a2a-exposed 0.8.1 → 0.8.2

package/lib/commands.mjs

@@ -62,7 +62,7 @@ export async function inbox(o) {
 	}
 }
 
-const PAIRING_NOTE = `Tell your human who is asking, the code and the link (details: ${CLI} pair list). Never approve on your own: in human mode they approve on the link with their approval password; in agent mode run \`pair approve <code>\` only after they say yes.`;
+const PAIRING_NOTE = `Tell your human who is asking, the code and the link (details: ${CLI} pair list). Never approve on your own: in human mode the owner approves with the owner token or on the link with the approval password; in agent mode run \`pair approve <code>\` only after they say yes.`;
 
 export const show = async (id) => out(await owner("GET", `/owner/tasks/${q(id)}`));
 

package/lib/deploy.mjs

@@ -204,7 +204,7 @@ function applyFlags(o) {
 	if (o["workers-dev-subdomain"] !== undefined && !WD.LABEL_RE.test(o["workers-dev-subdomain"]))
 		die("--workers-dev-subdomain must be lowercase letters, digits and hyphens (a DNS label)");
 	if (upd.PAIRING_APPROVAL !== undefined && !PAIRING_MODES.includes(upd.PAIRING_APPROVAL))
-		die(`--pairing-approval must be one of ${PAIRING_MODES.join(" | ")} (human: approval password on the /device page; agent: also \`pair approve\`; off: no device-flow pairing)`);
+		die(`--pairing-approval must be one of ${PAIRING_MODES.join(" | ")} (human: the owner token via \`pair approve\`, or the approval password on the /device page; agent: the agent runs \`pair approve\` after the human says yes; off: no device-flow pairing)`);
 	if (upd.A2A_PBKDF2_ITERATIONS !== undefined) {
 		const n = Number(upd.A2A_PBKDF2_ITERATIONS);
 		if (!Number.isInteger(n) || n < 50000 || n > 100000)

package/lib/main.mjs

@@ -17,17 +17,20 @@ const HELP = `a2a-exposed ${VERSION} - public A2A endpoint for any AI agent (Clo
 
 Usage: npx -y a2a-exposed@latest <command> [options]
        (optional speed-up: npm i -g a2a-exposed, then a2a-exposed <command>)
+       --version, -v                 print the version
+       --help, -h                    print this help
 
