a2a-exposed 0.8.15 → 0.8.16

package/lib/deploy.mjs

@@ -434,15 +434,41 @@ async function deployAndLearn(dir, secrets, o) {
  * whoami before npm install. A previous install has node_modules/.bin/cf.
  * A fresh init does not: `npx cf auth login` does not put `cf` on PATH, so this check uses `npx --yes cf`.
  */
-function cfLoginJson(dir) {
+function cfSpawn(dir, args, { allowFail = false } = {}) {
 	const local = path.join(dir, "node_modules", ".bin", "cf");
-	const args = cfArgs(["auth", "whoami"]);
-	const r = fs.existsSync(local)
-		? run(local, args, { cwd: dir, capture: true })
-		: run("npx", ["--yes", "cf", ...args], { cwd: dir, capture: true });
+	const full = cfArgs(args);
+	return fs.existsSync(local)
+		? run(local, full, { cwd: dir, capture: true, allowFail })
+		: run("npx", ["--yes", "cf", ...full], { cwd: dir, capture: true, allowFail });
+}
+
+function cfLoginJson(dir) {
+	const r = cfSpawn(dir, ["auth", "whoami"]);
 	try { return JSON.parse(r.stdout); } catch { die("unexpected output from cf auth whoami"); }
 }
 
+function normalizeAccounts(raw) {
+	const list = Array.isArray(raw) ? raw : (raw && typeof raw === "object" && Array.isArray(raw.result) ? raw.result : []);
+	return list.filter((a) => a && typeof a.id === "string" && a.id).map((a) => ({ id: a.id, name: typeof a.name === "string" && a.name ? a.name : a.id }));
+}
+
+/** `cf accounts list` (GET /accounts). whoami intersects memberships and can return [] for a logged-in profile. */
+function accountsFromList(dir) {
+	const all = [];
+	const seen = new Set();
+	for (let page = 1; page <= 20; page++) {
+		const r = cfSpawn(dir, ["accounts", "list", "--page", String(page), "--per-page", "50"], { allowFail: true });
+		if (!r || r.status !== 0) return page === 1 ? [] : all;
+		let data;
+		try { data = JSON.parse(r.stdout); } catch { return page === 1 ? [] : all; }
+		if (data && typeof data === "object" && !Array.isArray(data) && Array.isArray(data.result)) data = data.result;
+		if (!Array.isArray(data)) return page === 1 ? [] : all;
+		for (const a of normalizeAccounts(data)) if (!seen.has(a.id)) { seen.add(a.id); all.push(a); }
+		if (data.length < 50) break;
+	}
+	return all;
+}
+
 /** Cloudflare login, before init installs packages. Dies with the same advice as a later cf failure. */
 function requireCfLogin(dir) {
 	const prof = cfProfile();
@@ -454,7 +480,8 @@ function requireCfLogin(dir) {
 		: prof
 		? `cf profile "${prof}" is not logged in: run \`npx cf auth create ${prof} --no-browser\`, open the printed URL, enter the code, then re-run init`
 		: "not logged in to Cloudflare: run `npx cf auth login --no-browser`, open the printed URL, enter the code, then re-run init") + `\n${LOGIN_403_HELP}`);
-	const accts = who.accounts || [];
+	let accts = normalizeAccounts(who.accounts);
+	if (!accts.length && prof) accts = accountsFromList(dir);
 	if (!C.get("CLOUDFLARE_ACCOUNT_ID")) {
 		if (!accts.length && process.env.CLOUDFLARE_API_TOKEN)
 			die("the API token can't list accounts: add the permission User -> Memberships -> Read (or pass --account-id <id> / export CLOUDFLARE_ACCOUNT_ID; the id is in the dashboard URL)");

package/lib/main.mjs

@@ -41,7 +41,8 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
                                                --hostname H moves it back); the old URL answers 301/410
                                 --workers-dev-subdomain  create the account's workers.dev subdomain if missing
                                 --cf-profile   cf auth profile for a separate Cloudflare login
-                                               (npx cf auth create NAME --no-browser); saved, used by every cf call
+                                               (npx cf auth create NAME --no-browser); saved, used by every cf call.
+                                               When whoami lists no accounts, init reads cf accounts list
                                 --d1-name      D1 database to create or reuse (default: worker name)
                                 --pairing-approval  who approves device-flow pairing requests (default human:
                                                the owner token via \`pair approve\`, or the approval password

