on 2025-04-18
86
+ read_only: false
87
+
88
+ # whether to use project's .gitignore files to ignore files
89
+ ignore_all_files_in_gitignore: true
90
+
91
+ # initial prompt for the project. It will always be given to the LLM upon activating the project
92
+ # (contrary to the memories, which are loaded on demand).
93
+ initial_prompt: ''
94
+
95
+ # the encoding used by text files in the project
96
+ # For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
97
+ encoding: utf-8
98
+
99
+
100
+ # list of languages for which language servers are started; choose from:
101
+ # al bash clojure cpp csharp
102
+ # csharp_omnisharp dart elixir elm erlang
103
+ # fortran fsharp go groovy haskell
104
+ # java julia kotlin lua markdown
105
+ # matlab nix pascal perl php
106
+ # php_phpactor powershell python python_jedi r
107
+ # rego ruby ruby_solargraph rust scala
108
+ # swift terraform toml typescript typescript_vts
109
+ # vue yaml zig
110
+ # (This list may be outdated. For the current list, see values of Language enum here:
111
+ # https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
112
+ # For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
113
+ # Note:
114
+ # - For C, use cpp
115
+ # - For JavaScript, use typescript
116
+ # - For Free Pascal/Lazarus, use pascal
117
+ # Special requirements:
118
+ # Some languages require additional setup/installations.
119
+ # See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
120
+ # When using multiple languages, the first language server that supports a given file will be used for that file.
121
+ # The first language is the default language and the respective language server will be used as a fallback.
122
+ # Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
123
+ languages:
124
+ - typescript
125
+ # the name by which the project can be referenced within Serena
126
+ project_name: a2acalling
package/ARCHITECTURE.md CHANGED
@@ -7,14 +7,15 @@ A2A Calling enables agent-to-agent communication across OpenClaw instances. Agen
7
7
  ```
8
8
  ┌──────────────────────────────────────────────────────────────────┐
9
9
  │ CLI (bin/cli.js) │
10
- │ Commands: create, list, revoke, call, contacts, conversations
10
+ │ Commands: create/list/revoke/call + ops commands (quickstart, gui, update, app, skills)
11
11
  └───────────┬──────────────────────────────────────────────────────┘
12
12
 
13
13
  ┌───────────▼──────────────────────────────────────────────────────┐
14
14
  │ Express Server (src/server.js) │
15
- │ ├─ /api/a2a/* → src/routes/a2a.js (inbound calls, tokens)
16
- │ ├─ /api/callbook/* → src/routes/callbook.js (callbook sync)
17
- └─ /dashboard/* → src/routes/dashboard.js (API + SPA)
15
+ │ ├─ /api/a2a/* (invoke/end/message:send/agent-card/tokens/admin) → src/routes/a2a.js │
16
+ │ ├─ /api/a2a/callbook/* + /callbook/* → src/routes/callbook.js
17
+ ├─ /api/a2a/dashboard/* + /dashboard/* → src/routes/dashboard.js
18
+ │ └─ /.well-known/a2a-agent-card → src/lib/agent-card.js │
18
19
  └───────────┬──────────────────────────────────────────────────────┘
19
20
 
20
21
  ┌───────────▼──────────────────────────────────────────────────────┐
@@ -26,22 +27,24 @@ A2A Calling enables agent-to-agent communication across OpenClaw instances. Agen
26
27
  │ ├─ summarizer.js Call summary generation │
27
28
  │ ├─ summary-prompt.js Unified summary prompt builder │
28
29
  │ ├─ summary-formatter.js Format summaries for display │
29
- │ ├─ disclosure.js Disclosure level enforcement
30
+ │ ├─ disclosure.js Disclosure manifest loading + tier merging
30
31
  │ ├─ config.js Config file management │
31
32
  │ ├─ crypto.js Ed25519 identity keypair + signing │
33
+ │ ├─ agent-card.js Google A2A Agent Card generation │
32
34
  │ ├─ logger.js Structured logger (SQLite + stdout) │
