a2a-exposed 0.8.15 → 0.8.17

package/lib/deploy.mjs

@@ -434,15 +434,41 @@ async function deployAndLearn(dir, secrets, o) {
  * whoami before npm install. A previous install has node_modules/.bin/cf.
  * A fresh init does not: `npx cf auth login` does not put `cf` on PATH, so this check uses `npx --yes cf`.
  */
-function cfLoginJson(dir) {
+function cfSpawn(dir, args, { allowFail = false } = {}) {
 	const local = path.join(dir, "node_modules", ".bin", "cf");
-	const args = cfArgs(["auth", "whoami"]);
-	const r = fs.existsSync(local)
-		? run(local, args, { cwd: dir, capture: true })
-		: run("npx", ["--yes", "cf", ...args], { cwd: dir, capture: true });
+	const full = cfArgs(args);
+	return fs.existsSync(local)
+		? run(local, full, { cwd: dir, capture: true, allowFail })
+		: run("npx", ["--yes", "cf", ...full], { cwd: dir, capture: true, allowFail });
+}
+
+function cfLoginJson(dir) {
+	const r = cfSpawn(dir, ["auth", "whoami"]);
 	try { return JSON.parse(r.stdout); } catch { die("unexpected output from cf auth whoami"); }
 }
 
+function normalizeAccounts(raw) {
+	const list = Array.isArray(raw) ? raw : (raw && typeof raw === "object" && Array.isArray(raw.result) ? raw.result : []);
+	return list.filter((a) => a && typeof a.id === "string" && a.id).map((a) => ({ id: a.id, name: typeof a.name === "string" && a.name ? a.name : a.id }));
+}
+
+/** `cf accounts list` (GET /accounts). whoami intersects memberships and can return [] for a logged-in profile. */
+function accountsFromList(dir) {
+	const all = [];
+	const seen = new Set();
+	for (let page = 1; page <= 20; page++) {
+		const r = cfSpawn(dir, ["accounts", "list", "--page", String(page), "--per-page", "50"], { allowFail: true });
+		if (!r || r.status !== 0) return page === 1 ? [] : all;
+		let data;
+		try { data = JSON.parse(r.stdout); } catch { return page === 1 ? [] : all; }
+		if (data && typeof data === "object" && !Array.isArray(data) && Array.isArray(data.result)) data = data.result;
+		if (!Array.isArray(data)) return page === 1 ? [] : all;
+		for (const a of normalizeAccounts(data)) if (!seen.has(a.id)) { seen.add(a.id); all.push(a); }
+		if (data.length < 50) break;
+	}
+	return all;
+}
+
 /** Cloudflare login, before init installs packages. Dies with the same advice as a later cf failure. */
 function requireCfLogin(dir) {
 	const prof = cfProfile();
@@ -454,7 +480,8 @@ function requireCfLogin(dir) {
 		: prof
 		? `cf profile "${prof}" is not logged in: run \`npx cf auth create ${prof} --no-browser\`, open the printed URL, enter the code, then re-run init`
 		: "not logged in to Cloudflare: run `npx cf auth login --no-browser`, open the printed URL, enter the code, then re-run init") + `\n${LOGIN_403_HELP}`);
-	const accts = who.accounts || [];
+	let accts = normalizeAccounts(who.accounts);
+	if (!accts.length && prof) accts = accountsFromList(dir);
 	if (!C.get("CLOUDFLARE_ACCOUNT_ID")) {
 		if (!accts.length && process.env.CLOUDFLARE_API_TOKEN)
 			die("the API token can't list accounts: add the permission User -> Memberships -> Read (or pass --account-id <id> / export CLOUDFLARE_ACCOUNT_ID; the id is in the dashboard URL)");

package/lib/main.mjs

@@ -41,7 +41,8 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
                                                --hostname H moves it back); the old URL answers 301/410
                                 --workers-dev-subdomain  create the account's workers.dev subdomain if missing
                                 --cf-profile   cf auth profile for a separate Cloudflare login
-                                               (npx cf auth create NAME --no-browser); saved, used by every cf call
+                                               (npx cf auth create NAME --no-browser); saved, used by every cf call.
+                                               When whoami lists no accounts, init reads cf accounts list
                                 --d1-name      D1 database to create or reuse (default: worker name)
                                 --pairing-approval  who approves device-flow pairing requests (default human:
                                                the owner token via \`pair approve\`, or the approval password

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.15",
+	"version": "0.8.17",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/migrations/0010_conversation_peer.sql

@@ -0,0 +1,25 @@
+-- A wake is one peer's conversation. Two peers can use the same context id without sharing a row.
+CREATE TABLE wakes_peer (
+  context_id TEXT NOT NULL,
+  peer TEXT NOT NULL DEFAULT '',
+  last_sent_ms INTEGER NOT NULL DEFAULT 0,
+  pending_json TEXT,
+  pending_since_ms INTEGER,
+  PRIMARY KEY (context_id, peer)
+);
+INSERT INTO wakes_peer (context_id, peer, last_sent_ms, pending_json, pending_since_ms)
+SELECT
+  w.context_id,
+  COALESCE(
+    NULLIF(json_extract(w.pending_json, '$.from'), ''),
+    (SELECT t.peer FROM tasks t WHERE t.context_id = w.context_id AND t.peer IS NOT NULL AND t.peer != '' ORDER BY t.created_at, t.id LIMIT 1),
+    (SELECT h.peer FROM history h WHERE h.context_id = w.context_id AND h.peer IS NOT NULL AND h.peer != '' ORDER BY h.seq LIMIT 1),
+    ''
+  ),
+  w.last_sent_ms,
+  w.pending_json,
+  w.pending_since_ms
+FROM wakes w;
+DROP TABLE wakes;
+ALTER TABLE wakes_peer RENAME TO wakes;
+CREATE INDEX IF NOT EXISTS history_peer_ctx ON history(peer, context_id, seq);

package/worker/migrations/0011_conversation_owner.sql

@@ -0,0 +1,34 @@
+-- One owner per context id. The first peer to insert the row keeps it (ON CONFLICT DO NOTHING).
+CREATE TABLE conversation_owners (
+  context_id TEXT NOT NULL PRIMARY KEY,
+  peer TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+INSERT INTO conversation_owners (context_id, peer, created_at)
+SELECT t.context_id, t.peer, t.created_at
+FROM tasks t
+WHERE t.peer IS NOT NULL AND t.peer != ''
+  AND NOT EXISTS (
+    SELECT 1 FROM tasks t2
+    WHERE t2.context_id = t.context_id AND t2.peer IS NOT NULL AND t2.peer != ''
+      AND (t2.created_at < t.created_at OR (t2.created_at = t.created_at AND t2.id < t.id))
+  );
+INSERT INTO conversation_owners (context_id, peer, created_at)
+SELECT h.context_id, h.peer, h.ts
+FROM history h
+WHERE h.peer IS NOT NULL AND h.peer != ''
+  AND NOT EXISTS (SELECT 1 FROM conversation_owners o WHERE o.context_id = h.context_id)
+  AND NOT EXISTS (
+    SELECT 1 FROM history h2
+    WHERE h2.context_id = h.context_id AND h2.peer IS NOT NULL AND h2.peer != '' AND h2.seq < h.seq
+  );
+INSERT INTO conversation_owners (context_id, peer, created_at)
+SELECT o.context_id, o.peer, o.sent_at
+FROM outbound o
+WHERE o.peer IS NOT NULL AND o.peer != ''
+  AND NOT EXISTS (SELECT 1 FROM conversation_owners c WHERE c.context_id = o.context_id)
+  AND NOT EXISTS (
+    SELECT 1 FROM outbound o2
+    WHERE o2.context_id = o.context_id AND o2.peer IS NOT NULL AND o2.peer != ''
+      AND (o2.sent_at < o.sent_at OR (o2.sent_at = o.sent_at AND o2.task_id < o.task_id))
+  );

package/worker/src/export.ts

@@ -16,7 +16,7 @@ export const EXPORT_TABLES = [
 	"peers", "tasks", "messages", "history", "outbound", "wakes",
 	"rate", "wake_budget", "device_requests", "pairing_rate", "settings",
 	"facade_owners", "oauth_clients", "oauth_codes", "mcp_grants",
-	"outbound_peers", "oauth_client_metadata", "oidc_txns",
+	"outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners",
 ] as const;
 
 export type ExportTable = (typeof EXPORT_TABLES)[number];

package/worker/src/index.ts

@@ -67,6 +67,49 @@ function histStmt(ctx: TenantContext, contextId: string, e: Json) {
 		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null);
 }
 
