a2a-exposed 0.4.0 → 0.5.0

package/worker/test/migrations.test.ts

@@ -57,7 +57,7 @@ test("migration files: NNNN_name.sql, unique numbers, no gaps, 0002_wake_budget
 test("fresh database: every migration applies in order; a second run applies nothing", () => {
 	const db = new DatabaseSync(":memory:");
 	assert.deepEqual(applyMigrations(db), [...FILES].sort(byNumber));
-	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners"]) assert.ok(tables(db).includes(t), t);
+	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata"]) assert.ok(tables(db).includes(t), t);
 	assert.ok(columns(db, "peers").includes("source"));
 	assert.ok(columns(db, "device_requests").includes("replaces_label"));
 	assert.ok(columns(db, "device_requests").includes("replaces_hash"));
@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 

package/worker/test/pairing.test.ts

@@ -108,7 +108,7 @@ test("agent card, RFC 8414 metadata and the 401 hint advertise the device flow;
 	const meta = await s.call("GET", "/.well-known/oauth-authorization-server");
 	assert.equal(meta.status, 200);
 	assert.deepEqual([meta.data.issuer, meta.data.device_authorization_endpoint, meta.data.token_endpoint], [BASE, `${BASE}/oauth/device_authorization`, `${BASE}/oauth/token`]);
-	assert.deepEqual(meta.data.grant_types_supported, [GRANT]);
+	assert.deepEqual(meta.data.grant_types_supported, [GRANT, "authorization_code", "refresh_token"], "device flow + the MCP connector's grants");
 	assert.deepEqual(meta.data.token_endpoint_auth_methods_supported, ["none"]);
 
 	for (const [method, v] of [["message/send", "0.3"], ["SendMessage", "1.0"]]) {
@@ -157,7 +157,16 @@ test("/.well-known/agent.json serves an A2A 0.3 card (url, preferredTransport, p
 });
 
 test("PAIRING_APPROVAL=off: no pairing scheme, endpoints 404, plain 401", async (t) => {
-	const s = setup({ PAIRING_APPROVAL: "off" }); t.after(s.restore);
+	// with MCP on (the default) the authorization server stays up for the connector, without the device flow
+	const m = setup({ PAIRING_APPROVAL: "off" }); t.after(m.restore);
+	const meta = await m.call("GET", "/.well-known/oauth-authorization-server");
+	assert.equal(meta.status, 200);
+	assert.equal(meta.data.device_authorization_endpoint, undefined);
+	assert.deepEqual(meta.data.grant_types_supported, ["authorization_code", "refresh_token"]);
+	for (const [mm, p] of [["POST", "/oauth/device_authorization"], ["GET", "/device"]]) assert.equal((await m.call(mm, p, mm === "POST" ? { form: {} } : {})).status, 404, p);
+	assert.equal((await m.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: "x" } })).data.error, "unsupported_grant_type");
+	m.restore();
+	const s = setup({ PAIRING_APPROVAL: "off", MCP: "off" }); t.after(s.restore);
 	const card = (await s.call("GET", "/.well-known/agent-card.json")).data;
 	assert.deepEqual(Object.keys(card.securitySchemes), ["bearer"]);
 	assert.deepEqual(card.securityRequirements, [{ schemes: { bearer: { list: [] } } }]);
@@ -581,8 +590,11 @@ test("password setup link: expiry, mismatch, too short, CSRF, a new link invalid
 	for (let i = 0; i < 20; i++) await s.call("GET", "/device/setup?t=nope", { ip: "192.0.2.200" });
 	const limited = await s.call("GET", new URL(l.url).pathname + new URL(l.url).search, { ip: "192.0.2.200" });
 	assert.equal(limited.status, 429);
-	// off mode: no link
+	// pairing off: the link still works while MCP is on (the connector consent needs the password), not with both off
 	s.env.PAIRING_APPROVAL = "off";
+	assert.equal((await s.owner("POST", "/owner/pairing/password-link", {})).status, 200);
+	assert.equal((await s.call("GET", "/device/setup?t=x", { ip: "192.0.2.201" })).status, 404, "reachable (unknown setup token)");
+	s.env.MCP = "off";
 	assert.equal((await s.owner("POST", "/owner/pairing/password-link", {})).status, 409);
 	assert.equal((await s.call("GET", "/device/setup?t=x")).status, 404);
 });

