a2a-exposed 0.5.0 → 0.6.0

package/README.md

@@ -3,14 +3,13 @@
 Command-line companion for [a2a-exposed](https://github.com/telegraphic-dev/a2a-exposed). It gives any AI agent a public A2A endpoint: a Cloudflare Worker inbox plus a wake webhook.
 
 ```bash
-npm i -g a2a-exposed          # or one-off: npx -y a2a-exposed@latest --help
-a2a-exposed --help
+npx -y a2a-exposed@latest --help      # no install needed; @latest always runs the newest release
 ```
 
-The agent skills (`npx --yes skills add telegraphic-dev/a2a-exposed`) document the workflows; they do not install this CLI.
+Optional speed-up on your own machine: `npm i -g a2a-exposed@latest`, then `a2a-exposed <command>` (re-run the install to upgrade; the CLI prints a notice when a newer version is out). Agent sandboxes often block global installs as untrusted code, so docs, skills and wake hints always use the npx form. The agent skills (`npx -y skills add telegraphic-dev/a2a-exposed`, into the current project) document the workflows; they do not install this CLI.
 
 - Node 22.18+ and zero dependencies. `init` installs Cloudflare's `cf` CLI into the Worker folder and uses that; you only need a one-time login (`npx cf auth login --no-browser`). No domain? Omit `--hostname` and `init` deploys to `https://<worker>.<account-subdomain>.workers.dev` (`--workers-dev-subdomain <name>` registers the account subdomain if missing).
-- **Setup:** `init`, `deploy`, `wake set|unset|test|preview|fingerprint`, `tunnel create|status|rm` (secure Cloudflare Tunnel + Access for local-only webhooks; needs any zone on the account, the inbox can be on workers.dev), `status` (read-only setup check with a next step), `url`, `config`. Use `--cli-command` to set the command shown in wake hints (default `npx a2a-exposed`; e.g. a `node <checkout>/cli/bin/a2a-exposed.mjs` path for development).
+- **Setup:** `init`, `deploy`, `wake set|unset|test|preview|fingerprint`, `tunnel create|status|rm` (secure Cloudflare Tunnel + Access for local-only webhooks; needs any zone on the account, the inbox can be on workers.dev), `status` (read-only setup check with a next step), `url`, `config`. Use `--cli-command` to set the command shown in wake hints (default `npx -y a2a-exposed@latest`; e.g. a `node <checkout>/cli/bin/a2a-exposed.mjs` path for development).
 - **Inbox:** `inbox`, `show`, `working`, `reply`, `history`, `contexts`
 - **Pairing (OAuth 2.0 device flow, RFC 8628):** `connect <url>` (ask another inbox for a token; its owner approves), `pair set-password|list|approve|deny` (approve agents that connect to you; human approval by default)
 - **Peer tokens:** `token issue|list|revoke|rotate` (manual fallback; `list` also shows tokens created by pairing)

package/lib/a2a.mjs

@@ -3,6 +3,10 @@ import crypto from "node:crypto";
 
 export const ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
 
+/** The one way docs, hints and CLI output tell people (and agents) to run the CLI: npx, always the latest release, no
+ *  global install (agent sandboxes block global installs as untrusted code). A global install is an optional speed-up. */
+export const CLI = "npx -y a2a-exposed@latest";
+
 export class CliError extends Error {}
 export const die = (msg) => { throw new CliError(msg); };
 
@@ -178,8 +182,8 @@ export async function rpc(url, version, token, method03, method1, params, peer =
 		const who = peer && peer.alias ? `peer "${peer.alias}"` : new URL(url).origin;
 		const base = (peer && peer.base) || new URL(url).origin;
 		die(token
-			? `${who} rejected our token (HTTP 401: revoked, rotated, or never valid there). Re-pair: a2a-exposed connect ${base}${peer && peer.alias ? ` --alias ${peer.alias}` : ""} (its owner approves), or ask its owner for a new token`
-			: `${who} needs a token (HTTP 401): a2a-exposed connect ${base}${peer && peer.alias ? ` --alias ${peer.alias}` : ""} (its owner approves)`);
+			? `${who} rejected our token (HTTP 401: revoked, rotated, or never valid there). Re-pair: ${CLI} connect ${base}${peer && peer.alias ? ` --alias ${peer.alias}` : ""} (its owner approves), or ask its owner for a new token`
+			: `${who} needs a token (HTTP 401): ${CLI} connect ${base}${peer && peer.alias ? ` --alias ${peer.alias}` : ""} (its owner approves)`);
 	}
 	if (status !== 200 || !data || typeof data !== "object" || "error" in data)
 		die(`peer returned ${data && typeof data === "object" && data.error ? `JSON-RPC error ${describeHttp(status, data).replace(/^HTTP \d+: /, "")} (HTTP ${status})` : describeHttp(status, data)}`);

package/lib/commands.mjs

@@ -1,25 +1,25 @@
 // Day-to-day commands: inbox / reply / history (owner API) and outbound send / poll.
 import fs from "node:fs";
 import * as C from "./config.mjs";
-import { checkId, describeHttp, die, fetchCard, httpJson, newId, pickEndpoint, plainState, randomToken, rpc, textOf } from "./a2a.mjs";
+import { CLI, checkId, describeHttp, die, fetchCard, httpJson, newId, pickEndpoint, plainState, randomToken, rpc, textOf } from "./a2a.mjs";
 
 const q = encodeURIComponent;
 const out = (obj) => console.log(JSON.stringify(obj, null, 2));
 export const baseUrl = () => C.get("A2A_BASE_URL").replace(/\/$/, "");
 
-export async function owner(method, path, body) {
+export async function owner(method, path, body, timeout) {
 	const base = baseUrl(), tok = C.get("A2A_OWNER_TOKEN");
-	if (!base || !tok) die(`A2A_BASE_URL / A2A_OWNER_TOKEN missing (run \`a2a-exposed init\` or edit ${C.CONFIG_FILE})`);
-	const { status, data } = await httpJson(base + path, { method, body, headers: { authorization: `Bearer ${tok}` } });
+	if (!base || !tok) die(`A2A_BASE_URL / A2A_OWNER_TOKEN missing (run \`${CLI} init\` or edit ${C.CONFIG_FILE})`);
+	const { status, data } = await httpJson(base + path, { method, body, headers: { authorization: `Bearer ${tok}` }, timeout });
 	if (status < 200 || status >= 300) die(`worker ${method} ${path} -> ${describeHttp(status, data)}`);
 	return data;
 }
 
