a2acalling 0.6.75 → 0.6.76

package/.claude/worktrees/agent-a0a8dd02/src/lib/crypto.js

@@ -0,0 +1,113 @@
+/**
+ * A2A Ed25519 Cryptographic Identity
+ *
+ * Provides keypair generation, request signing, signature verification,
+ * and public key fingerprinting for agent-to-agent identity verification.
+ *
+ * A2A-52: Zero new dependencies — uses Node.js built-in crypto (Ed25519 since v15).
+ */
+
+const crypto = require('crypto');
+
+// A2A-52: 5-minute window for replay protection
+const TIMESTAMP_WINDOW_MS = 5 * 60 * 1000;
+
+/**
+ * Generate an Ed25519 keypair.
+ * Returns { privateKey, publicKey } as base64-encoded DER buffers.
+ */
+function generateKeypair() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
+    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+    publicKeyEncoding: { type: 'spki', format: 'der' }
+  });
+  return {
+    privateKey: privateKey.toString('base64'),
+    publicKey: publicKey.toString('base64')
+  };
+}
+
+/**
+ * Compute a SHA-256 fingerprint of a base64-encoded public key.
+ * Returns colon-separated hex string (like SSH fingerprints).
+ */
+function fingerprint(publicKeyBase64) {
+  const hash = crypto.createHash('sha256')
+    .update(Buffer.from(publicKeyBase64, 'base64'))
+    .digest('hex');
+  // A2A-52: colon-separated pairs for readability (SSH-style)
+  return hash.match(/.{2}/g).join(':');
+}
+
+/**
+ * Sign an outbound request.
+ *
+ * Signing payload: `${timestamp}:${method}:${endpoint}:${bodyHash}`
+ * where bodyHash = SHA-256 of the request body string.
+ *
+ * @param {object} params
+ * @param {string} params.privateKey - base64-encoded DER private key
+ * @param {string} params.publicKey  - base64-encoded DER public key
+ * @param {string} params.method     - HTTP method (e.g. 'POST')
+ * @param {string} params.endpoint   - Request path (e.g. '/api/a2a/invoke')
+ * @param {string} params.body       - Serialized request body
+ * @returns {object} Headers to attach: { 'X-A2A-Signature', 'X-A2A-Public-Key', 'X-A2A-Timestamp' }
+ */
+function signRequest({ privateKey, publicKey, method, endpoint, body }) {
+  const timestamp = new Date().toISOString();
+  const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
+  const payload = `${timestamp}:${method}:${endpoint}:${bodyHash}`;
+
+  const keyObject = crypto.createPrivateKey({
+    key: Buffer.from(privateKey, 'base64'),
+    format: 'der',
+    type: 'pkcs8'
+  });
+
+  const signature = crypto.sign(null, Buffer.from(payload), keyObject);
+
+  return {
+    'X-A2A-Signature': signature.toString('base64'),
+    'X-A2A-Public-Key': publicKey,
+    'X-A2A-Timestamp': timestamp
+  };
+}
+
+/**
+ * Verify an inbound request signature.
+ *
+ * @param {object} params
+ * @param {string} params.signature   - base64-encoded Ed25519 signature
+ * @param {string} params.publicKey   - base64-encoded DER public key
+ * @param {string} params.timestamp   - ISO 8601 timestamp from header
+ * @param {string} params.method      - HTTP method
+ * @param {string} params.endpoint    - Request path
+ * @param {string} params.body        - Raw request body string
+ * @returns {boolean} true if signature is valid
+ */
+function verifySignature({ signature, publicKey, timestamp, method, endpoint, body }) {
+  const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
+  const payload = `${timestamp}:${method}:${endpoint}:${bodyHash}`;
+
+  const keyObject = crypto.createPublicKey({
+    key: Buffer.from(publicKey, 'base64'),
+    format: 'der',
+    type: 'spki'
+  });
+
+  return crypto.verify(null, Buffer.from(payload), keyObject, Buffer.from(signature, 'base64'));
+}
+
+/**
+ * Check if a timestamp is within the allowed window (replay protection).
+ * @param {string} timestamp - ISO 8601 timestamp
+ * @returns {boolean} true if within +-5 minutes of now
+ */
+function isTimestampValid(timestamp) {
+  const ts = new Date(timestamp).getTime();
+  if (Number.isNaN(ts)) return false;
+  const diff = Math.abs(Date.now() - ts);
+  return diff <= TIMESTAMP_WINDOW_MS;
+}
+
+module.exports = { generateKeypair, fingerprint, signRequest, verifySignature, isTimestampValid };

