a2a-exposed 0.8.10 → 0.8.12

package/lib/commands.mjs

@@ -253,13 +253,24 @@ export function peers(sub, args, o) {
 	}
 }
 
+const ownerConfigured = () => !!(baseUrl() && C.get("A2A_OWNER_TOKEN"));
+
+// Outbound delivery works with just a peer token unless --push is requested.
+// Persistence failures must not hide successful delivery (and invite a duplicate send).
+async function persistOutbound(method, path, body, action) {
+	if (!ownerConfigured()) return false;
+	try { await owner(method, path, body); return true; }
+	catch { console.error(`warning: could not ${action} to the worker`); return false; }
+}
+
 async function logHistory(ctx, entry) {
-	try { await owner("POST", "/owner/history", { contextId: ctx, ...entry }); }
-	catch { console.error("warning: could not log history to the worker"); }
+	await persistOutbound("POST", "/owner/history", { contextId: ctx, ...entry }, "log history");
 }
 
 export async function send(o) {
 	if (!o.to) die("--to required");
+	// The callback authenticates against the token saved through the owner API.
+	if (o.push && !ownerConfigured()) die("--push needs A2A_BASE_URL and A2A_OWNER_TOKEN (your Worker); configure both or omit --push and poll instead");
 	const [alias, base, tok] = resolvePeer(o.to);
 	const card = await fetchCard(base);
 	const [url, version] = pickEndpoint(base, card, o.proto);
@@ -272,7 +283,6 @@ export async function send(o) {
 	const conf = v1 ? { returnImmediately: true } : { blocking: false };
 	let pushToken = null;
 	if (o.push) {
-		if (!baseUrl()) die("--push needs A2A_BASE_URL (your Worker)");
 		pushToken = randomToken(24);
 		conf[v1 ? "taskPushNotificationConfig" : "pushNotificationConfig"] = { url: baseUrl() + "/push", token: pushToken };
 	}
@@ -282,10 +292,13 @@ export async function send(o) {
 	const isTask = obj && typeof obj === "object" && "status" in obj;
 	const ctx = (obj && obj.contextId) || o.context || newId();
 	const tid = isTask ? obj.id : null;
+	out(obj);
 	await logHistory(ctx, { dir: "out", peer: alias, taskId: tid, role: "user", text, data: { messageId: msg.messageId, endpoint: url, protocol: version } });
-	if (tid) await owner("POST", "/owner/outbound", { taskId: tid, contextId: ctx, peer: alias, endpoint: url, protocol: version, pushToken, task: obj });
+	if (tid) {
+		const saved = await persistOutbound("POST", "/owner/outbound", { taskId: tid, contextId: ctx, peer: alias, endpoint: url, protocol: version, pushToken, task: obj }, "save outbound task");
+		if (o.push && !saved) console.error(`warning: push updates cannot authenticate because the outbound task token could not be saved; use ${CLI} poll --to ${alias} ${tid} instead; the message was delivered, do not resend`);
+	}
 	else if (obj && obj.parts) await logHistory(ctx, { dir: "in", peer: alias, role: "agent", event: "direct_message", text: textOf(obj) });
-	out(obj);
 	if (tid) console.error(`# task ${tid}: ${plainState(obj)}  (check: ${CLI} poll --to ${alias} ${tid})`);
 }
 
@@ -294,17 +307,19 @@ export async function poll(taskId, o) {
 	const [alias, base, tok] = resolvePeer(o.to);
 	const tid = checkId(taskId, "taskId");
 	let rec = {};
-	try { rec = await owner("GET", `/owner/outbound/${q(tid)}`); } catch { rec = {}; }
+	if (ownerConfigured()) {
+		try { rec = await owner("GET", `/owner/outbound/${q(tid)}`); } catch { rec = {}; }
+	}
 	const [url, version] = rec.endpoint ? [rec.endpoint, rec.protocol || "0.3"] : pickEndpoint(base, await fetchCard(base), o.proto);
 	const res = await rpc(url, version, tok, "tasks/get", "GetTask", { id: tid }, { alias: C.loadPeers()[alias] ? alias : null, base });
+	out(res);
 	if (rec.endpoint) {
-		await owner("PUT", `/owner/outbound/${q(tid)}`, { task: res });
+		await persistOutbound("PUT", `/owner/outbound/${q(tid)}`, { task: res }, "update outbound task");
 		let txt = textOf((res.status || {}).message || {});
 		const arts = (res.artifacts || []).map((x) => textOf(x)).join("\n");
 		if (arts && arts !== txt) txt = (txt ? txt + "\n" : "") + arts;
 		await logHistory(rec.contextId, { dir: "in", peer: alias, taskId: tid, event: "poll", state: plainState(res), text: txt });
 	}
-	out(res);
 	console.error(`# task ${tid}: ${plainState(res)}`);
 }
 