 /** Owner API call that returns { status, data } instead of dying, so callers can explain errors themselves. */
-export async function ownerTry(method, path, body) {
+export async function ownerTry(method, path, body, timeout) {
 	const base = baseUrl(), tok = C.get("A2A_OWNER_TOKEN");
-	if (!base || !tok) die(`A2A_BASE_URL / A2A_OWNER_TOKEN missing (run \`a2a-exposed init\` or edit ${C.CONFIG_FILE})`);
-	return httpJson(base + path, { method, body, headers: { authorization: `Bearer ${tok}` } });
+	if (!base || !tok) die(`A2A_BASE_URL / A2A_OWNER_TOKEN missing (run \`${CLI} init\` or edit ${C.CONFIG_FILE})`);
+	return httpJson(base + path, { method, body, headers: { authorization: `Bearer ${tok}` }, ...(timeout ? { timeout } : {}) });
 }
 
 function printPush(res) {
@@ -62,7 +62,7 @@ export async function inbox(o) {
 	}
 }
 
-const PAIRING_NOTE = "Tell your human who is asking, the code and the link (details: a2a-exposed pair list). Never approve on your own: in human mode they approve on the link with their approval password; in agent mode run `pair approve <code>` only after they say yes.";
+const PAIRING_NOTE = `Tell your human who is asking, the code and the link (details: ${CLI} pair list). Never approve on your own: in human mode they approve on the link with their approval password; in agent mode run \`pair approve <code>\` only after they say yes.`;
 
 export const show = async (id) => out(await owner("GET", `/owner/tasks/${q(id)}`));
 
@@ -132,7 +132,7 @@ export async function token(action, label, o) {
 			}
 		}
 		if (r.status === 404 || (r.status === 200 && r.data && r.data.revoked === false))
-			die((r.data && r.data.error) || `no active token with label ${label} (see: a2a-exposed token list)`);
+			die((r.data && r.data.error) || `no active token with label ${label} (see: ${CLI} token list)`);
 		die(`could not revoke ${label}: ${describeHttp(r.status, r.data)}`);
 	}
 	die(`unknown token action ${action} (issue|list|revoke|rotate)`);
@@ -167,7 +167,7 @@ function resolvePeer(to) {
 		for (const [alias, pe] of Object.entries(peers)) if (pe.url.replace(/\/$/, "") === to.replace(/\/$/, "")) return resolvePeer(alias);
 		return [to, to.replace(/\/$/, ""), peerToken("A2A_PEER_TOKEN")];
 	}
-	die(`unknown peer alias ${JSON.stringify(to)} (see: a2a-exposed peers list)`);
+	die(`unknown peer alias ${JSON.stringify(to)} (see: ${CLI} peers list)`);
 }
 
 /** peers sync [alias...]: upload outbound peers (URL + token, encrypted on the Worker with a key derived from the owner
@@ -184,13 +184,13 @@ async function peersRemote(sub, args) {
 	}
 	const all = C.loadPeers();
 	const list = args.length ? args : Object.keys(all);
-	if (!list.length) die("no peers to sync: add one first (a2a-exposed connect <url> or peers add)");
+	if (!list.length) die(`no peers to sync: add one first (${CLI} connect <url> or peers add)`);
 	for (const alias of list) {
 		const pe = all[alias];
-		if (!pe) die(`unknown peer alias ${JSON.stringify(alias)} (see: a2a-exposed peers list)`);
+		if (!pe) die(`unknown peer alias ${JSON.stringify(alias)} (see: ${CLI} peers list)`);
 		const tok = peerToken(pe.token_env);
 		const r = await ownerTry("PUT", `/owner/outbound-peers/${q(alias)}`, { url: pe.url.replace(/\/$/, ""), ...(tok ? { token: tok } : {}) });
-		if (r.status === 404) die("this Worker has no MCP support yet: redeploy (a2a-exposed deploy) and try again");
+		if (r.status === 404) die(`this Worker has no MCP support yet: redeploy (${CLI} deploy) and try again`);
 		if (r.status !== 200) die(`could not sync ${alias}: ${(r.data && r.data.error) || describeHttp(r.status, r.data)}`);
 		console.log(`synced ${alias}\t${pe.url}\t${tok ? "token stored encrypted on the Worker" : "no token"}`);
 	}
@@ -233,7 +233,7 @@ export function peers(sub, args, o) {
 		const inUse = new Set(Object.values(all).map((x) => x.token_env));
 		const reserved = (k) => /^(A2A_|CLOUDFLARE_|WAKE_|CF_PROFILE$)/.test(k);
 		const drop = [...vars].filter((k) => !inUse.has(k) && !reserved(k) && k in C.fileConfig());
-		if (!pe && !drop.length) die(`unknown peer alias ${JSON.stringify(alias)} (see: a2a-exposed peers list)`);
+		if (!pe && !drop.length) die(`unknown peer alias ${JSON.stringify(alias)} (see: ${CLI} peers list)`);
 		if (pe) C.savePeers(all);
 		if (drop.length) C.saveConfig(Object.fromEntries(drop.map((k) => [k, null])));
 		return console.log(`removed ${alias}${drop.length ? ` (and ${drop.join(", ")} from ${C.CONFIG_FILE})` : ""}`);
@@ -278,7 +278,7 @@ export async function send(o) {
 	if (tid) await owner("POST", "/owner/outbound", { taskId: tid, contextId: ctx, peer: alias, endpoint: url, protocol: version, pushToken, task: obj });
 	else if (obj && obj.parts) await logHistory(ctx, { dir: "in", peer: alias, role: "agent", event: "direct_message", text: textOf(obj) });
 	out(obj);
-	if (tid) console.error(`# task ${tid}: ${plainState(obj)}  (check: a2a-exposed poll --to ${alias} ${tid})`);
+	if (tid) console.error(`# task ${tid}: ${plainState(obj)}  (check: ${CLI} poll --to ${alias} ${tid})`);
 }
 
 export async function poll(taskId, o) {
@@ -301,3 +301,12 @@ export async function poll(taskId, o) {
 }
 
 export const outbound = async (id) => out(await owner("GET", `/owner/outbound/${q(id)}`));
+
+// ---------------------------------------------------------------- export
+/** JSON dump on stdout. `--sql` prints the same tables as SQL text. */
+export async function exportInbox(o) {
+	const path = o.sql ? "/owner/export?format=sql" : "/owner/export";
+	const data = await owner("GET", path, undefined, 120000);
+	if (o.sql) return console.log(typeof data === "string" ? data.replace(/\n$/, "") : JSON.stringify(data));
+	return out(data);
+}