33
35
  │ ├─ call-monitor.js Active call monitoring │
34
36
  │ ├─ callbook.js Contact/callbook management │
35
37
  │ ├─ claude-subagent.js Claude API integration for summaries │
36
38
  │ ├─ openclaw-integration.js OpenClaw runtime hooks │
37
39
  │ ├─ prompt-template.js Prompt template utilities │
38
- │ ├─ runtime-adapter.js Runtime mode detection (standalone/OCW)
40
+ │ ├─ runtime-adapter.js Runtime mode detection (openclaw/claude/test)
39
41
  │ ├─ dashboard-events.js SSE event broadcasting │
40
42
  │ ├─ external-ip.js External IP/hostname detection │
41
43
  │ ├─ invite-host.js Invite URL construction │
42
44
  │ ├─ port-scanner.js Available port detection │
43
45
  │ ├─ pid-file.js PID file management │
44
46
  │ ├─ turn-timeout.js Conversation turn timeout handling │
47
+ │ ├─ local-request.js Proxy-aware local request detection (A2A-73) │
45
48
  │ ├─ update-checker.js Version update detection │
46
49
  │ └─ update-manager.js Self-update orchestration │
47
50
  └──────────────────────────────────────────────────────────────────┘
@@ -50,8 +53,10 @@ A2A Calling enables agent-to-agent communication across OpenClaw instances. Agen
50
53
  ## Data Storage
51
54
 
52
55
  - **Tokens**: JSON file at `~/.config/openclaw/a2a.json`
53
- - **Conversations**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-conversations.db`
54
- - **Logs**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-logs.db`
56
+ - **Conversations**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-conversations.db` (WAL mode, A2A-71)
57
+ - **Logs**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-logs.db` (WAL mode, A2A-71)
58
+ - **Callbook**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-callbook.db`
59
+ - **Dashboard Events**: SQLite via `better-sqlite3` at `~/.config/openclaw/a2a-events.db`
55
60
  - **Config**: JSON at `~/.config/openclaw/a2a-config.json`
56
61
  - **Disclosure**: JSON at `~/.config/openclaw/a2a-disclosure.json`
57
62
 
@@ -72,29 +77,48 @@ Three tiers with escalating capabilities:
72
77
  - **friends**: `context-read`, `calendar.read`, `email.read`, `search`
73
78
  - **family**: `context-read`, `calendar`, `email`, `search`, `tools`, `memory`
74
79
 
75
- Three disclosure levels controlling information sharing:
76
- - **public**: Shares freely within tier boundaries
77
- - **minimal**: Direct answers only, no volunteered context
78
- - **none**: Confirms capability, provides no information
80
+ Disclosure policy is manifest-driven (`~/.config/openclaw/a2a-disclosure.json`), not a token/tier `disclosure` field:
81
+ - Per-tier `topics`, `objectives`, and `do_not_discuss` are loaded from the disclosure manifest
82
+ - Global `never_disclose` always applies
83
+ - Tier inheritance is enforced in prompt construction (`friends` includes `public`; `family` includes `friends` + `public`)
79
84
 
80
85
  ## Dependencies
81
86
 
82
87
  Only two runtime dependencies (intentionally minimal):
83
88
  - `express` — HTTP server and routing
84
- - `better-sqlite3` — SQLite for conversations and logs
89
+ - `better-sqlite3` — SQLite for conversations, logs, callbook, and dashboard events
85
90
 
86
91
  ## Dashboard
87
92
 
88
- Single-page app served from `src/dashboard/public/`. Uses Shoelace web components. Communicates with the API via `/dashboard/api/*` routes. Includes tabs: Contacts, Calls, Logs, Settings, Invites, Permissions, and Health (E2E test results).
93
+ Single-page app served from `src/dashboard/public/`. Uses Shoelace web components. Communicates with the API via `/api/a2a/dashboard/*` routes. UI is served at both `/api/a2a/dashboard/*` and legacy `/dashboard/*` mounts. Includes panels: Contacts, Calls, Permissions, Invites, Logs, Health (E2E test results), and Settings.