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.15",
+	"version": "0.8.16",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -569,6 +569,31 @@ const V03: Record<string, string> = {
 	"message/send": "send", "tasks/get": "get", "tasks/cancel": "cancel", "tasks/pushNotificationConfig/set": "pushset",
 	"tasks/pushNotificationConfig/get": "pushget", "message/stream": "stream", "tasks/resubscribe": "stream",
 };
+// Methods only the façade forwards (the inbox has one push config per task and no delete).
+const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
+const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
+const EXTENDED_CARD_METHODS = new Set(["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]);
+
+/** Header, else query `A2A-Version`. A patch (`1.0.1`, `0.3.0`) is ignored. Empty means the method name chooses the
+ *  shape, so a 0.3 client that omits the header stays on 0.3 and a headerless `SendMessage` stays 1.0. */
+function declaredA2AVersion(req: Request): { raw: string; version: string | null } {
+	let raw = (req.headers.get("a2a-version") || "").trim();
+	if (!raw) {
+		try { raw = (new URL(req.url).searchParams.get("A2A-Version") || "").trim(); } catch { raw = ""; }
+	}
+	if (!raw) return { raw: "", version: null };
+	if (/^(1\.0(\.\d+)?|1)$/.test(raw)) return { raw, version: "1.0" };
+	if (/^0\.3(\.\d+)?$/.test(raw)) return { raw, version: "0.3" };
+	return { raw, version: null };
+}
+
+function rpcOperation(method: string, proxy: boolean): { op: string; version: string } | null {
+	if (V1[method]) return { op: V1[method], version: "1.0" };
+	if (V03[method]) return { op: V03[method], version: "0.3" };
+	if (proxy && PROXY_V1[method]) return { op: PROXY_V1[method], version: "1.0" };
+	if (proxy && PROXY_V03[method]) return { op: PROXY_V03[method], version: "0.3" };
+	return null;
+}
 
 async function ownedTask(ctx: TenantContext, id: unknown, label: string): Promise<Json> {
 	if (typeof id !== "string" || !A.ID_RE.test(id)) throw new RpcError(-32001, "Task not found");
@@ -713,15 +738,14 @@ async function handleRpc(req: Request, ctx: TenantContext, ectx: ExecutionContex
 	const err = (code: number, message: string) => json({ jsonrpc: "2.0", id: rid, error: { code, message } });
 	if (!rq || typeof rq !== "object" || rq.jsonrpc !== "2.0" || typeof rq.method !== "string") return err(-32600, "Invalid Request");
 	const method: string = rq.method;
-	let op: string, version: string;
 	const proxy = proxyMode(ctx);
-	if (V1[method]) { op = V1[method]; version = "1.0"; }
-	else if (V03[method]) { op = V03[method]; version = "0.3"; }
-	else if (proxy && PROXY_V1[method]) { op = PROXY_V1[method]; version = "1.0"; }
-	else if (proxy && PROXY_V03[method]) { op = PROXY_V03[method]; version = "0.3"; }
-	else return err(-32601, "Method not found");
-	const hv = (req.headers.get("a2a-version") || "").trim();
-	if (hv && !/^(0\.3|1|1\.0)(\.\d+)?$/.test(hv)) return err(-32009, `A2A version ${hv} not supported (supported: 0.3, 1.0)`);
+	const declared = declaredA2AVersion(req);
+	if (declared.raw && !declared.version) return err(-32009, `A2A version ${declared.raw} not supported (supported: 0.3, 1.0)`);
+	if (EXTENDED_CARD_METHODS.has(method)) return err(-32007, "Extended agent card is not configured");
+	const found = rpcOperation(method, proxy);
+	if (!found) return err(-32601, "Method not found");
+	const version = declared.version || found.version;
+	const op = found.op;
 	if (op === "stream") return err(-32004, proxy ? "Streaming is not supported through this façade yet" : "Streaming is not supported");
 	const params = rq.params ?? {};
 	if (typeof params !== "object" || Array.isArray(params)) return err(-32602, "Invalid params");
@@ -796,10 +820,6 @@ async function verifyUpstream(ctx: TenantContext): Promise<Json> {
 	return { ok: verdict.reason === "reachable", ...verdict, sent, method: VERIFY_METHOD, upstreamWantsBearer: F.upstreamAuth(up.card).bearer };
 }
 