package/lib/deploy.mjs

@@ -5,7 +5,7 @@ import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import * as C from "./config.mjs";
-import { cardUrlProblem, cfErrorCode, die, fetchUpstreamCard, fingerprint, httpJson, randomToken, upstreamAuth, upstreamCardUrlProblem, upstreamUrlProblem } from "./a2a.mjs";
+import { CLI, cardUrlProblem, cfErrorCode, die, fetchUpstreamCard, fingerprint, httpJson, randomToken, upstreamAuth, upstreamCardUrlProblem, upstreamUrlProblem } from "./a2a.mjs";
 import { owner, ownerTry } from "./commands.mjs";
 import { readHidden } from "./pair.mjs";
 import * as WD from "./workersdev.mjs";
@@ -31,7 +31,9 @@ export const WAKE_SECRETS = ["WAKE_WEBHOOK_URL", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_
 // Proxy / expose mode (--upstream): the one credential the façade presents to the private upstream (Bearer), and the
 // Cloudflare Access service token for the upstream's tunnel hostname. Read from the environment only (never argv).
 export const UPSTREAM_SECRETS = ["UPSTREAM_TOKEN", "UPSTREAM_ACCESS_CLIENT_ID", "UPSTREAM_ACCESS_CLIENT_SECRET"];
-const DEPLOY_SECRETS = [...WAKE_SECRETS, ...UPSTREAM_SECRETS];
+/** OpenID Connect client secret for approval. Environment only; never config.env. */
+export const OIDC_SECRETS = ["APPROVAL_OIDC_CLIENT_SECRET"];
+const DEPLOY_SECRETS = [...WAKE_SECRETS, ...UPSTREAM_SECRETS, ...OIDC_SECRETS];
 
 // Non-secret deploy settings persisted in config.env and passed to cloudflare.config.ts as env vars.
 const DEPLOY_KEYS = [
@@ -42,6 +44,7 @@ const DEPLOY_KEYS = [
 	"WAKE_DEBOUNCE_SECONDS", "WAKE_MAX_PER_HOUR", "A2A_MAX_BODY", "A2A_RATE_PER_MIN", "A2A_ENABLE_CRON",
 	"A2A_WORKERS_DEV_SUBDOMAIN", "A2A_RETIRED_HOSTNAMES", "PAIRING_APPROVAL", "A2A_PBKDF2_ITERATIONS", "A2A_WORKERS_LOGS", "A2A_MCP",
 	"A2A_UPSTREAM_URL", "A2A_UPSTREAM_CARD_URL",
+	"APPROVAL_OIDC_ISSUER", "APPROVAL_OIDC_CLIENT_ID", "APPROVAL_OIDC_ALLOWED_SUBJECTS", "APPROVAL_METHODS",
 ];
 // init/deploy flag -> config key
 const FLAG_KEYS = {
@@ -68,7 +71,7 @@ export const workerDir = (o) => path.resolve(o.dir || C.get("A2A_WORKER_DIR") ||
 /** How to get Node 22.18+ (printed by the version check; the setup skill says the same). */
 export const NODE_HELP = `How to get Node 22 (any one; no root needed):
   mise (recommended; the agent skill: npx skills add telegraphic-dev/mise-skill):
-    one command:   mise exec node@22 -- npx a2a-exposed <command>
+    one command:   mise exec node@22 -- npx -y a2a-exposed@latest <command>
     this project:  mise use node@22   (then node/npx are Node 22 in this directory)
   nvm:   nvm install 22 && nvm use 22
   fnm:   fnm install 22 && fnm use 22
@@ -164,7 +167,7 @@ export function wakeSecretsFromEnv() {
 /** Secrets init/deploy upload when exported: the wake secrets plus, for proxy mode, the upstream credentials. */
 export function deploySecretsFromEnv() {
 	const s = wakeSecretsFromEnv();
-	for (const k of UPSTREAM_SECRETS) if (process.env[k]) s[k] = process.env[k];
+	for (const k of [...UPSTREAM_SECRETS, ...OIDC_SECRETS]) if (process.env[k]) s[k] = process.env[k];
 	return s;
 }
 
@@ -246,7 +249,7 @@ function applyFlags(o) {
 function reportSwitch(sw) {
 	if (!sw) return;
 	const to = C.fileConfig().A2A_BASE_URL || publicBase();
-	const card = to ? `${to}/.well-known/agent-card.json` : "(see `a2a-exposed url`)";
+	const card = to ? `${to}/.well-known/agent-card.json` : `(see \`${CLI} url\`)`;
 	console.error(`\nnote: the public URL moved${sw.from ? ` from ${sw.from}` : ""} to ${to || "workers.dev"}.`);
 	if (sw.fromHost) {
 		console.error(`  ${sw.fromHost} no longer serves this agent: its agent card redirects (301) to the new one and every other request gets 410 Gone.`);
@@ -289,9 +292,9 @@ async function verifyDeployedCard(base) {
 	if (justRegistered) step("waiting for the new workers.dev subdomain to resolve (usually 1-5 minutes)");
 	const r = await verifyCard(base, { tries, intervalMs: Number(process.env.A2A_VERIFY_INTERVAL_MS || 5000),
 		onWait: (why) => step(`agent card not served yet (${why}); a new deployment takes up to ~30 s to propagate, waiting`) });
-	if (r.ok && r.problem) return console.error(`warning: the agent card at ${base}/.well-known/agent-card.json does not point peers at this deployment: ${r.problem}. Check with: a2a-exposed status`);
+	if (r.ok && r.problem) return console.error(`warning: the agent card at ${base}/.well-known/agent-card.json does not point peers at this deployment: ${r.problem}. Check with: ${CLI} status`);
 	if (r.ok) return console.error(`agent card OK: ${r.name} (${base}/.well-known/agent-card.json)`);
-	console.error(`warning: agent card not reachable yet at ${base} (${r.lastError || "no answer"}); ${C.get("A2A_HOSTNAME") ? "a new custom domain" : "a new workers.dev deployment or subdomain"} can take a few minutes. Check again with: a2a-exposed status`);
+	console.error(`warning: agent card not reachable yet at ${base} (${r.lastError || "no answer"}); ${C.get("A2A_HOSTNAME") ? "a new custom domain" : "a new workers.dev deployment or subdomain"} can take a few minutes. Check again with: ${CLI} status`);
 }
 