+/** Claim an unused context for this peer. `conversation_owners.context_id` is unique, and the insert does nothing
+ *  when another peer already holds it or already has a task, history row, or outbound task on that id. */
+function claimContextStmt(ctx: TenantContext, contextId: string, peer: string, ts: string) {
+	return ctx.DB.prepare(
+		`INSERT INTO conversation_owners (context_id, peer, created_at)
+		 SELECT ?1, ?2, ?3
+		 WHERE NOT EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?1 AND peer != ?2)
+		   AND NOT EXISTS (SELECT 1 FROM tasks WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
+		   AND NOT EXISTS (SELECT 1 FROM history WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
+		   AND NOT EXISTS (SELECT 1 FROM outbound WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
+		 ON CONFLICT(context_id) DO NOTHING`,
+	).bind(contextId, peer, ts);
+}
+
+/** A new task is stored only when this peer owns the context. Runs in the same batch as `claimContextStmt`. */
+function saveTaskIfOwnerStmt(ctx: TenantContext, t: Json) {
+	return ctx.DB.prepare(
+		`INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, metadata_json, push_configs_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11
+		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?2) = ?3
+		 ON CONFLICT(id) DO UPDATE SET state=?4, updated_at=?7, status_json=?8, artifacts_json=?9, metadata_json=?10, push_configs_json=?11
+		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?2) = ?3`,
+	).bind(t.id, t.contextId, t._peer, t.status.state, t._protocol, t._createdAt, A.nowIso(), JSON.stringify(t.status),
+		JSON.stringify(t.artifacts || []), t.metadata ? JSON.stringify(t.metadata) : null, JSON.stringify(t._push || []));
+}
+
+function msgIfOwnerStmt(ctx: TenantContext, t: Json, m: Json) {
+	return ctx.DB.prepare(
+		`INSERT INTO messages (message_id, task_id, context_id, role, ts, message_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6
+		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?3) = ?7`,
+	).bind(m.messageId, t.id, t.contextId, m.role, A.nowIso(), JSON.stringify(m), t._peer);
+}
+
+function histIfOwnerStmt(ctx: TenantContext, contextId: string, e: Json, owner: string) {
+	return ctx.DB.prepare(
+		`INSERT INTO history (context_id, ts, dir, peer, task_id, role, state, event, text, data_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
+		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?1) = ?11`,
+	).bind(contextId, e.ts || A.nowIso(), e.dir || "local", e.peer ?? null, e.taskId ?? null, e.role ?? null, e.state ?? null,
+		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null, owner);
+}
+
 // ------------------------------------------------------------------ self-aware fetch (a Worker cannot reliably fetch its own custom domain)
 /**
  * Another tenant on this deployment's domain. A public fetch of that hostname returns 522, so the call
@@ -118,7 +161,7 @@ async function doFetch(ctx: TenantContext, ectx: ExecutionContext, url: string,
 	return fetch(url, { ...init, signal: AbortSignal.timeout(15000) });
 }
 
-// ------------------------------------------------------------------ wake webhook (presets), debounced per context via D1
+// ------------------------------------------------------------------ wake webhook (presets), debounced per peer and context via D1
 const preset = (ctx: TenantContext) => (ctx.WAKE_PRESET || "generic").trim();
 
