a2a-exposed 0.8.16 → 0.8.18

package/worker/src/index.ts

@@ -67,6 +67,44 @@ function histStmt(ctx: TenantContext, contextId: string, e: Json) {
 		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null);
 }
 
+/** Claim this peer's conversation. The primary key is (context_id, peer): another peer's row is a
+ *  different conversation and is not read or replaced. The insert does nothing when this peer already holds the id. */
+function claimContextStmt(ctx: TenantContext, contextId: string, peer: string, ts: string) {
+	return ctx.DB.prepare(
+		`INSERT INTO conversation_owners (context_id, peer, created_at) VALUES (?1, ?2, ?3)
+		 ON CONFLICT(context_id, peer) DO NOTHING`,
+	).bind(contextId, peer, ts);
+}
+
+/** A new task is stored only when this peer owns the context. Runs in the same batch as `claimContextStmt`. */
+function saveTaskIfOwnerStmt(ctx: TenantContext, t: Json) {
+	return ctx.DB.prepare(
+		`INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, metadata_json, push_configs_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?2 AND peer = ?3)
+		 ON CONFLICT(id) DO UPDATE SET state=?4, updated_at=?7, status_json=?8, artifacts_json=?9, metadata_json=?10, push_configs_json=?11
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?2 AND peer = ?3)`,
+	).bind(t.id, t.contextId, t._peer, t.status.state, t._protocol, t._createdAt, A.nowIso(), JSON.stringify(t.status),
+		JSON.stringify(t.artifacts || []), t.metadata ? JSON.stringify(t.metadata) : null, JSON.stringify(t._push || []));
+}
+
+function msgIfOwnerStmt(ctx: TenantContext, t: Json, m: Json) {
+	return ctx.DB.prepare(
+		`INSERT INTO messages (message_id, task_id, context_id, role, ts, message_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?3 AND peer = ?7)`,
+	).bind(m.messageId, t.id, t.contextId, m.role, A.nowIso(), JSON.stringify(m), t._peer);
+}
+
+function histIfOwnerStmt(ctx: TenantContext, contextId: string, e: Json, owner: string) {
+	return ctx.DB.prepare(
+		`INSERT INTO history (context_id, ts, dir, peer, task_id, role, state, event, text, data_json)
+		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?1 AND peer = ?11)`,
+	).bind(contextId, e.ts || A.nowIso(), e.dir || "local", e.peer ?? null, e.taskId ?? null, e.role ?? null, e.state ?? null,
+		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null, owner);
+}
+
 // ------------------------------------------------------------------ self-aware fetch (a Worker cannot reliably fetch its own custom domain)
 /**
  * Another tenant on this deployment's domain. A public fetch of that hostname returns 522, so the call
@@ -118,7 +156,7 @@ async function doFetch(ctx: TenantContext, ectx: ExecutionContext, url: string,
 	return fetch(url, { ...init, signal: AbortSignal.timeout(15000) });
 }
 
-// ------------------------------------------------------------------ wake webhook (presets), debounced per context via D1
+// ------------------------------------------------------------------ wake webhook (presets), debounced per peer and context via D1
 const preset = (ctx: TenantContext) => (ctx.WAKE_PRESET || "generic").trim();
 
