a2a-exposed 0.8.17 → 0.8.19

package/lib/commands.mjs

@@ -55,6 +55,7 @@ async function inboxRows(o) {
 	return followInbox(async (cursor) => {
 		const qs = [];
 		if (o.context) qs.push("context=" + q(o.context));
+		if (o.from) qs.push("from=" + q(o.from));
 		if (o.all) qs.push("all=1");
 		if (cursor) qs.push("cursor=" + q(cursor));
 		const path = "/owner/inbox" + (qs.length ? "?" + qs.join("&") : "");
@@ -125,7 +126,9 @@ export async function reply(id, o) {
 }
 
 export async function history(ctx, o) {
-	const rows = await owner("GET", `/owner/history/${q(ctx)}?n=${Number(o.n || 50)}`);
+	const qs = new URLSearchParams({ n: String(Number(o.n || 50)) });
+	if (o.from) qs.set("from", o.from);
+	const rows = await owner("GET", `/owner/history/${q(ctx)}?${qs}`);
 	if (o.json) return out(rows);
 	for (const e of rows) {
 		const tag = [e.event, e.state || e.role].filter(Boolean).join("/");

package/lib/deploy.mjs

@@ -25,7 +25,7 @@ export const CLAUDE_CODE_NOTE = [
 	"  Then open the new session from the routine's runs and confirm it ran the inbox command without errors.",
 ].join("\n");
 
-const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "generic"];
+const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "openbot", "generic"];
 // WAKE_ACCESS_*: Cloudflare Access service token for a wake URL behind Access (set by `tunnel create`, or exported
 // by hand for your own Access-protected endpoint)
 export const WAKE_SECRETS = ["WAKE_WEBHOOK_URL", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET"];

package/lib/main.mjs

@@ -92,9 +92,11 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
+                                openbot: human supplies WAKE_HMAC_SECRET via protected env/secret storage, never chat or argv
                                 --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
                                                which defaults to 25 when this is unset
   wake preview                  rendered wake request (a credential is Bearer •••• or ••••, none of the secret)
+                                openbot includes a sample delivery ID and canonical signing-input description
                                 + sha256 fingerprints of the uploaded URL/key/HMAC secret; compared with
                                 local env values when WAKE_WEBHOOK_URL, WAKE_WEBHOOK_KEY, and WAKE_HMAC_SECRET
                                 are exported in this shell. match: the exported value is the one on the Worker.
@@ -116,7 +118,7 @@ anywhere on the account: the A2A endpoint itself can be on workers.dev or a cust
                                 creates nothing when you run it again. A partial tunnel stops and asks for tunnel rm.
                                 The tunnel, the Access app, and the service token are named "a2a-exposed wake <worker>".
                                 The DNS host is wake-<word>-<word>-<4 hex>.<zone> unless --tunnel-hostname is set.
-                                Export WAKE_WEBHOOK_KEY (hermes: WAKE_HMAC_SECRET) so tunnel create uploads it.
+                                Export WAKE_WEBHOOK_KEY (hermes/openbot: WAKE_HMAC_SECRET) so tunnel create uploads it.
                                 The connector machine needs cloudflared installed
                                 (https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/).
                                 Defaults: openclaw-* -> http://127.0.0.1:18789 /hooks/wake|agent, hermes -> :8644
@@ -165,9 +167,11 @@ Status
   config                        print config (secrets masked) and its location
 
 Inbox (owner side)
-  inbox [--context C] [--all] [--json]     unhandled inbound tasks, and a reply to a message you sent until
-                                           this list is read (peer text is UNTRUSTED). A reply line says to
-                                           read it with history and continue with send. Then pending pairing
+  inbox [--context C] [--from PEER] [--all] [--json]
+                                           unhandled inbound tasks, and a reply to a message you sent until
+                                           this list is read (peer text is UNTRUSTED). --from is one peer
+                                           (the wake hint includes it). A reply line says to read it with
+                                           history and continue with send. Then pending pairing
                                            requests (tell your human; the dashboard URL when MANAGE_URL is set;
                                            --json: rows on stdout, requests on stderr). Follows every page; past
                                            10000 pages it errors instead of a short list
@@ -175,7 +179,8 @@ Inbox (owner side)
   working <taskId>                         mark task working
   reply <taskId> (--text T | --stdin) [--state completed|input-required|rejected|failed|working]
         [--artifact] [--artifact-name N] [--force]
-  history <contextId> [-n 50] [--json]     conversation log
+  history <contextId> [--from PEER] [-n 50] [--json]
+                                           conversation log. --from is one peer (the wake hint includes it)
   contexts                                 recent conversations
   export [--sql]                       JSON dump of this A2A endpoint on stdout (peer-token hashes and
                                        encrypted peer tokens are in the dump; the owner token stays
@@ -264,7 +269,7 @@ Feedback
                                 polling), and hosted or self-hosted. --connection overrides
                                 that detection. Remove tokens from the message and from --logs.
 
-Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
+Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | openbot | generic
          Which clients are tested end to end is in the client table:
          https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md#clients
 Config: ${C.CONFIG_FILE}  (override dir with --config-dir DIR or A2A_CONFIG_DIR; env vars override file values)
@@ -312,9 +317,9 @@ const deployOpts = {
 };
 const SPEC = {
 	init: { ...deployOpts, ...tunnelOpts, tunnel: B }, deploy: deployOpts, wake: deployOpts, tunnel: tunnelOpts,
-	inbox: { context: S, all: B, json: B },
+	inbox: { context: S, from: S, all: B, json: B },
 	reply: { text: S, stdin: B, state: { type: "string", default: "completed" }, artifact: B, "artifact-name": { type: "string", default: "response" }, force: B },
-	history: { n: { type: "string", short: "n", default: "50" }, json: B },
+	history: { from: S, n: { type: "string", short: "n", default: "50" }, json: B },
 	token: { rotate: B },
 	peers: { "token-env": S, "token-stdin": B },
 	send: { to: S, text: S, context: S, task: S, push: B, proto: S },

package/lib/status.mjs

@@ -171,8 +171,8 @@ function nextStepCore(s) {
 	if (t && !t.complete) return fail(`a previous \`tunnel create\` did not finish: run \`${CLI} tunnel rm\`, then \`${CLI} tunnel create\``);
 	if (t && !t.tokenFileOk)
 		return fail(`the tunnel's connector token file (${t.tokenFile}) is missing or empty: run \`${CLI} tunnel create\` again (it downloads the token again; nothing new is created)`);
-	const agentSecret = s.wake.preset === "hermes" ? "WAKE_HMAC_SECRET" : "WAKE_WEBHOOK_KEY";
-	const needsAgentSecret = LOCAL_PRESETS.includes(s.wake.preset) && !s.wake.hasKey && !s.wake.hasHmacSecret;
+	const agentSecret = ["hermes", "openbot"].includes(s.wake.preset) ? "WAKE_HMAC_SECRET" : "WAKE_WEBHOOK_KEY";
+	const needsAgentSecret = s.wake.preset === "openbot" ? !s.wake.hasHmacSecret : LOCAL_PRESETS.includes(s.wake.preset) && !s.wake.hasKey && !s.wake.hasHmacSecret;
 	const now = typeof s.now === "number" ? s.now : Date.now();
 	if (t && !(s.wake.hasAccessServiceToken && t.workerUrlMatches)) {
 		if (secretsPropagating(t, now) && (t.connections === 0 || t.connections == null))
@@ -184,7 +184,7 @@ function nextStepCore(s) {
 	if (t && t.connections === 0)
 		return fail(`the tunnel has ${t.state === "inactive" ? "never connected" : "no running connector"}: on the agent's machine run \`cloudflared tunnel run --token-file ${t.tokenFile}\` (outbound port 7844 must be open), then \`${CLI} wake test\``);
 	if (s.wake.configured && needsAgentSecret)
-		return fail(`the Worker sends no webhook auth, so the ${s.wake.preset} webhook will reject wakes: export ${agentSecret} (${s.wake.preset === "hermes" ? "the route secret" : "the hooks token"}), then run \`${CLI} ${t ? "tunnel create" : "wake set"}\``);
+		return fail(`the Worker sends no webhook auth, so the ${s.wake.preset} webhook will reject wakes: export ${agentSecret} (${["hermes", "openbot"].includes(s.wake.preset) ? "the route secret" : "the hooks token"}), then run \`${CLI} ${t ? "tunnel create" : "wake set"}\``);
 	// not broken, but peers can't pair until the human sets the approval password
 	const also = [];
 	if (s.pairing && s.pairing.mode === "human" && !s.pairing.passwordSet)
@@ -195,7 +195,7 @@ function nextStepCore(s) {
 	if (!s.wake.configured) {
 		const poll = "the agent must check the A2A endpoint on a schedule (Hermes and OpenClaw have copy-paste commands in the setup references)";
 		if (s.wake.preset && !LOCAL_PRESETS.includes(s.wake.preset) && s.wake.preset !== "generic")
-			return done2(`no wake webhook: export WAKE_WEBHOOK_URL and WAKE_WEBHOOK_KEY, then run \`${CLI} wake set --preset ${s.wake.preset}\`; or ${poll}`);
+			return done2(`no wake webhook: export WAKE_WEBHOOK_URL and ${agentSecret}, then run \`${CLI} wake set --preset ${s.wake.preset}\`; or ${poll}`);
 		const z = s.zones;
 		const tunnel = !z ? `a local-only webhook can use \`${CLI} tunnel create\` (needs a zone on the account)`
 			: !z.length ? "the account has no domain (zone), so the secure tunnel is not available"