 Setup (needs Node 22.18+, e.g. \`mise exec node@22 -- npx -y a2a-exposed@latest ...\`, and a Cloudflare login:
 npx cf auth login --no-browser; on a VPS where it fails with HTTP 403 before showing a code, export
-CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting. With no Cloudflare profile, token, or account,
-or when deploy hits error 1042 after the short wait, a data-center or network block, or an account that
-cannot take the Worker, name the reason and say "Ask your human to set it up on https://a2a.exposed")
+CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting. a2a.exposed hosts the inbox and is open to everyone
+(https://a2a.exposed/pricing). When to use it, and the sentence to say:
+https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md#hosted-inbox)
   init [--hostname <host> | --workers-dev [--workers-dev-subdomain NAME]]
        [--agent-name N] [--agent-description D] [--agent-skills JSON]
        [--provider-organization O --provider-url U] [--preset P] [--worker-name W] [--d1-name D]
        [--account-id ID] [--cf-profile NAME] [--cli-command CMD] [--debounce S] [--max-per-hour N]
        [--pairing-approval human|agent|off] [--pbkdf2-iterations N] [--workers-logs on|off] [--mcp on|off] [--cron]
+       [--rotate-owner-token]
        [--upstream URL [--upstream-card-url URL] [--upstream-token-stdin | --no-upstream-token]] [--worker-dir DIR]
                                 deploy the Worker + D1 to your account; wake secrets are read from
                                 env WAKE_WEBHOOK_URL / WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET (never argv)
@@ -39,13 +42,18 @@ cannot take the Worker, name the reason and say "Ask your human to set it up on
                                                (npx cf auth create NAME --no-browser); saved, used by every cf call
                                 --d1-name      D1 database to create or reuse (default: worker name)
                                 --pairing-approval  who approves device-flow pairing requests (default human:
-                                               approval password on the /device page; agent: also \`pair approve\`;
-                                               off: no pairing endpoints, \`token issue\` only)
+                                               the owner token via \`pair approve\`, or the approval password
+                                               on the /device page; agent: the agent runs \`pair approve\` after
+                                               the human says yes; off: no pairing endpoints, \`token issue\` only)
                                 --pbkdf2-iterations  approval-password hashing cost, 50000-100000 (default 100000,
                                                the Workers maximum; lower only if /device hits error 1102)
                                 --workers-logs on|off  persisted Cloudflare Workers Logs (query strings redacted)
                                 --mcp on|off   remote MCP server at <url>/mcp for Claude and other MCP clients
-                                               (default on; each client needs your approval password once)
+                                               (default on; each client needs your approval password once).
+                                               Plugin manifests leave MCP unset: the URL differs per deploy.
+                                               When GET /owner/mcp reports enabled and the agent card is reachable,
+                                               \`status\` prints \`claude mcp add --transport http a2a-exposed <url>/mcp\`
+                                --rotate-owner-token  on init, replace the owner token; other settings come from config.env
                                 --upstream URL  proxy / expose mode: a public façade for an agent that already
                                                speaks A2A (JSON-RPC) on a private network. URL is its endpoint on
                                                a Cloudflare Tunnel hostname behind Access (never a Tailnet/LAN
@@ -65,8 +73,7 @@ cannot take the Worker, name the reason and say "Ask your human to set it up on
                                 --cli-command  command shown in wake hints (default "npx -y a2a-exposed@latest";
                                                e.g. "node /path/to/repo/cli/bin/a2a-exposed.mjs")
                                 --worker-dir   where the Worker project (template copy) lives (default
-                                               <config dir>/worker; --dir is the old name). Not the config dir:
-                                               that is --config-dir / A2A_CONFIG_DIR
+                                               <config dir>/worker). The config dir is --config-dir / A2A_CONFIG_DIR
   deploy [same flags]           redeploy with saved settings (secrets persist)
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
@@ -100,6 +107,9 @@ Status
                                 upstream card, Access credential and upstream bearer configured (separately), the
                                 live upstream check, the last failed peer call, card-leak check; warnings for peer
                                 token variables shadowing saved tokens; and the next step to run.
+                                When GET /owner/mcp reports enabled and the agent card is reachable, prints
+                                \`claude mcp add --transport http a2a-exposed <base URL>/mcp\`.
+                                A failed probe, an unreachable card, or a Worker that reports MCP off leaves that line out.
                                 Read-only; run it after an interruption and continue from "next step". Exit 1 = broken
   upstream verify [--json]      proxy mode: check the façade's whole path, layer by layer: façade peer auth
                                 (unauthenticated call -> 401), then the Worker calls the upstream with its stored
@@ -129,8 +139,8 @@ Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens
                           (never printed). --no-wait: print the code and exit; run the same command again to
                           check (same code). An expired code exits 1 (nothing new is requested silently).
                           An alias whose token still works is refused unless --replace (alias --force): the
-                          peer then swaps the old token for the new one under the same label (older peers
-                          keep the old token until their owner revokes it). --card-url: the card to name in
+                          peer swaps the token under the same label when it accepts the replacement. When
+                          it keeps the previous token active, that owner revokes it. --card-url: the card to name in
                           the request (default: this deployment's); a *.ts.net / LAN card is sent as
                           informational (flagged "not publicly reachable"), a non-https one is left out.
                           The name sent is the card named in the request (--card-url, otherwise this
@@ -150,7 +160,8 @@ Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens
                           Leave the issuer unset and approval stays the password page
   pair list [--json]      pending pairing requests (code, claimed name/card, address), the approval mode and
                           when the approval password was set
-  pair approve <code>     approve (only with --pairing-approval agent, after your human said yes)
+  pair approve <code>     approve with the owner token (human mode records the owner; in agent
+                          mode, run it only after your human said yes)
   pair deny <code>        deny (any mode; on the /device page deny needs no password)
 
