a2a-exposed 0.8.18 → 0.8.20

package/lib/commands.mjs

@@ -26,6 +26,14 @@ function printPush(res) {
 	for (const r of (res && res.push) || []) console.error(`push -> ${r.url}: ${r.ok ? "ok" : "FAILED"} (${r.info})`);
 }
 
+function printDelivery(res) {
+	const d = res && res.delivery;
+	if (!d) return;
+	const target = d.target ? `${d.target.alias ? `${d.target.alias} at ` : ""}${d.target.host}` : "task storage";
+	const http = d.httpStatus ? ` (HTTP ${d.httpStatus})` : "";
+	console.error(`reply -> ${d.status} via ${d.method}: ${target}${http}`);
+}
+
 const readStdin = () => fs.readFileSync(0, "utf8");
 
 // ---------------------------------------------------------------- inbound side
@@ -121,7 +129,7 @@ export async function reply(id, o) {
 	const res = await owner("POST", `/owner/tasks/${q(id)}/reply`, {
 		text, state: o.state, artifact: !!o.artifact, artifactName: o["artifact-name"], force: !!o.force,
 	});
-	printPush(res);
+	printDelivery(res);
 	console.log(`${id} -> ${o.state}`);
 }
 

package/lib/deploy.mjs

@@ -25,7 +25,7 @@ export const CLAUDE_CODE_NOTE = [
 	"  Then open the new session from the routine's runs and confirm it ran the inbox command without errors.",
 ].join("\n");
 
-const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "generic"];
+const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "openbot", "generic"];
 // WAKE_ACCESS_*: Cloudflare Access service token for a wake URL behind Access (set by `tunnel create`, or exported
 // by hand for your own Access-protected endpoint)
 export const WAKE_SECRETS = ["WAKE_WEBHOOK_URL", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET"];

package/lib/main.mjs

@@ -92,9 +92,12 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
+                                openbot: human supplies WAKE_HMAC_SECRET via protected env/secret storage, never chat or argv
+                                the Worker refuses unsigned openbot wakes (a webhook key is not a signing secret)
                                 --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
                                                which defaults to 25 when this is unset
   wake preview                  rendered wake request (a credential is Bearer •••• or ••••, none of the secret)
+                                openbot includes a sample delivery ID and canonical signing-input description
                                 + sha256 fingerprints of the uploaded URL/key/HMAC secret; compared with
                                 local env values when WAKE_WEBHOOK_URL, WAKE_WEBHOOK_KEY, and WAKE_HMAC_SECRET
                                 are exported in this shell. match: the exported value is the one on the Worker.
@@ -116,7 +119,7 @@ anywhere on the account: the A2A endpoint itself can be on workers.dev or a cust
                                 creates nothing when you run it again. A partial tunnel stops and asks for tunnel rm.
                                 The tunnel, the Access app, and the service token are named "a2a-exposed wake <worker>".
                                 The DNS host is wake-<word>-<word>-<4 hex>.<zone> unless --tunnel-hostname is set.
-                                Export WAKE_WEBHOOK_KEY (hermes: WAKE_HMAC_SECRET) so tunnel create uploads it.
+                                Export WAKE_WEBHOOK_KEY (hermes/openbot: WAKE_HMAC_SECRET) so tunnel create uploads it.
                                 The connector machine needs cloudflared installed
                                 (https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/).
                                 Defaults: openclaw-* -> http://127.0.0.1:18789 /hooks/wake|agent, hermes -> :8644
@@ -267,7 +270,7 @@ Feedback
                                 polling), and hosted or self-hosted. --connection overrides
                                 that detection. Remove tokens from the message and from --logs.
 
-Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
+Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | openbot | generic
          Which clients are tested end to end is in the client table:
          https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md#clients
 Config: ${C.CONFIG_FILE}  (override dir with --config-dir DIR or A2A_CONFIG_DIR; env vars override file values)

package/lib/status.mjs

@@ -171,8 +171,8 @@ function nextStepCore(s) {
 	if (t && !t.complete) return fail(`a previous \`tunnel create\` did not finish: run \`${CLI} tunnel rm\`, then \`${CLI} tunnel create\``);
 	if (t && !t.tokenFileOk)
 		return fail(`the tunnel's connector token file (${t.tokenFile}) is missing or empty: run \`${CLI} tunnel create\` again (it downloads the token again; nothing new is created)`);
-	const agentSecret = s.wake.preset === "hermes" ? "WAKE_HMAC_SECRET" : "WAKE_WEBHOOK_KEY";
-	const needsAgentSecret = LOCAL_PRESETS.includes(s.wake.preset) && !s.wake.hasKey && !s.wake.hasHmacSecret;
+	const agentSecret = ["hermes", "openbot"].includes(s.wake.preset) ? "WAKE_HMAC_SECRET" : "WAKE_WEBHOOK_KEY";
+	const needsAgentSecret = s.wake.preset === "openbot" ? !s.wake.hasHmacSecret : LOCAL_PRESETS.includes(s.wake.preset) && !s.wake.hasKey && !s.wake.hasHmacSecret;
 	const now = typeof s.now === "number" ? s.now : Date.now();
 	if (t && !(s.wake.hasAccessServiceToken && t.workerUrlMatches)) {
 		if (secretsPropagating(t, now) && (t.connections === 0 || t.connections == null))
@@ -184,7 +184,7 @@ function nextStepCore(s) {
 	if (t && t.connections === 0)
 		return fail(`the tunnel has ${t.state === "inactive" ? "never connected" : "no running connector"}: on the agent's machine run \`cloudflared tunnel run --token-file ${t.tokenFile}\` (outbound port 7844 must be open), then \`${CLI} wake test\``);
 	if (s.wake.configured && needsAgentSecret)
-		return fail(`the Worker sends no webhook auth, so the ${s.wake.preset} webhook will reject wakes: export ${agentSecret} (${s.wake.preset === "hermes" ? "the route secret" : "the hooks token"}), then run \`${CLI} ${t ? "tunnel create" : "wake set"}\``);
+		return fail(`the Worker sends no webhook auth, so the ${s.wake.preset} webhook will reject wakes: export ${agentSecret} (${["hermes", "openbot"].includes(s.wake.preset) ? "the route secret" : "the hooks token"}), then run \`${CLI} ${t ? "tunnel create" : "wake set"}\``);
 	// not broken, but peers can't pair until the human sets the approval password
 	const also = [];
 	if (s.pairing && s.pairing.mode === "human" && !s.pairing.passwordSet)
@@ -195,7 +195,7 @@ function nextStepCore(s) {
 	if (!s.wake.configured) {
 		const poll = "the agent must check the A2A endpoint on a schedule (Hermes and OpenClaw have copy-paste commands in the setup references)";
 		if (s.wake.preset && !LOCAL_PRESETS.includes(s.wake.preset) && s.wake.preset !== "generic")
-			return done2(`no wake webhook: export WAKE_WEBHOOK_URL and WAKE_WEBHOOK_KEY, then run \`${CLI} wake set --preset ${s.wake.preset}\`; or ${poll}`);
+			return done2(`no wake webhook: export WAKE_WEBHOOK_URL and ${agentSecret}, then run \`${CLI} wake set --preset ${s.wake.preset}\`; or ${poll}`);
 		const z = s.zones;
 		const tunnel = !z ? `a local-only webhook can use \`${CLI} tunnel create\` (needs a zone on the account)`
 			: !z.length ? "the account has no domain (zone), so the secure tunnel is not available"