 /** Apply D1 migrations quietly: cf prints a bare JSON array (often `[]`) when stdout is not a TTY. */
@@ -350,7 +353,7 @@ async function deployAndLearn(dir, secrets, o) {
 	if (sub && o["workers-dev-subdomain"] && sub !== o["workers-dev-subdomain"])
 		console.error(`note: the account already has the workers.dev subdomain "${sub}"; using it (--workers-dev-subdomain ignored)`);
 	if (sub && sub !== baked()) C.saveConfig({ A2A_WORKERS_DEV_SUBDOMAIN: sub });
-	if (!baked()) return console.error("warning: could not find the workers.dev URL in cf's output; the Worker uses the request origin meanwhile. Check the URL in the dashboard and re-run `a2a-exposed deploy`.");
+	if (!baked()) return console.error(`warning: could not find the workers.dev URL in cf's output; the Worker uses the request origin meanwhile. Check the URL in the dashboard and re-run \`${CLI} deploy\`.`);
 	C.saveConfig({ A2A_BASE_URL: publicBase() });
 	if (baked() !== deployedWith) {
 		step(`redeploying once so the agent card advertises ${publicBase()}`);
@@ -428,7 +431,7 @@ export async function init(o) {
 	console.log(base);
 	reportSwitch(switched);
 	proxyNote(secrets);
-	console.error(`config saved to ${C.CONFIG_FILE} (chmod 600). Next: a2a-exposed status (shows the next setup step)`);
+	console.error(`config saved to ${C.CONFIG_FILE} (chmod 600). Next: ${CLI} status (shows the next setup step)`);
 }
 
 /** Proxy / expose mode reminder after a deploy (the upstream credentials are secrets: only their names are shown). */
@@ -437,7 +440,7 @@ function proxyNote(secrets = {}) {
 	if (!up) return;
 	const sent = UPSTREAM_SECRETS.filter((k) => k in secrets);
 	console.error(`proxy mode: authenticated A2A calls are forwarded to ${up}; the public card is the upstream's, rewritten to this deployment's URL.` +
-		` Upstream secrets uploaded now: ${sent.join(", ") || "none (existing ones kept)"}. Check the whole path (Access, the agent's bearer check) with: a2a-exposed status`);
+		` Upstream secrets uploaded now: ${sent.join(", ") || "none (existing ones kept)"}. Check the whole path (Access, the agent's bearer check) with: ${CLI} status`);
 }
 
 /** stdin and stderr are a terminal (a human at the keyboard), and not CI: only then may setup prompt. */
@@ -497,18 +500,18 @@ export async function upstreamTokenCheck(o, { upstreamChanged = false } = {}) {
 		if (t) { C.saveConfig({ A2A_UPSTREAM_NO_TOKEN: null }); return { UPSTREAM_TOKEN: t }; }
 		if (auth.bearer) die("no UPSTREAM_TOKEN given, but the upstream card asks for one: peers' calls would fail with HTTP 502. Re-run and enter it, or pass --no-upstream-token if the agent really accepts calls without it");
 		C.saveConfig({ A2A_UPSTREAM_NO_TOKEN: "1" });
-		console.error("note: deploying without an upstream bearer token (saved; check the whole path with `a2a-exposed status`)");
+		console.error(`note: deploying without an upstream bearer token (saved; check the whole path with \`${CLI} status\`)`);
 		return {};
 	}
 	die(`${why}, and no UPSTREAM_TOKEN is set. ${access}, so without it every peer call fails with HTTP 502.\n` +
-		"  Provide it (never as an argument): `read -rs UPSTREAM_TOKEN && export UPSTREAM_TOKEN`, then re-run; or pipe it: <command that prints the token> | a2a-exposed " +
+		`  Provide it (never as an argument): \`read -rs UPSTREAM_TOKEN && export UPSTREAM_TOKEN\`, then re-run; or pipe it: <command that prints the token> | ${CLI} ` +
 		`${C.get("A2A_D1_ID") ? "deploy" : "init ..."} --upstream-token-stdin\n` +
 		"  The agent needs no bearer token? Re-run with --no-upstream-token (saved for later deploys).");
 }
 
 export async function deploy(o) {
 	checkNode();
-	if (!C.get("A2A_D1_ID")) die("no saved deployment; run `a2a-exposed init` first");
+	if (!C.get("A2A_D1_ID")) die(`no saved deployment; run \`${CLI} init\` first`);
 	// init saves A2A_WORKER_NAME before it creates the D1 database, so a saved D1 without a name is a hand-edited config:
 	// refuse rather than guess, so a redeploy never creates a second Worker next to the one this config deployed.
 	if (!C.get("A2A_WORKER_NAME") && o["worker-name"] === undefined)
@@ -546,7 +549,7 @@ function guardTunnelUrl() {
 	if (!th || !url) return;
 	let host = "";
 	try { host = new URL(url).host; } catch { /* invalid URL: reported elsewhere */ }
-	if (host !== th) die(`this deployment wakes through the tunnel https://${th} (tunnel create); unset WAKE_WEBHOOK_URL, or run \`a2a-exposed tunnel rm\` first`);
+	if (host !== th) die(`this deployment wakes through the tunnel https://${th} (tunnel create); unset WAKE_WEBHOOK_URL, or run \`${CLI} tunnel rm\` first`);
 }
 