 Inbound peer tokens (one per peer label; paired agents get one too)

package/lib/pair.mjs

@@ -153,7 +153,7 @@ export async function list(o) {
 	if (o.json) return console.log(JSON.stringify(d, null, 2));
 	const how = d.mode === "off" ? "off (device-flow pairing disabled; `token issue` only)"
 		: d.mode === "agent" ? `agent (\`${CLI} pair approve <code>\` after your human says yes, or the ${d.verificationUri} page)`
-		: `human (your human approves on ${d.verificationUri} with the approval password)`;
+		: `human (the owner approves with the owner token, or on ${d.verificationUri} with the approval password)`;
 	console.log(`approval: ${how}`);
 	if (d.mode !== "off") {
 		console.log(`approval password: ${d.passwordSet ? `set${d.passwordSetAt ? ` ${d.passwordSetAt}` : ""}${d.passwordSetVia ? ` (via ${d.passwordSetVia})` : ""}`

package/lib/status.mjs

@@ -184,6 +184,7 @@ export async function collect() {
 		upstream: C.get("A2A_UPSTREAM_URL") || null, facade: null, upstreamVerify: null, upstreamVerifyError: "", facadePeerAuth: null,
 		upstreamNoToken: C.get("A2A_UPSTREAM_NO_TOKEN") === "1", localUpstreamToken: fingerprint(process.env.UPSTREAM_TOKEN),
 		peerTokenShadowed: shadowedPeerTokens(),
+		mcp: "unknown",
 	};
 	const envBase = (process.env.A2A_BASE_URL || "").replace(/\/$/, "");
 	if (envBase && envBase !== s.baseUrlSaved) s.baseUrlEnv = envBase;
@@ -209,6 +210,11 @@ export async function collect() {
 				catch (e) { s.facade = { mode: "unknown", error: e.message }; }
 				if (s.facade && s.facade.mode === "proxy") Object.assign(s, await upstreamCheck(s.baseUrl));
 			}
+			try {
+				const m = await ownerTry("GET", "/owner/mcp");
+				if (m.status === 200 && m.data && typeof m.data === "object" && typeof m.data.enabled === "boolean")
+					s.mcp = m.data.enabled ? "on" : "off";
+			} catch { /* probe failed: leave mcp unknown so status omits the add line */ }
 		}
 	}
 	const dir = D.workerDir({});
@@ -250,6 +256,12 @@ export async function upstreamCheck(base) {
 	return out;
 }
 