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.18",
+	"version": "0.8.20",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -28,7 +28,7 @@ const plain: Record<string, string> = {
 	PROVIDER_ORGANIZATION: v("A2A_PROVIDER_ORGANIZATION"),
 	PROVIDER_URL: v("A2A_PROVIDER_URL"),
 	DOCUMENTATION_URL: v("A2A_DOCUMENTATION_URL"),
-	WAKE_PRESET: v("WAKE_PRESET") || "generic", // grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
+	WAKE_PRESET: v("WAKE_PRESET") || "generic", // grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | openbot | generic
 	WAKE_AGENT_ID: v("WAKE_AGENT_ID"), // openclaw presets (default "main")
 	WAKE_KEY_HEADER: v("WAKE_KEY_HEADER"), // generic preset (default "authorization")
 	WAKE_KEY_PREFIX: e.WAKE_KEY_PREFIX ?? "", // generic preset; unset = "Bearer "

package/worker/migrations/0013_reply_delivery.sql

@@ -0,0 +1,11 @@
+-- One delivery outcome for one logical owner reply. The key includes the inbound turn and reply content,
+-- so an HTTP/MCP retry is idempotent while a later peer message permits the same words to be sent again.
+CREATE TABLE IF NOT EXISTS reply_deliveries (
+	delivery_key TEXT PRIMARY KEY,
+	task_id TEXT NOT NULL,
+	message_id TEXT NOT NULL,
+	result_json TEXT,
+	created_at TEXT NOT NULL,
+	updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS reply_deliveries_task ON reply_deliveries(task_id, created_at);

package/worker/scripts/stamp-version.mjs

@@ -1,4 +1,4 @@
-// Write worker/src/version.ts from cli/package.json. Publish runs `npm version` in cli/
+// Write worker/src/version.ts from cli/package.json. Release preparation runs `npm run version:set`
 // before the Worker tests and build, and prepack bundles this tree into the npm package.
 import fs from "node:fs";
 import path from "node:path";

package/worker/src/export.ts

@@ -16,7 +16,7 @@ export const EXPORT_TABLES = [
 	"peers", "tasks", "messages", "history", "outbound", "wakes",
 	"rate", "wake_budget", "device_requests", "pairing_rate", "settings",
 	"facade_owners", "oauth_clients", "oauth_codes", "mcp_grants",
-	"outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners",
+	"outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners", "reply_deliveries",
 ] as const;
 
 export type ExportTable = (typeof EXPORT_TABLES)[number];

package/worker/src/index.ts

@@ -7,7 +7,7 @@
 import * as A from "./a2a.ts";
 import * as F from "./facade.ts";
 import { renderWake, redact, cloudflareErrorHint, wakeUrlIsTunnelHost, defaultDebounceSeconds, defaultMaxPerHour, type WakeConfig, type WakeEvent } from "./wake.ts";
-import { fetchCheckedWake } from "./wake-target.ts";
+import { fetchCheckedPeer, fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
 import { lookupDirectory, pinDirectoryRegion, tenantNameFromHost, tenantRegion } from "./directory.ts";
@@ -1104,6 +1104,131 @@ async function notifyPeer(ctx: TenantContext, ectx: ExecutionContext, t: Json):
 	return results;
 }
 