 function wakeConfig(ctx: TenantContext): WakeConfig {
@@ -207,6 +245,21 @@ const WAKE_RETRIES = 3;
  *  flush it once Retry-After (30 s - 1 h) has passed, on the next request to the Worker or the optional cron. At most
  *  WAKE_RETRIES times per wake; a newer message for the conversation merges in and starts over. Pairing and test wakes
  *  are not retried (a pairing code lasts 60 minutes). */
+function pendingWakePeer(pending: string | null | undefined): string {
+	if (!pending) return "";
+	try {
+		const from = JSON.parse(pending)?.from;
+		return typeof from === "string" ? from : "";
+	} catch { return ""; }
+}
+
+/** The wake row for this peer's conversation. A row stored before peer was part of the key has peer ''. */
+async function loadWake(ctx: TenantContext, contextId: string, peer: string): Promise<Json | null> {
+	const exact: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, peer).first();
+	if (exact || !peer) return exact;
+	return ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ''").bind(contextId).first();
+}
+
 async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload: Json, retryAfter: string | null) {
 	if (payload.kind !== "inbound") return;
 	const attempts = (Number(payload.attempts) || 0) + 1;
@@ -214,16 +267,18 @@ async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload:
 	const secs = Number(retryAfter);
 	const waitMs = Math.min(3600, Math.max(30, Number.isFinite(secs) && secs > 0 ? secs : 60)) * 1000;
 	const now = Date.now(), contextId = payload.contextId;
-	const cur: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	const peer = typeof payload.from === "string" ? payload.from : "";
+	const cur: Json = await loadWake(ctx, contextId, peer);
 	const prev = cur?.pending_json ? JSON.parse(cur.pending_json) : null;
 	const merged = { ...payload, attempts, taskIds: [...new Set([...(prev?.taskIds || []), ...(payload.taskIds || [])])] };
 	// flushWake and nextCronAt wait until last_sent_ms + debounce. Store Retry-After minus that debounce so the
 	// deadline is Retry-After itself, including when the debounce is longer than Retry-After. Do not keep the
 	// previous last_sent_ms: that clock is the send we just made, and keeping it would wait out the debounce.
 	const due = now + waitMs - debounceMs(ctx);
-	await ctx.DB.prepare(`INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)
-		ON CONFLICT(context_id) DO UPDATE SET pending_json = excluded.pending_json, last_sent_ms = excluded.last_sent_ms,
-		pending_since_ms = COALESCE(wakes.pending_since_ms, excluded.pending_since_ms)`).bind(contextId, due, JSON.stringify(merged), now).run();
+	const rowPeer = cur && (cur.peer === peer || cur.peer === "" || cur.peer == null) ? (cur.peer ?? "") : peer;
+	await ctx.DB.prepare(`INSERT INTO wakes (context_id, peer, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT(context_id, peer) DO UPDATE SET pending_json = excluded.pending_json, last_sent_ms = excluded.last_sent_ms,
+		pending_since_ms = COALESCE(wakes.pending_since_ms, excluded.pending_since_ms)`).bind(contextId, rowPeer === "" ? peer : rowPeer, due, JSON.stringify(merged), now).run();
 	log("wake_requeued", { contextId, retryInS: Math.round(waitMs / 1000), attempt: attempts });
 	// The row exists now. A hosted alarm has to be set from this turn: the request that started sendWake may already have returned.
 	await noteWakeWrite(ectx);
@@ -232,33 +287,45 @@ async function requeueWake(ctx: TenantContext, ectx: ExecutionContext, payload:
 async function wake(ctx: TenantContext, ectx: ExecutionContext, contextId: string, taskId: string, from: string, preview: string, kind = "inbound") {
 	const payload: Json = { contextId, taskId, taskIds: [taskId], from, preview: preview.slice(0, 300), kind };
 	const now = Date.now(), deb = debounceMs(ctx);
-	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	let row: Json = await loadWake(ctx, contextId, from);
+	// A pre-peer row (peer '') is this conversation when it names this peer, or names nobody yet.
+	// Another peer's legacy row stays put; this peer gets its own row.
+	if (row && row.peer === "" && from) {
+		const named = pendingWakePeer(row.pending_json);
+		if (!named || named === from) {
+			const moved = await ctx.DB.prepare("UPDATE wakes SET peer = ? WHERE context_id = ? AND peer = ''").bind(from, contextId).run();
+			if (changed(moved) === 1) row = { ...row, peer: from };
+			else row = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, from).first();
+		} else row = null;
+	}
+	const peer = row?.peer ?? from;
 	let claimed = false;
 	if (!row) {
-		const r = await ctx.DB.prepare("INSERT INTO wakes (context_id, last_sent_ms) VALUES (?, ?) ON CONFLICT DO NOTHING").bind(contextId, now).run();
+		const r = await ctx.DB.prepare("INSERT INTO wakes (context_id, peer, last_sent_ms) VALUES (?, ?, ?) ON CONFLICT DO NOTHING").bind(contextId, peer, now).run();
 		claimed = r.meta.changes === 1;
 	} else if (!row.pending_json && now - row.last_sent_ms >= deb) {
-		const r = await ctx.DB.prepare("UPDATE wakes SET last_sent_ms = ? WHERE context_id = ? AND last_sent_ms = ? AND pending_json IS NULL")
-			.bind(now, contextId, row.last_sent_ms).run();
+		const r = await ctx.DB.prepare("UPDATE wakes SET last_sent_ms = ? WHERE context_id = ? AND peer = ? AND last_sent_ms = ? AND pending_json IS NULL")
+			.bind(now, contextId, peer, row.last_sent_ms).run();
 		claimed = r.meta.changes === 1;
 	}
 	if (claimed && (await wakeBudgetOk(ctx))) { ectx.waitUntil(sendWake(ctx, ectx, payload)); return; }
 	// debounce window (or hourly cap reached): merge into the pending wake and flush it later
-	const cur: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+	const cur: Json = await loadWake(ctx, contextId, from);
+	const curPeer = cur?.peer ?? peer;
 	const prev = cur?.pending_json ? JSON.parse(cur.pending_json) : null;
 	payload.taskIds = [...new Set([...(prev?.taskIds || []), taskId])];
-	await ctx.DB.prepare("UPDATE wakes SET pending_json = ?, pending_since_ms = COALESCE(pending_since_ms, ?) WHERE context_id = ?")
-		.bind(JSON.stringify(payload), now, contextId).run();
+	await ctx.DB.prepare("UPDATE wakes SET pending_json = ?, pending_since_ms = COALESCE(pending_since_ms, ?) WHERE context_id = ? AND peer = ?")
+		.bind(JSON.stringify(payload), now, contextId, curPeer).run();
 	// The pending row exists now. A hosted alarm is set in this turn, including when the delay is too long for waitUntil.
 	await noteWakeWrite(ectx);
 	const delay = Math.max(0, (cur?.last_sent_ms || now) + deb - now) + 100;
 	// waitUntil can outlive the response by ~30s. Longer windows are flushed by a later request, the optional
 	// single-inbox cron, or the registered alarm (set above).
-	if (delay <= 25000) ectx.waitUntil(new Promise((res) => setTimeout(res, delay)).then(() => flushWake(ctx, ectx, contextId)));
+	if (delay <= 25000) ectx.waitUntil(new Promise((res) => setTimeout(res, delay)).then(() => flushWake(ctx, ectx, contextId, curPeer)));
 }
 