89
94
 
90
95
  ## Native macOS App
91
96
 
92
97
  Tauri v2 app at `native/macos/` wrapping the dashboard SPA. Provides native menus, notifications, and server lifecycle management.
93
98
 
99
+ Runtime behavior:
100
+ - App startup uses a sidecar-first strategy (`app.shell().sidecar("a2a-server")`) from `native/macos/src-tauri/src/server.rs`
101
+ - If sidecar spawn fails, it falls back to starting an external `a2a` CLI process
102
+ - Sidecar exits are monitored with bounded auto-restart and exponential backoff (up to 5 consecutive crashes)
103
+ - Sidecar logs are bridged to the UI via emitted events
104
+
105
+ Packaging:
106
+ - The standalone server binary is built from `src/server.js` via `scripts/build-standalone.sh` using `@yao-pkg/pkg`
107
+ - Output binaries live at `native/macos/src-tauri/binaries/a2a-server-*`
108
+ - Tauri release builds bundle the app artifacts (`.dmg`, `.app.tar.gz`) via `.github/workflows/tauri-build.yml`
109
+
94
110
  ## Identity Verification
95
111
 
96
112
  Ed25519 cryptographic identity for agents. Each instance generates a keypair on first run (stored in config). Outbound calls sign messages; inbound calls verify signatures. Uses Node.js built-in `crypto.sign`/`crypto.verify` — no external dependencies. See `src/lib/crypto.js`.
97
113
 
114
+ ## Google A2A Compatibility
115
+
116
+ Inbound compatibility endpoints are implemented in `src/routes/a2a.js`:
117
+ - `POST /api/a2a/message:send` (Google A2A wire format ingress mapped into internal invoke flow)
118
+ - `GET /api/a2a/agent-card` and `GET /.well-known/a2a-agent-card` (Agent Card discovery via `src/lib/agent-card.js`)
119
+
120
+ Outbound calls auto-detect Google A2A remotes via Agent Card (`GET /.well-known/a2a-agent-card`, cached 5 min with prune-on-access eviction). When detected, `A2AClient.call()` sends via `message:send` format with response translation to the internal `{ response, conversation_id, can_continue }` shape; `end()` returns a synthetic `{ ended: true, summary: null }`. See `src/lib/client.js` (A2A-80).
121
+
98
122
  ## Testing
99
123
 
100
124
  Zero-dependency test runner at `test/run.js` with custom assert API. Three test tiers:
@@ -104,8 +128,8 @@ Zero-dependency test runner at `test/run.js` with custom assert API. Three test
104
128
 
105
129
  Test profiles at `test/profiles/` represent real personas with distinct permission tiers.
106
130
 
107
- E2E test results are persisted to `~/.config/openclaw/a2a-e2e-results.json` via `test/e2e/persist.js` and surfaced in the dashboard Health tab. The `scripts/run-e2e.sh` orchestrator runs E2E suites and stores results.
131
+ E2E test results are persisted to `~/.config/openclaw/test-results/` via `test/e2e/persist.js` (timestamped `result-*.json` plus `latest.json`) and surfaced in the dashboard Health tab. The `scripts/run-e2e.sh` orchestrator runs E2E suites and stores results.
108
132
 
109
133
  ## Network Resilience
110
134
 
111
- The outbound A2A client (`src/lib/client.js`) retries transient network failures (ECONNRESET, ECONNREFUSED, EPIPE, ENOTFOUND, EAI_AGAIN, timeouts) with exponential backoff (0s, 1s, 2s). HTTP 4xx/5xx errors are not retried. All response accumulation is capped at 2MB to prevent OOM from malicious remotes.
