v2.0.5

v2.0.5

Documentation Fixes

• skill/INTEGRATION_OpenClaw_Hermes_QwenPaw_Claude.md: Correct admin-token filename reference - changed from admin-token.txt to cue-admin-token.txt in integration docs

Files Changed

• skill/INTEGRATION_OpenClaw_Hermes_QwenPaw_Claude.md: Fixed token filename reference

CUE v2.0.2

[v2.0.2] - 2026-07-08

🐛 Bug Fixes

• history_client.list_peers(): replace deprecated messages/peers (v1.x) with
  ListTasks pagination (v2.0). Derives peer identity from contextId prefix.
  Falls back to configured aliases when ListTasks is unavailable.
• HistoryProxy.refresh(): no longer crashes when list_peers returns empty
  due to v2.0 API changes.

v2.0.0 — A2A-Native Workflow Engine

CUE v2.0.0 — Reposition as A2A-Native Workflow Engine

Architecture Change

• Before: Polled CORE history API for triggers
• After: Receives standard A2A messages via /a2a/jsonrpc

New Features

• Standard Agent Card: /.well-known/agent-card.json — A2A v1.0 format with supportedInterfaces, provider, skills
• JSON-RPC Endpoint: /a2a/jsonrpc — handles SendMessage, GetTask, ListTasks
• Backward Compatible: Existing /a2a/inbound and /.well-known/agent.json preserved

Changed

• Agent Card format updated to A2A v1.0 standard
• Compose references CORE v2.0.0 image
• ContentMatchTrigger continues to work with real-time A2A messages

Test Results

• 359/359 tests passing (0 regressions)

Companion Release

• agentwire-core v2.0.0 — A2A v1.0 Gateway Rewrite

v1.6.5 — script-receiver trigger fix + alias resolution

v1.6.5 — script-receiver trigger fix + history_change alias resolution

🐛 Bug Fixes (P0)

script-receiver trigger was registered but never fired

• examples/script-receiver/cue.yaml: rewrote trigger from a2a_content_match to history_change with guard expression. The original registered a handler on A2AListener (passive HTTP server on 18801) but CORE never pushes inbound messages to CUE — handler was dead code.
• New _PeerHistoryProxy.last_inbound_text() method returns concatenated text of recent inbound messages (skips outbound CORE auto-acks) so write_file actions can persist the full payload.

history_change alias resolution was broken since v1.4.3

• core/trigger_impl.py::HistoryChangeTrigger._poll_loop matched self.peer (e.g. 'remote_peer_a') against CORE's messages/peers name field, which CORE returns as the first 8 chars of the peer uuid (e.g. '75755f13'). The string comparison never matched, so every history_change trigger with an alias peer name was silently inactive — including owner-alert (deployed since v1.4.3).
• New _peer_matches() helper resolves self.peer via HistoryClient._aliases (alias → uuid → CORE name 8-char prefix) before comparing. Back-compat: explicit CORE names and peer: '*' continue to work.

📦 Changed

• __init__.py: __version__ = "1.6.5"
• core/trigger_impl.py: _peer_matches() helper extracted from _poll_loop()
• core/history_proxy.py: last_inbound_text() method added
• examples/script-receiver/cue.yaml: trigger type, guard expression, peer declaration
• examples/script-receiver/production.local.yaml: new overlay template
• docker-compose.yml: image tag v1.6.4 → v1.6.5

🧪 Tests

• New tests/test_v165_script_receiver_fix.py (11 cases)
• Full suite: 351 passed, 6 skipped, 0 failed (was 340 passing before)

v1.6.4 - sanitization + CUE_VERSION drift fix

v1.6.4 (2026-07-05)

Sanitization

Per user feedback: "Pawly" is the user's private agent name (running on the public QwenPaw platform) — it is not the QwenPaw platform name, and related identifiers (uuid / Tailscale IP / host description / workflow filename) must not appear in the release tree. v1.6.4 strips every concrete personal value out of the tracked files; real peer configuration moves to a *.local.yaml overlay (gitignored).