+/** Exact `claude mcp add` line when GET /owner/mcp reports `enabled` and the agent card is reachable. */
+export function mcpAddCommand(s) {
+	if (!s || !s.baseUrl || s.mcp !== "on" || !s.card?.ok || !s.ownerApi?.ok) return "";
+	return `claude mcp add --transport http a2a-exposed ${String(s.baseUrl).replace(/\/$/, "")}/mcp`;
+}
+
 /** `upstream verify`: the façade's whole path, layer by layer; exit 1 unless the upstream app answered. */
 export async function upstreamVerify(o) {
 	if (!C.get("A2A_UPSTREAM_URL")) die(`not a façade: ${C.CONFIG_FILE} has no A2A_UPSTREAM_URL (proxy mode: \`${CLI} deploy --upstream <tunnel URL>\`). For an inbox, check wakes with \`${CLI} wake test\``);
@@ -270,7 +282,8 @@ export async function upstreamVerify(o) {
 export async function status(o) {
 	const s = await collect();
 	const next = nextStep(s);
-	if (o.json) console.log(JSON.stringify({ ...s, nextStep: next.text, also: next.also, ok: next.ok }, null, 2));
+	const mcpAdd = mcpAddCommand(s);
+	if (o.json) console.log(JSON.stringify({ ...s, mcpAdd, nextStep: next.text, also: next.also, ok: next.ok }, null, 2));
 	else {
 		const rows = [
 			["config", s.configFile],
@@ -305,6 +318,7 @@ export async function status(o) {
 			if (pg) rows.push(["pairing", pg.mode === "off" ? "off (token issue only)"
 				: `${pg.mode} approval; approval password ${pg.passwordSet ? `set${pg.passwordSetAt ? ` ${pg.passwordSetAt}` : ""}${pg.passwordSetVia ? ` (via ${pg.passwordSetVia})` : ""}` : `NOT SET${pg.setupLinkExpiresAt ? ` (a setup link is open until ${pg.setupLinkExpiresAt})` : ""}`}${pg.oidcIssuer ? `; OpenID Connect (${pg.oidcIssuer})` : ""}${pg.pending ? `; ${pg.pending} pending request(s): ${CLI} pair list` : ""}`]);
 		}
+		if (mcpAdd) rows.push(["mcp", mcpAdd]);
 		rows.push(["next step", next.text]);
 		for (const a of next.also || []) rows.push(["also", a]);
 		const w = Math.max(12, ...rows.map(([k]) => k.length + 2));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.1",
+	"version": "0.8.2",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -355,7 +355,7 @@ function securitySchemes(ctx: TenantContext): Json {
 		description: "Get a bearer token without exchanging secrets in chat: OAuth 2.0 Device Authorization Grant (RFC 8628). " +
 			"POST client_name (your agent's name) and agent_card_url (your card) form-encoded to deviceAuthorizationUrl; show the user_code and " +
 			"verification_uri_complete to your human, who confirms the code with this agent's owner; poll tokenUrl with grant_type=" + P.DEVICE_GRANT +
-			" every `interval` seconds. The owner approves every request" + (pairingMode(ctx) === "human" ? " on the verification page." : ".") +
+			" every `interval` seconds. The owner approves every request" + (pairingMode(ctx) === "human" ? " with the owner token or on the verification page." : ".") +
 			" The access_token is a per-peer token for Authorization: Bearer (no refresh token; the owner can revoke it).",
 		flows: { deviceCode: { deviceAuthorizationUrl: u.device, tokenUrl: u.token, scopes: { a2a: "Send messages to this agent and read the tasks you created" } } },
 		oauth2MetadataUrl: u.metadata,
@@ -1716,11 +1716,16 @@ async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: st
 		if (!code) return json({ error: "not a valid code (it looks like WDJB-4827)" }, 400);
 		const approve = seg[1] === "approve";
 		// The header is set only by runOwnerRpc for actor "human". A network request is not trusted, so the same
-		// header on /owner/* does not approve and does not change who is logged.
+		// header on /owner/* does not change who is logged.
+		// handleOwner already returned 401 unless this request presented the owner token or is an in-process call.
+		// The owner token approves and denies in human mode, and decide records that as the owner. An in-process
+		// call that is not the human actor is the agent path: human mode still refuses its approve.
 		const dashboardHuman = trusted && req.headers.get(DASHBOARD_ACTOR_HEADER) === "human";
-		if (approve && mode !== "agent" && !dashboardHuman)
-			return json({ error: `approval mode is human: the owner approves on ${oauthUrls(ctx).page}?user_code=${P.formatUserCode(code)} with the approval password. \`pair approve\` works only after \`${cliCommand(ctx)} deploy --pairing-approval agent\`, and only if your human wants the agent to approve. \`pair deny\` works in every mode.` }, 403);
-		const d = await decide(ctx, code, approve, dashboardHuman ? "human" : approve ? "agent" : "owner");
+		const ownerAuthed = !trusted;
+		if (approve && mode !== "agent" && !dashboardHuman && !ownerAuthed)
+			return json({ error: `approval mode is human: this call cannot approve. The owner approves with the owner token, or on ${oauthUrls(ctx).page}?user_code=${P.formatUserCode(code)} with the approval password.` }, 403);
+		const by = dashboardHuman ? "human" : approve && mode === "agent" ? "agent" : "owner";
+		const d = await decide(ctx, code, approve, by);
 		if (!d.ok) return json({ error: d.error }, 409);
 		return json({ ok: true, decision: approve ? "approved" : "denied", userCode: P.formatUserCode(code), label: d.label || null,
 			clientName: d.request.client_name || d.request.client_id || null, replaced: !!d.replaced });