-async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId: string) {
-	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ?").bind(contextId).first();
+async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId: string, peer: string) {
+	const row: Json = await ctx.DB.prepare("SELECT * FROM wakes WHERE context_id = ? AND peer = ?").bind(contextId, peer).first();
 	if (!row || !row.pending_json) return;
 	const now = Date.now();
 	if (now - row.last_sent_ms < debounceMs(ctx)) return;
@@ -268,16 +335,16 @@ async function flushWake(ctx: TenantContext, ectx: ExecutionContext, contextId:
 		if ((b?.count ?? 0) >= maxPerHour(ctx)) return; // keep pending until the next hour
 	}
 	const r = await ctx.DB.prepare(
-		"UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL, last_sent_ms = ? WHERE context_id = ? AND last_sent_ms = ? AND pending_json IS NOT NULL",
-	).bind(now, contextId, row.last_sent_ms).run();
+		"UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL, last_sent_ms = ? WHERE context_id = ? AND peer = ? AND last_sent_ms = ? AND pending_json IS NOT NULL",
+	).bind(now, contextId, peer, row.last_sent_ms).run();
 	if (r.meta.changes === 1 && (await wakeBudgetOk(ctx))) await sendWake(ctx, ectx, JSON.parse(row.pending_json));
 }
 
 /** Flush every pending wake whose debounce window has passed (called opportunistically and from cron). */
 async function flushDue(ctx: TenantContext, ectx: ExecutionContext) {
-	const rows = await ctx.DB.prepare("SELECT context_id FROM wakes WHERE pending_json IS NOT NULL AND last_sent_ms <= ? LIMIT 20")
+	const rows = await ctx.DB.prepare("SELECT context_id, peer FROM wakes WHERE pending_json IS NOT NULL AND last_sent_ms <= ? LIMIT 20")
 		.bind(Date.now() - debounceMs(ctx)).all();
-	for (const r of rows.results as Json[]) await flushWake(ctx, ectx, r.context_id);
+	for (const r of rows.results as Json[]) await flushWake(ctx, ectx, r.context_id, typeof r.peer === "string" ? r.peer : "");
 }
 
 /**
@@ -563,15 +630,15 @@ function protectedResourceMetadata(ctx: TenantContext): Json {
 const V1: Record<string, string> = {
 	SendMessage: "send", GetTask: "get", CancelTask: "cancel", CreateTaskPushNotificationConfig: "pushset",
 	SetTaskPushNotificationConfig: "pushset", GetTaskPushNotificationConfig: "pushget", ListTasks: "list",
+	ListTaskPushNotificationConfig: "pushlist", ListTaskPushNotificationConfigs: "pushlist",
+	DeleteTaskPushNotificationConfig: "pushdel",
 	SendStreamingMessage: "stream", SubscribeToTask: "stream",
 };
 const V03: Record<string, string> = {
 	"message/send": "send", "tasks/get": "get", "tasks/cancel": "cancel", "tasks/pushNotificationConfig/set": "pushset",
-	"tasks/pushNotificationConfig/get": "pushget", "message/stream": "stream", "tasks/resubscribe": "stream",
+	"tasks/pushNotificationConfig/get": "pushget", "tasks/pushNotificationConfig/list": "pushlist",
+	"tasks/pushNotificationConfig/delete": "pushdel", "message/stream": "stream", "tasks/resubscribe": "stream",
 };
-// Methods only the façade forwards (the inbox has one push config per task and no delete).
-const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
-const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
 const EXTENDED_CARD_METHODS = new Set(["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]);
 
 /** Header, else query `A2A-Version`. A patch (`1.0.1`, `0.3.0`) is ignored. Empty means the method name chooses the
@@ -587,11 +654,9 @@ function declaredA2AVersion(req: Request): { raw: string; version: string | null
 	return { raw, version: null };
 }
 
-function rpcOperation(method: string, proxy: boolean): { op: string; version: string } | null {
+function rpcOperation(method: string): { op: string; version: string } | null {
 	if (V1[method]) return { op: V1[method], version: "1.0" };
 	if (V03[method]) return { op: V03[method], version: "0.3" };
-	if (proxy && PROXY_V1[method]) return { op: PROXY_V1[method], version: "1.0" };
-	if (proxy && PROXY_V03[method]) return { op: PROXY_V03[method], version: "0.3" };
 	return null;
 }
 
@@ -602,6 +667,10 @@ async function ownedTask(ctx: TenantContext, id: unknown, label: string): Promis
 	return t;
 }
 