package/lib/main.mjs

@@ -228,6 +228,8 @@ Outbound (agents you call)
                           differs between the two, connect/send/poll/peers/status warn (values never shown)
   send --to <alias|url> [--text T | stdin] [--context C] [--task T] [--push] [--proto 0.3|1.0]
   poll --to <alias|url> <taskId> [--proto 0.3|1.0]
+                          send/poll need only peer config; owner history/task storage is optional.
+                          Storage failures warn on stderr; the peer response still prints and exits 0
   outbound <taskId>       stored state of a task you sent (incl. pushed updates)
 
 Owner

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.10",
+	"version": "0.8.12",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {
@@ -15,7 +15,8 @@
 	],
 	"scripts": {
 		"prepack": "node scripts/sync-worker.mjs && node -e \"require('fs').copyFileSync('../LICENSE','LICENSE')\"",
-		"test": "node --test test/*.test.mjs"
+		"test": "node --test test/*.test.mjs",
+		"test:coverage": "node --experimental-test-coverage --test-coverage-include=lib/** --test-reporter=spec --test-reporter=lcov --test-reporter-destination=stdout --test-reporter-destination=../coverage/cli.lcov --test test/*.test.mjs"
 	},
 	"engines": {
 		"node": ">=22.18"

package/worker/deploy.env.example

@@ -16,7 +16,7 @@ A2A_AGENT_DESCRIPTION=An AI agent reachable over A2A. Replies asynchronously.
 WAKE_PRESET=generic
 # WAKE_AGENT_ID=main
 # WAKE_KEY_HEADER=authorization
-# WAKE_KEY_PREFIX=Bearer 
+# WAKE_KEY_PREFIX="Bearer "
 # WAKE_BODY_TEMPLATE={"text":"{{summary}}"}
 # Command shown in wake hints (CLI: --cli-command; default "npx -y a2a-exposed@latest"). For a source checkout:
 # WAKE_CLI_COMMAND=node /path/to/a2a-exposed/cli/bin/a2a-exposed.mjs

package/worker/package.json

@@ -9,6 +9,7 @@
 		"deploy": "cf deploy",
 		"pretest": "node scripts/stamp-version.mjs",
 		"test": "node --import ./test/register-hooks.mjs --test test/*.test.ts",
+		"test:coverage": "node scripts/stamp-version.mjs && node --import ./test/register-hooks.mjs --experimental-test-coverage --test-coverage-include=src/** --test-reporter=spec --test-reporter=lcov --test-reporter-destination=stdout --test-reporter-destination=../coverage/worker.lcov --test test/*.test.ts",
 		"typecheck": "cf workers types && tsc"
 	},
 	"engines": {
@@ -16,11 +17,11 @@
 	},
 	"devDependencies": {
 		"@cloudflare/vite-plugin": "beta",
-		"cf": "^1.0.0-beta.13",
-		"esbuild": "^0.28.1",
+		"cf": "^1.0.0-beta.18",
+		"esbuild": "^0.28.2",
 		"miniflare": "^5.20261006.0-alpha",
 		"typescript": "^7.0.2",
-		"vite": "^8.3.0"
+		"vite": "^8.3.4"
 	},
 	"dependencies": {
 		"tunnelfetch": "1.13.0"