 export async function wake(sub, o) {
@@ -562,7 +565,7 @@ export async function wake(sub, o) {
 		const local = localFingerprints(), remote = r.fingerprints || {};
 		for (const [k, v] of Object.entries(local)) {
 			if (!v) continue;
-			if (!r.fingerprints) { console.error("# this Worker predates fingerprints; redeploy (a2a-exposed deploy) to compare"); break; }
+			if (!r.fingerprints) { console.error(`# this Worker predates fingerprints; redeploy (${CLI} deploy) to compare`); break; }
 			console.error(`# ${k}: local ${v} vs uploaded ${remote[k] || "(unset)"} -> ${v === remote[k] ? "match" : "DIFFERENT"}`);
 		}
 		return;
@@ -570,7 +573,7 @@ export async function wake(sub, o) {
 	if (sub === "test") {
 		const r = await owner("POST", "/owner/wake/test", {});
 		if (r.configured === false || r.info === "WAKE_WEBHOOK_URL unset")
-			die("no wake webhook configured on the Worker: export WAKE_WEBHOOK_URL (and WAKE_WEBHOOK_KEY or WAKE_HMAC_SECRET), then run `a2a-exposed wake set` first (or use polling)");
+			die(`no wake webhook configured on the Worker: export WAKE_WEBHOOK_URL (and WAKE_WEBHOOK_KEY or WAKE_HMAC_SECRET), then run \`${CLI} wake set\` first (or use polling)`);
 		console.log(JSON.stringify(r, null, 2));
 		if (!(r.status >= 200 && r.status < 300)) process.exitCode = 1;
 		else if (C.get("WAKE_PRESET") === "claude-code") console.error(CLAUDE_CODE_NOTE);
@@ -582,7 +585,7 @@ export async function wake(sub, o) {
 		if (!Object.keys(secrets).length && !DEPLOY_FLAGS.some((f) => o[f] !== undefined))
 			die("nothing to set: export WAKE_WEBHOOK_URL / WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET and/or pass --preset etc.");
 		await deploy(o); // wake set = save settings + upload secrets + redeploy, in one step
-		console.error("wake settings deployed. Next: a2a-exposed wake preview, then a2a-exposed wake test");
+		console.error(`wake settings deployed. Next: ${CLI} wake preview, then ${CLI} wake test`);
 		if (C.get("WAKE_PRESET") === "claude-code") console.error(CLAUDE_CODE_NOTE);
 		return;
 	}

package/lib/main.mjs

@@ -1,6 +1,6 @@
 import { parseArgs } from "node:util";
 import fs from "node:fs";
-import { CliError } from "./a2a.mjs";
+import { CLI, CliError } from "./a2a.mjs";
 import * as C from "./config.mjs";
 import * as cmd from "./commands.mjs";
 import * as dep from "./deploy.mjs";
@@ -13,9 +13,10 @@ const VERSION = JSON.parse(fs.readFileSync(new URL("../package.json", import.met
 
 const HELP = `a2a-exposed ${VERSION} - public A2A endpoint for any AI agent (Cloudflare Worker inbox + wake webhook)
 
-Usage: a2a-exposed <command> [options]        (or: npx a2a-exposed <command>)
+Usage: npx -y a2a-exposed@latest <command> [options]
+       (optional speed-up: npm i -g a2a-exposed, then a2a-exposed <command>)
 
-Setup (needs Node 22.18+, e.g. \`mise exec node@22 -- npx a2a-exposed ...\`, and a Cloudflare login:
+Setup (needs Node 22.18+, e.g. \`mise exec node@22 -- npx -y a2a-exposed@latest ...\`, and a Cloudflare login:
 npx cf auth login --no-browser; on a VPS where it fails with HTTP 403 before showing a code, export
 CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
   init [--hostname <host> | --workers-dev [--workers-dev-subdomain NAME]]
@@ -57,7 +58,7 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
                                                on a terminal, else exit 1 with what to do
                                 --upstream-token-stdin  read UPSTREAM_TOKEN from stdin (hidden prompt on a terminal)
                                 --no-upstream-token  the upstream needs no bearer token: skip that check (saved)
-                                --cli-command  command shown in wake hints (default "npx a2a-exposed";
+                                --cli-command  command shown in wake hints (default "npx -y a2a-exposed@latest";
                                                e.g. "node /path/to/repo/cli/bin/a2a-exposed.mjs")
                                 --worker-dir   where the Worker project (template copy) lives (default
                                                <config dir>/worker; --dir is the old name). Not the config dir:
@@ -110,6 +111,9 @@ Inbox (owner side)
         [--artifact] [--artifact-name N] [--force]
   history <contextId> [-n 50] [--json]     conversation log
   contexts                                 recent conversations
+  export [--sql]                       JSON dump of this inbox on stdout (peer-token hashes and
+                                       encrypted peer tokens are in the dump; the owner token stays
+                                       a Worker secret). --sql prints the same tables as SQL
 
 Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens into chat)
   connect <base-or-card-url> [--alias A] [--name N] [--card-url URL] [--replace] [--no-wait] [--json]
@@ -127,6 +131,12 @@ Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens
                           approval password on a web page. Send it to them privately; never open or fill it
                           yourself. A new link invalidates the previous one
   pair set-password       the same in a terminal, no echo (the human runs it; never via argv/stdin)
+  pair set-oidc --issuer URL --client-id ID --subjects SUB[,SUB...] [--methods password,oidc] [--secret-stdin]
+                          optional OpenID Connect approval on /device and the MCP consent page. The client
+                          secret is APPROVAL_OIDC_CLIENT_SECRET in the environment, or one line on stdin with
+                          --secret-stdin. It is not a flag and it is not saved in config.env. The next
+                          \`npx -y a2a-exposed@latest deploy\` uploads that environment variable as a Worker
+                          secret. Leave the issuer unset and approval stays the password page
   pair list [--json]      pending pairing requests (code, claimed name/card, address), the approval mode and
                           when the approval password was set
   pair approve <code>     approve (only with --pairing-approval agent, after your human said yes)
@@ -171,9 +181,10 @@ const SPEC = {
 	send: { to: S, text: S, context: S, task: S, push: B, proto: S },
 	poll: { to: S, proto: S },
 	status: { json: B },
+	export: { sql: B },
 	upstream: { json: B },
 	connect: { alias: S, name: S, json: B, "no-wait": B, replace: B, force: B, "card-url": S },
-	pair: { json: B, web: B, ttl: S },
+	pair: { json: B, web: B, ttl: S, issuer: S, "client-id": S, subjects: S, methods: S, "secret-stdin": B },
 };
 const STATES = ["completed", "input-required", "failed", "rejected", "working"];
 