+/** A contextId this caller does not get to use. The same sentence is returned for an id the façade has no
+ *  record of. It does not say whether the id exists, or which peer holds it. */
+const UNKNOWN_CONTEXT = "Invalid params: unknown contextId (omit contextId to start a new conversation, then use the one returned)";
+
 function normPushCfg(cfg: Json, version: string): Json {
 	if (!cfg || typeof cfg !== "object" || typeof cfg.url !== "string") throw new RpcError(-32602, "push notification config needs url");
 	const out: Json = { id: typeof cfg.id === "string" && cfg.id ? cfg.id.slice(0, 128) : A.newId(), url: cfg.url, _version: version };
@@ -634,6 +703,12 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	}
 	const contextId = task ? task.contextId : msg.contextId ? A.checkId(msg.contextId, "contextId") : A.newId();
 	const ts = A.nowIso();
+	// A2A lets an agent accept a client-supplied contextId and forbids minting a replacement when it will not.
+	// This inbox accepts the id for the caller. A peer that already has it continues that conversation. An id
+	// this agent has never seen, and an id another peer already has, are the same for the caller: a new
+	// conversation of their own. The other peer's tasks, history, and wake are not read or written. The claim
+	// and the first task are one batch, so the task is stored only when this peer's owner row is present.
+	const creating = !task;
 	if (!task) task = { id: A.newId(), contextId, status: { state: "submitted", timestamp: ts }, artifacts: [], history: [], _peer: label, _protocol: version, _createdAt: ts, _push: [] };
 	msg.contextId = contextId; msg.taskId = task.id;
 	task.history.push(msg);
@@ -641,10 +716,21 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	if (pushCfg) task._push = [...task._push.filter((c: Json) => c.id !== pushCfg.id), pushCfg];
 	if (params.metadata && typeof params.metadata === "object") task.metadata = { ...(task.metadata || {}), ...params.metadata };
 	const preview = A.textOf(msg);
-	await ctx.DB.batch([
-		saveTaskStmt(ctx, task), msgStmt(ctx, task, msg),
-		histStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }),
-	]);
+	if (creating) {
+		const stored = await ctx.DB.batch([
+			claimContextStmt(ctx, contextId, label, ts),
+			saveTaskIfOwnerStmt(ctx, task),
+			msgIfOwnerStmt(ctx, task, msg),
+			histIfOwnerStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }, label),
+		]);
+		const wrote = stored[1]?.meta?.changes ?? 0;
+		if (wrote < 1) throw new RpcError(-32602, UNKNOWN_CONTEXT);
+	} else {
+		await ctx.DB.batch([
+			saveTaskStmt(ctx, task), msgStmt(ctx, task, msg),
+			histStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }),
+		]);
+	}
 	log("message_received", { peer: label, contextId, taskId: task.id, chars: preview.length, version });
 	await wake(ctx, ectx, contextId, task.id, label, preview);
 	const pt = A.publicTask(task, version, conf.historyLength);
@@ -680,22 +766,104 @@ const rpcPushGet: Rpc = async (p, label, version, ctx) => {
 	throw new RpcError(-32001, "Push notification config not found");
 };
 
+/** Config id for list/delete. 1.0 sends `{ taskId, id }`. 0.3 sends `{ id: taskId, pushNotificationConfigId }`. */
+function pushConfigId(p: Json): string | undefined {
+	const id = p.pushNotificationConfigId || (p.taskId ? p.id : undefined);
+	return typeof id === "string" && id ? id : undefined;
+}
+
+/** Cursor over this task's configs. The token is an index, not a config id, url, or token. */
+function pushListStart(raw: unknown): number {
+	if (raw === undefined || raw === null || raw === "") return 0;
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(raw)) throw new RpcError(-32602, "Invalid params: pageToken");
+	let text = "";
+	try { text = b64urlDecode(raw); } catch { throw new RpcError(-32602, "Invalid params: pageToken"); }
+	const m = /^cfg\n(\d{1,6})$/.exec(text);
+	if (!m) throw new RpcError(-32602, "Invalid params: pageToken");
+	return Number(m[1]);
+}
+
+const rpcPushList: Rpc = async (p, label, version, ctx) => {
+	const t = await ownedTask(ctx, p.taskId || p.id, label);
+	const all = (t._push || []).map((c: Json) => pubCfg(t.id, c, version));
+	if (!version.startsWith("1")) return all;
+	const size = Math.min(Math.max(Number(p.pageSize) || 50, 1), 100);
+	const start = pushListStart(p.pageToken);
+	const configs = all.slice(start, start + size);
+	const next = start + configs.length;
+	return { configs, nextPageToken: next < all.length ? b64url(`cfg\n${next}`) : "" };
+};
+
+const rpcPushDel: Rpc = async (p, label, version, ctx) => {
+	const t = await ownedTask(ctx, p.taskId || p.id, label);
+	const id = pushConfigId(p);
+	if (!id) throw new RpcError(-32602, "Invalid params: push notification config id");
+	const kept = (t._push || []).filter((c: Json) => c.id !== id);
+	if (kept.length !== (t._push || []).length) {
+		t._push = kept;
+		await saveTaskStmt(ctx, t).run();
+	}
+	// Idempotent: a missing config on this peer's task is the same as a config already removed.
+	return version.startsWith("1") ? {} : null;
+};
+
+/** Keyset cursor for ListTasks, newest update first. Empty means the first page. A bad token is rejected
+ *  without echoing it. The query still filters by the caller, so the cursor cannot select another peer's tasks. */
+function listCursor(raw: unknown): { updatedAt: string; id: string } | null {
+	if (raw === undefined || raw === null || raw === "") return null;
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(raw)) throw new RpcError(-32602, "Invalid params: pageToken");
+	let text = "";
+	try { text = b64urlDecode(raw); } catch { throw new RpcError(-32602, "Invalid params: pageToken"); }
+	const nl = text.indexOf("\n");
+	if (nl <= 0) throw new RpcError(-32602, "Invalid params: pageToken");
+	const updatedAt = text.slice(0, nl);
+	const id = text.slice(nl + 1);
+	if (!INBOX_STAMP.test(updatedAt) || !A.ID_RE.test(id) || id.includes("\n")) throw new RpcError(-32602, "Invalid params: pageToken");
+	return { updatedAt, id };
+}
+
 const rpcList: Rpc = async (p, label, version, ctx) => {
 	const size = Math.min(Math.max(Number(p.pageSize) || 50, 1), 100);
-	const where = p.contextId ? "peer = ? AND context_id = ?" : "peer = ?";
-	const args = p.contextId ? [label, p.contextId] : [label];
-	const total: Json = await ctx.DB.prepare(`SELECT COUNT(*) AS n FROM tasks WHERE ${where}`).bind(...args).first();
-	const rows = await ctx.DB.prepare(`SELECT id FROM tasks WHERE ${where} ORDER BY updated_at DESC LIMIT ?`).bind(...args, size).all();
+	const cursor = listCursor(p.pageToken);
+	const where = ["peer = ?"];
+	const args: Json[] = [label];
+	if (p.contextId !== undefined && p.contextId !== "") {
+		if (typeof p.contextId !== "string" || !A.ID_RE.test(p.contextId)) throw new RpcError(-32602, "Invalid params: invalid contextId");
+		where.push("context_id = ?");
+		args.push(p.contextId);
+	}
+	const whereSql = where.join(" AND ");
+	const total: Json = await ctx.DB.prepare(`SELECT COUNT(*) AS n FROM tasks WHERE ${whereSql}`).bind(...args).first();
+	const pageWhere = [...where];
+	const pageArgs = [...args];
+	if (cursor) {
+		pageWhere.push("(updated_at < ? OR (updated_at = ? AND id < ?))");
+		pageArgs.push(cursor.updatedAt, cursor.updatedAt, cursor.id);
+	}
+	const rows = await ctx.DB.prepare(
+		`SELECT id, updated_at FROM tasks WHERE ${pageWhere.join(" AND ")} ORDER BY updated_at DESC, id DESC LIMIT ?`,
+	).bind(...pageArgs, size + 1).all();
+	const found = (rows.results || []) as Json[];
+	const page = found.slice(0, size);
 	const tasks = [];
-	for (const r of rows.results as Json[]) {
+	for (const r of page) {
 		const t = A.publicTask(await loadTask(ctx, r.id), version, p.historyLength ?? 0);
 		if (!p.includeArtifacts) delete t.artifacts;
 		tasks.push(t);
 	}
-	return { tasks, nextPageToken: "", pageSize: size, totalSize: total?.n ?? tasks.length };
+	let nextPageToken = "";
+	if (found.length > size && page.length) {
+		const updatedAt = String(page[page.length - 1].updated_at);
+		const id = String(page[page.length - 1].id);
+		if (INBOX_STAMP.test(updatedAt) && A.ID_RE.test(id)) nextPageToken = b64url(`${updatedAt}\n${id}`);
+	}
+	return { tasks, nextPageToken, pageSize: size, totalSize: total?.n ?? tasks.length };
 };
 