package/worker/src/index.ts

@@ -10,7 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, wakeUrlIsTunnelHost, defaultDe
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
-import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
+import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, ownerRpcBody, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { pairingAgent, pairingEventTarget, postPairingEvent } from "./pairing-events.ts";
 import { publicManageUrl, resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql } from "./export.ts";
@@ -1060,6 +1060,17 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		}
 	}
 	if (seg[0] === "pairing") return await ownerPairing(req, ctx, ectx, m, seg.slice(1), body, trusted);
+	if (seg[0] === "mcp" && seg[1] && !seg[2] && m === "POST" && (seg[1] === "send" || seg[1] === "reply" || seg[1] === "mark_working")) {
+		const checked = ownerRpcBody(`POST /owner/mcp/${seg[1]}`, await body());
+		if (!checked.ok) return json({ error: checked.error }, 400);
+		try {
+			const text = await runTool(ctx, ectx, seg[1], checked.value);
+			return json({ text, isError: false });
+		} catch (e: any) {
+			if (e instanceof ToolError) return json({ text: `Error: ${e.message}`, isError: true });
+			throw e;
+		}
+	}
 	if (seg[0] === "mcp" && !seg[1] && m === "GET") {
 		const rows = await ctx.DB.prepare("SELECT label, client_id, client_name, redirect_host, scope, created_at, last_used_at, revoked_at, refresh_expires_ms FROM mcp_grants ORDER BY created_at").all();
 		return json({ enabled: mcpOn(ctx), url: oauthUrls(ctx).mcp, grants: (rows.results as Json[]).map((r) => ({ ...r, refresh_expires_ms: undefined,
@@ -2282,7 +2293,8 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	}
 	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
 	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
-	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	const parsedBody = ownerRpcBody(matched.route.name, raw?.body);
+	if (!parsedBody.ok) return refuse(400, parsedBody.error, "body");
 	const actor = (raw as { actor?: unknown } | null)?.actor;
 	if (actor !== undefined && actor !== "human") return refuse(400, "actor is invalid", "actor");
 	const pairingDecision = matched.route.name === "POST /owner/pairing/:code/approve" || matched.route.name === "POST /owner/pairing/:code/deny";
@@ -2297,7 +2309,11 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	const url = new URL(origin + matched.route.path + search);
 	const headers = new Headers({ "content-type": "application/json" });
 	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
-	const req = new Request(url, { method: matched.route.method, headers });
+	const req = new Request(url, {
+		method: matched.route.method,
+		headers,
+		body: parsedBody.value === undefined ? undefined : JSON.stringify(parsedBody.value),
+	});
 	let res: Response;
 	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
 	catch (e: any) {

package/worker/src/owner-rpc.ts

@@ -1,7 +1,9 @@
 // Hosted owner RPC allowlist. The caller has checked that the account owns the tenant.
 // This list is the only paths that call may run, and it is stricter than
 // the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
-// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first. Self-host never calls this.
+// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first.
+// POST /owner/mcp/send, reply, and mark_working take a checked argument object. A peer token is not one of those arguments.
+// Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
 import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
@@ -39,7 +41,10 @@ export interface OwnerRpcRequest {
 	path: string;
 	/** Allowlisted query parameters only. */
 	query?: Record<string, string>;
-	/** Refused. The owner HTTP API is where a body is accepted. */
+	/**
+	 * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, and `POST /owner/mcp/mark_working`.
+	 * Any other call refuses a body.
+	 */
 	body?: unknown;
 	/**
 	 * Approve or deny after a recent sign-in.
@@ -141,6 +146,9 @@ const ROUTES: RouteDef[] = [
 	{ method: "POST", name: "POST /owner/pairing/:code/deny", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "deny", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/deny` },
 	{ method: "GET", name: "GET /owner/mcp", take: (s) => s.length === 2 && s[1] === "mcp", search: noQuery, path: () => "/owner/mcp" },
 	{ method: "DELETE", name: "DELETE /owner/mcp/:label", take: (s) => s.length === 3 && s[1] === "mcp" && MCP_LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/mcp/${s[2]}` },
+	{ method: "POST", name: "POST /owner/mcp/send", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "send", search: noQuery, path: () => "/owner/mcp/send" },
+	{ method: "POST", name: "POST /owner/mcp/reply", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "reply", search: noQuery, path: () => "/owner/mcp/reply" },
+	{ method: "POST", name: "POST /owner/mcp/mark_working", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "mark_working", search: noQuery, path: () => "/owner/mcp/mark_working" },
 	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
 	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
 	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
@@ -166,6 +174,63 @@ export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): O
 	return { ok: true, route: { method, path: def.path(seg), search, name: def.name } };
 }
 