 function wakeConfig(ctx: TenantContext): WakeConfig {
@@ -207,6 +250,21 @@ const WAKE_RETRIES = 3;
  *  flush it once Retry-After (30 s - 1 h) has passed, on the next request to the Worker or the optional cron. At most
  *  WAKE_RETRIES times per wake; a newer message for the conversation merges in and starts over. Pairing and test wakes
  *  are not retried (a pairing code lasts 60 minutes). */
+function pendingWakePeer(pending: string | null | undefined): string {
+	if (!pending) return "";
+	try {
+		const from = JSON.parse(pending)?.from;
+		return typeof from === "string" ? from : "";
+	} catch { return ""; }
+}
+
+/** The wake row for this peer's conversation. A row stored before peer was part of the key has peer ''. */
+async function loadWake(ctx: TenantContext, contextId: string, peer: string): Promise<Json | null> {
+	const exact: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, peer).first();
+	if (exact || !peer) return exact;
+	return ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ''").bind(contextId).first();
+}
+
 async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload: Json, retryAfter: string | null) {
 	if (payload.kind !== "inbound") return;
 	const attempts = (Number(payload.attempts) || 0) + 1;
@@ -214,16 +272,18 @@ async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload:
 	const secs = Number(retryAfter);
 	const waitMs = Math.min(3600, Math.max(30, Number.isFinite(secs) && secs > 0 ? secs : 60)) * 1000;
 	const now = Date.now(), contextId = payload.contextId;
-	const cur: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	const peer = typeof payload.from === "string" ? payload.from : "";
+	const cur: Json = await loadWake(ctx, contextId, peer);
 	const prev = cur?.pending_json ? JSON.parse(cur.pending_json) : null;
 	const merged = { ...payload, attempts, taskIds: [...new Set([...(prev?.taskIds || []), ...(payload.taskIds || [])])] };
 	// flushWake and nextCronAt wait until last_sent_ms + debounce. Store Retry-After minus that debounce so the
 	// deadline is Retry-After itself, including when the debounce is longer than Retry-After. Do not keep the
 	// previous last_sent_ms: that clock is the send we just made, and keeping it would wait out the debounce.
 	const due = now + waitMs - debounceMs(ctx);
-	await ctx.DB.prepare(`INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)
-		ON CONFLICT(context_id) DO UPDATE SET pending_json = excluded.pending_json, last_sent_ms = excluded.last_sent_ms,
-		pending_since_ms = COALESCE(wakes.pending_since_ms, excluded.pending_since_ms)`).bind(contextId, due, JSON.stringify(merged), now).run();
+	const rowPeer = cur && (cur.peer === peer || cur.peer === "" || cur.peer == null) ? (cur.peer ?? "") : peer;
+	await ctx.DB.prepare(`INSERT INTO wakes (context_id, peer, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT(context_id, peer) DO UPDATE SET pending_json = excluded.pending_json, last_sent_ms = excluded.last_sent_ms,
+		pending_since_ms = COALESCE(wakes.pending_since_ms, excluded.pending_since_ms)`).bind(contextId, rowPeer === "" ? peer : rowPeer, due, JSON.stringify(merged), now).run();
 	log("wake_requeued", { contextId, retryInS: Math.round(waitMs / 1000), attempt: attempts });
 	// The row exists now. A hosted alarm has to be set from this turn: the request that started sendWake may already have returned.
 	await noteWakeWrite(ectx);
@@ -232,33 +292,45 @@ async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload:
 async function wake(ctx: TenantContext, ectx: ExecutionContext, contextId: string, taskId: string, from: string, preview: string, kind = "inbound") {
 	const payload: Json = { contextId, taskId, taskIds: [taskId], from, preview: preview.slice(0, 300), kind };
 	const now = Date.now(), deb = debounceMs(ctx);
-	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	let row: Json = await loadWake(ctx, contextId, from);
+	// A pre-peer row (peer '') is this conversation when it names this peer, or names nobody yet.
+	// Another peer's legacy row stays put; this peer gets its own row.
+	if (row && row.peer === "" && from) {
+		const named = pendingWakePeer(row.pending_json);
+		if (!named || named === from) {
+			const moved = await ctx.DB.prepare("UPDATE wakes SET peer = ? WHERE context_id = ? AND peer = ''").bind(from, contextId).run();
+			if (changed(moved) === 1) row = { ...row, peer: from };
+			else row = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, from).first();
+		} else row = null;
+	}
+	const peer = row?.peer ?? from;
 	let claimed = false;
 	if (!row) {
-		const r = await ctx.DB.prepare("INSERT INTO wakes (context_id, last_sent_ms) VALUES (?, ?) ON CONFLICT DO NOTHING").bind(contextId, now).run();
+		const r = await ctx.DB.prepare("INSERT INTO wakes (context_id, peer, last_sent_ms) VALUES (?, ?, ?) ON CONFLICT DO NOTHING").bind(contextId, peer, now).run();
 		claimed = r.meta.changes === 1;
 	} else if (!row.pending_json && now - row.last_sent_ms >= deb) {
-		const r = await ctx.DB.prepare("UPDATE wakes SET last_sent_ms = ? WHERE context_id = ? AND last_sent_ms = ? AND pending_json IS NULL")
-			.bind(now, contextId, row.last_sent_ms).run();
+		const r = await ctx.DB.prepare("UPDATE wakes SET last_sent_ms = ? WHERE context_id = ? AND peer = ? AND last_sent_ms = ? AND pending_json IS NULL")
+			.bind(now, contextId, peer, row.last_sent_ms).run();
 		claimed = r.meta.changes === 1;
 	}
 	if (claimed && (await wakeBudgetOk(ctx))) { ectx.waitUntil(sendWake(ctx, ectx, payload)); return; }
 	// debounce window (or hourly cap reached): merge into the pending wake and flush it later
-	const cur: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	const cur: Json = await loadWake(ctx, contextId, from);
+	const curPeer = cur?.peer ?? peer;
 	const prev = cur?.pending_json ? JSON.parse(cur.pending_json) : null;
 	payload.taskIds = [...new Set([...(prev?.taskIds || []), taskId])];
-	await ctx.DB.prepare("UPDATE wakes SET pending_json = ?, pending_since_ms = COALESCE(pending_since_ms, ?) WHERE context_id = ?")
-		.bind(JSON.stringify(payload), now, contextId).run();
+	await ctx.DB.prepare("UPDATE wakes SET pending_json = ?, pending_since_ms = COALESCE(pending_since_ms, ?) WHERE context_id = ? AND peer = ?")
+		.bind(JSON.stringify(payload), now, contextId, curPeer).run();
 	// The pending row exists now. A hosted alarm is set in this turn, including when the delay is too long for waitUntil.
 	await noteWakeWrite(ectx);
 	const delay = Math.max(0, (cur?.last_sent_ms || now) + deb - now) + 100;
 	// waitUntil can outlive the response by ~30s. Longer windows are flushed by a later request, the optional
 	// single-inbox cron, or the registered alarm (set above).
-	if (delay <= 25000) ectx.waitUntil(new Promise((res) => setTimeout(res, delay)).then(() => flushWake(ctx, ectx, contextId)));
+	if (delay <= 25000) ectx.waitUntil(new Promise((res) => setTimeout(res, delay)).then(() => flushWake(ctx, ectx, contextId, curPeer)));
 }
 
-async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId: string) {
-	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId: string, peer: string) {
+	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, peer).first();
 	if (!row || !row.pending_json) return;
 	const now = Date.now();
 	if (now - row.last_sent_ms < debounceMs(ctx)) return;
@@ -268,16 +340,16 @@ async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId:
 		if ((b?.count ?? 0) >= maxPerHour(ctx)) return; // keep pending until the next hour
 	}
 	const r = await ctx.DB.prepare(
-		"UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL, last_sent_ms = ? WHERE context_id = ? AND last_sent_ms = ? AND pending_json IS NOT NULL",
-	).bind(now, contextId, row.last_sent_ms).run();
+		"UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL, last_sent_ms = ? WHERE context_id = ? AND peer = ? AND last_sent_ms = ? AND pending_json IS NOT NULL",
+	).bind(now, contextId, peer, row.last_sent_ms).run();
 	if (r.meta.changes === 1 && (await wakeBudgetOk(ctx))) await sendWake(ctx, ectx, JSON.parse(row.pending_json));
 }
 
 /** Flush every pending wake whose debounce window has passed (called opportunistically and from cron). */
 async function flushDue(ctx: TenantContext, ectx: ExecutionContext) {
-	const rows = await ctx.DB.prepare("SELECT context_id FROM wakes WHERE pending_json IS NOT NULL AND last_sent_ms <= ? LIMIT 20")
+	const rows = await ctx.DB.prepare("SELECT context_id, peer FROM wakes WHERE pending_json IS NOT NULL AND last_sent_ms <= ? LIMIT 20")
 		.bind(Date.now() - debounceMs(ctx)).all();
-	for (const r of rows.results as Json[]) await flushWake(ctx, ectx, r.context_id);
+	for (const r of rows.results as Json[]) await flushWake(ctx, ectx, r.context_id, typeof r.peer === "string" ? r.peer : "");
 }
 
 /**
@@ -569,6 +641,31 @@ const V03: Record<string, string> = {
 	"message/send": "send", "tasks/get": "get", "tasks/cancel": "cancel", "tasks/pushNotificationConfig/set": "pushset",
 	"tasks/pushNotificationConfig/get": "pushget", "message/stream": "stream", "tasks/resubscribe": "stream",
 };
+// Methods only the façade forwards (the inbox has one push config per task and no delete).
+const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
+const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
+const EXTENDED_CARD_METHODS = new Set(["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]);
+
+/** Header, else query `A2A-Version`. A patch (`1.0.1`, `0.3.0`) is ignored. Empty means the method name chooses the
+ *  shape, so a 0.3 client that omits the header stays on 0.3 and a headerless `SendMessage` stays 1.0. */
+function declaredA2AVersion(req: Request): { raw: string; version: string | null } {
+	let raw = (req.headers.get("a2a-version") || "").trim();
+	if (!raw) {
+		try { raw = (new URL(req.url).searchParams.get("A2A-Version") || "").trim(); } catch { raw = ""; }
+	}
+	if (!raw) return { raw: "", version: null };
+	if (/^(1\.0(\.\d+)?|1)$/.test(raw)) return { raw, version: "1.0" };
+	if (/^0\.3(\.\d+)?$/.test(raw)) return { raw, version: "0.3" };
+	return { raw, version: null };
+}
+
+function rpcOperation(method: string, proxy: boolean): { op: string; version: string } | null {
+	if (V1[method]) return { op: V1[method], version: "1.0" };
+	if (V03[method]) return { op: V03[method], version: "0.3" };
+	if (proxy && PROXY_V1[method]) return { op: PROXY_V1[method], version: "1.0" };
+	if (proxy && PROXY_V03[method]) return { op: PROXY_V03[method], version: "0.3" };
+	return null;
+}
 
 async function ownedTask(ctx: TenantContext, id: unknown, label: string): Promise<Json> {
 	if (typeof id !== "string" || !A.ID_RE.test(id)) throw new RpcError(-32001, "Task not found");
@@ -577,6 +674,10 @@ async function ownedTask(ctx: TenantContext, id: unknown, label: string): Promis
 	return t;
 }
 