-const HANDLERS: Record<string, Rpc> = { send: rpcSend, get: rpcGet, cancel: rpcCancel, pushset: rpcPushSet, pushget: rpcPushGet, list: rpcList };
+const HANDLERS: Record<string, Rpc> = {
+	send: rpcSend, get: rpcGet, cancel: rpcCancel, pushset: rpcPushSet, pushget: rpcPushGet,
+	pushlist: rpcPushList, pushdel: rpcPushDel, list: rpcList,
+};
 
 /** 401 for A2A calls. Unless pairing is off, the error says how to get a token (device flow), so a generic agent can follow it.
  *  The JSON-RPC id is echoed when the request body parses (JSON-RPC 2.0); WWW-Authenticate points to RFC 9728 metadata. */
@@ -742,7 +910,7 @@ async function handleRpc(req: Request, ctx: TenantContext, ectx: ExecutionContex
 	const declared = declaredA2AVersion(req);
 	if (declared.raw && !declared.version) return err(-32009, `A2A version ${declared.raw} not supported (supported: 0.3, 1.0)`);
 	if (EXTENDED_CARD_METHODS.has(method)) return err(-32007, "Extended agent card is not configured");
-	const found = rpcOperation(method, proxy);
+	const found = rpcOperation(method);
 	if (!found) return err(-32601, "Method not found");
 	const version = declared.version || found.version;
 	const op = found.op;
@@ -857,7 +1025,7 @@ async function proxyRpc(req: Request, ctx: TenantContext, c: { raw: string; rid:
 			// may still be a live upstream context (another peer's, or one opened outside the façade), and the façade can't
 			// tell, so client-chosen context ids are refused; omit contextId to start a conversation and reuse the returned one.
 			if ((await ownerOf(ctx, "context", m.contextId)) !== c.label)
-				return err(-32602, "Invalid params: unknown contextId (omit contextId to start a new conversation, then use the one returned)");
+				return err(-32602, UNKNOWN_CONTEXT);
 		}
 	} else {
 		const tid = F.taskIdOf(c.op, c.params);
@@ -994,6 +1162,8 @@ async function handlePush(req: Request, ctx: TenantContext, ectx: ExecutionConte
 