+/** Send text cap. The owner HTTP body limit is 1 MiB; this keeps one argument inside that. */
+const TEXT_MAX = 100_000;
+const REPLY_STATES = new Set(["completed", "input-required", "working", "failed", "rejected"]);
+
+const MCP_ARGS: Record<string, { required: readonly string[]; optional: readonly string[] }> = {
+	"POST /owner/mcp/send": { required: ["to", "text"], optional: ["contextId", "taskId"] },
+	"POST /owner/mcp/reply": { required: ["taskId", "text"], optional: ["state"] },
+	"POST /owner/mcp/mark_working": { required: ["taskId"], optional: [] },
+};
+
+function mcpArgOk(key: string, value: string): string | null {
+	if (key === "to") return ALIAS.test(value) ? null : "to is invalid";
+	if (key === "text") {
+		if (!value.trim()) return "text is required";
+		if (value.length > TEXT_MAX) return "text is too long";
+		return null;
+	}
+	if (key === "taskId" || key === "contextId") return idOk(value) ? null : `${key} is invalid`;
+	if (key === "state") return REPLY_STATES.has(value) ? null : "state is invalid";
+	return "body is not allowed";
+}
+
+/**
+ * Body allowed on this owner RPC route.
+ * MCP send, reply, and mark_working receive a flat object of tool arguments.
+ * Every other route accepts only an absent body.
+ */
+export function ownerRpcBody(routeName: string, body: unknown): { ok: true; value?: Record<string, string> } | { ok: false; error: string } {
+	const spec = MCP_ARGS[routeName];
+	if (!spec) {
+		if (body !== undefined && body !== null) return { ok: false, error: "this call takes no body" };
+		return { ok: true };
+	}
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "body must be an object" };
+	const allowed = new Set([...spec.required, ...spec.optional]);
+	const keys = Object.keys(body);
+	if (keys.length > allowed.size || keys.some((key) => !allowed.has(key))) return { ok: false, error: "body is not allowed" };
+	const value: Record<string, string> = {};
+	for (const key of spec.required) {
+		const item = (body as Record<string, unknown>)[key];
+		if (item == null || item === "") return { ok: false, error: `${key} is required` };
+		if (typeof item !== "string") return { ok: false, error: `${key} is invalid` };
+		const why = mcpArgOk(key, item);
+		if (why) return { ok: false, error: why };
+		value[key] = item;
+	}
+	for (const key of spec.optional) {
+		if (!Object.prototype.hasOwnProperty.call(body, key)) continue;
+		const item = (body as Record<string, unknown>)[key];
+		if (typeof item !== "string" || !item) return { ok: false, error: `${key} is invalid` };
+		const why = mcpArgOk(key, item);
+		if (why) return { ok: false, error: why };
+		value[key] = item;
+	}
+	return { ok: true, value };
+}
+
 function stringLeaks(value: string, key: string | null): boolean {
 	if (TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value)) return true;
 	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.10";
+export const VERSION = "0.8.12";

package/worker/test/mcp.test.ts

@@ -492,6 +492,43 @@ test("tools: send / poll_outbound through synced peers; each peer's token stays
 	assert.equal((await s.owner("GET", "/owner/outbound-peers")).data.length, 1);
 });
 