+/** A contextId this caller does not get to use. The same sentence is returned for an id the façade has no
+ *  record of. It does not say whether the id exists, or which peer holds it. */
+const UNKNOWN_CONTEXT = "Invalid params: unknown contextId (omit contextId to start a new conversation, then use the one returned)";
+
 function normPushCfg(cfg: Json, version: string): Json {
 	if (!cfg || typeof cfg !== "object" || typeof cfg.url !== "string") throw new RpcError(-32602, "push notification config needs url");
 	const out: Json = { id: typeof cfg.id === "string" && cfg.id ? cfg.id.slice(0, 128) : A.newId(), url: cfg.url, _version: version };
@@ -609,6 +710,11 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	}
 	const contextId = task ? task.contextId : msg.contextId ? A.checkId(msg.contextId, "contextId") : A.newId();
 	const ts = A.nowIso();
+	// A client-provided id nobody owns is still this peer's new conversation (single-peer and outbound send
+	// keep passing one). An id another peer already has is not. A2A forbids minting a replacement id when the
+	// client id is refused, so this is the same error the façade returns for an unknown context, not a new id.
+	// The claim and the first task are one batch: a second peer cannot pass a read and then write its own task.
+	const creating = !task;
 	if (!task) task = { id: A.newId(), contextId, status: { state: "submitted", timestamp: ts }, artifacts: [], history: [], _peer: label, _protocol: version, _createdAt: ts, _push: [] };
 	msg.contextId = contextId; msg.taskId = task.id;
 	task.history.push(msg);
@@ -616,10 +722,23 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	if (pushCfg) task._push = [...task._push.filter((c: Json) => c.id !== pushCfg.id), pushCfg];
 	if (params.metadata && typeof params.metadata === "object") task.metadata = { ...(task.metadata || {}), ...params.metadata };
 	const preview = A.textOf(msg);
-	await ctx.DB.batch([
-		saveTaskStmt(ctx, task), msgStmt(ctx, task, msg),
-		histStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }),
-	]);
+	if (creating) {
+		const stored = await ctx.DB.batch([
+			claimContextStmt(ctx, contextId, label, ts),
+			saveTaskIfOwnerStmt(ctx, task),
+			msgIfOwnerStmt(ctx, task, msg),
+			histIfOwnerStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }, label),
+			ctx.DB.prepare("SELECT peer FROM conversation_owners WHERE context_id = ?").bind(contextId),
+		]);
+		const owner = (stored[4]?.results?.[0] as Json | undefined)?.peer;
+		const wrote = stored[1]?.meta?.changes ?? 0;
+		if (owner !== label || wrote < 1) throw new RpcError(-32602, UNKNOWN_CONTEXT);
+	} else {
+		await ctx.DB.batch([
+			saveTaskStmt(ctx, task), msgStmt(ctx, task, msg),
+			histStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }),
+		]);
+	}
 	log("message_received", { peer: label, contextId, taskId: task.id, chars: preview.length, version });
 	await wake(ctx, ectx, contextId, task.id, label, preview);
 	const pt = A.publicTask(task, version, conf.historyLength);
@@ -713,15 +832,14 @@ async function handleRpc(req: Request, ctx: TenantContext, ectx: ExecutionContex
 	const err = (code: number, message: string) => json({ jsonrpc: "2.0", id: rid, error: { code, message } });
 	if (!rq || typeof rq !== "object" || rq.jsonrpc !== "2.0" || typeof rq.method !== "string") return err(-32600, "Invalid Request");
 	const method: string = rq.method;
-	let op: string, version: string;
 	const proxy = proxyMode(ctx);
-	if (V1[method]) { op = V1[method]; version = "1.0"; }
-	else if (V03[method]) { op = V03[method]; version = "0.3"; }
-	else if (proxy && PROXY_V1[method]) { op = PROXY_V1[method]; version = "1.0"; }
-	else if (proxy && PROXY_V03[method]) { op = PROXY_V03[method]; version = "0.3"; }
-	else return err(-32601, "Method not found");
-	const hv = (req.headers.get("a2a-version") || "").trim();
-	if (hv && !/^(0\.3|1|1\.0)(\.\d+)?$/.test(hv)) return err(-32009, `A2A version ${hv} not supported (supported: 0.3, 1.0)`);
+	const declared = declaredA2AVersion(req);
+	if (declared.raw && !declared.version) return err(-32009, `A2A version ${declared.raw} not supported (supported: 0.3, 1.0)`);
+	if (EXTENDED_CARD_METHODS.has(method)) return err(-32007, "Extended agent card is not configured");
+	const found = rpcOperation(method, proxy);
+	if (!found) return err(-32601, "Method not found");
+	const version = declared.version || found.version;
+	const op = found.op;
 	if (op === "stream") return err(-32004, proxy ? "Streaming is not supported through this façade yet" : "Streaming is not supported");
 	const params = rq.params ?? {};
 	if (typeof params !== "object" || Array.isArray(params)) return err(-32602, "Invalid params");
@@ -796,10 +914,6 @@ async function verifyUpstream(ctx: TenantContext): Promise<Json> {
 	return { ok: verdict.reason === "reachable", ...verdict, sent, method: VERIFY_METHOD, upstreamWantsBearer: F.upstreamAuth(up.card).bearer };
 }
 