+type ReplyDelivery = {
+	status: "delivered" | "stored-only" | "delivery-failed";
+	method: "push" | "a2a-message" | "stored";
+	taskId: string;
+	state: string;
+	target?: { alias?: string; host: string };
+	httpStatus?: number;
+	detail: string;
+};
+
+const DIRECT_REPLY_META = "a2a.exposed/reply-delivery";
+
+function safeTarget(alias: string | undefined, raw: string): { alias?: string; host: string } | undefined {
+	try { return { ...(alias ? { alias } : {}), host: new URL(raw).host }; } catch { return undefined; }
+}
+
+/** A paired endpoint fetch. Same-deployment tenants stay inside the Durable Object namespace. Every other host is
+ *  resolved once and the checked address is pinned to the socket; redirects are refused. */
+async function checkedPeerFetch(ctx: TenantContext, ectx: ExecutionContext, base: string, url: string, init: RequestInit): Promise<Response> {
+	let baseUrl: URL, target: URL;
+	try { baseUrl = new URL(base); target = new URL(url); } catch { throw new ToolError("peer endpoint is not a URL"); }
+	if (target.origin !== baseUrl.origin) throw new ToolError("peer card endpoint refused: it is on a different origin");
+	const why = peerUrlProblem(target.href);
+	if (why) throw new ToolError(`peer endpoint ${target.href} refused: ${why}`);
+	const internal = await fetchTenant(ctx, target, { ...init, redirect: "manual" });
+	if (internal) {
+		if (internal.status >= 300 && internal.status < 400) throw new ToolError("peer endpoint refused: redirects are not allowed");
+		return internal;
+	}
+	const checked = await fetchCheckedPeer(target.href, { ...init, redirect: "manual" });
+	if ("refused" in checked) throw new ToolError(`peer endpoint refused: ${checked.refused}`);
+	return checked.response;
+}
+
+async function checkedPeerCard(ctx: TenantContext, ectx: ExecutionContext, base: string): Promise<Json> {
+	for (const p of ["/.well-known/agent-card.json", "/.well-known/agent.json"]) {
+		try {
+			const r = await checkedPeerFetch(ctx, ectx, base, new URL(p, base).href, { headers: { accept: "application/json" } });
+			if (r.status !== 200) continue;
+			const text = (await r.text()).slice(0, 1 << 20);
+			const d = JSON.parse(text);
+			if (d && typeof d === "object") return d;
+		} catch { /* default endpoint below */ }
+	}
+	return null;
+}
+
+/** The exact inbound label must still have a live token here and an outbound pairing whose token we can decrypt.
+ *  A claimed card URL or a tokenless outbound entry is never enough. */
+async function replyPeer(ctx: TenantContext, label: string): Promise<{ alias: string; url: string; token: string } | null> {
+	const row: Json = await ctx.DB.prepare(
+		`SELECT o.alias, o.url, o.token_enc FROM outbound_peers o
+		 JOIN peers p ON p.label = o.alias
+		 WHERE o.alias = ? AND o.token_enc IS NOT NULL AND p.revoked_at IS NULL`,
+	).bind(label).first();
+	if (!row) return null;
+	const key = await ctx.peerKey();
+	const token = key ? await M.openPeerTokenWithKey(key, row.alias, row.token_enc) : null;
+	return token ? { alias: row.alias, url: row.url, token } : null;
+}
+
+async function deliverReplyMessage(ctx: TenantContext, ectx: ExecutionContext, task: Json, message: Json, state: string, text: string): Promise<ReplyDelivery> {
+	if (task._push?.length) {
+		const pushed = await notifyPeer(ctx, ectx, task);
+		const failed = pushed.find((x: Json) => !x.ok);
+		const target = safeTarget(undefined, String((failed || pushed[0])?.url || ""));
+		const http = /HTTP (\d{3})/.exec(String((failed || pushed[0])?.info || ""));
+		return {
+			status: failed ? "delivery-failed" : "delivered", method: "push", taskId: task.id, state,
+			...(target ? { target } : {}), ...(http ? { httpStatus: Number(http[1]) } : {}),
+			detail: failed ? "A task push failed; the reply remains stored on the task." : "Delivered as the task's existing push update.",
+		};
+	}
+	if (task.metadata?.[DIRECT_REPLY_META]) return {
+		status: "stored-only", method: "stored", taskId: task.id, state,
+		detail: "Stored on the task; a directly delivered reply is not delivered again.",
+	};
+	const peer = await replyPeer(ctx, task._peer);
+	if (!peer) return {
+		status: "stored-only", method: "stored", taskId: task.id, state,
+		detail: "Stored on the task for the peer to fetch; no live paired outbound address with a held token was found.",
+	};
+	const target = safeTarget(peer.alias, peer.url);
+	try {
+		const card = await checkedPeerCard(ctx, ectx, peer.url);
+		const [endpoint, version] = M.pickEndpoint(peer.url, card);
+		if (new URL(endpoint).origin !== new URL(peer.url).origin) throw new ToolError("peer card endpoint refused: it is on a different origin");
+		const v1 = version.startsWith("1");
+		const direct: Json = {
+			messageId: message.messageId, role: v1 ? "ROLE_USER" : "user", contextId: task.contextId,
+			referenceTaskIds: [task.id],
+			parts: v1 ? [{ text }] : [{ kind: "text", text }],
+			metadata: { [DIRECT_REPLY_META]: { taskId: task.id, messageId: message.messageId, state } },
+		};
+		if (!v1) direct.kind = "message";
+		const directMetadata = { [DIRECT_REPLY_META]: { taskId: task.id, messageId: message.messageId, state } };
+		const headers: Record<string, string> = {
+			"content-type": "application/json", accept: "application/json", "a2a-version": v1 ? "1.0" : "0.3",
+			authorization: `Bearer ${peer.token}`,
+		};
+		const response = await checkedPeerFetch(ctx, ectx, peer.url, endpoint, {
+			method: "POST", headers,
+			body: JSON.stringify({ jsonrpc: "2.0", id: message.messageId, method: v1 ? "SendMessage" : "message/send",
+				params: { message: direct, metadata: directMetadata, configuration: v1 ? { returnImmediately: true } : { blocking: false } } }),
+		});
+		const httpStatus = response.status;
+		const raw = (await response.text()).slice(0, 1 << 20);
+		let body: Json = null;
+		try { body = JSON.parse(raw); } catch { /* failure below */ }
+		if (httpStatus !== 200 || !body || typeof body !== "object" || body.error) return {
+			status: "delivery-failed", method: "a2a-message", taskId: task.id, state, ...(target ? { target } : {}), httpStatus,
+			detail: "The paired peer did not accept the A2A message; the reply remains stored on the task.",
+		};
+		return {
+			status: "delivered", method: "a2a-message", taskId: task.id, state, ...(target ? { target } : {}), httpStatus,
+			detail: "Delivered as an A2A message in the same context, referencing the original task.",
+		};
+	} catch (e: any) {
+		return {
+			status: "delivery-failed", method: "a2a-message", taskId: task.id, state, ...(target ? { target } : {}),
+			detail: `${scrubSecretText(String(e?.message || "delivery failed")).slice(0, 200)}; the reply remains stored on the task.`,
+		};
+	}
+}
+
 /** State and text of one pushed task, in the internal shape history and the inbox store.
  *  A full task or a status update carries both. A message and an artifact update carry text and no task state. */
 function pushUpdateView(body: Json): { state: string | null; text: string } {
@@ -1436,15 +1561,52 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			const state = b.state || "completed";
 			if (!["completed", "input-required", "failed", "rejected", "working"].includes(state)) return json({ error: "bad state" }, 400);
 			if (typeof b.text !== "string" || !b.text) return json({ error: "text required" }, 400);
+			const turn = [...t.history].reverse().find((x: Json) => x.role === "user")?.messageId || t.id;
+			const deliveryKey = await A.sha256(JSON.stringify([t.id, turn, state, b.text]));
+			let previous: Json = await ctx.DB.prepare("SELECT message_id, result_json, updated_at FROM reply_deliveries WHERE delivery_key = ?").bind(deliveryKey).first();
+			if (previous?.result_json) return json({ task: ownerTaskView(t), delivery: JSON.parse(previous.result_json), idempotent: true });
+			if (previous && Date.now() - Date.parse(previous.updated_at) > 20000) {
+				const storedMessage = t.history.find((x: Json) => x.messageId === previous.message_id);