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.1";
+export const VERSION = "0.8.2";

package/worker/src/wake.ts

@@ -80,7 +80,7 @@ export function wakePayload(ev: WakeEvent, cli: string): Record<string, unknown>
 export function pairingInstructions(p: PairingInfo, cli: string): string {
 	return p.approval === "human"
 		? `Ask your human; never approve on your own. Show them the code ${p.userCode} and give them this link: ${p.verificationUriComplete} . ` +
-			`They approve or deny there with their approval password, after checking the code with the other agent's owner. Details: \`${cli} pair list\`.`
+			`They approve there with their approval password, or with \`${cli} pair approve ${p.userCode}\` (the owner token), after checking the code with the other agent's owner. Deny with \`${cli} pair deny ${p.userCode}\`. Details: \`${cli} pair list\`.`
 		: `Ask your human; never approve on your own. Show them the code ${p.userCode}, who is asking, and the link ${p.verificationUriComplete} . ` +
 			`Only if they say yes, run \`${cli} pair approve ${p.userCode}\`; if they say no (or don't answer), \`${cli} pair deny ${p.userCode}\`.`;
 }

package/worker/test/hosted.test.ts

@@ -708,17 +708,50 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	assert.equal(pending.some((row) => row.userCode === code && row.clientName === "Barry Bot" && row.clientId === "barry-alias" && row.agentCardUrl === "https://barry.example/.well-known/agent-card.json"), true);
 	const refused = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve` });
 	assert.equal(refused.status, 403);
-	const httpSpoof = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
+	assert.match(String((refused.body as { error?: string }).error || ""), /this call cannot approve/);
+	const httpNoAuth = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
 		method: "POST",
-		headers: { authorization: "Bearer owner-carol", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+		headers: { "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(httpNoAuth.status, 401);
+	const httpPeer = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer a2aow_" + "b".repeat(43), "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
 	});
-	assert.equal(httpSpoof.status, 403);
+	assert.equal(httpPeer.status, 401);
 	const approved = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve`, actor: "human" });
 	assert.equal(approved.status, 200);
 	assert.equal((approved.body as { decision?: string }).decision, "approved");
 	assert.equal(await saw('"event":"pairing_approved"'), true);
 	assert.equal(lines.some((line) => line.includes('"event":"pairing_approved"') && line.includes('"by":"human"')), true);
 