135
+ The outbound A2A client (`src/lib/client.js`) retries transient network failures (ECONNRESET, ECONNREFUSED, EPIPE, ENOTFOUND, EAI_AGAIN, timeouts) with exponential backoff (0s, 1s, 2s). HTTP 4xx/5xx errors are not retried. All response accumulation is capped at 2MB to prevent OOM from malicious remotes. These retry and size-cap mechanisms apply equally to Google A2A outbound calls via the same `withRetry()` and `handleSizeCappedResponse()` functions (A2A-80).
package/CONVENTIONS.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  ## Logging
4
4
 
5
- Use the structured logger from `src/lib/logger.js`. Never use bare `console.log`.
5
+ For runtime/server code under `src/`, use the structured logger from `src/lib/logger.js`. Keep bare `console.log`/`console.error` limited to CLI/setup/test entrypoints (for user-facing terminal output) and the logger sink implementation in `src/lib/logger.js`.
6
6
 
7
7
  ```js
8
8
  const { createLogger } = require('./logger');
@@ -46,7 +46,7 @@ Do NOT add new npm dependencies without explicit justification. Use Node.js buil
46
46
 
47
47
  ## Module Pattern
48
48
 
49
- All modules use CommonJS (`require`/`module.exports`). Each lib file exports a focused API. Large modules export a class (e.g., `TokenStore`, `ConversationStore`, `A2AClient`). Utility modules export functions.
49
+ Runtime/server modules use CommonJS (`require`/`module.exports`). Each lib file exports a focused API. Large modules export a class (e.g., `TokenStore`, `ConversationStore`, `A2AClient`). Utility modules export functions. Tooling scripts in this repo currently use CommonJS as well; only introduce ESM if a host integration requires it, and keep module style consistent within a file.
50
50
 
51
51
  ## Naming
52
52
 
@@ -61,10 +61,10 @@ All modules use CommonJS (`require`/`module.exports`). Each lib file exports a f
61
61
 
62
62
  - Single-page app in `src/dashboard/public/`
63
63
  - Uses Shoelace web components (`<sl-*>` elements)
64
- - Communicates via fetch to `/dashboard/api/*` endpoints
64
+ - Communicates via fetch to `/api/a2a/dashboard/*` endpoints
65
65
  - SSE for real-time updates via `src/lib/dashboard-events.js`
66
66
  - Dark theme is the default; uses CSS custom properties for theming
67
- - Sidebar navigation with tab switching (Contacts, Calls, Invites, Logs, Settings, Permissions, Health)
67
+ - Sidebar navigation with panel switching (Contacts, Calls, Permissions, Invites, Logs, Health, Settings)
68
68
  - Permissions tab uses tier cards with tool toggles and auto-save
69
69
  - Drag-and-drop uses event delegation on stable parent containers (`.perm-sidebar` for sidebar items, zone containers for drop targets) — do NOT bind listeners directly to innerHTML-generated elements (A2A-61)
70
70
 
@@ -105,7 +105,13 @@ close() {
105
105
 
106
106
  ## Permission Tiers
107
107
 
108
- Tokens have a tier (`public`, `friends`, `family`) and a disclosure level (`public`, `minimal`, `none`). These are enforced at the route level in `src/routes/a2a.js`.
108
+ Tokens carry a permissions tier (`public`, `friends`, `family`, `custom`). Disclosure policy is manifest-driven via `src/lib/disclosure.js` and tier inheritance in prompt/runtime paths.
109
+
110
+ Do not add new logic that depends on `tier.disclosure` or `token.disclosure` fields; those fields were removed from the core tier/token model.
111
+
112
+ ## Local Request Detection (A2A-73)
113
+
114
+ Use `isDirectLocalRequest(req)` from `src/lib/local-request.js` for admin/dashboard local-only checks. This helper validates loopback socket origin, localhost Host header, and absence of proxy-forwarding headers. Do NOT use raw `req.ip` comparison behind reverse proxies. The module also exports `isLoopbackAddress(ip)` for IP-only checks.