+				if (storedMessage) {
+					const recovered: ReplyDelivery = {
+						status: "delivery-failed", method: t._push?.length ? "push" : "a2a-message", taskId: t.id, state,
+						detail: "The earlier delivery result is uncertain, so it was not sent again; the reply remains stored on the task.",
+					};
+					await ctx.DB.prepare("UPDATE reply_deliveries SET result_json = ?, updated_at = ? WHERE delivery_key = ? AND result_json IS NULL")
+						.bind(JSON.stringify(recovered), A.nowIso(), deliveryKey).run();
+					const settled: Json = await ctx.DB.prepare("SELECT result_json FROM reply_deliveries WHERE delivery_key = ?").bind(deliveryKey).first();
+					return json({ task: ownerTaskView(t), delivery: JSON.parse(settled.result_json), idempotent: true });
+				}
+				await ctx.DB.prepare("DELETE FROM reply_deliveries WHERE delivery_key = ? AND result_json IS NULL AND updated_at = ?")
+					.bind(deliveryKey, previous.updated_at).run();
+				previous = null;
+			}
 			if (A.TERMINAL.has(t.status.state) && !b.force) return json({ error: `task is already ${t.status.state}` }, 409);
 			const msg = { kind: "message", role: "agent", messageId: A.newId(), contextId: t.contextId, taskId: t.id, parts: [{ kind: "text", text: b.text }] };
+			const now = A.nowIso();
+			const claimed = await ctx.DB.prepare(
+				"INSERT INTO reply_deliveries (delivery_key, task_id, message_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?) ON CONFLICT DO NOTHING",
+			).bind(deliveryKey, t.id, msg.messageId, now, now).run();
+			if (claimed.meta.changes !== 1) {
+				const raced: Json = await ctx.DB.prepare("SELECT result_json FROM reply_deliveries WHERE delivery_key = ?").bind(deliveryKey).first();
+				if (raced?.result_json) return json({ task: ownerTaskView(await loadTask(ctx, t.id)), delivery: JSON.parse(raced.result_json), idempotent: true });
+				return json({ error: "this reply is already being delivered; retry to read its result" }, 409);
+			}
 			if (state === "completed" || b.artifact) t.artifacts.push({ artifactId: A.newId(), name: b.artifactName || "response", parts: [{ kind: "text", text: b.text }] });
 			t.history.push(msg);
-			t.status = { state, timestamp: A.nowIso(), message: msg };
+			t.status = { state, timestamp: now, message: msg };
 			await ctx.DB.batch([saveTaskStmt(ctx, t), msgStmt(ctx, t, msg),
 				histStmt(ctx, t.contextId, { dir: "out", peer: t._peer, taskId: t.id, role: "agent", state, text: b.text })]);
 			await ackPendingWakes(ctx, [{ taskId: t.id, contextId: t.contextId }]);
-			return json({ task: ownerTaskView(t), push: await notifyPeer(ctx, ectx, t) });
+			let delivery: ReplyDelivery;
+			try { delivery = await deliverReplyMessage(ctx, ectx, t, msg, state, b.text); }
+			catch {
+				delivery = { status: "delivery-failed", method: t._push?.length ? "push" : "a2a-message", taskId: t.id, state,
+					detail: "Delivery could not be completed; the reply remains stored on the task." };
+			}
+			await ctx.DB.prepare("UPDATE reply_deliveries SET result_json = ?, updated_at = ? WHERE delivery_key = ?")
+				.bind(JSON.stringify(delivery), A.nowIso(), deliveryKey).run();
+			return json({ task: ownerTaskView(t), delivery, idempotent: false });
 		}
 	}
 	if (seg[0] === "history" && seg[1] && m === "GET") {
@@ -1542,8 +1704,9 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		const checked = ownerRpcBody(`POST /owner/mcp/${seg[1]}`, await body());
 		if (!checked.ok) return json({ error: checked.error }, 400);
 		try {
-			const text = await runTool(ctx, ectx, seg[1], checked.value);
-			return json({ text, isError: false });
+			const result = await runTool(ctx, ectx, seg[1], checked.value);
+			return json({ text: typeof result === "string" ? result : result.text, isError: false,
+				...(typeof result === "string" ? {} : { structuredContent: result.structuredContent }) });
 		} catch (e: any) {
 			if (e instanceof ToolError) return json({ text: `Error: ${e.message}`, isError: true });
 			throw e;
@@ -1612,6 +1775,8 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		// uploaded secrets so the owner can compare them with local values without revealing them
 		const ev: WakeEvent = { contextId: "ctx-preview", taskId: "task-preview", taskIds: ["task-preview"], from: "example-peer",
 			preview: "Example message preview", kind: "test", publicUrl: ctx.PUBLIC_URL };
+		if (preset(ctx) === "openbot" && !ctx.WAKE_HMAC_SECRET?.trim())
+			return json({ error: "OpenBot requires WAKE_HMAC_SECRET from the routine settings" }, 400);
 		const req = await renderWake(wakeConfig(ctx), ev, { requestId: "preview" });
 		return json({ preset: preset(ctx), configured: !!req, debounceSeconds: debounceMs(ctx) / 1000, maxPerHour: maxPerHour(ctx),
 			hasKey: !!ctx.WAKE_WEBHOOK_KEY, hasHmacSecret: !!ctx.WAKE_HMAC_SECRET,
@@ -1619,6 +1784,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			fingerprints: { url: await A.fingerprint(ctx.WAKE_WEBHOOK_URL), key: await A.fingerprint(ctx.WAKE_WEBHOOK_KEY),
 				hmacSecret: await A.fingerprint(ctx.WAKE_HMAC_SECRET),
 				accessClientId: await A.fingerprint(ctx.WAKE_ACCESS_CLIENT_ID), accessClientSecret: await A.fingerprint(ctx.WAKE_ACCESS_CLIENT_SECRET) },
+			...(preset(ctx) === "openbot" ? { signingInput: "<timestamp>.<delivery-id>.<exact-body-bytes>" } : {}),
 			request: req ? redact(req) : null });
 	}
 	if (seg[0] === "wake" && seg[1] === "test" && m === "POST") {
@@ -2912,7 +3078,9 @@ function newPushToken(): string {
 	return btoa(String.fromCharCode(...b)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string, a: Json, grant?: Json): Promise<string> {
+type ToolRun = string | { text: string; structuredContent: Json };
+
+async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string, a: Json, grant?: Json): Promise<ToolRun> {
 	const enc = encodeURIComponent;
 	switch (name) {
 		case "inbox": {
@@ -2965,7 +3133,15 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 		case "reply": {
 			const state = argStr(a, "state", false) || "completed";
 			const r = must(await ownerCall(ctx, ectx, "POST", `/owner/tasks/${enc(A.checkId(argStr(a, "taskId"), "taskId"))}/reply`, { text: argStr(a, "text"), state }));
-			return M.toolText(`Replied; task ${r.task.id} is now ${r.task.status.state}.`, { push: r.push });
+			const d: ReplyDelivery = r.delivery;
+			const where = d.target ? `${d.target.alias ? `**${d.target.alias}** at ` : ""}\`${d.target.host}\`` : "the task";
+			const http = d.httpStatus ? ` (HTTP ${d.httpStatus})` : "";
+			const line = d.status === "delivered"
+				? `Task \`${d.taskId}\` is now ${d.state}. Reply stored and delivered to ${where} via ${d.method}${http}.`
+				: d.status === "delivery-failed"
+					? `Task \`${d.taskId}\` is now ${d.state}. Reply stored; delivery to ${where} failed${http}, so the stored reply was not lost.`
+					: `Task \`${d.taskId}\` is now ${d.state}. Reply stored for the peer to fetch.`;
+			return { text: `${line}\n\n${d.detail}`, structuredContent: d };
 		}
 		case "send": {
 			const peer = await outboundPeer(ctx, argStr(a, "to"));
@@ -3104,9 +3280,10 @@ async function callTool(ctx: TenantContext, ectx: ExecutionContext, grant: Json,
 	const args = params.arguments ?? {};
 	if (typeof args !== "object" || Array.isArray(args)) return { error: [M.ERR.INVALID_PARAMS, "arguments must be an object"] };
 	try {
-		const text = await runTool(ctx, ectx, name, args, grant);
+		const value = await runTool(ctx, ectx, name, args, grant);
 		log("mcp_tool", { label: grant.label, tool: name });
-		return { result: { content: [{ type: "text", text }], isError: false } };
+		return { result: { content: [{ type: "text", text: typeof value === "string" ? value : value.text }],
+			...(typeof value === "string" ? {} : { structuredContent: value.structuredContent }), isError: false } };
 	} catch (e: any) {
 		log("mcp_tool_failed", { label: grant.label, tool: name, error: String(e.message).slice(0, 200) });
 		return { result: { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true } };