+	const ownerHttpStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.24" },
+		body: "client_name=Owner+Http&client_id=owner-http",
+	});
+	const ownerHttpDevice = await ownerHttpStart.json() as { user_code?: string; device_code?: string };
+	assert.equal(ownerHttpStart.status, 200, JSON.stringify(ownerHttpDevice));
+	const ownerHttpAt = lines.length;
+	const ownerHttp = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${ownerHttpDevice.user_code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-carol", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	const ownerHttpBody = await ownerHttp.json() as { decision?: string; error?: string };
+	assert.equal(ownerHttp.status, 200, JSON.stringify(ownerHttpBody));
+	assert.equal(ownerHttpBody.decision, "approved");
+	const ownerHttpLine = lines.slice(ownerHttpAt).find((line) => line.includes('"event":"pairing_approved"')) ?? "";
+	assert.match(ownerHttpLine, /"by":"owner"/);
+	assert.equal(ownerHttpLine.includes('"by":"human"'), false);
+	const ownerHttpPoll = await mf.dispatchFetch("https://carol.example.com/oauth/token", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.25" },
+		body: `grant_type=${encodeURIComponent("urn:ietf:params:oauth:grant-type:device_code")}&device_code=${encodeURIComponent(ownerHttpDevice.device_code || "")}`,
+	});
+	const ownerHttpToken = await ownerHttpPoll.json() as { access_token?: string; error?: string };
+	assert.equal(ownerHttpPoll.status, 200, JSON.stringify(ownerHttpToken));
+	assert.match(ownerHttpToken.access_token || "", /^a2aow_/);
+
 	const deniedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
 		method: "POST",
 		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
@@ -817,3 +850,77 @@ test("TenantStore.deleteStorage wipes the object and a second call succeeds", as
 	assert.equal(stayed.configured, false);
 	assert.deepEqual(stayed.tables, []);
 });
+
+test("self-host workerd: human mode owner token approves, the device poll returns the token, and agent calls are refused", async (t) => {
+	const base = "https://agent.example.com";
+	const mf = await start({
+		bindings: { PUBLIC_URL: base, OWNER_TOKEN: "owner-secret", PAIRING_APPROVAL: "human", AGENT_NAME: "Test Inbox" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	await migrateD1(mf);
+	const grant = "urn:ietf:params:oauth:grant-type:device_code";
+	const startDevice = async (ip: string, name: string) => {
+		const res = await mf.dispatchFetch(base + "/oauth/device_authorization", {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": ip },
+			body: `client_name=${encodeURIComponent(name)}&client_id=barry`,
+		});
+		const data = await res.json() as { user_code?: string; device_code?: string; error?: string };
+		assert.equal(res.status, 200, JSON.stringify(data));
+		return data;
+	};
+	const device = await startDevice("198.51.100.40", "Barry Bot");
+	const code = device.user_code || "";
+	const anon = await mf.dispatchFetch(`${base}/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(anon.status, 401);
+	const peer = await mf.dispatchFetch(`${base}/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer a2aow_" + "c".repeat(43), "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(peer.status, 401);
+	const approved = await mf.dispatchFetch(`${base}/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-secret", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	const approvedBody = await approved.json() as { decision?: string; error?: string };
+	assert.equal(approved.status, 200, JSON.stringify(approvedBody));
+	assert.equal(approvedBody.decision, "approved");
+	const row = await (await mf.getD1Database("DB")).prepare("SELECT decided_by, status FROM device_requests WHERE user_code = ?")
+		.bind(code.replace("-", "")).first<{ decided_by: string; status: string }>();
+	assert.equal(row?.decided_by, "owner");
+	assert.equal(row?.status, "approved");
+	const polled = await mf.dispatchFetch(base + "/oauth/token", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.41" },
+		body: `grant_type=${encodeURIComponent(grant)}&device_code=${encodeURIComponent(device.device_code || "")}`,
+	});
+	const token = await polled.json() as { access_token?: string; token_type?: string; peer_label?: string; error?: string };
+	assert.equal(polled.status, 200, JSON.stringify(token));
+	assert.match(token.access_token || "", /^a2aow_/);
+	assert.equal(token.token_type, "Bearer");
+	assert.equal(token.peer_label, "Barry-Bot");
+
+	const second = await startDevice("198.51.100.42", "Deny Bot");
+	const denied = await mf.dispatchFetch(`${base}/owner/pairing/${second.user_code}/deny`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-secret", "content-type": "application/json" },
+	});
+	const deniedBody = await denied.json() as { decision?: string; error?: string };
+	assert.equal(denied.status, 200, JSON.stringify(deniedBody));
+	assert.equal(deniedBody.decision, "denied");
+	const denyRow = await (await mf.getD1Database("DB")).prepare("SELECT decided_by FROM device_requests WHERE user_code = ?")
+		.bind((second.user_code || "").replace("-", "")).first<{ decided_by: string }>();
+	assert.equal(denyRow?.decided_by, "owner");
+	const deniedPoll = await mf.dispatchFetch(base + "/oauth/token", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.43" },
+		body: `grant_type=${encodeURIComponent(grant)}&device_code=${encodeURIComponent(second.device_code || "")}`,
+	});
+	const deniedToken = await deniedPoll.json() as { error?: string };
+	assert.equal(deniedToken.error, "access_denied");
+});

package/worker/test/pairing.test.ts

@@ -2,8 +2,9 @@
 // wake webhook captured. Run: npm test
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import worker from "../src/index.ts";
+import worker, { runOwnerRpc } from "../src/index.ts";
 import { DASHBOARD_ACTOR_HEADER } from "../src/owner-rpc.ts";
+import { resolveTenant } from "../src/tenancy.ts";
 import * as P from "../src/pairing.ts";
 import { wakeSummary, renderWake, type WakeEvent } from "../src/wake.ts";
 import { d1 } from "./d1.ts";
@@ -244,7 +245,7 @@ test("PAIRING_APPROVAL=off: no pairing scheme, endpoints 404, plain 401", async
 	assert.equal(a.status, 404);
 });
 
-test("human approval: pending, slow_down, page approve with the password, single-use token, owner approve refused", async (t) => {
+test("human approval: pending, slow_down, page approve with the password, single-use token", async (t) => {
 	const s = setup(); t.after(s.restore);
 	const st = await s.start({ client_name: 'Barry <script>alert(1)</script>', client_id: "barry", agent_card_url: "https://barry.example.org/.well-known/agent-card.json" });
 	assert.equal(st.status, 200);
@@ -281,13 +282,6 @@ test("human approval: pending, slow_down, page approve with the password, single
 	advance(16);
 	assert.equal((await s.poll(d.device_code)).data.error, "authorization_pending");
 
