feat: migrate mesh transport from vendored @agentmesh/sdk to @microsoft/agentmesh-sdk (AGT)

cli/package.json

@@ -30,7 +30,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@agentmesh/sdk": "^0.1.2",
+    "@microsoft/agentmesh-sdk": "^3.2.0",
     "@azure/identity": "^4.0.0",
     "@azure/keyvault-secrets": "^4.8.0",
     "blessed": "^0.1.81",

cli/src/plugin.ts

@@ -5,7 +5,7 @@
  * and agent tools (spawn, mesh, inbox, destroy) within the OpenClaw
  * plugin system using the native definePluginEntry SDK.
  *
- * AGT Integration: Uses @agentmesh/sdk for tool-level policy evaluation,
+ * AGT Integration: Uses @microsoft/agentmesh-sdk for tool-level policy evaluation,
  * trust scoring, and audit logging. AzureClaw's Rust router handles
  * infrastructure-level controls (mesh routing, content safety, token budgets).
  *
@@ -1750,12 +1750,12 @@ async function initAGT(log: { info: (m: string) => void; warn: (m: string) => vo
     // ESM import preferred; fall back to CJS require if extension loader context rejects it
     let sdk: any;
     try {
-      sdk = await import("@agentmesh/sdk");
+      sdk = await import("@microsoft/agentmesh-sdk");
     } catch {
       // ESM import failed — load CJS entry via createRequire
       const { createRequire } = await import("node:module");
       const _require = createRequire(import.meta.url);
-      sdk = _require("@agentmesh/sdk");
+      sdk = _require("@microsoft/agentmesh-sdk");
     }
 
     // Policy engine — tool allow/deny evaluation
@@ -1942,7 +1942,7 @@ async function initAGT(log: { info: (m: string) => void; warn: (m: string) => vo
           pushSigningCounter("rejected");
           pushTrustToRouter(fromName, -0.3);
         } else {
-          const sdk = await import("@agentmesh/sdk");
+          const sdk = await import("@microsoft/agentmesh-sdk");
           const pubKey = await resolveSigningKey(senderAmid);
           if (pubKey) {
             try {
@@ -3321,7 +3321,7 @@ async function initAGT(log: { info: (m: string) => void; warn: (m: string) => vo
     // Distinguish module-not-found from other errors
     const isModuleError = e.code === 'MODULE_NOT_FOUND' || e.code === 'ERR_MODULE_NOT_FOUND';
     if (isModuleError) {
-      log.warn(`AGT SDK not installed: ${e.message}. Install @agentmesh/sdk to enable inter-agent communication.`);
+      log.warn(`AGT SDK not installed: ${e.message}. Install @microsoft/agentmesh-sdk to enable inter-agent communication.`);
     } else {
       log.warn(`AGT SDK init failed: ${e.message}. Stack: ${e.stack?.split('\n').slice(0, 3).join(' → ')}`);
     }
@@ -6860,7 +6860,7 @@ const azureClawPlugin = definePluginEntry({
             const decision = agtPolicy.evaluate(action);
             return {
               text: [
-                `**AGT Policy Check** (via @agentmesh/sdk)`,
+                `**AGT Policy Check** (via @microsoft/agentmesh-sdk)`,
                 `Action: \`${action}\``,
                 `Decision: **${decision.effect}**`,
                 decision.effect === "deny" ? "Blocked by AGT policy" : "Allowed",
@@ -6886,7 +6886,7 @@ const azureClawPlugin = definePluginEntry({
         }
 
         // Status mode
-        const sdkStatus = agtPolicy ? "active (@agentmesh/sdk)" : "unavailable (using router-native)";
+        const sdkStatus = agtPolicy ? "active (@microsoft/agentmesh-sdk)" : "unavailable (using router-native)";
         const trustStatus = agtTrustStore ? "active (Ed25519, 0-1000 scale)" : "unavailable";
         const auditStatus = agtAuditLogger ? "active (hash-chain)" : "unavailable";
         const meshStatus = agtMeshClient
@@ -6907,7 +6907,7 @@ const azureClawPlugin = definePluginEntry({
             text: [
               "**AzureClaw AGT Governance**",
               "",
-              "**Application Layer** (plugin, @agentmesh/sdk):",
+              "**Application Layer** (plugin, @microsoft/agentmesh-sdk):",
               `  Identity: ${identityStatus}`,
               `  Mesh client: ${meshStatus}`,
               `  Policy engine: ${sdkStatus}`,