-// Methods only the façade forwards (the inbox has one push config per task and no delete).
-const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
-const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
-
 async function ownerOf(ctx: TenantContext, kind: "task" | "context", id: string): Promise<string | null> {
 	const r: Json = await ctx.DB.prepare("SELECT peer FROM facade_owners WHERE kind = ? AND id = ?").bind(kind, id).first();
 	return r ? r.peer : null;
@@ -847,8 +867,9 @@ async function proxyRpc(req: Request, ctx: TenantContext, c: { raw: string; rid:
 	// public-looking name to a private address), so push configs never reach it. Follow-up: a relay through the Worker.
 	if (F.wantsPush(c.op, c.params)) return err(-32003, "Push notifications are not supported through this façade; poll GetTask with the task id instead");
 	const headers = upstreamHeaders(ctx, ep, { "content-type": "application/json", accept: "application/json", "x-a2a-peer": c.label });
-	const hv = req.headers.get("a2a-version");
-	if (hv) headers["a2a-version"] = hv;
+	// Declared version only (header, else query). A headerless call stays headerless, so the upstream still chooses from the method name.
+	const declared = declaredA2AVersion(req);
+	if (declared.version) headers["a2a-version"] = declared.version;
 	let r: Response;
 	try {
 		r = await fetch(ep, { method: "POST", headers, body: c.raw, redirect: "manual", signal: AbortSignal.timeout(90000) });

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.15";
+export const VERSION = "0.8.16";

package/worker/test/facade.test.ts

@@ -268,6 +268,54 @@ test("proxy mode: JSON-RPC is forwarded with the façade's credential, never the
 	assert.equal((s.DB.db.prepare("SELECT COUNT(*) AS n FROM tasks").get() as any).n, 0);
 });
 