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.17",
+	"version": "0.8.19",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -28,7 +28,7 @@ const plain: Record<string, string> = {
 	PROVIDER_ORGANIZATION: v("A2A_PROVIDER_ORGANIZATION"),
 	PROVIDER_URL: v("A2A_PROVIDER_URL"),
 	DOCUMENTATION_URL: v("A2A_DOCUMENTATION_URL"),
-	WAKE_PRESET: v("WAKE_PRESET") || "generic", // grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
+	WAKE_PRESET: v("WAKE_PRESET") || "generic", // grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | openbot | generic
 	WAKE_AGENT_ID: v("WAKE_AGENT_ID"), // openclaw presets (default "main")
 	WAKE_KEY_HEADER: v("WAKE_KEY_HEADER"), // generic preset (default "authorization")
 	WAKE_KEY_PREFIX: e.WAKE_KEY_PREFIX ?? "", // generic preset; unset = "Bearer "

package/worker/migrations/0012_conversation_peer_owner.sql

@@ -0,0 +1,13 @@
+-- One row per peer. The same context id can be a separate conversation for each peer.
+-- 0011's single-column primary key made a second peer's insert fail, which is how a caller
+-- could tell a fresh id from one another peer already held.
+CREATE TABLE conversation_owners_peer (
+  context_id TEXT NOT NULL,
+  peer TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (context_id, peer)
+);
+INSERT INTO conversation_owners_peer (context_id, peer, created_at)
+SELECT context_id, peer, created_at FROM conversation_owners;
+DROP TABLE conversation_owners;
+ALTER TABLE conversation_owners_peer RENAME TO conversation_owners;

package/worker/scripts/stamp-version.mjs

@@ -1,4 +1,4 @@
-// Write worker/src/version.ts from cli/package.json. Publish runs `npm version` in cli/
+// Write worker/src/version.ts from cli/package.json. Release preparation runs `npm run version:set`
 // before the Worker tests and build, and prepack bundles this tree into the npm package.
 import fs from "node:fs";
 import path from "node:path";

package/worker/src/index.ts

@@ -67,17 +67,12 @@ function histStmt(ctx: TenantContext, contextId: string, e: Json) {
 		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null);
 }
 
-/** Claim an unused context for this peer. `conversation_owners.context_id` is unique, and the insert does nothing
- *  when another peer already holds it or already has a task, history row, or outbound task on that id. */
+/** Claim this peer's conversation. The primary key is (context_id, peer): another peer's row is a
+ *  different conversation and is not read or replaced. The insert does nothing when this peer already holds the id. */
 function claimContextStmt(ctx: TenantContext, contextId: string, peer: string, ts: string) {
 	return ctx.DB.prepare(
-		`INSERT INTO conversation_owners (context_id, peer, created_at)
-		 SELECT ?1, ?2, ?3
-		 WHERE NOT EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?1 AND peer != ?2)
-		   AND NOT EXISTS (SELECT 1 FROM tasks WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
-		   AND NOT EXISTS (SELECT 1 FROM history WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
-		   AND NOT EXISTS (SELECT 1 FROM outbound WHERE context_id = ?1 AND peer IS NOT NULL AND peer != '' AND peer != ?2)
-		 ON CONFLICT(context_id) DO NOTHING`,
+		`INSERT INTO conversation_owners (context_id, peer, created_at) VALUES (?1, ?2, ?3)
+		 ON CONFLICT(context_id, peer) DO NOTHING`,
 	).bind(contextId, peer, ts);
 }
 
@@ -86,9 +81,9 @@ function saveTaskIfOwnerStmt(ctx: TenantContext, t: Json) {
 	return ctx.DB.prepare(
 		`INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, metadata_json, push_configs_json)
 		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11
-		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?2) = ?3
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?2 AND peer = ?3)
 		 ON CONFLICT(id) DO UPDATE SET state=?4, updated_at=?7, status_json=?8, artifacts_json=?9, metadata_json=?10, push_configs_json=?11
-		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?2) = ?3`,
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?2 AND peer = ?3)`,
 	).bind(t.id, t.contextId, t._peer, t.status.state, t._protocol, t._createdAt, A.nowIso(), JSON.stringify(t.status),
 		JSON.stringify(t.artifacts || []), t.metadata ? JSON.stringify(t.metadata) : null, JSON.stringify(t._push || []));
 }
@@ -97,7 +92,7 @@ function msgIfOwnerStmt(ctx: TenantContext, t: Json, m: Json) {
 	return ctx.DB.prepare(
 		`INSERT INTO messages (message_id, task_id, context_id, role, ts, message_json)
 		 SELECT ?1, ?2, ?3, ?4, ?5, ?6
-		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?3) = ?7`,
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?3 AND peer = ?7)`,
 	).bind(m.messageId, t.id, t.contextId, m.role, A.nowIso(), JSON.stringify(m), t._peer);
 }
 