 // ------------------------------------------------------------------ owner API (local CLI)
 const INBOX_STAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
+/** Inbound labels and outbound aliases. Used to scope a conversation read to one peer. */
+const PEER_FILTER = /^[A-Za-z0-9_.-]{1,64}$/;
 
 function inboxLimit(raw: string | null): number {
 	if (raw === null) return M.INBOX_MAX;
@@ -1120,22 +1290,25 @@ async function ackPendingWakes(ctx: TenantContext, seen: { taskId: string; conte
 		byContext.set(row.contextId, ids);
 	}
 	for (const [contextId, seenIds] of byContext) {
-		const row: Json = await ctx.DB.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind(contextId).first();
-		if (typeof row?.pending_json !== "string") continue;
-		let payload: Json;
-		try { payload = JSON.parse(row.pending_json); } catch { continue; }
-		const wakeKind = typeof payload?.kind === "string" && payload.kind ? payload.kind : "inbound";
-		if (wakeKind !== kind) continue;
-		if (typeof payload?.contextId === "string" && payload.contextId !== contextId) continue;
-		const ids = wakeTaskIds(payload);
-		if (!ids.some((id) => seenIds.has(id))) continue;
-		const kept = ids.filter((id) => !seenIds.has(id));
-		if (!kept.length) {
-			await ctx.DB.prepare("UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL WHERE context_id = ? AND pending_json = ?").bind(contextId, row.pending_json).run();
-			continue;
+		const rows = await ctx.DB.prepare("SELECT peer, pending_json FROM wakes WHERE context_id = ? AND pending_json IS NOT NULL").bind(contextId).all();
+		for (const row of (rows.results || []) as Json[]) {
+			if (typeof row?.pending_json !== "string") continue;
+			let payload: Json;
+			try { payload = JSON.parse(row.pending_json); } catch { continue; }
+			const wakeKind = typeof payload?.kind === "string" && payload.kind ? payload.kind : "inbound";
+			if (wakeKind !== kind) continue;
+			if (typeof payload?.contextId === "string" && payload.contextId !== contextId) continue;
+			const ids = wakeTaskIds(payload);
+			if (!ids.some((id) => seenIds.has(id))) continue;
+			const kept = ids.filter((id) => !seenIds.has(id));
+			const peer = typeof row.peer === "string" ? row.peer : "";
+			if (!kept.length) {
+				await ctx.DB.prepare("UPDATE wakes SET pending_json = NULL, pending_since_ms = NULL WHERE context_id = ? AND peer = ? AND pending_json = ?").bind(contextId, peer, row.pending_json).run();
+				continue;
+			}
+			const next = { ...payload, taskIds: kept, taskId: kept[kept.length - 1] };
+			await ctx.DB.prepare("UPDATE wakes SET pending_json = ? WHERE context_id = ? AND peer = ? AND pending_json = ?").bind(JSON.stringify(next), contextId, peer, row.pending_json).run();
 		}
-		const next = { ...payload, taskIds: kept, taskId: kept[kept.length - 1] };
-		await ctx.DB.prepare("UPDATE wakes SET pending_json = ? WHERE context_id = ? AND pending_json = ?").bind(JSON.stringify(next), contextId, row.pending_json).run();
 	}
 }
 