docs/agt-migration-phase3-guide.md

@@ -0,0 +1,92 @@
+# AGT Migration — Phase 3 Implementation Guide
+
+## What's done (Phases 1-2)
+- `transport-interface.ts` — IMeshTransport abstraction
+- `agt-transport.ts` — AGT-backed implementation
+- `agt-identity.ts` — AGT-compatible identity (did:agentmesh)
+
+## Phase 3: Swap connection.ts
+
+### Step 1: Update package.json
+```diff
+- "@agentmesh/sdk": "file:../vendor/agentmesh-sdk",
++ "@microsoft/agentmesh-sdk": "^3.2.0",
+```
+
+### Step 2: Update identity.ts imports
+Replace all `import { Identity, type IdentityData } from "@agentmesh/sdk"` with:
+```typescript
+import { loadOrCreateIdentity, type AgtMeshIdentity } from "./agt-identity.js";
+```
+
+### Step 3: Refactor MeshConnection to use IMeshTransport
+The key change: MeshConnection's constructor takes an `IMeshTransport` instead of creating an `AgentMeshClient` internally.
+
+```typescript
+// Before
+constructor(config: ConnectionConfig) {
+  // creates AgentMeshClient internally
+}
+
+// After
+constructor(config: ConnectionConfig, transport?: IMeshTransport) {
+  this.transport = transport ?? new AgtTransport({
+    relayUrl: config.relayUrl,
+    registryUrl: config.registryUrl,
+    identity: config.identity,
+    wsFactory: config.wsFactory,
+    plaintextPeers: config.plaintextPeers,
+  });
+}
+```
+
+### Step 4: Replace SDK calls in connection.ts
+
+| Current (vendored @agentmesh/sdk) | New (AGT via IMeshTransport) |
+|----|----|
+| `client.connect()` | `transport.connect()` |
+| `client.send(amid, payload)` | `transport.send(amid, payload)` |
+| `client.onMessage(handler)` | `transport.onMessage(handler)` |
+| `client.addPlaintextPeer(amid)` | `transport.addPlaintextPeer(amid)` |
+| `client.disconnect()` | `transport.disconnect()` |
+| `Identity.generate()` | `generateIdentity()` from agt-identity |
+| `Identity.fromData(data)` | `loadIdentity()` from agt-identity |
+
+### Step 5: Keep app-layer code unchanged
+These stay in MeshConnection (they don't touch the SDK):
+- Chunking logic (CHUNK_THRESHOLD, reassembly)
+- File transfer protocol (file_transfer + ack dance)
+- Inbox/waiter management (getInbox, drainInbox, consumeInbox)
+- mesh:ping / mesh:pong
+- Discovery fan-out
+
+### Step 6: Update cli/src/plugin.ts
+Replace `import("@agentmesh/sdk")` with `import("@microsoft/agentmesh-sdk")`.
+The policy evaluation path already uses AGT governance — just the import path changes.
+
+### Step 7: Update deploy/agentmesh.yaml
+Replace vendored relay/registry containers with AGT services:
+```yaml
+# Before: custom relay + registry images
+# After:
+- image: agentmesh/governance-sidecar:3.1.1  # includes registry
+- python -m agentmesh.relay  # relay service
+- python -m agentmesh.registry  # registry service
+```
+
+### Step 8: Remove vendor/
+```bash
+git rm -r vendor/agentmesh-sdk vendor/agentmesh-relay vendor/agentmesh-registry
+```
+
+## Testing checklist
+- [ ] Identity generation (did:agentmesh format)
+- [ ] Connect to relay
+- [ ] Send/receive encrypted messages (parent <-> sub-agent)
+- [ ] Plaintext peer communication (Rust controller)
+- [ ] KNOCK handshake + policy evaluation
+- [ ] File transfer
+- [ ] Offline message delivery (store-and-forward)
+- [ ] Heartbeat/presence
+- [ ] Discovery
+- [ ] Reconnect after disconnect

mesh-plugin/package.json

@@ -43,7 +43,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@agentmesh/sdk": "file:../vendor/agentmesh-sdk",
+    "@microsoft/agentmesh-sdk": "^3.2.2",
     "ws": "^8.18"
   },
   "devDependencies": {