@@ -105,7 +100,7 @@ function histIfOwnerStmt(ctx: TenantContext, contextId: string, e: Json, owner:
 	return ctx.DB.prepare(
 		`INSERT INTO history (context_id, ts, dir, peer, task_id, role, state, event, text, data_json)
 		 SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10
-		 WHERE (SELECT peer FROM conversation_owners WHERE context_id = ?1) = ?11`,
+		 WHERE EXISTS (SELECT 1 FROM conversation_owners WHERE context_id = ?1 AND peer = ?11)`,
 	).bind(contextId, e.ts || A.nowIso(), e.dir || "local", e.peer ?? null, e.taskId ?? null, e.role ?? null, e.state ?? null,
 		e.event ?? null, e.text ?? null, e.data !== undefined ? JSON.stringify(e.data) : null, owner);
 }
@@ -635,15 +630,15 @@ function protectedResourceMetadata(ctx: TenantContext): Json {
 const V1: Record<string, string> = {
 	SendMessage: "send", GetTask: "get", CancelTask: "cancel", CreateTaskPushNotificationConfig: "pushset",
 	SetTaskPushNotificationConfig: "pushset", GetTaskPushNotificationConfig: "pushget", ListTasks: "list",
+	ListTaskPushNotificationConfig: "pushlist", ListTaskPushNotificationConfigs: "pushlist",
+	DeleteTaskPushNotificationConfig: "pushdel",
 	SendStreamingMessage: "stream", SubscribeToTask: "stream",
 };
 const V03: Record<string, string> = {
 	"message/send": "send", "tasks/get": "get", "tasks/cancel": "cancel", "tasks/pushNotificationConfig/set": "pushset",
-	"tasks/pushNotificationConfig/get": "pushget", "message/stream": "stream", "tasks/resubscribe": "stream",
+	"tasks/pushNotificationConfig/get": "pushget", "tasks/pushNotificationConfig/list": "pushlist",
+	"tasks/pushNotificationConfig/delete": "pushdel", "message/stream": "stream", "tasks/resubscribe": "stream",
 };
-// Methods only the façade forwards (the inbox has one push config per task and no delete).
-const PROXY_V1: Record<string, string> = { ListTaskPushNotificationConfig: "pushlist", DeleteTaskPushNotificationConfig: "pushdel" };
-const PROXY_V03: Record<string, string> = { "tasks/pushNotificationConfig/list": "pushlist", "tasks/pushNotificationConfig/delete": "pushdel" };
 const EXTENDED_CARD_METHODS = new Set(["GetExtendedAgentCard", "agent/getAuthenticatedExtendedCard"]);
 
 /** Header, else query `A2A-Version`. A patch (`1.0.1`, `0.3.0`) is ignored. Empty means the method name chooses the
@@ -659,11 +654,9 @@ function declaredA2AVersion(req: Request): { raw: string; version: string | null
 	return { raw, version: null };
 }
 
-function rpcOperation(method: string, proxy: boolean): { op: string; version: string } | null {
+function rpcOperation(method: string): { op: string; version: string } | null {
 	if (V1[method]) return { op: V1[method], version: "1.0" };
 	if (V03[method]) return { op: V03[method], version: "0.3" };
-	if (proxy && PROXY_V1[method]) return { op: PROXY_V1[method], version: "1.0" };
-	if (proxy && PROXY_V03[method]) return { op: PROXY_V03[method], version: "0.3" };
 	return null;
 }
 
@@ -710,10 +703,11 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	}
 	const contextId = task ? task.contextId : msg.contextId ? A.checkId(msg.contextId, "contextId") : A.newId();
 	const ts = A.nowIso();
-	// A client-provided id nobody owns is still this peer's new conversation (single-peer and outbound send
-	// keep passing one). An id another peer already has is not. A2A forbids minting a replacement id when the
-	// client id is refused, so this is the same error the façade returns for an unknown context, not a new id.
-	// The claim and the first task are one batch: a second peer cannot pass a read and then write its own task.
+	// A2A lets an agent accept a client-supplied contextId and forbids minting a replacement when it will not.
+	// This inbox accepts the id for the caller. A peer that already has it continues that conversation. An id
+	// this agent has never seen, and an id another peer already has, are the same for the caller: a new
+	// conversation of their own. The other peer's tasks, history, and wake are not read or written. The claim
+	// and the first task are one batch, so the task is stored only when this peer's owner row is present.
 	const creating = !task;
 	if (!task) task = { id: A.newId(), contextId, status: { state: "submitted", timestamp: ts }, artifacts: [], history: [], _peer: label, _protocol: version, _createdAt: ts, _push: [] };
 	msg.contextId = contextId; msg.taskId = task.id;
@@ -728,11 +722,9 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 			saveTaskIfOwnerStmt(ctx, task),
 			msgIfOwnerStmt(ctx, task, msg),
 			histIfOwnerStmt(ctx, contextId, { dir: "in", peer: label, taskId: task.id, role: "user", text: preview, data: { messageId: msg.messageId } }, label),
-			ctx.DB.prepare("SELECT peer FROM conversation_owners WHERE context_id = ?").bind(contextId),
 		]);
-		const owner = (stored[4]?.results?.[0] as Json | undefined)?.peer;
 		const wrote = stored[1]?.meta?.changes ?? 0;
-		if (owner !== label || wrote < 1) throw new RpcError(-32602, UNKNOWN_CONTEXT);
+		if (wrote < 1) throw new RpcError(-32602, UNKNOWN_CONTEXT);
 	} else {
 		await ctx.DB.batch([
 			saveTaskStmt(ctx, task), msgStmt(ctx, task, msg),
@@ -774,22 +766,104 @@ const rpcPushGet: Rpc = async (p, label, version, ctx) => {
 	throw new RpcError(-32001, "Push notification config not found");
 };
 