package/.claude/worktrees/agent-a0a8dd02/src/lib/dashboard-events.js

@@ -0,0 +1,213 @@
+const fs = require('fs');
+const path = require('path');
+const { EventEmitter } = require('events');
+
+const DEFAULT_CONFIG_DIR = process.env.A2A_CONFIG_DIR ||
+  process.env.OPENCLAW_CONFIG_DIR ||
+  path.join(process.env.HOME || '/tmp', '.config', 'openclaw');
+
+const DB_FILENAME = 'a2a-events.db';
+const DEFAULT_RETENTION_COUNT = 5000;
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+class DashboardEventStore {
+  constructor(configDir = DEFAULT_CONFIG_DIR, options = {}) {
+    this.configDir = configDir;
+    this.dbPath = options.dbPath || path.join(configDir, DB_FILENAME);
+    this.retentionCount = Number.isFinite(options.retentionCount)
+      ? Math.max(100, Math.floor(options.retentionCount))
+      : DEFAULT_RETENTION_COUNT;
+    this.db = null;
+    this._dbError = null;
+    this._stmts = null;
+    this._emitter = new EventEmitter();
+    this._ensureDir();
+  }
+
+  _ensureDir() {
+    if (!fs.existsSync(this.configDir)) {
+      fs.mkdirSync(this.configDir, { recursive: true });
+    }
+  }
+
+  _initDb() {
+    if (this.db) return this.db;
+    if (this._dbError) return null;
+    try {
+      const Database = require('better-sqlite3');
+      this.db = new Database(this.dbPath);
+      try {
+        fs.chmodSync(this.dbPath, 0o600);
+      } catch (_) {
+        // Best effort.
+      }
+      this._migrate();
+      this._prepareStatements();
+      return this.db;
+    } catch (err) {
+      this._dbError = err && err.message ? err.message : 'failed_to_initialize_event_db';
+      return null;
+    }
+  }
+
+  _migrate() {
+    this.db.exec(`
+      PRAGMA journal_mode = WAL;
+
+      CREATE TABLE IF NOT EXISTS dashboard_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        event_type TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        payload_json TEXT NOT NULL,
+        conversation_id TEXT,
+        contact_id TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_dashboard_events_created ON dashboard_events(created_at);
+      CREATE INDEX IF NOT EXISTS idx_dashboard_events_type ON dashboard_events(event_type);
+      CREATE INDEX IF NOT EXISTS idx_dashboard_events_conversation ON dashboard_events(conversation_id);
+      CREATE INDEX IF NOT EXISTS idx_dashboard_events_contact ON dashboard_events(contact_id);
+    `);
+  }
+
+  _prepareStatements() {
+    this._stmts = {
+      insertEvent: this.db.prepare(`
+        INSERT INTO dashboard_events (event_type, created_at, payload_json, conversation_id, contact_id)
+        VALUES (@event_type, @created_at, @payload_json, @conversation_id, @contact_id)
+      `),
+      listSince: this.db.prepare(`
+        SELECT id, event_type, created_at, payload_json, conversation_id, contact_id
+        FROM dashboard_events
+        WHERE id > @since_id
+        ORDER BY id ASC
+        LIMIT @limit
+      `),
+      listLatest: this.db.prepare(`
+        SELECT id, event_type, created_at, payload_json, conversation_id, contact_id
+        FROM dashboard_events
+        ORDER BY id DESC
+        LIMIT @limit
+      `),
+      prune: this.db.prepare(`
+        DELETE FROM dashboard_events
+        WHERE id NOT IN (
+          SELECT id FROM dashboard_events
+          ORDER BY id DESC
+          LIMIT @retention
+        )
+      `)
+    };
+  }
+
+  isAvailable() {
+    return Boolean(this._initDb());
+  }
+
+  getDbError() {
+    this._initDb();
+    return this._dbError;
+  }
+
+  emitEvent(eventType, payload = {}, meta = {}) {
+    const db = this._initDb();
+    if (!db) {
+      return { success: false, error: 'event_storage_unavailable', message: this._dbError };
+    }
+
+    const event_type = String(eventType || '').trim().slice(0, 80);
+    if (!event_type) {
+      return { success: false, error: 'event_type_required' };
+    }
+
+    const created_at = nowIso();
+    const row = {
+      event_type,
+      created_at,
+      payload_json: JSON.stringify(payload || {}),
+      conversation_id: meta && meta.conversationId ? String(meta.conversationId).slice(0, 120) : null,
+      contact_id: meta && meta.contactId ? String(meta.contactId).slice(0, 120) : null
+    };
+
+    const info = this._stmts.insertEvent.run(row);
+    const id = Number(info.lastInsertRowid);
+    const event = {
+      id,
+      type: event_type,
+      created_at,
+      conversation_id: row.conversation_id,
+      contact_id: row.contact_id,
+      payload: payload || {}
+    };
+
+    if (id % 100 === 0) {
+      try {
+        this._stmts.prune.run({ retention: this.retentionCount });
+      } catch (_) {
+        // Best effort.
+      }
+    }
+
+    this._emitter.emit('event', event);
+    return { success: true, event };
+  }
+
+  listSince(sinceId, options = {}) {
+    const db = this._initDb();
+    if (!db) return [];
+    const limit = Math.min(500, Math.max(1, Number.parseInt(String(options.limit || '200'), 10) || 200));
+    const parsedSince = Number.parseInt(String(sinceId || '0'), 10);
+    if (Number.isFinite(parsedSince) && parsedSince > 0) {
+      const rows = this._stmts.listSince.all({ since_id: parsedSince, limit });
+      return rows.map((row) => this._toEvent(row));
+    }
+    const rows = this._stmts.listLatest.all({ limit }).reverse();
+    return rows.map((row) => this._toEvent(row));
+  }
+
+  subscribe(listener) {
+    const safe = (event) => {
+      try {
+        listener(event);
+      } catch (_) {
+        // Keep stream robust.
+      }
+    };
+    this._emitter.on('event', safe);
+    return () => {
+      this._emitter.off('event', safe);
+    };
+  }
+
+  // A2A-57: Close the SQLite database and flush WAL on shutdown
+  close() {
+    if (this.db) {
+      try { this.db.close(); } catch (_) {}
+      this.db = null;
+    }
+  }
+
+  _toEvent(row) {
+    let payload = {};
+    try {
+      payload = row.payload_json ? JSON.parse(row.payload_json) : {};
+    } catch (_) {
+      payload = {};
+    }
+    return {
+      id: row.id,
+      type: row.event_type,
+      created_at: row.created_at,
+      conversation_id: row.conversation_id || null,
+      contact_id: row.contact_id || null,
+      payload
+    };
+  }
+}
+
+module.exports = {
+  DashboardEventStore
+};