+test("POST /owner/mcp/send, reply, and mark_working use the owner token", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const a = await s.connect();
+	await s.owner("PUT", "/owner/outbound-peers/alpha", { url: "https://alpha.example.org", token: "tok-alpha" });
+	const noAuth = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" } });
+	assert.equal(noAuth.status, 401);
+	const mcpTok = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" }, headers: { authorization: `Bearer ${a.access_token}` } });
+	assert.equal(mcpTok.status, 401);
+	const peerTok = "a2aow_" + "c".repeat(43);
+	const peer = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" }, headers: { authorization: `Bearer ${peerTok}` } });
+	assert.equal(peer.status, 401);
+	assert.equal(s.peerCalls.length, 0, "a refused caller does not send");
+	const extra = await s.owner("POST", "/owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" });
+	assert.equal(extra.status, 400);
+	assert.equal(s.peerCalls.length, 0, "a token field is not a send");
+	const sent = await s.owner("POST", "/owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-owner" });
+	assert.equal(sent.status, 200, sent.text);
+	assert.equal(sent.data.isError, false);
+	assert.match(sent.data.text, /task pt-alpha/);
+	assert.equal(sent.text.includes("tok-alpha"), false);
+	assert.equal(s.peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+	assert.equal(s.peerCalls.at(-1)!.body.params.message.contextId, "ctx-owner");
+
+	const inbound = await s.inbound("barry", "please reply");
+	const taskId = inbound.task.id as string;
+	const working = await s.owner("POST", "/owner/mcp/mark_working", { taskId });
+	assert.equal(working.status, 200, working.text);
+	assert.equal(working.data.isError, false);
+	assert.match(working.data.text, new RegExp(`Task ${taskId} is now working`));
+	const replied = await s.owner("POST", "/owner/mcp/reply", { taskId, text: "done", state: "completed" });
+	assert.equal(replied.status, 200, replied.text);
+	assert.equal(replied.data.isError, false);
+	assert.equal((await s.owner("GET", `/owner/tasks/${taskId}`)).data.status.state, "completed");
+	const mcpReply = await s.call("POST", "/owner/mcp/reply", { json: { taskId, text: "no" }, headers: { authorization: `Bearer ${a.access_token}` } });
+	assert.equal(mcpReply.status, 401);
+});
+
 test("peer token encryption round-trips and is bound to the alias", async () => {
 	const sealed = await M.sealPeerToken("owner", "alpha", "secret");
 	assert.equal(await M.openPeerToken("owner", "alpha", sealed), "secret");