package/worker/src/mcp.ts

@@ -318,7 +318,7 @@ type Schema = Record<string, unknown>;
 const str = (description: string, extra: Schema = {}): Schema => ({ type: "string", description, ...extra });
 const ro = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };
 
-export const TOOLS: { name: string; title: string; description: string; inputSchema: Schema; annotations: Schema }[] = [
+export const TOOLS: { name: string; title: string; description: string; inputSchema: Schema; outputSchema?: Schema; annotations: Schema }[] = [
 	{ name: "inbox", title: "Inbox", annotations: ro,
 		description: `Open tasks other agents sent to this A2A endpoint (state submitted or working), oldest first, one page at a time, plus a reply to a message you sent (kind "outbound") until this inbox lists it, plus pending pairing requests. When the result says more tasks are waiting, call inbox again with the cursor before you stop. Handle each inbound task, then answer it with reply. A reply to a message you sent: read it with history, and continue that conversation with send. ${RULES}`,
 		inputSchema: { type: "object", properties: {
@@ -338,9 +338,16 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		description: "Tell the peer you are working on a task (state working; the peer is notified if it asked for push updates). Use for anything that takes more than a moment.",
 		inputSchema: { type: "object", properties: { taskId: str("Task id") }, required: ["taskId"], additionalProperties: false } },
 	{ name: "reply", title: "Reply to task", annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-		description: `Answer an inbound task. state: completed (default; the text becomes the result), input-required (ask the peer a question), working, failed or rejected. The reply goes to the agent that sent the task. Don't include secrets or private data your human hasn't approved sharing. ${RULES}`,
+		description: `Answer an inbound task. state: completed (default; the text becomes the result), input-required (ask the peer a question), working, failed or rejected. The answer is always stored on the task. It uses the task's existing push update, or, when no push exists, an exact paired outbound peer with a held token; otherwise the peer fetches it. Don't include secrets or private data your human hasn't approved sharing. ${RULES}`,
 		inputSchema: { type: "object", properties: { taskId: str("Task id"), text: str("Reply text"),
-			state: str("New task state", { enum: ["completed", "input-required", "working", "failed", "rejected"] }) }, required: ["taskId", "text"], additionalProperties: false } },
+			state: str("New task state", { enum: ["completed", "input-required", "working", "failed", "rejected"] }) }, required: ["taskId", "text"], additionalProperties: false },
+		outputSchema: { type: "object", properties: {
+			taskId: str("Task that stores the reply"), state: str("Stored task state"),
+			status: str("Delivery outcome", { enum: ["delivered", "stored-only", "delivery-failed"] }),
+			method: str("Path used", { enum: ["push", "a2a-message", "stored"] }),
+			target: { type: "object", properties: { alias: str("Paired peer alias"), host: str("Destination host") }, required: ["host"], additionalProperties: false },
+			httpStatus: { type: "integer", minimum: 100, maximum: 599 }, detail: str("Safe delivery summary"),
+		}, required: ["taskId", "state", "status", "method", "detail"], additionalProperties: false } },
 	{ name: "send", title: "Send to peer", annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
 		description: `Send a message to a peer agent (alias from list_peers; only peers synced to this A2A endpoint with \`peers sync\`). When the peer's card advertises push notifications, the peer is asked to push its reply here, which then shows in history and in the inbox. Otherwise check the task with poll_outbound. Pass contextId to continue a conversation, taskId to answer a peer's input-required task. The conversation id stays the one returned. Returns the peer's task. Ask your human before sending anything consequential or private. ${RULES}`,
 		inputSchema: { type: "object", properties: { to: str("Peer alias"), text: str("Message text"), contextId: str("Continue this conversation"), taskId: str("Continue this peer task") }, required: ["to", "text"], additionalProperties: false } },

package/worker/src/migrations.ts

@@ -12,6 +12,7 @@ import m0009 from "../migrations/0009_outbound_seen.sql?raw";
 import m0010 from "../migrations/0010_conversation_peer.sql?raw";
 import m0011 from "../migrations/0011_conversation_owner.sql?raw";
 import m0012 from "../migrations/0012_conversation_peer_owner.sql?raw";
+import m0013 from "../migrations/0013_reply_delivery.sql?raw";
 import type { Migration } from "./storage.ts";
 
 export const MIGRATIONS: Migration[] = [
@@ -27,4 +28,5 @@ export const MIGRATIONS: Migration[] = [
 	{ name: "0010_conversation_peer.sql", sql: m0010 },
 	{ name: "0011_conversation_owner.sql", sql: m0011 },
 	{ name: "0012_conversation_peer_owner.sql", sql: m0012 },
+	{ name: "0013_reply_delivery.sql", sql: m0013 },
 ];

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.18";
+export const VERSION = "0.8.20";

package/worker/src/wake-target.ts

@@ -199,6 +199,57 @@ async function responseForCaller(res: Response): Promise<Response> {
 	return new Response(merged, { status: res.status, headers });
 }
 
+/** Keep a bounded response body for an authenticated peer JSON-RPC call. The socket client enforces the
+ *  limit before this helper runs; copying detaches the returned body from the socket before it is closed. */
+async function peerResponseForCaller(res: Response): Promise<Response> {
+	const body = res.body ? await res.arrayBuffer() : null;
+	return new Response(body, { status: res.status, headers: new Headers(res.headers) });
+}
+
+async function deliverPinnedPeer(url: string, init: RequestInit, target: { ip: string; hostname: string }, connect: WakeConnect): Promise<Response> {
+	const client = new Client({
+		connect: dialChecked(target.ip, connect),
+		forceTunnel: true,
+		maxRedirects: 0,
+		maxBodyBytes: 1 << 20,
+		http2: false,
+		keepAlive: false,
+		timeouts: { totalMs: REQUEST_TIMEOUT_MS },
+	});
+	try {
+		const res = await client.fetch(url, { method: init.method, headers: init.headers, body: init.body, redirect: "manual" });
+		return await peerResponseForCaller(res);
+	} catch (e) {
+		if (e instanceof TlsError || e instanceof CertificateError) throw new Error("TLS Handshake Failed.");
+		throw e;
+	} finally {
+		await client.close().catch(() => {});
+	}
+}
+
+/** One authenticated peer request with DNS resolution pinned to the connected socket. Redirects are refused:
+ *  a bearer token and a reply must never be replayed at a card-selected second destination. */
+export async function fetchCheckedPeer(
+	url: string,
+	init: RequestInit,
+	deps: Pick<WakeDeps, "lookup" | "connect" | "deliver"> = {},
+): Promise<{ response: Response } | { refused: string }> {
+	const checked = await checkedWakeAddresses(url, deps.lookup ?? lookupAddresses);
+	if ("refused" in checked) return checked;
+	const target = { ip: checked.ips[0]!, hostname: checked.hostname };
+	const nextInit: RequestInit = { ...init, redirect: "manual" };
+	const response = deps.deliver
+		? await deps.deliver(url, nextInit, target)
+		: wakeNet.deliver
+			? await wakeNet.deliver(url, nextInit, target)
+			: await deliverPinnedPeer(url, nextInit, target, deps.connect ?? wakeNet.connect ?? await runtimeConnect());
+	if (response.status >= 300 && response.status < 400) {
+		await response.body?.cancel().catch(() => {});
+		return { refused: "redirects are not allowed" };
+	}
+	return { response };
+}
+
 function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
 	if (body == null) return new Uint8Array();
 	if (typeof body === "string") return new TextEncoder().encode(body);

package/worker/src/wake.ts

@@ -46,7 +46,7 @@ export type WakeConfig = {
 
 export type WakeRequest = { url: string; method: "POST"; headers: Record<string, string>; body: string };
 