Maintenance: agent-card version drift fix

After the sanitization commit was tagged v1.6.4, an operator deploying the image noticed that /.well-known/agent.json and /admin/status still reported version: "1.6.2" while the package __version__ was already "1.6.4". Root cause: core/a2a_client.py::CUE_VERSION was a hardcoded literal that hadn't been bumped across the v1.6.x series.

Fix (commit 824cf27):

• CUE_VERSION now derives from agentwire_cue.__version__, so the advertised version and the package version cannot drift.
• New regression test test_cue_version_matches_package_version asserts CUE_VERSION == agentwire_cue.__version__.
• Existing test_v150_regressions.py::test_agent_card_reports_current_version also made version-dynamic (was hardcoded "1.6.2").

Verified post-fix:

• /.well-known/agent.json -> version: "1.6.4" ✓
• /admin/status -> cue_version: "1.6.4" ✓
• 340 passed / 6 skipped test suite ✓
• Docker image rebuilt and container recreated (healthy) ✓

Required operator follow-up (still pending)

The Pawly A2A token literal value (ee8d7415...) leaked into commit f8fbfeb (v1.6.3) and is still extractable from git history. The secrets file secrets/peer-a-a2a-token.txt was rotated on disk but the server-side Pawly A2A token must be regenerated on Pawly's CORE to make the leaked value invalid. Until that rotation, anyone with read access to the historical blob can connect as Pawly.

v1.6.3 - CUE_CORE_URL env + Docker-secrets Pawly token

v1.6.3 (2026-07-05)

Fixed

• CUE_CORE_URL env wiring (__main__.py + Dockerfile)
  • --a2a-url default now reads $CUE_CORE_URL (same pattern as $CUE_DOCTOR_A2A_URL)
  • Dockerfile CMD no longer hardcodes agentwire-core:18800
  • docker-compose.yml pins CUE_CORE_URL=http://127.0.0.1:18800 for the host-network layout
• Pawly per-peer token via Docker secrets (commit ce890ae)
  • Previously released commit f8fbfeb hardcoded a real Pawly A2A token as a literal env var in docker-compose.yml. That mishap is superseded by ce890aec, which switches to the established secrets-file pattern:
    • secrets/pawly-a2a-token.txt (chmod 600, gitignored) mounted at /run/secrets/pawly-a2a-token.txt
    • docker-compose.yml exports PAWLY_A2A_TOKEN_FILE=<path> only
    • examples/owner-alert/cue.yaml alias uses token_file so HistoryClient._resolve_peer_token reads the file

Required operator actions

• Rotate the Pawly A2A token server-side. The literal value still appears in commit f8fbfeb (which is a parent of ce890aec); treat that token as compromised even though this repo is private.
• Update secrets/pawly-a2a-token.txt (chmod 600) with the new token, then docker compose up -d to mount it.

Verification

• 338 passed / 6 skipped — no regression vs v1.6.2 baseline
• After docker compose up -d agentwire-cue: zero history_change ... poll failed log lines across multiple 15-second cycles

Image

agentwire-cue:v1.6.3 (rebuild required)

v1.6.2 — audit fixes: contains_count + doc sync + host-network comment

Audit Fixes (P2 / P3)

针对 v1.6.1 审计员报告的 5 个修复项:

Fixed

• core/trigger_impl.py::ContentMatchTrigger 现在正确填充:

  • event.matched_keywords: list[str] (实际匹配的关键词列表)
  • event.contains_count: int (contains 列表总长度)

  v1.6.1 中 matched_keywords 误存为 int count,导致 {{event.contains_count}}
  模板变量在 script-receiver/cue.yaml 中渲染为空。

Documentation

• docker-compose.yml: network_mode: host 上方加注释说明 WSL2/Tailscale 兼容原因和防火墙建议
• SKILL.md / SKILL_CN.md: a2a_content_match 触发器行 + 完整 event payload 表
• PLUGIN_AUTHORING.md: 新增 spec.peers 章节 (含 v1.6.1 per-peer token 字段)
• examples/a2a-with-fallback.yaml / examples/file-watcher.yaml: match: "*" 注释

Tests

• 339 passed, 5 skipped
• 新增 tests/test_v162_audit_fixes.py 锁住 matched_keywords 列表语义和 contains_count 行为