-// Methods only the façade forwards (the inbox has one push config per task and no delete).
-const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
-const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
-
 async function ownerOf(ctx: TenantContext, kind: "task" | "context", id: string): Promise<string | null> {
 	const r: Json = await ctx.DB.prepare("SELECT peer FROM facade_owners WHERE kind = ? AND id = ?").bind(kind, id).first();
 	return r ? r.peer : null;
@@ -837,7 +951,7 @@ async function proxyRpc(req: Request, ctx: TenantContext, c: { raw: string; rid:
 			// may still be a live upstream context (another peer's, or one opened outside the façade), and the façade can't
 			// tell, so client-chosen context ids are refused; omit contextId to start a conversation and reuse the returned one.
 			if ((await ownerOf(ctx, "context", m.contextId)) !== c.label)
-				return err(-32602, "Invalid params: unknown contextId (omit contextId to start a new conversation, then use the one returned)");
+				return err(-32602, UNKNOWN_CONTEXT);
 		}
 	} else {
 		const tid = F.taskIdOf(c.op, c.params);
@@ -847,8 +961,9 @@ async function proxyRpc(req: Request, ctx: TenantContext, c: { raw: string; rid:
 	// public-looking name to a private address), so push configs never reach it. Follow-up: a relay through the Worker.
 	if (F.wantsPush(c.op, c.params)) return err(-32003, "Push notifications are not supported through this façade; poll GetTask with the task id instead");
 	const headers = upstreamHeaders(ctx, ep, { "content-type": "application/json", accept: "application/json", "x-a2a-peer": c.label });
-	const hv = req.headers.get("a2a-version");
-	if (hv) headers["a2a-version"] = hv;
+	// Declared version only (header, else query). A headerless call stays headerless, so the upstream still chooses from the method name.
+	const declared = declaredA2AVersion(req);
+	if (declared.version) headers["a2a-version"] = declared.version;
 	let r: Response;
 	try {
 		r = await fetch(ep, { method: "POST", headers, body: c.raw, redirect: "manual", signal: AbortSignal.timeout(90000) });
@@ -1099,22 +1214,25 @@ async function ackPendingWakes(ctx: TenantContext, seen: { taskId: string; conte
 		byContext.set(row.contextId, ids);
 	}
 	for (const [contextId, seenIds] of byContext) {
-		const row: Json = await ctx.DB.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind(contextId).first();
-		if (typeof row?.pending_json !== "string") continue;
-		let payload: Json;
-		try { payload = JSON.parse(row.pending_json); } catch { continue; }
-		const wakeKind = typeof payload?.kind === "string" && payload.kind ? payload.kind : "inbound";
-		if (wakeKind !== kind) continue;
-		if (typeof payload?.contextId === "string" && payload.contextId !== contextId) continue;
-		const ids = wakeTaskIds(payload);
-		if (!ids.some((id) => seenIds.has(id))) continue;
-		const kept = ids.filter((id) => !seenIds.has(id));
-		if (!kept.length) {
-			await ctx.DB.prepare("UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL WHERE context_id = ? AND pending_json = ?").bind(contextId, row.pending_json).run();
-			continue;
+		const rows = await ctx.DB.prepare("SELECT peer, pending_json FROM wakes WHERE context_id = ? AND pending_json IS NOT NULL").bind(contextId).all();
+		for (const row of (rows.results || []) as Json[]) {
+			if (typeof row?.pending_json !== "string") continue;
+			let payload: Json;
+			try { payload = JSON.parse(row.pending_json); } catch { continue; }
+			const wakeKind = typeof payload?.kind === "string" && payload.kind ? payload.kind : "inbound";
+			if (wakeKind !== kind) continue;
+			if (typeof payload?.contextId === "string" && payload.contextId !== contextId) continue;
+			const ids = wakeTaskIds(payload);
+			if (!ids.some((id) => seenIds.has(id))) continue;
+			const kept = ids.filter((id) => !seenIds.has(id));
+			const peer = typeof row.peer === "string" ? row.peer : "";
+			if (!kept.length) {
+				await ctx.DB.prepare("UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL WHERE context_id = ? AND peer = ? AND pending_json = ?").bind(contextId, peer, row.pending_json).run();
+				continue;
+			}
+			const next = { ...payload, taskIds: kept, taskId: kept[kept.length - 1] };
+			await ctx.DB.prepare("UPDATE wakes SET pending_json = ? WHERE context_id = ? AND peer = ? AND pending_json = ?").bind(JSON.stringify(next), contextId, peer, row.pending_json).run();
 		}
-		const next = { ...payload, taskIds: kept, taskId: kept[kept.length - 1] };
-		await ctx.DB.prepare("UPDATE wakes SET pending_json = ? WHERE context_id = ? AND pending_json = ?").bind(JSON.stringify(next), contextId, row.pending_json).run();
 	}
 }
 
@@ -1251,7 +1369,19 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	}
 	if (seg[0] === "history" && seg[1] && m === "GET") {
 		const n = Math.min(Number(url.searchParams.get("n") || "50"), 1000);
-		const rows = await ctx.DB.prepare("SELECT * FROM (SELECT * FROM history WHERE context_id = ? ORDER BY seq DESC LIMIT ?) ORDER BY seq").bind(seg[1], n).all();
+		// Rows for this conversation: this context, and a peer that owns it (a task or an outbound task).
+		// A null peer is a local note. When nothing owns the id yet, the rows that name it are the conversation.
+		const rows = await ctx.DB.prepare(`SELECT * FROM (
+			SELECT * FROM history WHERE context_id = ? AND (
+				peer IS NULL OR peer = ''
+				OR peer IN (SELECT peer FROM tasks WHERE context_id = ? AND peer IS NOT NULL AND peer != '')
+				OR peer IN (SELECT peer FROM outbound WHERE context_id = ? AND peer IS NOT NULL AND peer != '')
+				OR (
+					NOT EXISTS (SELECT 1 FROM tasks WHERE context_id = ?)
+					AND NOT EXISTS (SELECT 1 FROM outbound WHERE context_id = ?)
+				)
+			) ORDER BY seq DESC LIMIT ?
+		) ORDER BY seq`).bind(seg[1], seg[1], seg[1], seg[1], seg[1], n).all();
 		return json((rows.results as Json[]).map((r) => ({ ...r, data: r.data_json ? JSON.parse(r.data_json) : undefined, data_json: undefined })));
 	}
 	if (seg[0] === "history" && !seg[1] && m === "POST") {
@@ -1413,6 +1543,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 				ctx.DB.prepare("DELETE FROM history WHERE context_id = ?").bind(c),
 				ctx.DB.prepare("DELETE FROM outbound WHERE context_id = ?").bind(c),
 				ctx.DB.prepare("DELETE FROM wakes WHERE context_id = ?").bind(c),
+				ctx.DB.prepare("DELETE FROM conversation_owners WHERE context_id = ?").bind(c),
 			]);
 			n += res.reduce((s, r) => s + (r.meta.changes || 0), 0);
 		}

package/worker/src/migrations.ts

@@ -9,6 +9,8 @@ import m0006 from "../migrations/0006_mcp.sql?raw";
 import m0007 from "../migrations/0007_cimd.sql?raw";
 import m0008 from "../migrations/0008_oidc_txns.sql?raw";
 import m0009 from "../migrations/0009_outbound_seen.sql?raw";
+import m0010 from "../migrations/0010_conversation_peer.sql?raw";
+import m0011 from "../migrations/0011_conversation_owner.sql?raw";
 import type { Migration } from "./storage.ts";
 
 export const MIGRATIONS: Migration[] = [
@@ -21,4 +23,6 @@ export const MIGRATIONS: Migration[] = [
 	{ name: "0007_cimd.sql", sql: m0007 },
 	{ name: "0008_oidc_txns.sql", sql: m0008 },
 	{ name: "0009_outbound_seen.sql", sql: m0009 },
+	{ name: "0010_conversation_peer.sql", sql: m0010 },
+	{ name: "0011_conversation_owner.sql", sql: m0011 },
 ];

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.15";
+export const VERSION = "0.8.17";