@@ -187,6 +198,8 @@ export async function main(argv) {
 	if (!name || name === "help" || name === "--help" || name === "-h") return console.log(HELP);
 	if (name === "--version" || name === "-v") return console.log(VERSION);
 	if (rest.includes("--help") || rest.includes("-h")) return console.log(HELP);
+	if (name === "pair" && rest[0] === "set-oidc" && rest.some((a) => /^--(secret|client-secret)(=|$)/.test(a)))
+		throw new CliError("the OpenID Connect client secret is not a flag: export APPROVAL_OIDC_CLIENT_SECRET or pass --secret-stdin (it is not saved in config.env)");
 	if (name === "pair" && rest[0] === "set-password") {
 		// only --web [--ttl M] [--json]: the password itself never comes from argv, stdin or the environment
 		const extra = rest.slice(1);
@@ -203,7 +216,7 @@ export async function main(argv) {
 			await dep.init(o);
 			if (!o.tunnel) return;
 			try { return await tun.create(o); } catch (e) {
-				if (e instanceof CliError) e.message += "\n(the inbox is deployed and works; fix the above, then run `a2a-exposed tunnel create`, or check `a2a-exposed status`)";
+				if (e instanceof CliError) e.message += `\n(the inbox is deployed and works; fix the above, then run \`${CLI} tunnel create\`, or check \`${CLI} status\`)`;
 				throw e;
 			}
 		case "tunnel": return tun.tunnel(need(p[0], "tunnel create|status|rm"), o);
@@ -217,7 +230,7 @@ export async function main(argv) {
 		case "wake": return dep.wake(p[0], o);
 		case "url": {
 			const u = cmd.baseUrl();
-			if (!u) throw new CliError(`no base URL configured in ${C.CONFIG_FILE}: run \`a2a-exposed init\` (or pass --config-dir / A2A_CONFIG_DIR for another deployment)`);
+			if (!u) throw new CliError(`no base URL configured in ${C.CONFIG_FILE}: run \`${CLI} init\` (or pass --config-dir / A2A_CONFIG_DIR for another deployment)`);
 			return console.log(u);
 		}
 		case "config": {
@@ -234,15 +247,17 @@ export async function main(argv) {
 			return cmd.reply(need(p[0], "reply <taskId> --text ..."), o);
 		case "history": return cmd.history(need(p[0], "history <contextId>"), o);
 		case "contexts": return cmd.contexts();
+		case "export": return cmd.exportInbox(o);
 		case "token": return cmd.token(need(p[0], "token issue|list|revoke|rotate [label]"), p[1], o);
 		case "peers": return cmd.peers(p[0] || "list", p.slice(1), o);
 		case "connect": return pair.connect(need(p[0], "connect <base-or-card-url> [--alias A] [--no-wait] [--json]"), o);
 		case "pair": {
-			const sub = need(p[0], "pair set-password|list|approve <code>|deny <code>");
+			const sub = need(p[0], "pair set-password|set-oidc|list|approve <code>|deny <code>");
 			if (sub === "set-password") return pair.setPassword(o);
+			if (sub === "set-oidc") return pair.setOidc(o, p.slice(1));
 			if (sub === "list") return pair.list(o);
 			if (sub === "approve" || sub === "deny") return pair.decide(sub, need(p[1], `pair ${sub} <code>`));
-			throw new CliError(`unknown pair action ${sub} (set-password|list|approve|deny)`);
+			throw new CliError(`unknown pair action ${sub} (set-password|set-oidc|list|approve|deny)`);
 		}
 		case "send": return cmd.send(o);
 		case "poll": return cmd.poll(need(p[0], "poll --to <peer> <taskId>"), o);

package/lib/pair.mjs

@@ -1,14 +1,13 @@
 // Device-flow pairing (OAuth 2.0 Device Authorization Grant, RFC 8628).
-//   Owner side (this inbox is the authorization server): pair set-password | list | approve | deny
+//   Owner side (this inbox is the authorization server): pair set-password | set-oidc | list | approve | deny
 //   Client side (connect to another inbox): connect <base-or-card-url>
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import * as C from "./config.mjs";
-import { describeHttp, die, fetchCard, httpJson, isPrivateHost, pickEndpoint } from "./a2a.mjs";
+import { CLI, describeHttp, die, fetchCard, httpJson, isPrivateHost, pickEndpoint } from "./a2a.mjs";
 import { baseUrl, peerToken, warnPeerTokenEnv } from "./commands.mjs";
 
-const CLI = "a2a-exposed";
 export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 export const PBKDF2_ITERATIONS = 100000; // default (the Workers runtime's maximum); the Worker advertises its own setting
 export const MIN_PASSWORD_LENGTH = 12;
@@ -102,6 +101,50 @@ No terminal? \`${CLI} pair set-password --web\` prints a one-time link where you
 	console.error(`Approve pairing requests at ${baseUrl()}/device: a webhook wake carries each request's direct link; polling agents see requests in \`${CLI} inbox\` and \`${CLI} pair list\`.${r.data.mode === "human" ? "" : ` Note: approval mode is ${r.data.mode}.`}`);
 }
 