+/** Config id for list/delete. 1.0 sends `{ taskId, id }`. 0.3 sends `{ id: taskId, pushNotificationConfigId }`. */
+function pushConfigId(p: Json): string | undefined {
+	const id = p.pushNotificationConfigId || (p.taskId ? p.id : undefined);
+	return typeof id === "string" && id ? id : undefined;
+}
+
+/** Cursor over this task's configs. The token is an index, not a config id, url, or token. */
+function pushListStart(raw: unknown): number {
+	if (raw === undefined || raw === null || raw === "") return 0;
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(raw)) throw new RpcError(-32602, "Invalid params: pageToken");
+	let text = "";
+	try { text = b64urlDecode(raw); } catch { throw new RpcError(-32602, "Invalid params: pageToken"); }
+	const m = /^cfg\n(\d{1,6})$/.exec(text);
+	if (!m) throw new RpcError(-32602, "Invalid params: pageToken");
+	return Number(m[1]);
+}
+
+const rpcPushList: Rpc = async (p, label, version, ctx) => {
+	const t = await ownedTask(ctx, p.taskId || p.id, label);
+	const all = (t._push || []).map((c: Json) => pubCfg(t.id, c, version));
+	if (!version.startsWith("1")) return all;
+	const size = Math.min(Math.max(Number(p.pageSize) || 50, 1), 100);
+	const start = pushListStart(p.pageToken);
+	const configs = all.slice(start, start + size);
+	const next = start + configs.length;
+	return { configs, nextPageToken: next < all.length ? b64url(`cfg\n${next}`) : "" };
+};
+
+const rpcPushDel: Rpc = async (p, label, version, ctx) => {
+	const t = await ownedTask(ctx, p.taskId || p.id, label);
+	const id = pushConfigId(p);
+	if (!id) throw new RpcError(-32602, "Invalid params: push notification config id");
+	const kept = (t._push || []).filter((c: Json) => c.id !== id);
+	if (kept.length !== (t._push || []).length) {
+		t._push = kept;
+		await saveTaskStmt(ctx, t).run();
+	}
+	// Idempotent: a missing config on this peer's task is the same as a config already removed.
+	return version.startsWith("1") ? {} : null;
+};
+
+/** Keyset cursor for ListTasks, newest update first. Empty means the first page. A bad token is rejected
+ *  without echoing it. The query still filters by the caller, so the cursor cannot select another peer's tasks. */
+function listCursor(raw: unknown): { updatedAt: string; id: string } | null {
+	if (raw === undefined || raw === null || raw === "") return null;
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(raw)) throw new RpcError(-32602, "Invalid params: pageToken");
+	let text = "";
+	try { text = b64urlDecode(raw); } catch { throw new RpcError(-32602, "Invalid params: pageToken"); }
+	const nl = text.indexOf("\n");
+	if (nl <= 0) throw new RpcError(-32602, "Invalid params: pageToken");
+	const updatedAt = text.slice(0, nl);
+	const id = text.slice(nl + 1);
+	if (!INBOX_STAMP.test(updatedAt) || !A.ID_RE.test(id) || id.includes("\n")) throw new RpcError(-32602, "Invalid params: pageToken");
+	return { updatedAt, id };
+}
+
 const rpcList: Rpc = async (p, label, version, ctx) => {
 	const size = Math.min(Math.max(Number(p.pageSize) || 50, 1), 100);
-	const where = p.contextId ? "peer = ? AND context_id = ?" : "peer = ?";
-	const args = p.contextId ? [label, p.contextId] : [label];
-	const total: Json = await ctx.DB.prepare(`SELECT COUNT(*) AS n FROM tasks WHERE ${where}`).bind(...args).first();
-	const rows = await ctx.DB.prepare(`SELECT id FROM tasks WHERE ${where} ORDER BY updated_at DESC LIMIT ?`).bind(...args, size).all();
+	const cursor = listCursor(p.pageToken);
+	const where = ["peer = ?"];
+	const args: Json[] = [label];
+	if (p.contextId !== undefined && p.contextId !== "") {
+		if (typeof p.contextId !== "string" || !A.ID_RE.test(p.contextId)) throw new RpcError(-32602, "Invalid params: invalid contextId");
+		where.push("context_id = ?");
+		args.push(p.contextId);
+	}
+	const whereSql = where.join(" AND ");
+	const total: Json = await ctx.DB.prepare(`SELECT COUNT(*) AS n FROM tasks WHERE ${whereSql}`).bind(...args).first();
+	const pageWhere = [...where];
+	const pageArgs = [...args];
+	if (cursor) {
+		pageWhere.push("(updated_at < ? OR (updated_at = ? AND id < ?))");
+		pageArgs.push(cursor.updatedAt, cursor.updatedAt, cursor.id);
+	}
+	const rows = await ctx.DB.prepare(
+		`SELECT id, updated_at FROM tasks WHERE ${pageWhere.join(" AND ")} ORDER BY updated_at DESC, id DESC LIMIT ?`,
+	).bind(...pageArgs, size + 1).all();
+	const found = (rows.results || []) as Json[];
+	const page = found.slice(0, size);
 	const tasks = [];
-	for (const r of rows.results as Json[]) {
+	for (const r of page) {
 		const t = A.publicTask(await loadTask(ctx, r.id), version, p.historyLength ?? 0);
 		if (!p.includeArtifacts) delete t.artifacts;
 		tasks.push(t);
 	}
-	return { tasks, nextPageToken: "", pageSize: size, totalSize: total?.n ?? tasks.length };
+	let nextPageToken = "";
+	if (found.length > size && page.length) {
+		const updatedAt = String(page[page.length - 1].updated_at);
+		const id = String(page[page.length - 1].id);
+		if (INBOX_STAMP.test(updatedAt) && A.ID_RE.test(id)) nextPageToken = b64url(`${updatedAt}\n${id}`);
+	}
+	return { tasks, nextPageToken, pageSize: size, totalSize: total?.n ?? tasks.length };
 };
 