-	// human mode: the owner API (the agent) cannot approve, and the dashboard header does not change that
-	const oa = await s.owner("POST", `/owner/pairing/${d.user_code}/approve`);
-	assert.equal(oa.status, 403);
-	assert.match(oa.data.error, /approval mode is human: the owner approves on https:\/\/agent\.example\.com\/device\?user_code=/);
-	const spoofed = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
-	assert.equal(spoofed.status, 403);
-	assert.match(spoofed.data.error, /approval mode is human/);
 	const list = await s.owner("GET", "/owner/pairing");
 	assert.deepEqual([list.data.mode, list.data.passwordSet, list.data.pending.length, list.data.pending[0].userCode], ["human", false, 1, d.user_code]);
 
@@ -351,6 +345,54 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal((await s.call("POST", "/", { json: { jsonrpc: "2.0", id: 1, method: "GetTask", params: { id: "x" } }, headers: { authorization: `Bearer ${p.data.access_token}` } })).status, 401);
 });
 
+test("human mode: the owner token approves and denies; the device poll returns the token; agent and anonymous calls are refused", async (t) => {
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => { lines.push(args.map((part) => String(part)).join(" ")); orig(...args); };
+	t.after(() => { console.log = orig; });
+	const s = setup(); t.after(s.restore);
+	const st = await s.start({ client_name: "Barry Bot", client_id: "barry" }, "203.0.113.70");
+	assert.equal(st.status, 200, JSON.stringify(st.data));
+	const d = st.data;
+	const anon = await s.call("POST", `/owner/pairing/${d.user_code}/approve`);
+	assert.equal(anon.status, 401);
+	const peerTok = "a2aow_" + "c".repeat(43);
+	const agent = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { authorization: `Bearer ${peerTok}`, [DASHBOARD_ACTOR_HEADER]: "human" } });
+	assert.equal(agent.status, 401);
+	const headerOnly = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { [DASHBOARD_ACTOR_HEADER]: "human" } });
+	assert.equal(headerOnly.status, 401);
+	const rpc = await runOwnerRpc(resolveTenant(s.env), { waitUntil() {}, passThroughOnException() {} }, {
+		accountId: "acct_owner", method: "POST", path: `/owner/pairing/${d.user_code}/approve`, actor: "human",
+	});
+	assert.equal(rpc.status, 404);
+	assert.equal((await s.owner("GET", "/owner/pairing")).data.pending.length, 1, "an in-process host call does not approve a self-hosted Worker");
+
+	const approved = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, {
+		headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" },
+	});
+	assert.equal(approved.status, 200, JSON.stringify(approved.data));
+	assert.equal(approved.data.decision, "approved");
+	const decided = s.DB.db.prepare("SELECT decided_by, status FROM device_requests WHERE user_code = ?").get(d.user_code.replace("-", "")) as { decided_by: string; status: string };
+	assert.equal(decided.decided_by, "owner");
+	assert.equal(decided.status, "approved");
+	const logged = lines.find((line) => line.includes('"event":"pairing_approved"')) ?? "";
+	assert.match(logged, /"by":"owner"/);
+	assert.equal(logged.includes('"by":"human"'), false);
+	const polled = await s.poll(d.device_code);
+	assert.equal(polled.status, 200, JSON.stringify(polled.data));
+	assert.match(polled.data.access_token, /^a2aow_[A-Za-z0-9_-]{43}$/);
+	assert.equal(polled.data.token_type, "Bearer");
+	assert.equal(polled.data.peer_label, "Barry-Bot");
+
+	const deny = (await s.start(undefined, "203.0.113.71")).data;
+	const denied = await s.owner("POST", `/owner/pairing/${deny.user_code}/deny`);
+	assert.equal(denied.status, 200, JSON.stringify(denied.data));
+	assert.equal(denied.data.decision, "denied");
+	const denyRow = s.DB.db.prepare("SELECT decided_by FROM device_requests WHERE user_code = ?").get(deny.user_code.replace("-", "")) as { decided_by: string };
+	assert.equal(denyRow.decided_by, "owner");
+	assert.equal((await s.poll(deny.device_code)).data.error, "access_denied");
+});
+
 test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {
 	const lines: string[] = [];
 	const orig = console.log;