+/** `pair set-oidc`: non-secret settings in config.env. The client secret stays in the environment (or was read from stdin and discarded). */
+export async function setOidc(o, extra = []) {
+	if (extra.length) die("pair set-oidc takes no extra arguments. The client secret is not an argument: export APPROVAL_OIDC_CLIENT_SECRET or pass --secret-stdin");
+	if (!o.issuer || !o["client-id"] || !o.subjects) die("usage: pair set-oidc --issuer https://idp.example --client-id ID --subjects sub@example.com[,other] [--methods password,oidc] [--secret-stdin]");
+	let issuer;
+	try { issuer = new URL(String(o.issuer).trim()); } catch { die("--issuer must be an https URL"); }
+	if (issuer.protocol !== "https:" || issuer.username || issuer.password) die("--issuer must be an https URL with no user name or password");
+	const clientId = String(o["client-id"]).trim();
+	if (!clientId || clientId.length > 200 || /\s/.test(clientId)) die("--client-id must be a single token, at most 200 characters");
+	const subjects = String(o.subjects).split(",").map((s) => s.trim()).filter(Boolean);
+	if (!subjects.length || subjects.some((s) => s.length > 320 || /[\r\n]/.test(s))) die("--subjects is a comma-separated list of allowed sub or email values");
+	let methods;
+	if (o.methods !== undefined) {
+		const parts = String(o.methods).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+		if (!parts.length || parts.some((p) => p !== "password" && p !== "oidc")) die("--methods is a comma-separated list of password and oidc");
+		methods = [...new Set(parts)].join(",");
+	}
+	let sawStdin = false;
+	if (o["secret-stdin"]) {
+		if (process.stdin.isTTY) die("--secret-stdin reads the client secret from a pipe. Or export APPROVAL_OIDC_CLIENT_SECRET. It is not saved in config.env");
+		const chunks = [];
+		for await (const c of process.stdin) chunks.push(c);
+		const secret = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+		if (!secret || /[\r\n]/.test(secret)) die("the client secret must be a single non-empty line on stdin");
+		sawStdin = true;
+		const fromEnv = process.env.APPROVAL_OIDC_CLIENT_SECRET || "";
+		if (fromEnv && fromEnv !== secret) console.error("The secret on stdin differs from APPROVAL_OIDC_CLIENT_SECRET. Deploy uploads the environment variable. Neither value was printed or saved.");
+	} else if (!(process.env.APPROVAL_OIDC_CLIENT_SECRET || "").trim()) {
+		die("export APPROVAL_OIDC_CLIENT_SECRET or pass --secret-stdin. The client secret is not a flag and is not saved in config.env");
+	}
+	C.saveConfig({
+		APPROVAL_OIDC_ISSUER: String(o.issuer).trim(),
+		APPROVAL_OIDC_CLIENT_ID: clientId,
+		APPROVAL_OIDC_ALLOWED_SUBJECTS: subjects.join(","),
+		...(methods !== undefined ? { APPROVAL_METHODS: methods } : {}),
+	});
+	console.error(`OpenID Connect approval saved in ${C.CONFIG_FILE} (issuer, client id, allowed subjects${methods !== undefined ? ", methods" : ""}).`);
+	console.error("The client secret was not written there and was not printed.");
+	if (sawStdin && !(process.env.APPROVAL_OIDC_CLIENT_SECRET || "").trim())
+		console.error(`Export APPROVAL_OIDC_CLIENT_SECRET in the environment you use for deploy. This command did not store it.`);
+	console.error(`The next \`npx -y a2a-exposed@latest deploy\` uploads APPROVAL_OIDC_CLIENT_SECRET from the environment as a Worker secret.`);
+	console.error("Password approval stays available unless --methods oidc (and only once the issuer, client id, secret and allowlist are all set).");
+}
+
 // ---------------------------------------------------------------- owner: list / approve / deny
 export async function list(o) {
 	const r = await ownerCall("GET", "/owner/pairing");
@@ -115,6 +158,7 @@ export async function list(o) {
 	if (d.mode !== "off") {
 		console.log(`approval password: ${d.passwordSet ? `set${d.passwordSetAt ? ` ${d.passwordSetAt}` : ""}${d.passwordSetVia ? ` (via ${d.passwordSetVia})` : ""}`
 			: `NOT SET: run \`${CLI} pair set-password --web\` and send your human the one-time link (or they run \`${CLI} pair set-password\` in a terminal)`}`);
+		if (d.oidcIssuer) console.log(`OpenID Connect: ${(d.approvalMethods || []).join(" and ")} (${d.oidcIssuer})`);
 		if (d.setupLinkExpiresAt) console.log(`setup link: one is open until ${d.setupLinkExpiresAt} (a new \`pair set-password --web\` replaces it)`);
 	}
 	if (!d.pending.length) return console.log("(no pending pairing requests)");

package/lib/status.mjs

@@ -3,12 +3,11 @@
 // itself, so agents need no curl (some agent sandboxes flag *.dev URLs in shell commands).
 import fs from "node:fs";
 import * as C from "./config.mjs";
-import { cardUrlProblem, cfErrorCode, describeHttp, die, fingerprint, httpJson } from "./a2a.mjs";
+import { CLI, cardUrlProblem, cfErrorCode, describeHttp, die, fingerprint, httpJson } from "./a2a.mjs";
 import { baseUrl, owner, ownerTry } from "./commands.mjs";
 import * as D from "./deploy.mjs";
 import * as T from "./tunnel.mjs";
 
-const CLI = "a2a-exposed";
 /** Presets whose webhook usually listens only locally: wakes need the tunnel (or another reverse proxy). */
 export const LOCAL_PRESETS = ["openclaw-wake", "openclaw-agent", "hermes"];
 
@@ -202,7 +201,8 @@ export async function collect() {
 				const pr = await owner("GET", "/owner/pairing");
 				if (pr && typeof pr === "object" && ["human", "agent", "off"].includes(pr.mode))
 					s.pairing = { mode: pr.mode, passwordSet: !!pr.passwordSet, passwordSetAt: pr.passwordSetAt || null, passwordSetVia: pr.passwordSetVia || null,
-						setupLinkExpiresAt: pr.setupLinkExpiresAt || null, pending: (pr.pending || []).length };
+						setupLinkExpiresAt: pr.setupLinkExpiresAt || null, pending: (pr.pending || []).length,
+						...(typeof pr.oidcIssuer === "string" && pr.oidcIssuer ? { oidcIssuer: pr.oidcIssuer } : {}) };
 			} catch { /* older Worker (no pairing yet): leave unknown */ }
 			if (s.upstream) {
 				try { s.facade = await owner("GET", "/owner/facade"); }
@@ -303,7 +303,7 @@ export async function status(o) {
 			if (s.zones) rows.push(["zones", s.zones.length ? s.zones.join(", ") : "none on this account"]);
 			const pg = s.pairing;
 			if (pg) rows.push(["pairing", pg.mode === "off" ? "off (token issue only)"
-				: `${pg.mode} approval; approval password ${pg.passwordSet ? `set${pg.passwordSetAt ? ` ${pg.passwordSetAt}` : ""}${pg.passwordSetVia ? ` (via ${pg.passwordSetVia})` : ""}` : `NOT SET${pg.setupLinkExpiresAt ? ` (a setup link is open until ${pg.setupLinkExpiresAt})` : ""}`}${pg.pending ? `; ${pg.pending} pending request(s): ${CLI} pair list` : ""}`]);
+				: `${pg.mode} approval; approval password ${pg.passwordSet ? `set${pg.passwordSetAt ? ` ${pg.passwordSetAt}` : ""}${pg.passwordSetVia ? ` (via ${pg.passwordSetVia})` : ""}` : `NOT SET${pg.setupLinkExpiresAt ? ` (a setup link is open until ${pg.setupLinkExpiresAt})` : ""}`}${pg.oidcIssuer ? `; OpenID Connect (${pg.oidcIssuer})` : ""}${pg.pending ? `; ${pg.pending} pending request(s): ${CLI} pair list` : ""}`]);
 		}
 		rows.push(["next step", next.text]);
 		for (const a of next.also || []) rows.push(["also", a]);

package/lib/tunnel.mjs

@@ -10,7 +10,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import * as C from "./config.mjs";
-import { CliError, die, fingerprint, httpJson } from "./a2a.mjs";
+import { CLI, CliError, die, fingerprint, httpJson } from "./a2a.mjs";
 import { owner } from "./commands.mjs";
 import * as D from "./deploy.mjs";
 