@@ -1177,6 +1350,8 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	}
 	if (seg[0] === "inbox" && m === "GET") {
 		const contextFilter = url.searchParams.get("context");
+		const fromFilter = url.searchParams.get("from");
+		if (fromFilter !== null && !PEER_FILTER.test(fromFilter)) throw new HttpError(400, "from is invalid");
 		const all = url.searchParams.get("all") === "1";
 		const limit = inboxLimit(url.searchParams.get("limit"));
 		const cursor = inboxCursor(url.searchParams.get("cursor"));
@@ -1184,6 +1359,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		const args: Json[] = [];
 		if (!all) q += " AND state IN ('submitted','working')";
 		if (contextFilter) { A.checkId(contextFilter, "contextId"); q += " AND context_id = ?"; args.push(contextFilter); }
+		if (fromFilter) { q += " AND peer = ?"; args.push(fromFilter); }
 		if (cursor) { q += " AND (updated_at > ? OR (updated_at = ? AND id > ?))"; args.push(cursor.updatedAt, cursor.updatedAt, cursor.id); }
 		q += " ORDER BY updated_at, id LIMIT ?";
 		args.push(limit + 1);
@@ -1205,6 +1381,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			const oargs: Json[] = [];
 			if (!all) oq += " AND updates_seen = 0";
 			if (contextFilter) { oq += " AND context_id = ?"; oargs.push(contextFilter); }
+			if (fromFilter) { oq += " AND peer = ?"; oargs.push(fromFilter); }
 			oq += " ORDER BY sent_at LIMIT ?";
 			oargs.push(limit);
 			const replies = await ctx.DB.prepare(oq).bind(...oargs).all();
@@ -1272,7 +1449,34 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	}
 	if (seg[0] === "history" && seg[1] && m === "GET") {
 		const n = Math.min(Number(url.searchParams.get("n") || "50"), 1000);
-		const rows = await ctx.DB.prepare("SELECT * FROM (SELECT * FROM history WHERE context_id = ? ORDER BY seq DESC LIMIT ?) ORDER BY seq").bind(seg[1], n).all();
+		const fromFilter = url.searchParams.get("from");
+		if (fromFilter !== null && !PEER_FILTER.test(fromFilter)) return json({ error: "from is invalid" }, 400);
+		// Without `from`, rows for every peer that owns this context id (a task or an outbound task), plus local notes.
+		// With `from`, one peer's rows only, so another peer's conversation is not in this read.
+		const rows = await ctx.DB.prepare(fromFilter ? `SELECT * FROM (
+			SELECT * FROM history WHERE context_id = ? AND (
+				peer = ?
+				OR (
+					(peer IS NULL OR peer = '')
+					AND (
+						task_id IN (SELECT id FROM tasks WHERE context_id = ? AND peer = ?)
+						OR task_id IN (SELECT task_id FROM outbound WHERE context_id = ? AND peer = ?)
+					)
+				)
+			) ORDER BY seq DESC LIMIT ?
+		) ORDER BY seq` : `SELECT * FROM (
+			SELECT * FROM history WHERE context_id = ? AND (
+				peer IS NULL OR peer = ''
+				OR peer IN (SELECT peer FROM tasks WHERE context_id = ? AND peer IS NOT NULL AND peer != '')
+				OR peer IN (SELECT peer FROM outbound WHERE context_id = ? AND peer IS NOT NULL AND peer != '')
+				OR (
+					NOT EXISTS (SELECT 1 FROM tasks WHERE context_id = ?)
+					AND NOT EXISTS (SELECT 1 FROM outbound WHERE context_id = ?)
+				)
+			) ORDER BY seq DESC LIMIT ?
+		) ORDER BY seq`).bind(...(fromFilter
+			? [seg[1], fromFilter, seg[1], fromFilter, seg[1], fromFilter, n]
+			: [seg[1], seg[1], seg[1], seg[1], seg[1], n])).all();
 		return json((rows.results as Json[]).map((r) => ({ ...r, data: r.data_json ? JSON.parse(r.data_json) : undefined, data_json: undefined })));
 	}
 	if (seg[0] === "history" && !seg[1] && m === "POST") {
@@ -1434,6 +1638,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 				ctx.DB.prepare("DELETE FROM history WHERE context_id = ?").bind(c),
 				ctx.DB.prepare("DELETE FROM outbound WHERE context_id = ?").bind(c),
 				ctx.DB.prepare("DELETE FROM wakes WHERE context_id = ?").bind(c),
+				ctx.DB.prepare("DELETE FROM conversation_owners WHERE context_id = ?").bind(c),
 			]);
 			n += res.reduce((s, r) => s + (r.meta.changes || 0), 0);
 		}
@@ -2713,6 +2918,11 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 		case "inbox": {
 			const qs = new URLSearchParams();
 			if (a.contextId !== undefined) qs.set("context", A.checkId(argStr(a, "contextId"), "contextId"));
+			if (a.from !== undefined) {
+				const from = argStr(a, "from");
+				if (!PEER_FILTER.test(from)) throw new ToolError("from is invalid");
+				qs.set("from", from);
+			}
 			if (a.all === true) qs.set("all", "1");
 			if (a.cursor !== undefined) {
 				const cursor = argStr(a, "cursor");
@@ -2740,7 +2950,13 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 		case "history": {
 			const n = a.n === undefined ? 50 : Number(a.n);
 			if (!Number.isInteger(n) || n < 1 || n > 1000) throw new ToolError("n must be 1-1000");
-			return M.toolText(`History, oldest first. ${UNTRUSTED}`, must(await ownerCall(ctx, ectx, "GET", `/owner/history/${enc(A.checkId(argStr(a, "contextId"), "contextId"))}?n=${n}`)));
+			let histPath = `/owner/history/${enc(A.checkId(argStr(a, "contextId"), "contextId"))}?n=${n}`;
+			if (a.from !== undefined) {
+				const from = argStr(a, "from");
+				if (!PEER_FILTER.test(from)) throw new ToolError("from is invalid");
+				histPath += `&from=${enc(from)}`;
+			}
+			return M.toolText(`History, oldest first. ${UNTRUSTED}`, must(await ownerCall(ctx, ectx, "GET", histPath)));
 		}
 		case "mark_working": {
 			const r = must(await ownerCall(ctx, ectx, "POST", `/owner/tasks/${enc(A.checkId(argStr(a, "taskId"), "taskId"))}/working`));

package/worker/src/mcp.ts

@@ -323,6 +323,7 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		description: `Open tasks other agents sent to this A2A endpoint (state submitted or working), oldest first, one page at a time, plus a reply to a message you sent (kind "outbound") until this inbox lists it, plus pending pairing requests. When the result says more tasks are waiting, call inbox again with the cursor before you stop. Handle each inbound task, then answer it with reply. A reply to a message you sent: read it with history, and continue that conversation with send. ${RULES}`,
 		inputSchema: { type: "object", properties: {
 			contextId: str("Only this conversation"),
+			from: str("Only this peer (the wake's from). The same context id can be a different peer's conversation"),
 			all: { type: "boolean", description: "Include finished tasks on this page" },
 			cursor: str("Cursor from the previous inbox page, when more tasks are waiting"),
 			limit: { type: "integer", minimum: 1, maximum: INBOX_MAX, description: `Tasks in this page (default ${INBOX_PAGE}, at most ${INBOX_MAX})` },
@@ -332,7 +333,7 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		inputSchema: { type: "object", properties: { taskId: str("Task id from the A2A endpoint") }, required: ["taskId"], additionalProperties: false } },
 	{ name: "history", title: "Conversation history", annotations: ro,
 		description: `The log of one conversation (both directions), oldest first. ${RULES}`,
-		inputSchema: { type: "object", properties: { contextId: str("Conversation (context) id"), n: { type: "integer", minimum: 1, maximum: 1000, description: "Entries (default 50)" } }, required: ["contextId"], additionalProperties: false } },
+		inputSchema: { type: "object", properties: { contextId: str("Conversation (context) id"), from: str("Only this peer (the wake's from)"), n: { type: "integer", minimum: 1, maximum: 1000, description: "Entries (default 50)" } }, required: ["contextId"], additionalProperties: false } },
 	{ name: "mark_working", title: "Mark task working", annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
 		description: "Tell the peer you are working on a task (state working; the peer is notified if it asked for push updates). Use for anything that takes more than a moment.",
 		inputSchema: { type: "object", properties: { taskId: str("Task id") }, required: ["taskId"], additionalProperties: false } },