109
115
 
110
116
  ## Route Hardening (A2A-53)
111
117
 
@@ -126,9 +132,36 @@ All data stores implement retention cleanup following the `dashboard-events.js`
126
132
  - **Config defaults**: `A2AConfig.getRetention()` merges partial config with defaults — never writes defaults to disk
127
133
  - **Token grace period**: Expired tokens are kept for 1 hour after expiry (in-flight call protection)
128
134
 
135
+ ## Test Runtime (A2A-66)
136
+
137
+ `A2A_RUNTIME=test` provides a minimal runtime for CI and headless environments:
138
+ - `runTurn()`: if `A2A_AGENT_COMMAND` env var is set, spawns it with `shell: true` and JSON payload on stdin; otherwise echoes the message
139
+ - `summarize()`: returns canned `{ summary, ownerSummary }` — no LLM required
140
+ - `notify()`: no-op (same as claude mode)
141
+ - Non-zero exit from `A2A_AGENT_COMMAND` throws an error with stderr context
142
+ - The CI smoke lane (`a2atesting/a2acalling/scenarios/smoke-lane.js`) uses this mode
143
+
144
+ ## In-Memory Map Eviction (A2A-69)
145
+
146
+ For in-memory Maps that accumulate entries over time (e.g., `claudeSessions` in `runtime-adapter.js`), use the prune-on-access pattern:
147
+ - TTL eviction: delete entries older than a configurable threshold (checked via `updatedAt` timestamp)
148
+ - Max-entry eviction: delete oldest entries first when Map exceeds a configurable max size
149
+ - Prune runs at the start of the next operation (not on a timer) — zero overhead when idle
150
+ - Both thresholds configurable via environment variables
151
+ - Refresh `updatedAt` on every access to prevent evicting active entries
152
+
153
+ ## Native App Sidecar Lifecycle (A2A-93, A2A-96)
154
+
155
+ For native macOS server process management in `native/macos/src-tauri/src/server.rs`:
156
+ - Start with sidecar first (`a2a-server` bundled binary), then fall back to external `a2a` only if sidecar fails
157
+ - Track child process state in shared `SidecarState` and clear dead children on exit
158
+ - Use exponential backoff for restart attempts and enforce a hard crash cap to avoid restart loops
159
+ - Emit status/log events to the frontend for observability; do not silently retry in background
160
+ - During shutdown, set explicit shutdown state to prevent unintended auto-restart
161
+
129
162
  ## Anti-Patterns
130
163
 
131
- - Do NOT use `console.log` use the structured logger
164
+ - Do NOT use `console.log` outside the logger sink in `src/lib/logger.js`
132
165
  - Do NOT add npm dependencies for things Node.js builtins handle
133
166
  - Do NOT create new error classes — use existing patterns
134
167
  - Do NOT hardcode config paths — use config resolution
package/biome.json ADDED
@@ -0,0 +1,27 @@
1
+ {
2
+ "$schema": "https://biomejs.dev/schemas/2.4.4/schema.json",
3
+ "vcs": {
4
+ "enabled": true,
5
+ "clientKind": "git",
6
+ "useIgnoreFile": true
7
+ },
8
+ "files": {
9
+ "ignoreUnknown": false,
10
+ "includes": ["src/**/*.js"]
11
+ },
12
+ "formatter": {
13
+ "enabled": false
14
+ },
15
+ "linter": {
16
+ "enabled": true,
17
+ "rules": {
18
+ "recommended": true,
19
+ "correctness": {
20
+ "noUnusedVariables": "warn"
21
+ }
22
+ }
23
+ },
24
+ "assist": {