@@ -63,7 +63,7 @@ export function noZoneHelp(zones) {
 			: "this Cloudflare account has no domain (zone).",
 		"The wake tunnel needs a zone anywhere on the account for its hostname and Access app (whether the inbox is on workers.dev or a custom hostname).",
 		"Without one, use scheduled polling: the inbox works as it is (setup skill: \"Agents without inbound webhooks: polling\").",
-		"To use the tunnel later, add a domain to the account and run `a2a-exposed tunnel create` (no redeploy needed).",
+		`To use the tunnel later, add a domain to the account and run \`${CLI} tunnel create\` (no redeploy needed).`,
 	].join("\n");
 }
 
@@ -215,9 +215,9 @@ export function listZones(dir) {
 
 // ------------------------------------------------------------------ commands
 function needDeployment(o) {
-	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die("no saved deployment; run `a2a-exposed init` first");
+	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`no saved deployment; run \`${CLI} init\` first`);
 	const dir = D.workerDir(o);
-	if (!fs.existsSync(dir)) die(`worker project not found at ${dir}; run \`a2a-exposed deploy\` once`);
+	if (!fs.existsSync(dir)) die(`worker project not found at ${dir}; run \`${CLI} deploy\` once`);
 	return dir;
 }
 
@@ -293,12 +293,12 @@ export async function create(o) {
 		console.log(url);
 		console.error(`\ntunnel ready: wakes go to ${url} -> ${origin}${wpath} on the agent's machine`);
 		console.error(connectorInstructions(tokenFile, o["show-token"] ? token : ""));
-		console.error(`\nThen (Worker secrets apply within ~15 s): a2a-exposed tunnel status   and   a2a-exposed wake test`);
+		console.error(`\nThen (Worker secrets apply within ~15 s): ${CLI} tunnel status   and   ${CLI} wake test`);
 		if (!process.env.WAKE_WEBHOOK_KEY && !process.env.WAKE_HMAC_SECRET && preset !== "generic")
 			console.error(`note: no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET in the environment; keep the ${preset} webhook's own auth too (export it and run \`wake set\`)`);
 	} catch (e) {
 		console.error(`error: ${e.message}\n==> rolling back what was created`);
-		await remove(o, { quiet: true }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`a2a-exposed tunnel rm\``));
+		await remove(o, { quiet: true }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`${CLI} tunnel rm\``));
 		throw e;
 	}
 }
@@ -335,10 +335,10 @@ export const tunnelComplete = () =>
  *  tunnel must be removed first. */
 async function resume(dir, o) {
 	if (!tunnelComplete())
-		die("a previous `tunnel create` did not finish (some ids are saved, see `a2a-exposed status`); run `a2a-exposed tunnel rm`, then `a2a-exposed tunnel create` again");
+		die(`a previous \`tunnel create\` did not finish (some ids are saved, see \`${CLI} status\`); run \`${CLI} tunnel rm\`, then \`${CLI} tunnel create\` again`);
 	const host = C.get("A2A_TUNNEL_HOSTNAME");
 	if (o["tunnel-hostname"] && o["tunnel-hostname"].toLowerCase() !== host)
-		die(`a tunnel already exists on ${host}; to use another hostname run \`a2a-exposed tunnel rm\` first`);
+		die(`a tunnel already exists on ${host}; to use another hostname run \`${CLI} tunnel rm\` first`);
 	if (!tokenFileOk()) {
 		step(`the connector token file ${C.get("A2A_TUNNEL_TOKEN_FILE")} is missing or empty: downloading the tunnel token again`);
 		fetchTokenFile(dir, C.get("A2A_TUNNEL_ID"));
@@ -356,11 +356,11 @@ async function resume(dir, o) {
 	}
 	const preset = C.get("WAKE_PRESET", "generic");
 	if (p && !p.hasKey && !p.hasHmacSecret && !Object.keys(agentAuth).length && preset !== "generic")
-		console.error(`warning: the Worker has no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET, so the ${preset} webhook will reject wakes; export it and run \`a2a-exposed tunnel create\` again`);
+		console.error(`warning: the Worker has no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET, so the ${preset} webhook will reject wakes; export it and run \`${CLI} tunnel create\` again`);
 	console.log(url);
 	console.error(`tunnel already set up: wakes go to ${url} -> ${C.get("A2A_TUNNEL_ORIGIN")}${C.get("A2A_TUNNEL_PATH")} (nothing new created; to change it: tunnel rm, then tunnel create)`);
 	console.error(connectorInstructions(C.get("A2A_TUNNEL_TOKEN_FILE")));
-	console.error("Then: a2a-exposed tunnel status   and   a2a-exposed wake test");
+	console.error(`Then: ${CLI} tunnel status   and   ${CLI} wake test`);
 }
 
 function putSecrets(dir, worker, map) {
@@ -370,7 +370,7 @@ function putSecrets(dir, worker, map) {
 export async function status(o) {
 	const dir = needDeployment(o);
 	const host = C.get("A2A_TUNNEL_HOSTNAME");
-	if (!host) return console.log("no tunnel configured (a2a-exposed tunnel create)");
+	if (!host) return console.log(`no tunnel configured (${CLI} tunnel create)`);
 	const info = { hostname: host, wakeUrl: wakeUrl(host, C.get("A2A_TUNNEL_PATH") || "/"), origin: C.get("A2A_TUNNEL_ORIGIN") };
 	const tid = C.get("A2A_TUNNEL_ID");
 	if (tid) {

package/lib/update.mjs

@@ -31,7 +31,7 @@ export function newer(a, b) {
 /** The notice for `current`, given the cache contents (or "" when up to date / unknown). */
 export function notice(current, cache) {
 	if (!cache || !cache.latest || !newer(cache.latest, current)) return "";
-	return `a2a-exposed ${cache.latest} is available (you have ${current}): npm i -g a2a-exposed@latest, then a2a-exposed deploy (updates the Worker; applies new D1 migrations). Silence: A2A_NO_UPDATE_CHECK=1`;
+	return `a2a-exposed ${cache.latest} is available (you have ${current}): run npx -y a2a-exposed@latest deploy (updates the Worker; applies new D1 migrations). With a global install, npm i -g a2a-exposed@latest first. Silence: A2A_NO_UPDATE_CHECK=1`;
 }
 
 export const due = (cache, now = Date.now()) => !cache || !(now - (cache.checkedAt || 0) < CHECK_INTERVAL_MS);