不变更项

• 协议层 (A2A v1.0.1) 不变
• 公共 API 不变
• 仅修字段类型 + 文档同步

v1.6.1 — content match trigger + per-peer token + script-receiver

全流程测试修复 (Production Full-Flow E2E Fixes)

针对 CUE + 初梦 + 小爪 端到端视频脚本协作流暴露的两个缺口：

1. CUE 访问 Pawly history 时被 CORE 拒绝（本地 CORE token 与 Pawly 自己的 token 不同）
2. 没有 trigger 能识别 "这是视频脚本" 并触发后续动作

改动

Per-peer A2A token

spec.peers.<alias> 新增可选字段：

• token: 字面量 token
• token_env: 从环境变量读取
• token_file: 从文件读取

优先级: token_file > token_env > token (字面量) > 默认本地 CORE token.

A2AClient.send_message 和 HistoryClient._rpc 都接入 per-peer token，解决多机部署时 token 隔离问题。

a2a_content_match trigger

新 trigger 类型，按消息文本内容触发：

triggers:
  - id: on-script-received
    type: a2a_content_match
    config:
      contains: ["project:", "scenes:"]
      min_match: 2
      peer: "Pawly"  # 可选

event payload 包含 peer、peer_uuid、text、parts、metadata、matched_keywords。

script-receiver 插件示例

examples/script-receiver/cue.yaml: 收到小爪脚本 → write_file 保存到磁盘 → send_a2a 通知初梦（含 workflow_pointer metadata）。

write_file 路径模板渲染

with.path 现在也会渲染 {{event.peer}} 这类模板变量（之前只渲染 with.content）。

owner-alert 更新

Pawly peer 配置加 token_env: "PAWLY_A2A_TOKEN"，部署时设置对应环境变量即可。

验证

• CUE 测试套件: 334 passed, 6 skipped
• 全流程测试路径验证: 待主人线上验收

配套

• agentwire-core v1.5.5

v1.6.0 — Production Ready Milestone (final cleanup)

Production Ready Milestone

AgentWire-Cue has reached production readiness. All v1.5.x series functionality, security hardening, and documentation work has converged; v1.6.0 marks this milestone. Future work moves to maintenance mode (defect fixes only).

Changes

• Version jump — 1.5.9 → 1.6.0: __init__.py, a2a_client.py, tests, image tag, all SKILL docs.
• README rewrite — README.md + README_CN.md rewritten: status badge v1.6.0, Docker Compose quick-start, full feature list (all v1.5.x items: spec.peers, spec.requires, send_a2a metadata, workflow-pointer, on_exhaust validation, permissions.peers enforcement, admin API /admin/peers redaction, doctor, structured observability, security defaults), updated deployment section with Docker Compose as canonical path, migrated examples to v1.4.8+ peers config block, updated repository structure.
• docker-compose.yml — CUE image v1.6.0, CORE image v1.5.5.
• SKILL docs — SKILL.md, SKILL_CN.md, PLUGIN_AUTHORING.md, EXPRESSION_REFERENCE.md, INTEGRATION_OpenClaw_Hermes_QwenPaw_Claude.md: version headers synced to v1.6.0.
• CHANGELOG.md — v1.6.0 Production Ready Milestone entry.
• Purged all stale v1.4.3 / v1.4.4 / "future v1.5+" references from READMEs.

Verification

• CUE test suite: 334 passed, 6 skipped.
• No code behavior changes — documentation + version alignment only.

Companion

• agentwire-core v1.5.5 — OpenClaw 2026.6.6 schema compat (final v1.5.x).

Series Status

Repo	Version	Status
agentwire-cue	v1.6.0	Production Ready, maintenance mode
agentwire-core	v1.5.5	Frozen, maintenance mode

AgentWire-Cue v1.5.9 Audit Fix

Summary

• Critical fix: owner-alert/cue.yaml set_context was silently setting context["key"] and context["value"] instead of context["last_notified_round"]. Dedup guard was completely non-functional. Now uses correct direct key-value structure.
• resilience.on_exhaust is now validated at loader time against declared state names.
• Examples with match: "*" now have inline comments documenting the intent.

Verification

• CUE test suite: 334 passed, 6 skipped.