package/worker/test/context-peer.test.ts

@@ -0,0 +1,171 @@
+// A peer must not post into another peer's conversation by reusing its contextId.
+// Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://agent.example.com";
+const UNKNOWN = "Invalid params: unknown contextId (omit contextId to start a new conversation, then use the one returned)";
+
+function setup() {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const env: any = {
+		DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox", WAKE_PRESET: "generic",
+		WAKE_DEBOUNCE_SECONDS: "3600", WAKE_WEBHOOK_URL: "https://hook.example.net/wake", WAKE_WEBHOOK_KEY: "hook-key",
+	};
+	const origFetch = globalThis.fetch;
+	globalThis.fetch = (async () => new Response("ok")) as typeof fetch;
+	const call = async (method: string, path: string, json?: unknown, auth = "Bearer owner-secret") => {
+		const headers: Record<string, string> = { authorization: auth, "content-type": "application/json", "cf-connecting-ip": "198.51.100.7" };
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers, body: json === undefined ? undefined : JSON.stringify(json) }) as any,
+			env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		await Promise.allSettled(pending);
+		const text = await res.text();
+		let data: any = text;
+		try { data = text ? JSON.parse(text) : null; } catch { /* not json */ }
+		return { status: res.status, data, text };
+	};
+	const owner = (method: string, path: string, json?: unknown) => call(method, path, json);
+	const send = (token: string, text: string, contextId?: string, method = "message/send") => call("POST", "/", {
+		jsonrpc: "2.0", id: 1, method,
+		params: { message: { kind: "message", role: "user", messageId: crypto.randomUUID(), ...(contextId ? { contextId } : {}), parts: [{ kind: "text", text }] } },
+	}, `Bearer ${token}`);
+	return { DB, owner, send, restore: () => { globalThis.fetch = origFetch; } };
+}
+
+test("another peer's contextId is refused without joining that conversation", async (t) => {
+	const s = setup();
+	t.after(s.restore);
+	const ada = (await s.owner("POST", "/owner/peers", { label: "ada" })).data.token as string;
+	const bob = (await s.owner("POST", "/owner/peers", { label: "bob" })).data.token as string;
+	assert.match(ada, /^a2aow_/);
+	assert.match(bob, /^a2aow_/);
+
+	const first = await s.send(ada, "y-one", "ctx-y");
+	assert.equal(first.status, 200, first.text);
+	assert.equal(first.data.result.contextId, "ctx-y");
+	const second = await s.send(ada, "y-two", "ctx-y");
+	assert.equal(second.status, 200, second.text);
+	assert.equal(second.data.result.contextId, "ctx-y");
+
+	const history = () => s.owner("GET", "/owner/history/ctx-y");
+	const beforeHist = await history();
+	assert.equal(beforeHist.status, 200, beforeHist.text);
+	const beforeTexts = (beforeHist.data as { text: string }[]).map((r) => r.text);
+	assert.deepEqual(beforeTexts, ["y-one", "y-two"]);
+	const wake = () => s.DB.db.prepare("SELECT context_id, peer, last_sent_ms, pending_json, pending_since_ms FROM wakes WHERE context_id = 'ctx-y' AND peer = 'ada'").get() as {
+		pending_json: string; peer: string; last_sent_ms: number; pending_since_ms: number;
+	};
+	const beforeWake = wake();
+	assert.equal(beforeWake.peer, "ada");
+	const pending = JSON.parse(beforeWake.pending_json);
+	assert.equal(pending.from, "ada");
+	assert.equal(pending.preview, "y-two");
+	assert.equal(pending.taskIds.includes(second.data.result.id), true);
+
+	const foreign = await s.send(bob, "x-inject", "ctx-y");
+	const foreignV1 = await s.send(bob, "x-inject-v1", "ctx-y", "SendMessage");
+	assert.deepEqual(foreign.data.error, { code: -32602, message: UNKNOWN });
+	assert.deepEqual(foreignV1.data.error, foreign.data.error);
+	const body = JSON.stringify(foreign.data);
+	assert.equal(body.includes("ada"), false);
+	assert.equal(body.includes("ctx-y"), false);
+	assert.equal(body.includes("y-one"), false);
+	assert.equal(body.includes("y-two"), false);
+	assert.equal(body.includes("exists"), false);
+	assert.equal(body.includes(ada), false);
+	assert.equal(body.includes(bob), false);
+
+	const afterHist = await history();
+	assert.deepEqual(afterHist.data, beforeHist.data);
+	assert.deepEqual(wake(), beforeWake);
+	const db = s.DB.db;
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM tasks WHERE context_id = 'ctx-y' AND peer = 'bob'").get() as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM history WHERE context_id = 'ctx-y' AND peer = 'bob'").get() as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM wakes WHERE context_id = 'ctx-y' AND peer = 'bob'").get() as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM messages WHERE context_id = 'ctx-y' AND message_json LIKE '%x-inject%'").get() as { n: number }).n, 0);
+
+	assert.equal((db.prepare("SELECT peer FROM conversation_owners WHERE context_id = 'ctx-y'").get() as { peer: string }).peer, "ada");
+
+	const follow = await s.send(ada, "y-three", "ctx-y");
+	assert.equal(follow.status, 200, follow.text);
+	assert.equal(follow.data.result.contextId, "ctx-y");
+	const texts = ((await history()).data as { text: string; peer: string }[]).map((r) => r.text);
+	assert.deepEqual(texts, ["y-one", "y-two", "y-three"]);
+	const after = JSON.parse(wake().pending_json);
+	assert.equal(after.from, "ada");
+	assert.equal(after.preview, "y-three");
+	assert.equal(String(after.preview).includes("x-inject"), false);
+	assert.equal(after.taskIds.includes(follow.data.result.id), true);
+	assert.equal(after.taskIds.includes(second.data.result.id), true);
+
+	const own = await s.send(bob, "x-own", "ctx-x");
+	assert.equal(own.status, 200, own.text);
+	assert.equal(own.data.result.contextId, "ctx-x");
+	const again = await s.send(bob, "x-again", "ctx-x");
+	assert.equal(again.status, 200, again.text);
+	assert.equal(again.data.result.contextId, "ctx-x");
+	const bobHist = await s.owner("GET", "/owner/history/ctx-x");
+	assert.deepEqual((bobHist.data as { text: string }[]).map((r) => r.text), ["x-own", "x-again"]);
+	assert.deepEqual(((await history()).data as { text: string }[]).map((r) => r.text), ["y-one", "y-two", "y-three"]);
+	assert.equal(JSON.parse(wake().pending_json).from, "ada");
+	assert.equal(JSON.parse(wake().pending_json).preview, "y-three");
+	assert.equal((db.prepare("SELECT peer FROM conversation_owners WHERE context_id = 'ctx-x'").get() as { peer: string }).peer, "bob");
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM conversation_owners WHERE context_id = 'ctx-y'").get() as { n: number }).n, 1);
+});
+
+test("two peers cannot both claim one unused contextId", async (t) => {
+	const s = setup();
+	t.after(s.restore);
+	const ada = (await s.owner("POST", "/owner/peers", { label: "ada" })).data.token as string;
+	const bob = (await s.owner("POST", "/owner/peers", { label: "bob" })).data.token as string;
+	let arrived = 0;
+	let openGate = () => {};
+	const gate = new Promise<void>((resolve) => { openGate = resolve; });
+	const orig = s.DB.batch.bind(s.DB);
+	s.DB.batch = async (stmts: { __sql?: string }[]) => {
+		const claim = stmts.some((st) => typeof st.__sql === "string" && st.__sql.includes("INSERT INTO conversation_owners"));
+		if (!claim || arrived >= 2) return orig(stmts);
+		arrived++;
+		if (arrived === 2) openGate();
+		await gate;
+		return orig(stmts);
+	};
+	const [left, right] = await Promise.all([
+		s.send(ada, "from-ada", "ctx-race"),
+		s.send(bob, "from-bob", "ctx-race"),
+	]);
+	assert.equal(arrived, 2);
+	const ok = [left, right].filter((r) => r.status === 200 && !r.data.error);
+	const denied = [left, right].filter((r) => r.data?.error);
+	assert.equal(ok.length, 1, JSON.stringify([left.data, right.data]));
+	assert.equal(denied.length, 1);
+	assert.deepEqual(denied[0].data.error, { code: -32602, message: UNKNOWN });
+	assert.equal(ok[0].data.result.contextId, "ctx-race");
+	const body = JSON.stringify(denied[0].data);
+	for (const secret of ["ada", "bob", "ctx-race", "from-ada", "from-bob", "exists", ada, bob]) assert.equal(body.includes(secret), false, secret);
+
+	const db = s.DB.db;
+	const owners = db.prepare("SELECT peer FROM conversation_owners WHERE context_id = 'ctx-race'").all() as { peer: string }[];
+	assert.equal(owners.length, 1);
+	const winner = owners[0].peer;
+	const loser = winner === "ada" ? "bob" : "ada";
+	assert.equal(winner === "ada" || winner === "bob", true);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM tasks WHERE context_id = 'ctx-race'").get() as { n: number }).n, 1);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM tasks WHERE context_id = 'ctx-race' AND peer = ?").get(loser) as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM history WHERE context_id = 'ctx-race' AND peer = ?").get(loser) as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM messages WHERE context_id = 'ctx-race' AND message_json LIKE ?").get(`%from-${loser}%`) as { n: number }).n, 0);
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM wakes WHERE context_id = 'ctx-race' AND peer = ?").get(loser) as { n: number }).n, 0);
+
+	const follow = await s.send(winner === "ada" ? ada : bob, "follow", "ctx-race");
+	assert.equal(follow.status, 200, follow.text);
+	assert.equal(follow.data.result.contextId, "ctx-race");
+	const hist = await s.owner("GET", "/owner/history/ctx-race");
+	assert.deepEqual((hist.data as { text: string; peer: string }[]).map((r) => r.text), [winner === "ada" ? "from-ada" : "from-bob", "follow"]);
+	assert.equal((hist.data as { peer: string }[]).every((r) => r.peer === winner), true);
+	const again = await s.send(loser === "ada" ? ada : bob, "still-no", "ctx-race");
+	assert.deepEqual(again.data.error, { code: -32602, message: UNKNOWN });
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM tasks WHERE context_id = 'ctx-race' AND peer = ?").get(loser) as { n: number }).n, 0);
+});