-const HANDLERS: Record<string, Rpc> = { send: rpcSend, get: rpcGet, cancel: rpcCancel, pushset: rpcPushSet, pushget: rpcPushGet, list: rpcList };
+const HANDLERS: Record<string, Rpc> = {
+	send: rpcSend, get: rpcGet, cancel: rpcCancel, pushset: rpcPushSet, pushget: rpcPushGet,
+	pushlist: rpcPushList, pushdel: rpcPushDel, list: rpcList,
+};
 
 /** 401 for A2A calls. Unless pairing is off, the error says how to get a token (device flow), so a generic agent can follow it.
  *  The JSON-RPC id is echoed when the request body parses (JSON-RPC 2.0); WWW-Authenticate points to RFC 9728 metadata. */
@@ -836,7 +910,7 @@ async function handleRpc(req: Request, ctx: TenantContext, ectx: ExecutionContex
 	const declared = declaredA2AVersion(req);
 	if (declared.raw && !declared.version) return err(-32009, `A2A version ${declared.raw} not supported (supported: 0.3, 1.0)`);
 	if (EXTENDED_CARD_METHODS.has(method)) return err(-32007, "Extended agent card is not configured");
-	const found = rpcOperation(method, proxy);
+	const found = rpcOperation(method);
 	if (!found) return err(-32601, "Method not found");
 	const version = declared.version || found.version;
 	const op = found.op;
@@ -1088,6 +1162,8 @@ async function handlePush(req: Request, ctx: TenantContext, ectx: ExecutionConte
 
 // ------------------------------------------------------------------ owner API (local CLI)
 const INBOX_STAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
+/** Inbound labels and outbound aliases. Used to scope a conversation read to one peer. */
+const PEER_FILTER = /^[A-Za-z0-9_.-]{1,64}$/;
 