-export const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "generic"] as const;
+export const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "openbot", "generic"] as const;
 
 /** Default debounce window per preset (seconds), used when WAKE_DEBOUNCE_SECONDS is unset. */
 export function defaultDebounceSeconds(preset: string): number {
@@ -177,9 +177,10 @@ async function hermesSign(headers: Record<string, string>, secret: string, body:
 	headers["X-Webhook-Signature-V2"] = await hmacSha256Hex(secret, `${ts}.${body}`);
 }
 
-/** Build the HTTP request for a wake, or return null when the wake is not configured. */
+/** Build the HTTP request, return null without a URL, or throw when OpenBot signing is missing. */
 export async function renderWake(cfg: WakeConfig, ev: WakeEvent, opts: { nowMs?: number; requestId?: string } = {}): Promise<WakeRequest | null> {
 	if (!cfg.url) return null;
+	if (cfg.preset === "openbot" && !cfg.hmacSecret?.trim()) throw new Error("OpenBot requires WAKE_HMAC_SECRET from the routine settings");
 	const cli = cfg.cliCommand || DEFAULT_CLI;
 	const nowMs = opts.nowMs ?? Date.now();
 	const requestId = opts.requestId ?? crypto.randomUUID();
@@ -207,6 +208,16 @@ export async function renderWake(cfg: WakeConfig, ev: WakeEvent, opts: { nowMs?:
 			// `name` is the hook name OpenClaw filters match. It stays "A2A inbox". The wake text itself starts with "A2A endpoint:".
 			body = JSON.stringify({ message: wakeSummary(ev, cli), name: "A2A inbox", agentId: cfg.agentId || "main", sessionMode: "isolated", deliver: false });
 			break;
+		case "openbot": {
+			const ts = String(Math.floor(nowMs / 1000));
+			headers["x-openbot-timestamp"] = ts;
+			headers["x-openbot-delivery-id"] = requestId;
+			// Serialize once: the signature covers exactly the UTF-8 bytes sent to OpenBot.
+			body = JSON.stringify({ type: "a2a_wake", occurredAt: new Date(nowMs).toISOString(), data: wakePayload(ev, cli) });
+			if (cfg.hmacSecret)
+				headers["x-openbot-signature"] = `sha256=${await hmacSha256Hex(cfg.hmacSecret, `${ts}.${requestId}.${body}`)}`;
+			break;
+		}
 		case "hermes":
 			headers["x-request-id"] = requestId;
 			body = JSON.stringify(wakePayload(ev, cli));
@@ -268,7 +279,7 @@ export function cloudflareErrorHint(status: number, body: string, opts?: { tunne
 
 /** Headers a wake preview may show in full. Every other header carries a credential, whatever its name. */
 export const PREVIEW_PLAIN_HEADERS = new Set([
-	"content-type", "user-agent", "x-request-id", "idempotency-key", "anthropic-version", "x-webhook-timestamp",
+	"content-type", "user-agent", "x-request-id", "idempotency-key", "anthropic-version", "x-webhook-timestamp", "x-openbot-timestamp", "x-openbot-delivery-id",
 ]);
 
 export function previewHeaderPlain(name: string): boolean {

package/worker/test/mcp.test.ts

@@ -411,6 +411,8 @@ test("tools: inbox, show_task, history, mark_working, reply (with state), pairin
 	assert.match((await s.tool(a.access_token, "mark_working", { taskId: task.id })).content[0].text, /now working/);
 	const q = await s.tool(a.access_token, "reply", { taskId: task.id, text: "Which report?", state: "input-required" });
 	assert.match(q.content[0].text, /now input-required/);
+	assert.deepEqual({ status: q.structuredContent.status, method: q.structuredContent.method, taskId: q.structuredContent.taskId },
+		{ status: "stored-only", method: "stored", taskId: task.id });
 	const done = await s.tool(a.access_token, "reply", { taskId: task.id, text: "Here it is." });
 	assert.match(done.content[0].text, /now completed/);
 	assert.equal((await s.tool(a.access_token, "reply", { taskId: task.id, text: "again" })).isError, true, "terminal tasks stay closed");

package/worker/test/migrations.test.ts

@@ -57,7 +57,7 @@ test("migration files: NNNN_name.sql, unique numbers, no gaps, 0002_wake_budget
 test("fresh database: every migration applies in order; a second run applies nothing", () => {
 	const db = new DatabaseSync(":memory:");
 	assert.deepEqual(applyMigrations(db), [...FILES].sort(byNumber));
-	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners"]) assert.ok(tables(db).includes(t), t);
+	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns", "conversation_owners", "reply_deliveries"]) assert.ok(tables(db).includes(t), t);
 	assert.ok(columns(db, "peers").includes("source"));
 	assert.ok(columns(db, "device_requests").includes("replaces_label"));
 	assert.ok(columns(db, "device_requests").includes("replaces_hash"));
@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql", "0013_reply_delivery.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql", "0013_reply_delivery.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql", "0013_reply_delivery.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql", "0010_conversation_peer.sql", "0011_conversation_owner.sql", "0012_conversation_peer_owner.sql", "0013_reply_delivery.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 