package/worker/test/facade.test.ts

@@ -268,6 +268,54 @@ test("proxy mode: JSON-RPC is forwarded with the façade's credential, never the
 	assert.equal((s.DB.db.prepare("SELECT COUNT(*) AS n FROM tasks").get() as any).n, 0);
 });
 
+test("proxy mode: a declared A2A-Version query is forwarded as the header; a headerless call stays headerless", async (t) => {
+	let n = 0;
+	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-ver.json" }, async (url, init) => {
+		if (url.endsWith(".json")) return Response.json(tailnetCard());
+		const rq = JSON.parse(init.body);
+		const hv = init.headers?.["a2a-version"];
+		const v1 = hv ? hv.startsWith("1") : !String(rq.method).includes("/");
+		const id = `up-task-${++n}`, contextId = `up-ctx-${n}`;
+		const result = v1
+			? { task: { id, contextId, status: { state: "TASK_STATE_SUBMITTED" }, history: [{ role: "ROLE_USER", parts: [{ text: "hi" }] }] } }
+			: { kind: "task", id, contextId, status: { state: "submitted" }, history: [{ kind: "message", role: "user", parts: [{ kind: "text", text: "hi" }] }] };
+		return Response.json({ jsonrpc: "2.0", id: rq.id, result });
+	});
+	t.after(s.restore);
+	const tok = await s.issue("ada");
+	const msg = { message: { role: "user", messageId: "m-ver", parts: [{ kind: "text", text: "hi" }] } };
+	const post = (path: string, method: string, headers: Record<string, string> = {}) =>
+		s.call("POST", path, { token: tok, json: { jsonrpc: "2.0", id: 1, method, params: msg }, headers });
+	const last = () => s.calls.filter((c) => c.url === UPSTREAM).at(-1);
+
+	const q = await post("/?A2A-Version=0.3", "SendMessage");
+	assert.equal(q.status, 200, q.text);
+	assert.equal(last().url, UPSTREAM);
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(q.data.result.kind, "task");
+	assert.equal(q.data.result.status.state, "submitted");
+	assert.equal(q.data.result.task, undefined);
+
+	const bare = await post("/", "SendMessage");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	assert.equal(bare.data.result.kind, undefined);
+
+	const bare03 = await post("/", "message/send");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare03.data.result.kind, "task");
+	assert.equal(bare03.data.result.status.state, "submitted");
+
+	const wins = await post("/?A2A-Version=0.3", "SendMessage", { "a2a-version": "1.0" });
+	assert.equal(last().headers["a2a-version"], "1.0");
+	assert.equal(wins.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const patch = await post("/?A2A-Version=0.3.0", "SendMessage");
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(patch.data.result.kind, "task");
+	assert.equal(patch.data.result.status.state, "submitted");
+});
+
 test("proxy mode: peers sharing the upstream identity can't touch each other's tasks or contexts", async (t) => {
 	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-c.json" });
 	t.after(s.restore);
@@ -309,7 +357,14 @@ test("proxy mode: peers sharing the upstream identity can't touch each other's t
 	// ListTasks would list every peer's tasks; streaming is not proxied yet
 	assert.equal((await s.rpc(a, "ListTasks", {})).data.error?.code, -32004);
 	assert.equal((await s.rpc(a, "SendStreamingMessage", { message: { role: "ROLE_USER", parts: [{ text: "x" }] } })).data.error?.code, -32004);
-	assert.equal((await s.rpc(a, "GetExtendedAgentCard", {})).data.error?.code, -32601);
+	const nCard = s.calls.filter((c) => c.url === UPSTREAM).length;
+	const ext = await s.rpc(a, "GetExtendedAgentCard", {});
+	assert.equal(ext.status, 200);
+	assert.equal(ext.data.error?.code, -32007);
+	assert.equal(ext.data.error?.message, "Extended agent card is not configured");
+	const ext03 = await s.call("POST", "/", { token: a, json: { jsonrpc: "2.0", id: 1, method: "agent/getAuthenticatedExtendedCard", params: {} }, headers: { "a2a-version": "0.3" } });
+	assert.equal(ext03.data.error?.code, -32007);
+	assert.equal(s.calls.filter((c) => c.url === UPSTREAM).length, nCard, "the extended card stays on the façade");
 });
 
 test("proxy mode: push configs never reach the upstream (it would call them from inside the private network)", async (t) => {