25
+ "enabled": false
26
+ }
27
+ }
@@ -0,0 +1,224 @@
1
+ body, html {
2
+ margin:0; padding: 0;
3
+ height: 100%;
4
+ }
5
+ body {
6
+ font-family: Helvetica Neue, Helvetica, Arial;
7
+ font-size: 14px;
8
+ color:#333;
9
+ }
10
+ .small { font-size: 12px; }
11
+ *, *:after, *:before {
12
+ -webkit-box-sizing:border-box;
13
+ -moz-box-sizing:border-box;
14
+ box-sizing:border-box;
15
+ }
16
+ h1 { font-size: 20px; margin: 0;}
17
+ h2 { font-size: 14px; }
18
+ pre {
19
+ font: 12px/1.4 Consolas, "Liberation Mono", Menlo, Courier, monospace;
20
+ margin: 0;
21
+ padding: 0;
22
+ -moz-tab-size: 2;
23
+ -o-tab-size: 2;
24
+ tab-size: 2;
25
+ }
26
+ a { color:#0074D9; text-decoration:none; }
27
+ a:hover { text-decoration:underline; }
28
+ .strong { font-weight: bold; }
29
+ .space-top1 { padding: 10px 0 0 0; }
30
+ .pad2y { padding: 20px 0; }
31
+ .pad1y { padding: 10px 0; }
32
+ .pad2x { padding: 0 20px; }
33
+ .pad2 { padding: 20px; }
34
+ .pad1 { padding: 10px; }
35
+ .space-left2 { padding-left:55px; }
36
+ .space-right2 { padding-right:20px; }
37
+ .center { text-align:center; }
38
+ .clearfix { display:block; }
39
+ .clearfix:after {
40
+ content:'';
41
+ display:block;
42
+ height:0;
43
+ clear:both;
44
+ visibility:hidden;
45
+ }
46
+ .fl { float: left; }
47
+ @media only screen and (max-width:640px) {
48
+ .col3 { width:100%; max-width:100%; }
49
+ .hide-mobile { display:none!important; }
50
+ }
51
+
52
+ .quiet {
53
+ color: #7f7f7f;
54
+ color: rgba(0,0,0,0.5);
55
+ }
56
+ .quiet a { opacity: 0.7; }
57
+
58
+ .fraction {
59
+ font-family: Consolas, 'Liberation Mono', Menlo, Courier, monospace;
60
+ font-size: 10px;
61
+ color: #555;
62
+ background: #E8E8E8;
63
+ padding: 4px 5px;
64
+ border-radius: 3px;
65
+ vertical-align: middle;
66
+ }
67
+
68
+ div.path a:link, div.path a:visited { color: #333; }
69
+ table.coverage {
70
+ border-collapse: collapse;
71
+ margin: 10px 0 0 0;
72
+ padding: 0;
73
+ }
74
+
75
+ table.coverage td {
76
+ margin: 0;
77
+ padding: 0;
78
+ vertical-align: top;
79
+ }
80
+ table.coverage td.line-count {
81
+ text-align: right;
82
+ padding: 0 5px 0 20px;
83
+ }
84
+ table.coverage td.line-coverage {
85
+ text-align: right;
86
+ padding-right: 10px;
87
+ min-width:20px;
88
+ }
89
+
90
+ table.coverage td span.cline-any {
91
+ display: inline-block;
92
+ padding: 0 5px;
93
+ width: 100%;
94
+ }
95
+ .missing-if-branch {
96
+ display: inline-block;
97
+ margin-right: 5px;
98
+ border-radius: 3px;
99
+ position: relative;
100
+ padding: 0 4px;
101
+ background: #333;
102
+ color: yellow;
103
+ }
104
+
105
+ .skip-if-branch {
106
+ display: none;
107
+ margin-right: 10px;
108
+ position: relative;
109
+ padding: 0 4px;
110
+ background: #ccc;
111
+ color: white;
112
+ }
113
+ .missing-if-branch .typ, .skip-if-branch .typ {
114
+ color: inherit !important;
115
+ }
116
+ .coverage-summary {
117
+ border-collapse: collapse;
118
+ width: 100%;
119
+ }
120
+ .coverage-summary tr { border-bottom: 1px solid #bbb; }
121
+ .keyline-all { border: 1px solid #ddd; }
122
+ .coverage-summary td, .coverage-summary th { padding: 10px; }
123
+ .coverage-summary tbody { border: 1px solid #bbb; }
124