 function inboxLimit(raw: string | null): number {
 	if (raw === null) return M.INBOX_MAX;
@@ -1274,6 +1350,8 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	}
 	if (seg[0] === "inbox" && m === "GET") {
 		const contextFilter = url.searchParams.get("context");
+		const fromFilter = url.searchParams.get("from");
+		if (fromFilter !== null && !PEER_FILTER.test(fromFilter)) throw new HttpError(400, "from is invalid");
 		const all = url.searchParams.get("all") === "1";
 		const limit = inboxLimit(url.searchParams.get("limit"));
 		const cursor = inboxCursor(url.searchParams.get("cursor"));
@@ -1281,6 +1359,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		const args: Json[] = [];
 		if (!all) q += " AND state IN ('submitted','working')";
 		if (contextFilter) { A.checkId(contextFilter, "contextId"); q += " AND context_id = ?"; args.push(contextFilter); }
+		if (fromFilter) { q += " AND peer = ?"; args.push(fromFilter); }
 		if (cursor) { q += " AND (updated_at > ? OR (updated_at = ? AND id > ?))"; args.push(cursor.updatedAt, cursor.updatedAt, cursor.id); }
 		q += " ORDER BY updated_at, id LIMIT ?";
 		args.push(limit + 1);
@@ -1302,6 +1381,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			const oargs: Json[] = [];
 			if (!all) oq += " AND updates_seen = 0";
 			if (contextFilter) { oq += " AND context_id = ?"; oargs.push(contextFilter); }
+			if (fromFilter) { oq += " AND peer = ?"; oargs.push(fromFilter); }
 			oq += " ORDER BY sent_at LIMIT ?";
 			oargs.push(limit);
 			const replies = await ctx.DB.prepare(oq).bind(...oargs).all();
@@ -1369,9 +1449,22 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	}
 	if (seg[0] === "history" && seg[1] && m === "GET") {
 		const n = Math.min(Number(url.searchParams.get("n") || "50"), 1000);
-		// Rows for this conversation: this context, and a peer that owns it (a task or an outbound task).
-		// A null peer is a local note. When nothing owns the id yet, the rows that name it are the conversation.
-		const rows = await ctx.DB.prepare(`SELECT * FROM (
+		const fromFilter = url.searchParams.get("from");
+		if (fromFilter !== null && !PEER_FILTER.test(fromFilter)) return json({ error: "from is invalid" }, 400);
+		// Without `from`, rows for every peer that owns this context id (a task or an outbound task), plus local notes.
+		// With `from`, one peer's rows only, so another peer's conversation is not in this read.
+		const rows = await ctx.DB.prepare(fromFilter ? `SELECT * FROM (
+			SELECT * FROM history WHERE context_id = ? AND (
+				peer = ?
+				OR (
+					(peer IS NULL OR peer = '')
+					AND (
+						task_id IN (SELECT id FROM tasks WHERE context_id = ? AND peer = ?)
+						OR task_id IN (SELECT task_id FROM outbound WHERE context_id = ? AND peer = ?)
+					)
+				)
+			) ORDER BY seq DESC LIMIT ?
+		) ORDER BY seq` : `SELECT * FROM (
 			SELECT * FROM history WHERE context_id = ? AND (
 				peer IS NULL OR peer = ''
 				OR peer IN (SELECT peer FROM tasks WHERE context_id = ? AND peer IS NOT NULL AND peer != '')
@@ -1381,7 +1474,9 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 					AND NOT EXISTS (SELECT 1 FROM outbound WHERE context_id = ?)
 				)
 			) ORDER BY seq DESC LIMIT ?
-		) ORDER BY seq`).bind(seg[1], seg[1], seg[1], seg[1], seg[1], n).all();
+		) ORDER BY seq`).bind(...(fromFilter
+			? [seg[1], fromFilter, seg[1], fromFilter, seg[1], fromFilter, n]
+			: [seg[1], seg[1], seg[1], seg[1], seg[1], n])).all();
 		return json((rows.results as Json[]).map((r) => ({ ...r, data: r.data_json ? JSON.parse(r.data_json) : undefined, data_json: undefined })));
 	}
 	if (seg[0] === "history" && !seg[1] && m === "POST") {
@@ -1524,6 +1619,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			fingerprints: { url: await A.fingerprint(ctx.WAKE_WEBHOOK_URL), key: await A.fingerprint(ctx.WAKE_WEBHOOK_KEY),
 				hmacSecret: await A.fingerprint(ctx.WAKE_HMAC_SECRET),
 				accessClientId: await A.fingerprint(ctx.WAKE_ACCESS_CLIENT_ID), accessClientSecret: await A.fingerprint(ctx.WAKE_ACCESS_CLIENT_SECRET) },
+			...(preset(ctx) === "openbot" ? { signingInput: "<timestamp>.<delivery-id>.<exact-body-bytes>" } : {}),
 			request: req ? redact(req) : null });
 	}
 	if (seg[0] === "wake" && seg[1] === "test" && m === "POST") {
@@ -2823,6 +2919,11 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 		case "inbox": {
 			const qs = new URLSearchParams();
 			if (a.contextId !== undefined) qs.set("context", A.checkId(argStr(a, "contextId"), "contextId"));
+			if (a.from !== undefined) {
+				const from = argStr(a, "from");
+				if (!PEER_FILTER.test(from)) throw new ToolError("from is invalid");
+				qs.set("from", from);
+			}
 			if (a.all === true) qs.set("all", "1");
 			if (a.cursor !== undefined) {
 				const cursor = argStr(a, "cursor");
@@ -2850,7 +2951,13 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 		case "history": {
 			const n = a.n === undefined ? 50 : Number(a.n);
 			if (!Number.isInteger(n) || n < 1 || n > 1000) throw new ToolError("n must be 1-1000");
-			return M.toolText(`History, oldest first. ${UNTRUSTED}`, must(await ownerCall(ctx, ectx, "GET", `/owner/history/${enc(A.checkId(argStr(a, "contextId"), "contextId"))}?n=${n}`)));
+			let histPath = `/owner/history/${enc(A.checkId(argStr(a, "contextId"), "contextId"))}?n=${n}`;
+			if (a.from !== undefined) {
+				const from = argStr(a, "from");
+				if (!PEER_FILTER.test(from)) throw new ToolError("from is invalid");
+				histPath += `&from=${enc(from)}`;
+			}
+			return M.toolText(`History, oldest first. ${UNTRUSTED}`, must(await ownerCall(ctx, ectx, "GET", histPath)));
 		}
 		case "mark_working": {
 			const r = must(await ownerCall(ctx, ectx, "POST", `/owner/tasks/${enc(A.checkId(argStr(a, "taskId"), "taskId"))}/working`));