package/worker/src/migrations.ts

@@ -9,6 +9,9 @@ import m0006 from "../migrations/0006_mcp.sql?raw";
 import m0007 from "../migrations/0007_cimd.sql?raw";
 import m0008 from "../migrations/0008_oidc_txns.sql?raw";
 import m0009 from "../migrations/0009_outbound_seen.sql?raw";
+import m0010 from "../migrations/0010_conversation_peer.sql?raw";
+import m0011 from "../migrations/0011_conversation_owner.sql?raw";
+import m0012 from "../migrations/0012_conversation_peer_owner.sql?raw";
 import type { Migration } from "./storage.ts";
 
 export const MIGRATIONS: Migration[] = [
@@ -21,4 +24,7 @@ export const MIGRATIONS: Migration[] = [
 	{ name: "0007_cimd.sql", sql: m0007 },
 	{ name: "0008_oidc_txns.sql", sql: m0008 },
 	{ name: "0009_outbound_seen.sql", sql: m0009 },
+	{ name: "0010_conversation_peer.sql", sql: m0010 },
+	{ name: "0011_conversation_owner.sql", sql: m0011 },
+	{ name: "0012_conversation_peer_owner.sql", sql: m0012 },
 ];

package/worker/src/owner-rpc.ts

@@ -105,25 +105,31 @@ function noQuery(q: Record<string, string>): string | null {
 }
 
 function inboxQuery(q: Record<string, string>): string | null {
-	for (const k of Object.keys(q)) if (k !== "context" && k !== "all" && k !== "limit" && k !== "cursor") return null;
+	for (const k of Object.keys(q)) if (k !== "context" && k !== "all" && k !== "limit" && k !== "cursor" && k !== "from") return null;
 	if (q.context !== undefined && !idOk(q.context)) return null;
 	if (q.all !== undefined && q.all !== "1") return null;
 	if (q.limit !== undefined && (!/^[1-9]\d{0,2}$/.test(q.limit) || Number(q.limit) > 200)) return null;
 	if (q.cursor !== undefined && !/^[A-Za-z0-9_-]{1,256}$/.test(q.cursor)) return null;
+	if (q.from !== undefined && !/^[A-Za-z0-9_.-]{1,64}$/.test(q.from)) return null;
 	const sp = new URLSearchParams();
 	if (q.context) sp.set("context", q.context);
 	if (q.all) sp.set("all", "1");
 	if (q.limit) sp.set("limit", q.limit);
 	if (q.cursor) sp.set("cursor", q.cursor);
+	if (q.from) sp.set("from", q.from);
 	const s = sp.toString();
 	return s ? `?${s}` : "";
 }
 
 function historyQuery(q: Record<string, string>): string | null {
-	for (const k of Object.keys(q)) if (k !== "n") return null;
-	if (q.n === undefined) return "";
-	if (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000) return null;
-	return `?n=${q.n}`;
+	for (const k of Object.keys(q)) if (k !== "n" && k !== "from") return null;
+	if (q.n !== undefined && (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000)) return null;
+	if (q.from !== undefined && !/^[A-Za-z0-9_.-]{1,64}$/.test(q.from)) return null;
+	const sp = new URLSearchParams();
+	if (q.n) sp.set("n", q.n);
+	if (q.from) sp.set("from", q.from);
+	const s = sp.toString();
+	return s ? `?${s}` : "";
 }
 
 /** `format=sql` is the only export query. The RPC still calls the JSON handler and redacts before building SQL. */

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.16";
+export const VERSION = "0.8.18";

package/worker/src/wake.ts

@@ -92,9 +92,11 @@ export function pairingInstructions(p: PairingInfo, cli: string): string {
 
 function hintFor(ev: WakeEvent, cli: string): string {
 	if (ev.kind === "pairing_request") return `${cli} pair list`;
+	// `--from` keeps the read on this peer. The same context id can be another peer's separate conversation.
+	const from = /^[A-Za-z0-9_.-]{1,64}$/.test(ev.from) ? ` --from ${ev.from}` : "";
 	return ev.kind === "outbound_update"
-		? `${cli} history ${ev.contextId}`
-		: `${cli} inbox --context ${ev.contextId}`;
+		? `${cli} history ${ev.contextId}${from}`
+		: `${cli} inbox --context ${ev.contextId}${from}`;
 }
 
 /** Human/agent-readable wake text. `withPreview=false` keeps peer-authored text out entirely. */