package/worker/test/owner-mcp.test.ts

@@ -0,0 +1,125 @@
+// Hosted owner RPC for send, reply, and mark_working. The caller has already checked that the account owns the tenant.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { sha256 } from "../src/a2a.ts";
+import { dispatch, runOwnerRpc } from "../src/index.ts";
+import { hostedTenantContext, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://carol.example.com";
+const ectx = { waitUntil() {}, passThroughOnException() {} };
+
+test("hosted control plane send, reply, and mark_working", async (t) => {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const ownerToken = "hosted-owner-token";
+	const hash = await sha256(ownerToken);
+	const env = {
+		DB, TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", PUBLIC_URL: BASE, OWNER_TOKEN: "platform-owner",
+	} as WorkerBindings;
+	const ctx = hostedTenantContext(env, {
+		id: "ten_carol", db: DB, publicUrl: BASE, ownerTokenHash: hash, status: "active",
+		config: { AGENT_NAME: "Carol" },
+	});
+	const peerCalls: { host: string; auth: string | null; body: any }[] = [];
+	const origFetch = globalThis.fetch;
+	globalThis.fetch = (async (input: any, init: any = {}) => {
+		const u = new URL(String(input));
+		if (u.pathname === "/.well-known/agent-card.json")
+			return Response.json({ name: u.host, supportedInterfaces: [{ url: `https://${u.host}/a2a`, protocolBinding: "JSONRPC", protocolVersion: "1.0" }] });
+		if (u.pathname === "/a2a") {
+			const body = JSON.parse(init.body);
+			const auth = new Headers(init.headers).get("authorization");
+			peerCalls.push({ host: u.host, auth, body });
+			if (auth !== `Bearer tok-${u.host.split(".")[0]}`) return new Response("no", { status: 401 });
+			if (body.method === "SendMessage") return Response.json({ jsonrpc: "2.0", id: body.id, result: { task: { id: `pt-${u.host.split(".")[0]}`, contextId: "ctx-out-1", status: { state: "TASK_STATE_SUBMITTED" } } } });
+		}
+		return new Response("not found", { status: 404 });
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = origFetch; });
+
+	const http = async (method: string, path: string, auth: string | null, json?: unknown, headers: Record<string, string> = {}) => {
+		const h: Record<string, string> = { "content-type": "application/json", ...headers };
+		if (auth) h.authorization = auth;
+		const res = await dispatch(new Request(BASE + path, {
+			method, headers: h, body: json === undefined ? undefined : JSON.stringify(json),
+		}), ctx, ectx as any);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* plain text */ }
+		return { status: res.status, data, text };
+	};
+	const rpc = (path: string, body?: unknown, extra: Record<string, unknown> = {}) =>
+		runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "POST", path, ...(body === undefined ? {} : { body }), ...extra } as any);
+
+	const single = await runOwnerRpc(resolveTenant({ DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret" } as WorkerBindings), ectx as any, {
+		accountId: "acct_carol", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "hi" },
+	});
+	assert.equal(single.status, 404, "self-host keeps the bearer owner API");
+
+	assert.equal((await http("POST", "/owner/mcp/send", null, { to: "alpha", text: "hi" })).status, 401);
+	assert.equal((await http("POST", "/owner/mcp/send", "Bearer platform-owner", { to: "alpha", text: "hi" })).status, 401);
+	assert.equal((await http("POST", "/owner/mcp/send", "Bearer a2aow_" + "c".repeat(43), { to: "alpha", text: "hi" })).status, 401);
+	const synced = await http("PUT", "/owner/outbound-peers/alpha", `Bearer ${ownerToken}`, { url: "https://alpha.example.org", token: "tok-alpha" });
+	assert.equal(synced.status, 200, synced.text);
+
+	const missing = await rpc("/owner/mcp/send");
+	assert.equal(missing.status, 400);
+	assert.match(String((missing.body as { error?: string }).error), /body must be an object/);
+	const sneaky = await rpc("/owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" });
+	assert.equal(sneaky.status, 400);
+	assert.equal(peerCalls.length, 0);
+	const human = await rpc("/owner/mcp/send", { to: "alpha", text: "hi" }, { actor: "human" });
+	assert.equal(human.status, 400);
+	assert.equal(peerCalls.length, 0);
+	const badAccount = await runOwnerRpc(ctx, ectx as any, {
+		accountId: "../acct", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "hi" },
+	});
+	assert.equal(badAccount.status, 400);
+	assert.equal(peerCalls.length, 0);
+
+	const sent = await rpc("/owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-hosted" });
+	assert.equal(sent.status, 200, JSON.stringify(sent.body));
+	const sentBody = sent.body as { text?: string; isError?: boolean };
+	assert.equal(sentBody.isError, false);
+	assert.match(sentBody.text || "", /task pt-alpha/);
+	assert.equal(JSON.stringify(sent.body).includes("tok-alpha"), false);
+	assert.equal(JSON.stringify(sent.body).includes(ownerToken), false);
+	assert.equal(peerCalls.at(-1)!.host, "alpha.example.org");
+	assert.equal(peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "status?");
+	assert.equal(peerCalls.at(-1)!.body.params.message.contextId, "ctx-hosted");
+
+	const viaHttp = await http("POST", "/owner/mcp/send", `Bearer ${ownerToken}`, { to: "alpha", text: "from the owner token" });
+	assert.equal(viaHttp.status, 200, viaHttp.text);
+	assert.equal(viaHttp.data.isError, false);
+	assert.equal(viaHttp.text.includes("tok-alpha"), false);
+	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "from the owner token");
+
+	const withBody = await runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(withBody.status, 400);
+	assert.equal((withBody.body as { error?: string }).error, "this call takes no body");
+	const minted = await rpc("/owner/peers", { label: "bob" });
+	assert.equal(minted.status, 404);
+
+	const issued = await http("POST", "/owner/peers", `Bearer ${ownerToken}`, { label: "ada" });
+	assert.match(issued.data.token || "", /^a2aow_/);
+	const inbound = await http("POST", "/", `Bearer ${issued.data.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-ada", parts: [{ kind: "text", text: "hello" }] } },
+	}, { "a2a-version": "0.3" });
+	assert.equal(inbound.status, 200, inbound.text);
+	const taskId = inbound.data.result.id as string;
+	assert.ok(taskId);
+	const working = await rpc("/owner/mcp/mark_working", { taskId });
+	assert.equal(working.status, 200, JSON.stringify(working.body));
+	assert.match((working.body as { text?: string }).text || "", new RegExp(`Task ${taskId} is now working`));
+	const replied = await rpc("/owner/mcp/reply", { taskId, text: "done", state: "completed" });
+	assert.equal(replied.status, 200, JSON.stringify(replied.body));
+	assert.equal((replied.body as { isError?: boolean }).isError, false);
+	const task = await http("GET", `/owner/tasks/${taskId}`, `Bearer ${ownerToken}`);
+	assert.equal(task.data.status.state, "completed");
+	const unknown = await rpc("/owner/mcp/send", { to: "missing", text: "hi" });
+	assert.equal(unknown.status, 200);
+	assert.equal((unknown.body as { isError?: boolean }).isError, true);
+	assert.match((unknown.body as { text?: string }).text || "", /no peer "missing"/);
+});