package/worker/src/mcp.ts

@@ -323,6 +323,7 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		description: `Open tasks other agents sent to this A2A endpoint (state submitted or working), oldest first, one page at a time, plus a reply to a message you sent (kind "outbound") until this inbox lists it, plus pending pairing requests. When the result says more tasks are waiting, call inbox again with the cursor before you stop. Handle each inbound task, then answer it with reply. A reply to a message you sent: read it with history, and continue that conversation with send. ${RULES}`,
 		inputSchema: { type: "object", properties: {
 			contextId: str("Only this conversation"),
+			from: str("Only this peer (the wake's from). The same context id can be a different peer's conversation"),
 			all: { type: "boolean", description: "Include finished tasks on this page" },
 			cursor: str("Cursor from the previous inbox page, when more tasks are waiting"),
 			limit: { type: "integer", minimum: 1, maximum: INBOX_MAX, description: `Tasks in this page (default ${INBOX_PAGE}, at most ${INBOX_MAX})` },
@@ -332,7 +333,7 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		inputSchema: { type: "object", properties: { taskId: str("Task id from the A2A endpoint") }, required: ["taskId"], additionalProperties: false } },
 	{ name: "history", title: "Conversation history", annotations: ro,
 		description: `The log of one conversation (both directions), oldest first. ${RULES}`,
-		inputSchema: { type: "object", properties: { contextId: str("Conversation (context) id"), n: { type: "integer", minimum: 1, maximum: 1000, description: "Entries (default 50)" } }, required: ["contextId"], additionalProperties: false } },
+		inputSchema: { type: "object", properties: { contextId: str("Conversation (context) id"), from: str("Only this peer (the wake's from)"), n: { type: "integer", minimum: 1, maximum: 1000, description: "Entries (default 50)" } }, required: ["contextId"], additionalProperties: false } },
 	{ name: "mark_working", title: "Mark task working", annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
 		description: "Tell the peer you are working on a task (state working; the peer is notified if it asked for push updates). Use for anything that takes more than a moment.",
 		inputSchema: { type: "object", properties: { taskId: str("Task id") }, required: ["taskId"], additionalProperties: false } },

package/worker/src/migrations.ts

@@ -11,6 +11,7 @@ import m0008 from "../migrations/0008_oidc_txns.sql?raw";
 import m0009 from "../migrations/0009_outbound_seen.sql?raw";
 import m0010 from "../migrations/0010_conversation_peer.sql?raw";
 import m0011 from "../migrations/0011_conversation_owner.sql?raw";
+import m0012 from "../migrations/0012_conversation_peer_owner.sql?raw";
 import type { Migration } from "./storage.ts";
 
 export const MIGRATIONS: Migration[] = [
@@ -25,4 +26,5 @@ export const MIGRATIONS: Migration[] = [
 	{ name: "0009_outbound_seen.sql", sql: m0009 },
 	{ name: "0010_conversation_peer.sql", sql: m0010 },
 	{ name: "0011_conversation_owner.sql", sql: m0011 },
+	{ name: "0012_conversation_peer_owner.sql", sql: m0012 },
 ];

package/worker/src/owner-rpc.ts

@@ -105,25 +105,31 @@ function noQuery(q: Record<string, string>): string | null {
 }
 
 function inboxQuery(q: Record<string, string>): string | null {
-	for (const k of Object.keys(q)) if (k !== "context" && k !== "all" && k !== "limit" && k !== "cursor") return null;
+	for (const k of Object.keys(q)) if (k !== "context" && k !== "all" && k !== "limit" && k !== "cursor" && k !== "from") return null;
 	if (q.context !== undefined && !idOk(q.context)) return null;
 	if (q.all !== undefined && q.all !== "1") return null;
 	if (q.limit !== undefined && (!/^[1-9]\d{0,2}$/.test(q.limit) || Number(q.limit) > 200)) return null;
 	if (q.cursor !== undefined && !/^[A-Za-z0-9_-]{1,256}$/.test(q.cursor)) return null;
+	if (q.from !== undefined && !/^[A-Za-z0-9_.-]{1,64}$/.test(q.from)) return null;
 	const sp = new URLSearchParams();
 	if (q.context) sp.set("context", q.context);
 	if (q.all) sp.set("all", "1");
 	if (q.limit) sp.set("limit", q.limit);
 	if (q.cursor) sp.set("cursor", q.cursor);
+	if (q.from) sp.set("from", q.from);
 	const s = sp.toString();
 	return s ? `?${s}` : "";
 }
 
 function historyQuery(q: Record<string, string>): string | null {
-	for (const k of Object.keys(q)) if (k !== "n") return null;
-	if (q.n === undefined) return "";
-	if (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000) return null;
-	return `?n=${q.n}`;
+	for (const k of Object.keys(q)) if (k !== "n" && k !== "from") return null;
+	if (q.n !== undefined && (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000)) return null;
+	if (q.from !== undefined && !/^[A-Za-z0-9_.-]{1,64}$/.test(q.from)) return null;
+	const sp = new URLSearchParams();
+	if (q.n) sp.set("n", q.n);
+	if (q.from) sp.set("from", q.from);
+	const s = sp.toString();
+	return s ? `?${s}` : "";
 }
 
 /** `format=sql` is the only export query. The RPC still calls the JSON handler and redacts before building SQL. */

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.17";
+export const VERSION = "0.8.19";