+ .coverage-summary td { border-right: 1px solid #bbb; }
125
+ .coverage-summary td:last-child { border-right: none; }
126
+ .coverage-summary th {
127
+ text-align: left;
128
+ font-weight: normal;
129
+ white-space: nowrap;
130
+ }
131
+ .coverage-summary th.file { border-right: none !important; }
132
+ .coverage-summary th.pct { }
133
+ .coverage-summary th.pic,
134
+ .coverage-summary th.abs,
135
+ .coverage-summary td.pct,
136
+ .coverage-summary td.abs { text-align: right; }
137
+ .coverage-summary td.file { white-space: nowrap; }
138
+ .coverage-summary td.pic { min-width: 120px !important; }
139
+ .coverage-summary tfoot td { }
140
+
141
+ .coverage-summary .sorter {
142
+ height: 10px;
143
+ width: 7px;
144
+ display: inline-block;
145
+ margin-left: 0.5em;
146
+ background: url(sort-arrow-sprite.png) no-repeat scroll 0 0 transparent;
147
+ }
148
+ .coverage-summary .sorted .sorter {
149
+ background-position: 0 -20px;
150
+ }
151
+ .coverage-summary .sorted-desc .sorter {
152
+ background-position: 0 -10px;
153
+ }
154
+ .status-line { height: 10px; }
155
+ /* yellow */
156
+ .cbranch-no { background: yellow !important; color: #111; }
157
+ /* dark red */
158
+ .red.solid, .status-line.low, .low .cover-fill { background:#C21F39 }
159
+ .low .chart { border:1px solid #C21F39 }
160
+ .highlighted,
161
+ .highlighted .cstat-no, .highlighted .fstat-no, .highlighted .cbranch-no{
162
+ background: #C21F39 !important;
163
+ }
164
+ /* medium red */
165
+ .cstat-no, .fstat-no, .cbranch-no, .cbranch-no { background:#F6C6CE }
166
+ /* light red */
167
+ .low, .cline-no { background:#FCE1E5 }
168
+ /* light green */
169
+ .high, .cline-yes { background:rgb(230,245,208) }
170
+ /* medium green */
171
+ .cstat-yes { background:rgb(161,215,106) }
172
+ /* dark green */
173
+ .status-line.high, .high .cover-fill { background:rgb(77,146,33) }
174
+ .high .chart { border:1px solid rgb(77,146,33) }
175
+ /* dark yellow (gold) */
176
+ .status-line.medium, .medium .cover-fill { background: #f9cd0b; }
177
+ .medium .chart { border:1px solid #f9cd0b; }
178
+ /* light yellow */
179
+ .medium { background: #fff4c2; }
180
+
181
+ .cstat-skip { background: #ddd; color: #111; }
182
+ .fstat-skip { background: #ddd; color: #111 !important; }
183
+ .cbranch-skip { background: #ddd !important; color: #111; }
184
+
185
+ span.cline-neutral { background: #eaeaea; }
186
+
187
+ .coverage-summary td.empty {
188
+ opacity: .5;
189
+ padding-top: 4px;
190
+ padding-bottom: 4px;
191
+ line-height: 1;
192
+ color: #888;
193
+ }
194
+
195
+ .cover-fill, .cover-empty {
196
+ display:inline-block;
197
+ height: 12px;
198
+ }
199
+ .chart {
200
+ line-height: 0;
201
+ }
202
+ .cover-empty {
203
+ background: white;
204
+ }
205
+ .cover-full {
206
+ border-right: none !important;
207
+ }
208
+ pre.prettyprint {
209
+ border: none !important;
210
+ padding: 0 !important;
211
+ margin: 0 !important;
212
+ }
213
+ .com { color: #999 !important; }
214
+ .ignore-none { color: #999; font-weight: normal; }
215
+
216
+ .wrapper {
217
+ min-height: 100%;
218
+ height: auto !important;
219
+ height: 100%;
220
+ margin: 0 auto -48px;
221
+ }
222
+ .footer, .push {
223
+ height: 48px;
224
+ }