package/worker/test/owner-rpc.test.ts

@@ -1,7 +1,7 @@
 // Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims } from "../src/owner-rpc.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, ownerRpcBody, scrubOwnerClaims } from "../src/owner-rpc.ts";
 
 test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
 	const ok = (method: string, path: string, query?: Record<string, string>) => {
@@ -22,6 +22,9 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(ok("POST", "/owner/pairing/wdjb4827/deny")?.name, "POST /owner/pairing/:code/deny");
 	assert.equal(ok("GET", "/owner/mcp")?.name, "GET /owner/mcp");
 	assert.equal(ok("DELETE", "/owner/mcp/mcp-claude")?.path, "/owner/mcp/mcp-claude");
+	assert.equal(ok("POST", "/owner/mcp/send")?.name, "POST /owner/mcp/send");
+	assert.equal(ok("POST", "/owner/mcp/reply")?.path, "/owner/mcp/reply");
+	assert.equal(ok("POST", "/owner/mcp/mark_working")?.name, "POST /owner/mcp/mark_working");
 	assert.equal(ok("GET", "/owner/outbound-peers")?.name, "GET /owner/outbound-peers");
 	assert.equal(ok("DELETE", "/owner/outbound-peers/ada.bot")?.path, "/owner/outbound-peers/ada.bot");
 	assert.equal(ok("GET", "/owner/facade")?.name, "GET /owner/facade");
@@ -44,6 +47,9 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.deepEqual(refused("GET", "/owner/log", { n: "10" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/mcp/send", { to: "alpha" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("POST", "/owner/mcp/poll_outbound"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/mcp/send"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/peers/../export"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/%2e%2e/peers"), { ok: false, reason: "path" });
@@ -58,6 +64,41 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(accountIdOf(""), null);
 });
 
+test("owner RPC accepts a tool-argument body only on send, reply, and mark_working", () => {
+	const absent = ownerRpcBody("GET /owner/peers", undefined);
+	assert.equal(absent.ok, true);
+	assert.equal(absent.ok && absent.value, undefined);
+	assert.equal(ownerRpcBody("GET /owner/peers", null).ok, true);
+	assert.deepEqual(ownerRpcBody("GET /owner/peers", { label: "bob" }), { ok: false, error: "this call takes no body" });
+	assert.deepEqual(ownerRpcBody("POST /owner/wake/test", {}), { ok: false, error: "this call takes no body" });
+
+	const sent = ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-1" });
+	assert.deepEqual(sent, { ok: true, value: { to: "alpha", text: "status?", contextId: "ctx-1" } });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "status?", taskId: "task-1" }), {
+		ok: true, value: { to: "alpha", text: "status?", taskId: "task-1" },
+	});
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", state: "input-required" }), {
+		ok: true, value: { taskId: "task-1", text: "done", state: "input-required" },
+	});
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: "task-1" }), { ok: true, value: { taskId: "task-1" } });
+
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", undefined).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", null).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", []).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", "hi").ok, false);
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", {}), { ok: false, error: "to is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha" }), { ok: false, error: "text is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "https://alpha.example", text: "hi" }), { ok: false, error: "to is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "   " }), { ok: false, error: "text is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "x".repeat(100_001) }), { ok: false, error: "text is too long" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "hi", url: "https://evil.example" }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", state: "canceled" }), { ok: false, error: "state is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", force: true }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: ".." }), { ok: false, error: "taskId is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: "task-1", text: "no" }), { ok: false, error: "body is not allowed" });
+});
+
 test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	const token = "a2aow_" + "a".repeat(43);
 	assert.equal(ownerResponseLeaks("a2aot_" + "Q".repeat(43)), true);
@@ -111,4 +152,4 @@ test("a token-shaped claim is blanked and the rest of the list is returned", ()
 	assert.equal(JSON.stringify(listed).includes(token), false);
 	assert.equal(JSON.stringify(listed).includes("t=" + "c".repeat(16)), false);
 	assert.equal(JSON.stringify(listed).includes("user:secret"), false);
-});
+});

package/worker/tsconfig.json

@@ -19,4 +19,4 @@
 		"cloudflare.config.ts",
 		".cloudflare/types"
 	]
-}
+}