+test("proxy mode: a declared A2A-Version query is forwarded as the header; a headerless call stays headerless", async (t) => {
+	let n = 0;
+	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-ver.json" }, async (url, init) => {
+		if (url.endsWith(".json")) return Response.json(tailnetCard());
+		const rq = JSON.parse(init.body);
+		const hv = init.headers?.["a2a-version"];
+		const v1 = hv ? hv.startsWith("1") : !String(rq.method).includes("/");
+		const id = `up-task-${++n}`, contextId = `up-ctx-${n}`;
+		const result = v1
+			? { task: { id, contextId, status: { state: "TASK_STATE_SUBMITTED" }, history: [{ role: "ROLE_USER", parts: [{ text: "hi" }] }] } }
+			: { kind: "task", id, contextId, status: { state: "submitted" }, history: [{ kind: "message", role: "user", parts: [{ kind: "text", text: "hi" }] }] };
+		return Response.json({ jsonrpc: "2.0", id: rq.id, result });
+	});
+	t.after(s.restore);
+	const tok = await s.issue("ada");
+	const msg = { message: { role: "user", messageId: "m-ver", parts: [{ kind: "text", text: "hi" }] } };
+	const post = (path: string, method: string, headers: Record<string, string> = {}) =>
+		s.call("POST", path, { token: tok, json: { jsonrpc: "2.0", id: 1, method, params: msg }, headers });
+	const last = () => s.calls.filter((c) => c.url === UPSTREAM).at(-1);
+
+	const q = await post("/?A2A-Version=0.3", "SendMessage");
+	assert.equal(q.status, 200, q.text);
+	assert.equal(last().url, UPSTREAM);
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(q.data.result.kind, "task");
+	assert.equal(q.data.result.status.state, "submitted");
+	assert.equal(q.data.result.task, undefined);
+
+	const bare = await post("/", "SendMessage");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	assert.equal(bare.data.result.kind, undefined);
+
+	const bare03 = await post("/", "message/send");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare03.data.result.kind, "task");
+	assert.equal(bare03.data.result.status.state, "submitted");
+
+	const wins = await post("/?A2A-Version=0.3", "SendMessage", { "a2a-version": "1.0" });
+	assert.equal(last().headers["a2a-version"], "1.0");
+	assert.equal(wins.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const patch = await post("/?A2A-Version=0.3.0", "SendMessage");
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(patch.data.result.kind, "task");
+	assert.equal(patch.data.result.status.state, "submitted");
+});
+
 test("proxy mode: peers sharing the upstream identity can't touch each other's tasks or contexts", async (t) => {
 	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-c.json" });
 	t.after(s.restore);
@@ -309,7 +357,14 @@ test("proxy mode: peers sharing the upstream identity can't touch each other's t
 	// ListTasks would list every peer's tasks; streaming is not proxied yet
 	assert.equal((await s.rpc(a, "ListTasks", {})).data.error?.code, -32004);
 	assert.equal((await s.rpc(a, "SendStreamingMessage", { message: { role: "ROLE_USER", parts: [{ text: "x" }] } })).data.error?.code, -32004);
-	assert.equal((await s.rpc(a, "GetExtendedAgentCard", {})).data.error?.code, -32601);
+	const nCard = s.calls.filter((c) => c.url === UPSTREAM).length;
+	const ext = await s.rpc(a, "GetExtendedAgentCard", {});
+	assert.equal(ext.status, 200);
+	assert.equal(ext.data.error?.code, -32007);
+	assert.equal(ext.data.error?.message, "Extended agent card is not configured");
+	const ext03 = await s.call("POST", "/", { token: a, json: { jsonrpc: "2.0", id: 1, method: "agent/getAuthenticatedExtendedCard", params: {} }, headers: { "a2a-version": "0.3" } });
+	assert.equal(ext03.data.error?.code, -32007);
+	assert.equal(s.calls.filter((c) => c.url === UPSTREAM).length, nCard, "the extended card stays on the façade");
 });
 
 test("proxy mode: push configs never reach the upstream (it would call them from inside the private network)", async (t) => {