package/worker/test/migrations.test.ts

@@ -57,7 +57,7 @@ test("migration files: NNNN_name.sql, unique numbers, no gaps, 0002_wake_budget
 test("fresh database: every migration applies in order; a second run applies nothing", () => {
 	const db = new DatabaseSync(":memory:");
 	assert.deepEqual(applyMigrations(db), [...FILES].sort(byNumber));
-	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns"]) assert.ok(tables(db).includes(t), t);
+	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners"]) assert.ok(tables(db).includes(t), t);
 	assert.ok(columns(db, "peers").includes("source"));
 	assert.ok(columns(db, "device_requests").includes("replaces_label"));
 	assert.ok(columns(db, "device_requests").includes("replaces_hash"));
@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 
@@ -122,3 +122,38 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		globalThis.fetch = origFetch;
 	}
 });
+
+test("0010 keys an existing wake by the peer in its payload and allows a second peer", () => {
+	const prior = [...FILES].sort(byNumber).filter((f) => f !== "0010_conversation_peer.sql");
+	const db = existingDb(prior.map(sql), prior);
+	db.prepare(`INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, push_configs_json)
+		VALUES ('t1', 'ctx-y', 'ada', 'submitted', '0.3', 't', 't', '{}', '[]', '[]')`).run();
+	const pending = JSON.stringify({ contextId: "ctx-y", from: "ada", taskId: "t1", taskIds: ["t1"], kind: "inbound", preview: "hi" });
+	db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('ctx-y', 5, ?, 5)").run(pending);
+	assert.deepEqual(applyMigrations(db), ["0010_conversation_peer.sql"]);
+	const row = db.prepare("SELECT peer, pending_json, last_sent_ms FROM wakes WHERE context_id = 'ctx-y'").get() as { peer: string; pending_json: string; last_sent_ms: number };
+	assert.equal(row.peer, "ada");
+	assert.equal(row.last_sent_ms, 5);
+	assert.equal(JSON.parse(row.pending_json).preview, "hi");
+	db.prepare("INSERT INTO wakes (context_id, peer, last_sent_ms) VALUES ('ctx-y', 'bob', 6)").run();
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM wakes WHERE context_id = 'ctx-y'").get() as { n: number }).n, 2);
+	assert.equal((db.prepare("SELECT pending_json FROM wakes WHERE context_id = 'ctx-y' AND peer = 'ada'").get() as { pending_json: string }).pending_json, pending);
+});
+
+test("0011 keeps one owner per context from the earliest task, then history, then outbound", () => {
+	const prior = [...FILES].sort(byNumber).filter((f) => f !== "0011_conversation_owner.sql");
+	const db = existingDb(prior.map(sql), prior);
+	const task = `INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, push_configs_json)
+		VALUES (?, ?, ?, 'submitted', '0.3', ?, ?, '{}', '[]', '[]')`;
+	db.prepare(task).run("t-bob", "ctx-y", "bob", "2026-02-01T00:00:00.000Z", "2026-02-01T00:00:00.000Z");
+	db.prepare(task).run("t-ada", "ctx-y", "ada", "2026-01-01T00:00:00.000Z", "2026-01-01T00:00:00.000Z");
+	db.prepare("INSERT INTO history (context_id, ts, dir, peer, text) VALUES ('ctx-h', '2026-01-01T00:00:00.000Z', 'local', 'ada', 'note')").run();
+	db.prepare("INSERT INTO outbound (task_id, context_id, peer, sent_at) VALUES ('o1', 'ctx-o', 'alias', '2026-01-01T00:00:00.000Z')").run();
+	assert.deepEqual(applyMigrations(db), ["0011_conversation_owner.sql"]);
+	const owner = (id: string) => (db.prepare("SELECT peer FROM conversation_owners WHERE context_id = ?").get(id) as { peer: string }).peer;
+	assert.equal(owner("ctx-y"), "ada");
+	assert.equal((db.prepare("SELECT COUNT(*) AS n FROM conversation_owners WHERE context_id = 'ctx-y'").get() as { n: number }).n, 1);
+	assert.equal(owner("ctx-h"), "ada");
+	assert.equal(owner("ctx-o"), "alias");
+	assert.throws(() => db.prepare("INSERT INTO conversation_owners (context_id, peer, created_at) VALUES ('ctx-y', 'bob', 'later')").run());
+});

package/worker/test/version-header.test.ts

@@ -0,0 +1,100 @@
+// A2A-Version selects the response shape; the extended card is -32007. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://agent.example.com";
+
+function setup() {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const env: any = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox", PAIRING_APPROVAL: "off" };
+	const call = async (method: string, path: string, o: { json?: any; headers?: Record<string, string> } = {}) => {
+		const headers: Record<string, string> = { "cf-connecting-ip": "198.51.100.7", ...(o.headers || {}) };
+		let body: string | undefined;
+		if (o.json !== undefined) { headers["content-type"] = "application/json"; body = JSON.stringify(o.json); }
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers, body }) as any, env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		await Promise.allSettled(pending);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* text */ }
+		return { status: res.status, data, text };
+	};
+	return { call };
+}
+
+test("A2A-Version selects the response shape; an absent header keeps the method name", async () => {
+	const s = setup();
+	const issued = await s.call("POST", "/owner/peers", { json: { label: "ada" }, headers: { authorization: "Bearer owner-secret" } });
+	assert.equal(issued.status, 200, issued.text);
+	const token = issued.data.token as string;
+	let n = 0;
+	const msg = () => ({ message: { role: "user", messageId: `m${++n}`, parts: [{ kind: "text", text: "hi" }] } });
+	const rpc = (method: string, params: any, headers: Record<string, string> = {}, path = "/") =>
+		s.call("POST", path, { json: { jsonrpc: "2.0", id: 1, method, params }, headers: { authorization: `Bearer ${token}`, ...headers } });
+
+	const v1 = await rpc("message/send", msg(), { "a2a-version": "1.0" });
+	assert.equal(v1.status, 200, v1.text);
+	assert.equal(v1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	assert.equal(v1.data.result.task.kind, undefined);
+	assert.equal(v1.data.result.task.history[0].role, "ROLE_USER");
+	assert.equal(v1.data.result.task.history[0].parts[0].kind, undefined);
+	assert.equal(v1.data.result.task.history[0].parts[0].text, "hi");
+
+	const v03 = await rpc("SendMessage", msg(), { "a2a-version": "0.3" });
+	assert.equal(v03.data.result.kind, "task");
+	assert.equal(v03.data.result.status.state, "submitted");
+	assert.equal(v03.data.result.task, undefined);
+	assert.equal(v03.data.result.history[0].role, "user");
+	assert.equal(v03.data.result.history[0].kind, "message");
+	assert.equal(v03.data.result.history[0].parts[0].kind, "text");
+
+	const bare03 = await rpc("message/send", msg());
+	assert.equal(bare03.data.result.kind, "task");
+	assert.equal(bare03.data.result.status.state, "submitted");
+	const bare1 = await rpc("SendMessage", msg());
+	assert.equal(bare1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const patch1 = await rpc("message/send", msg(), { "a2a-version": "1.0.1" });
+	assert.equal(patch1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	const patch03 = await rpc("SendMessage", msg(), { "A2A-Version": "0.3.0" });
+	assert.equal(patch03.data.result.kind, "task");
+	const short1 = await rpc("message/send", msg(), { "a2a-version": "1" });
+	assert.equal(short1.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const query = await rpc("SendMessage", msg(), {}, "/?A2A-Version=0.3");
+	assert.equal(query.data.result.kind, "task");
+	assert.equal(query.data.result.status.state, "submitted");
+	const headerWins = await rpc("SendMessage", msg(), { "a2a-version": "1.0" }, "/?A2A-Version=0.3");
+	assert.equal(headerWins.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const created = bare1.data.result.task.id as string;
+	const reread = await rpc("GetTask", { id: created }, { "a2a-version": "0.3" });
+	assert.equal(reread.data.result.kind, "task");
+	assert.equal(reread.data.result.status.state, "submitted");
+	assert.equal(reread.data.result.id, created);
+
+	for (const method of ["SendMessage", "no-such-method"]) {
+		const bad = await rpc(method, msg(), { "a2a-version": "2.0" });
+		assert.equal(bad.data.error?.code, -32009, method);
+		assert.match(bad.data.error.message, /2\.0/);
+	}
+	const minor = await rpc("SendMessage", msg(), { "a2a-version": "1.2" });
+	assert.equal(minor.data.error?.code, -32009);
+	const unknown = await rpc("no-such-method", {});
+	assert.equal(unknown.data.error?.code, -32601);
+	const unknownOk = await rpc("no-such-method", {}, { "a2a-version": "1.0" });
+	assert.equal(unknownOk.data.error?.code, -32601);
+
+	for (const method of ["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]) {
+		const missing = await rpc(method, {});
+		assert.equal(missing.status, 200);
+		assert.equal(missing.data.error?.code, -32007, method);
+		assert.equal(missing.data.error?.message, "Extended agent card is not configured");
+		const withHeader = await rpc(method, {}, { "a2a-version": "0.3" });
+		assert.equal(withHeader.data.error?.code, -32007, method);
+	}
+	const extFirst = await rpc("GetExtendedAgentCard", {}, { "a2a-version": "2.0" });
+	assert.equal(extFirst.data.error?.code, -32009);
+});