package/worker/test/reply-delivery.test.ts

@@ -0,0 +1,161 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { sha256 } from "../src/a2a.ts";
+import { clearDirectoryCache } from "../src/directory.ts";
+import { dispatch, runOwnerRpc } from "../src/index.ts";
+import { hostedTenantContext, type DoNamespace, type KvNamespace, type TenantContext, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const MIGRATIONS = new URL("../migrations/", import.meta.url);
+const ectx = { waitUntil(_p: Promise<unknown>) {}, passThroughOnException() {} };
+type Delivery = { status: string; method: string; taskId: string; target?: { alias?: string; host?: string }; httpStatus?: number };
+
+async function fixture(t: Parameters<typeof test>[1] extends (t: infer T) => unknown ? T : never) {
+	clearDirectoryCache();
+	t.after(clearDirectoryCache);
+	const store = new Map<string, string>();
+	const kv: KvNamespace = {
+		async get(key: string, type?: "json") { const v = store.get(key); return v == null ? null : type === "json" ? JSON.parse(v) : v; },
+		async put(key: string, value: string) { store.set(key, value); },
+	};
+	const byId = new Map<string, TenantContext>();
+	let directPosts = 0;
+	let hold: Promise<void> | null = null;
+	const ns: DoNamespace = {
+		idFromName(name: string) { return name; },
+		get(id: unknown) {
+			return { async fetch(req: Request) {
+				const ctx = byId.get(String(id));
+				if (!ctx) return new Response("missing", { status: 404 });
+				if (req.method === "POST" && new URL(req.url).pathname === "/") {
+					directPosts++;
+					if (hold) await hold;
+				}
+				return dispatch(req, ctx, ectx as never);
+			} };
+		},
+	};
+	const env = { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-key", DATA_REGION: "", TENANT_DIRECTORY: kv, TENANT_DO: ns } as WorkerBindings;
+	const dbA = d1(MIGRATIONS);
+	const dbB = d1(MIGRATIONS);
+	const ownerA = "owner-alice";
+	const ownerB = "owner-bob";
+	const a = hostedTenantContext(env, { id: "id-alice", db: dbA, publicUrl: "https://alice.example.com", ownerTokenHash: await sha256(ownerA), status: "active", config: { AGENT_NAME: "Alice" } });
+	const b = hostedTenantContext(env, { id: "id-bob", db: dbB, publicUrl: "https://bob.example.com", ownerTokenHash: await sha256(ownerB), status: "active", config: { AGENT_NAME: "Bob" } });
+	byId.set("id-alice", a); byId.set("id-bob", b);
+	store.set("tenant:alice", JSON.stringify({ id: "id-alice", status: "active", region: "default", version: 1 }));
+	store.set("tenant:bob", JSON.stringify({ id: "id-bob", status: "active", region: "default", version: 1 }));
+	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) =>
+		runOwnerRpc(ctx, ectx as never, { accountId, method, path, ...(body === undefined ? {} : { body }) });
+	const issue = async (ctx: TenantContext, ownerToken: string, label: string) => {
+		const r = await dispatch(new Request(ctx.PUBLIC_URL + "/owner/peers", { method: "POST", headers: { authorization: `Bearer ${ownerToken}`, "content-type": "application/json" }, body: JSON.stringify({ label }) }), ctx, ectx as never);
+		return (await r.json() as { token: string }).token;
+	};
+	const aliceAtBob = await issue(b, ownerB, "alice");
+	const bobAtAlice = await issue(a, ownerA, "bob");
+	assert.equal((await owner(b, "acct-bob", "PUT", "/owner/outbound-peers/alice", { url: a.PUBLIC_URL, token: bobAtAlice })).status, 200);
+	const sendToBob = async (text: string, contextId: string, push?: unknown) => {
+		const body = { jsonrpc: "2.0", id: "send-1", method: "message/send", params: { message: { kind: "message", role: "user", messageId: `m-${text}`, contextId, parts: [{ kind: "text", text }] }, configuration: { blocking: false, ...(push ? { pushNotificationConfig: push } : {}) } } };
+		const r = await dispatch(new Request(b.PUBLIC_URL, { method: "POST", headers: { authorization: `Bearer ${aliceAtBob}`, "content-type": "application/json" }, body: JSON.stringify(body) }), b, ectx as never);
+		const data = await r.json() as any;
+		assert.equal(r.status, 200, JSON.stringify(data));
+		return data.result.id as string;
+	};
+	return { a, b, dbA, dbB, owner, sendToBob, get directPosts() { return directPosts; }, blockDirect() {
+		let release!: () => void;
+		hold = new Promise<void>((resolve) => { release = resolve; });
+		return () => { hold = null; release(); };
+	} };
+}
+
+test("reply delivers once to an exact paired peer in the same context and a direct reply cannot loop", async (t) => {
+	const s = await fixture(t as never);
+	const taskId = await s.sendToBob("question", "ctx-direct");
+	const first = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "answer", state: "completed" });
+	assert.equal(first.status, 200, JSON.stringify(first.body));
+	const structured = (first.body as any).structuredContent as Delivery;
+	assert.deepEqual({ status: structured.status, method: structured.method, taskId: structured.taskId, alias: structured.target?.alias, host: structured.target?.host, http: structured.httpStatus },
+		{ status: "delivered", method: "a2a-message", taskId, alias: "alice", host: "alice.example.com", http: 200 });
+	assert.match(String((first.body as any).text), /stored.*delivered/i);
+	assert.equal(JSON.stringify(first.body).includes("a2aow_"), false);
+	assert.equal(s.directPosts, 1);
+
+	const inbox = await s.owner(s.a, "acct-alice", "GET", "/owner/inbox");
+	const delivered = (inbox.body as any[]).find((row) => row.text === "answer");
+	assert.equal(delivered.contextId, "ctx-direct");
+	const stored = await s.dbA.prepare("SELECT metadata_json FROM tasks WHERE id = ?").bind(delivered.taskId).first() as { metadata_json?: string };
+	const metadata = JSON.parse(stored.metadata_json || "{}");
+	assert.deepEqual(metadata["a2a.exposed/reply-delivery"].taskId, taskId);
+
+	const noLoop = await s.owner(s.a, "acct-alice", "POST", "/owner/mcp/reply", { taskId: delivered.taskId, text: "ack", state: "completed" });
+	assert.equal((noLoop.body as any).structuredContent.status, "stored-only");
+	assert.equal(s.directPosts, 1, "a directly delivered reply is never delivered back");
+
+	const retry = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "answer", state: "completed" });
+	assert.equal(retry.status, 200, JSON.stringify(retry.body));
+	assert.equal((retry.body as any).structuredContent.status, "delivered");
+	assert.equal(s.directPosts, 1, "the same logical reply is idempotent");
+	const count = await s.dbA.prepare("SELECT COUNT(*) AS n FROM tasks WHERE context_id = ?").bind("ctx-direct").first() as { n: number };
+	assert.equal(count.n, 1);
+});
+
+test("push wins over paired direct delivery and a revoked inbound peer stores only", async (t) => {
+	const s = await fixture(t as never);
+	const originalFetch = globalThis.fetch;
+	let pushes = 0;
+	globalThis.fetch = (async (input: RequestInfo | URL) => {
+		const u = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+		if (u.host === "push.example.net") { pushes++; return new Response(null, { status: 204 }); }
+		return originalFetch(input);
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = originalFetch; });
+	const pushedTask = await s.sendToBob("push question", "ctx-push", { id: "cfg", url: "https://push.example.net/update" });
+	const pushed = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId: pushedTask, text: "push answer" });
+	assert.equal((pushed.body as any).structuredContent.method, "push");
+	assert.equal(pushes, 1);
+	assert.equal(s.directPosts, 0, "push and direct message are never both used");
+
+	const revokedTask = await s.sendToBob("revoked question", "ctx-revoked");
+	await s.dbB.prepare("UPDATE peers SET revoked_at = ? WHERE label = 'alice'").bind(new Date().toISOString()).run();
+	const revoked = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId: revokedTask, text: "stored answer" });
+	assert.equal((revoked.body as any).structuredContent.status, "stored-only");
+	assert.equal(s.directPosts, 0);
+	const task = await s.dbB.prepare("SELECT state, status_json FROM tasks WHERE id = ?").bind(revokedTask).first() as { state: string; status_json: string };
+	assert.equal(task.state, "completed");
+	assert.match(task.status_json, /stored answer/);
+});
+
+test("stale recovery never overlaps an uncertain delivery and a later retry reads the settled result", async (t) => {
+	const s = await fixture(t as never);
+	const taskId = await s.sendToBob("concurrent question", "ctx-concurrent");
+	const release = s.blockDirect();
+	const first = s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "one answer" });
+	while (s.directPosts === 0) await new Promise((resolve) => setTimeout(resolve, 0));
+	await s.dbB.prepare("UPDATE reply_deliveries SET updated_at = '2000-01-01T00:00:00.000Z'").run();
+	const raced = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "one answer" });
+	assert.equal(raced.status, 200);
+	assert.equal((raced.body as any).structuredContent.status, "delivery-failed");
+	assert.match(String((raced.body as any).structuredContent.detail), /uncertain.*not sent again/);
+	assert.equal(s.directPosts, 1, "the overlapping call cannot start a second delivery");
+	release();
+	assert.equal(((await first).body as any).structuredContent.status, "delivered");
+	const retry = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "one answer" });
+	assert.equal(retry.status, 200);
+	assert.equal((retry.body as any).structuredContent.status, "delivered");
+	assert.equal(s.directPosts, 1);
+});
+
+test("a remote token rejection reports HTTP status without losing the stored reply", async (t) => {
+	const s = await fixture(t as never);
+	const taskId = await s.sendToBob("will the old token work?", "ctx-rejected");
+	await s.dbA.prepare("UPDATE peers SET revoked_at = ? WHERE label = 'bob'").bind(new Date().toISOString()).run();
+	const result = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "the answer stays", state: "completed" });
+	const delivery = (result.body as any).structuredContent as Delivery;
+	assert.deepEqual({ status: delivery.status, method: delivery.method, http: delivery.httpStatus },
+		{ status: "delivery-failed", method: "a2a-message", http: 401 });
+	assert.match(String((result.body as any).text), /stored.*failed/i);
+	assert.equal(JSON.stringify(result.body).includes("a2aow_"), false);
+	const stored = await s.dbB.prepare("SELECT state, status_json FROM tasks WHERE id = ?").bind(taskId).first() as { state: string; status_json: string };
+	assert.equal(stored.state, "completed");
+	assert.match(stored.status_json, /the answer stays/);
+});