package/worker/test/version-header.test.ts

@@ -0,0 +1,100 @@
+// A2A-Version selects the response shape; the extended card is -32007. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://agent.example.com";
+
+function setup() {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const env: any = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox", PAIRING_APPROVAL: "off" };
+	const call = async (method: string, path: string, o: { json?: any; headers?: Record<string, string> } = {}) => {
+		const headers: Record<string, string> = { "cf-connecting-ip": "198.51.100.7", ...(o.headers || {}) };
+		let body: string | undefined;
+		if (o.json !== undefined) { headers["content-type"] = "application/json"; body = JSON.stringify(o.json); }
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers, body }) as any, env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		await Promise.allSettled(pending);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* text */ }
+		return { status: res.status, data, text };
+	};
+	return { call };
+}
+
+test("A2A-Version selects the response shape; an absent header keeps the method name", async () => {
+	const s = setup();
+	const issued = await s.call("POST", "/owner/peers", { json: { label: "ada" }, headers: { authorization: "Bearer owner-secret" } });
+	assert.equal(issued.status, 200, issued.text);
+	const token = issued.data.token as string;
+	let n = 0;
+	const msg = () => ({ message: { role: "user", messageId: `m${++n}`, parts: [{ kind: "text", text: "hi" }] } });
+	const rpc = (method: string, params: any, headers: Record<string, string> = {}, path = "/") =>
+		s.call("POST", path, { json: { jsonrpc: "2.0", id: 1, method, params }, headers: { authorization: `Bearer ${token}`, ...headers } });
+
+	const v1 = await rpc("message/send", msg(), { "a2a-version": "1.0" });
+	assert.equal(v1.status, 200, v1.text);
+	assert.equal(v1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	assert.equal(v1.data.result.task.kind, undefined);
+	assert.equal(v1.data.result.task.history[0].role, "ROLE_USER");
+	assert.equal(v1.data.result.task.history[0].parts[0].kind, undefined);
+	assert.equal(v1.data.result.task.history[0].parts[0].text, "hi");
+
+	const v03 = await rpc("SendMessage", msg(), { "a2a-version": "0.3" });
+	assert.equal(v03.data.result.kind, "task");
+	assert.equal(v03.data.result.status.state, "submitted");
+	assert.equal(v03.data.result.task, undefined);
+	assert.equal(v03.data.result.history[0].role, "user");
+	assert.equal(v03.data.result.history[0].kind, "message");
+	assert.equal(v03.data.result.history[0].parts[0].kind, "text");
+
+	const bare03 = await rpc("message/send", msg());
+	assert.equal(bare03.data.result.kind, "task");
+	assert.equal(bare03.data.result.status.state, "submitted");
+	const bare1 = await rpc("SendMessage", msg());
+	assert.equal(bare1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const patch1 = await rpc("message/send", msg(), { "a2a-version": "1.0.1" });
+	assert.equal(patch1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	const patch03 = await rpc("SendMessage", msg(), { "A2A-Version": "0.3.0" });
+	assert.equal(patch03.data.result.kind, "task");
+	const short1 = await rpc("message/send", msg(), { "a2a-version": "1" });
+	assert.equal(short1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const query = await rpc("SendMessage", msg(), {}, "/?A2A-Version=0.3");
+	assert.equal(query.data.result.kind, "task");
+	assert.equal(query.data.result.status.state, "submitted");
+	const headerWins = await rpc("SendMessage", msg(), { "a2a-version": "1.0" }, "/?A2A-Version=0.3");
+	assert.equal(headerWins.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const created = bare1.data.result.task.id as string;
+	const reread = await rpc("GetTask", { id: created }, { "a2a-version": "0.3" });
+	assert.equal(reread.data.result.kind, "task");
+	assert.equal(reread.data.result.status.state, "submitted");
+	assert.equal(reread.data.result.id, created);
+
+	for (const method of ["SendMessage", "no-such-method"]) {
+		const bad = await rpc(method, msg(), { "a2a-version": "2.0" });
+		assert.equal(bad.data.error?.code, -32009, method);
+		assert.match(bad.data.error.message, /2\.0/);
+	}
+	const minor = await rpc("SendMessage", msg(), { "a2a-version": "1.2" });
+	assert.equal(minor.data.error?.code, -32009);
+	const unknown = await rpc("no-such-method", {});
+	assert.equal(unknown.data.error?.code, -32601);
+	const unknownOk = await rpc("no-such-method", {}, { "a2a-version": "1.0" });
+	assert.equal(unknownOk.data.error?.code, -32601);
+
+	for (const method of ["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]) {
+		const missing = await rpc(method, {});
+		assert.equal(missing.status, 200);
+		assert.equal(missing.data.error?.code, -32007, method);
+		assert.equal(missing.data.error?.message, "Extended agent card is not configured");
+		const withHeader = await rpc(method, {}, { "a2a-version": "0.3" });
+		assert.equal(withHeader.data.error?.code, -32007, method);
+	}
+	const extFirst = await rpc("GetExtendedAgentCard", {}, { "a2a-version": "2.0" });
+	assert.equal(extFirst.data.error?.code, -32009);
+});