package/worker/test/wake-retry.test.ts

@@ -0,0 +1,51 @@
+// A wake endpoint that answers 429 / 503 (e.g. a Claude Code routine over its fire limit): the wake is kept pending and
+// re-sent after Retry-After, at most 3 times. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://agent.example.com";
+const realNow = Date.now;
+let offset = 0;
+Date.now = () => realNow() + offset;
+
+test("429 with Retry-After: the wake is re-sent after the wait, merged with newer tasks, and dropped after 3 retries", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", WAKE_PRESET: "claude-code",
+		WAKE_WEBHOOK_URL: "https://api.anthropic.com/v1/claude_code/routines/trig_x/fire", WAKE_WEBHOOK_KEY: "rt", WAKE_DEBOUNCE_SECONDS: "20" };
+	const sent: any[] = [];
+	let answer = 429;
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (_u: any, init: any) => { sent.push(JSON.parse(init.body)); return new Response("{}", { status: answer, headers: { "retry-after": "120" } }); }) as any;
+	t.after(() => { globalThis.fetch = orig; Date.now = realNow; });
+	const call = async (method: string, path: string, json?: any, auth = "Bearer owner-secret") => {
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers: { "content-type": "application/json", authorization: auth }, body: json ? JSON.stringify(json) : undefined }) as any,
+			env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		// settle the request's background work (the 20 s debounce timer is never needed here)
+		await Promise.race([Promise.allSettled(pending), new Promise((r) => setTimeout(r, 200))]);
+		return res.json().catch(() => null);
+	};
+	const tok = (await call("POST", "/owner/peers", { label: "barry" })).token;
+	const msg = (text: string) => call("POST", "/", { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: crypto.randomUUID(), contextId: "ctx-r", parts: [{ kind: "text", text }] } } }, `Bearer ${tok}`);
+	await msg("one");
+	assert.equal(sent.length, 1);
+	const row = () => env.DB.db.prepare("SELECT * FROM wakes WHERE context_id = 'ctx-r'").get() as any;
+	assert.ok(row().pending_json, "kept pending after the 429");
+	offset += 60_000;
+	await call("GET", "/health");
+	assert.equal(sent.length, 1, "not before Retry-After");
+	offset += 61_000;
+	await call("GET", "/health");
+	assert.equal(sent.length, 2, "re-sent after Retry-After");
+	assert.equal(JSON.parse(row().pending_json).attempts, 2);
+	for (let i = 0; i < 3; i++) { offset += 121_000; await call("GET", "/health"); }
+	assert.equal(sent.length, 4, "3 retries, then dropped");
+	assert.equal(row().pending_json, null);
+	// a success clears it for good
+	answer = 200;
+	offset += 3_600_000;
+	await msg("two");
+	assert.equal(sent.length, 5);
+	assert.equal(row().pending_json, null);
+});

package/worker/test/wake.test.ts

@@ -30,6 +30,21 @@ test("claude-code: anthropic-version + text body", async () => {
 	assert.deepEqual(Object.keys(b), ["text"]);
 	assert.match(b.text, /2 new messages from peer "peer-a"/);
 	assert.match(b.text, /untrusted/);
+	// a fresh routine session learns what it needs and what to do when setup is missing
+	assert.match(b.text, /A2A_BASE_URL and A2A_OWNER_TOKEN/);
+	assert.match(b.text, /a2a-exposed connector \(MCP tools/, "the connector comes first");
+	assert.ok(b.text.indexOf("connector") < b.text.indexOf("A2A_OWNER_TOKEN"), "the CLI is the fallback");
+	assert.match(b.text, /never ask for the token in chat/);
+	assert.ok(!b.text.includes("Bearer rt") && !b.text.includes(" rt "), "no secret in the text");
+});
+
+test("claude-code: a human-approved pairing wake stays CLI-free (no cold-start note)", async () => {
+	const pe = { ...ev, kind: "pairing_request" as const, taskIds: [], pairing: { userCode: "WDJB-4827", verificationUriComplete: "https://agent.example.com/device?user_code=WDJB-4827",
+		approval: "human" as const, clientName: "Peer", clientId: "", agentCardUrl: "", expiresIn: 600 } };
+	const r = (await renderWake({ preset: "claude-code", url: "https://api.anthropic.com/v1/claude_code/routines/trig_x/fire", key: "rt" }, pe))!;
+	const b = JSON.parse(r.body);
+	assert.match(b.text, /WDJB-4827/);
+	assert.ok(!b.text.includes("A2A_OWNER_TOKEN"), "human pairing needs no CLI or owner token");
 });
 
 test("openclaw-wake: no peer text, mode now, agentId", async () => {