package/worker/test/wake-retry.test.ts

@@ -72,3 +72,58 @@ test("a 429 is due at Retry-After when the debounce is longer", async (t) => {
 	const at = await nextCronAt(resolveTenant(env), Date.now());
 	assert.ok(at != null && at >= before + 25_000 && at <= before + 35_000, `alarm ${at} is Retry-After, not the 120s debounce`);
 });
+
+test("OpenBot preview masks signing credentials and wake test accepts HTTP 202", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret",
+		WAKE_PRESET: "openbot", WAKE_WEBHOOK_URL: "https://hooks.example.com/a2a", WAKE_HMAC_SECRET: "dummy-openbot-secret" };
+	const pending: Promise<unknown>[] = [];
+	const call = (method: string, path: string) => worker.fetch(new Request(BASE + path, { method, headers: { authorization: "Bearer owner-secret" } }) as any,
+		env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+	const preview = await (await call("GET", "/owner/wake/preview")).json() as any;
+	assert.equal(preview.preset, "openbot");
+	assert.equal(preview.signingInput, "<timestamp>.<delivery-id>.<exact-body-bytes>");
+	assert.equal(preview.request.headers["x-openbot-delivery-id"], "preview");
+	assert.equal(preview.request.headers["x-openbot-signature"], "••••");
+	assert.ok(!JSON.stringify(preview).includes(env.WAKE_HMAC_SECRET));
+	const original = globalThis.fetch;
+	let sent = false;
+	globalThis.fetch = (async (_url: any, init: any) => {
+		sent = true;
+		assert.equal(JSON.parse(init.body).type, "a2a_wake");
+		assert.match(init.headers["x-openbot-signature"], /^sha256=[0-9a-f]{64}$/);
+		assert.ok(init.headers["x-openbot-delivery-id"]);
+		return new Response("{}", { status: 202 });
+	}) as any;
+	t.after(() => { globalThis.fetch = original; });
+	const result = await (await call("POST", "/owner/wake/test")).json() as any;
+	assert.equal(result.status, 202);
+	assert.equal(sent, true);
+	await Promise.allSettled(pending);
+});
+
+test("unsigned OpenBot owner test/preview and inbound wake never contact the webhook", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret",
+		WAKE_PRESET: "openbot", WAKE_WEBHOOK_URL: "https://hooks.example.com/wake", WAKE_WEBHOOK_KEY: "not-a-signing-secret" };
+	let calls = 0;
+	const original = globalThis.fetch;
+	globalThis.fetch = (async () => { calls++; throw new Error("must not send"); }) as typeof fetch;
+	t.after(() => { globalThis.fetch = original; });
+	const call = async (method: string, path: string, body?: unknown, auth = "Bearer owner-secret") => {
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers: { authorization: auth, "content-type": "application/json" }, body: body ? JSON.stringify(body) : undefined }) as any,
+			env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		await Promise.allSettled(pending);
+		return { status: res.status, body: await res.json() as any };
+	};
+	const preview = await call("GET", "/owner/wake/preview");
+	assert.equal(preview.status, 400);
+	assert.match(preview.body.error, /WAKE_HMAC_SECRET/);
+	const result = await call("POST", "/owner/wake/test");
+	assert.equal(result.body.status, null);
+	assert.match(result.body.info, /WAKE_HMAC_SECRET/);
+	const peer = await call("POST", "/owner/peers", { label: "dummy" });
+	const message = await call("POST", "/", { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "unsigned", parts: [{ kind: "text", text: "dummy" }] } } }, `Bearer ${peer.body.token}`);
+	assert.equal(message.status, 200);
+	assert.equal(message.body.error, undefined, "stored inbox message succeeds without a wake");
+	assert.equal(calls, 0);
+});

package/worker/test/wake-target.test.ts

@@ -7,7 +7,7 @@ import { Duplex } from "node:stream";
 import worker from "../src/index.ts";
 import { d1 } from "./d1.ts";
 import * as M from "../src/mcp.ts";
-import { dialChecked, fetchCheckedWake, publicWakeProblem, wakeNet, type AddressLookup, type CheckedDeliver, type WakeConnect } from "../src/wake-target.ts";
+import { dialChecked, fetchCheckedPeer, fetchCheckedWake, publicWakeProblem, wakeNet, type AddressLookup, type CheckedDeliver, type WakeConnect } from "../src/wake-target.ts";
 
 const publicLookup: AddressLookup = async (host) => {
 	if (host === "hook.example" || host === "also.example") return ["1.2.3.4"];
@@ -196,6 +196,26 @@ test("a cross-origin redirect is not followed, so credentials stay on the first
 	assert.equal("refused" in result && result.refused, "cross-origin redirect");
 });
 
+test("an authenticated peer call pins DNS, refuses every redirect, and fails closed on private or missing answers", async () => {
+	const hop = recorded(() => ({ status: 307, location: "https://hook.example/next" }));
+	const redirected = await fetchCheckedPeer("https://hook.example/a2a", {
+		method: "POST", headers: { authorization: "Bearer peer-secret" }, body: "{\"jsonrpc\":\"2.0\"}",
+	}, { lookup: publicLookup, deliver: hop.deliver });
+	assert.equal(hop.calls.length, 1);
+	assert.deepEqual({ ip: hop.calls[0].ip, hostname: hop.calls[0].hostname, redirect: hop.calls[0].redirect },
+		{ ip: "1.2.3.4", hostname: "hook.example", redirect: "manual" });
+	assert.equal(hop.calls[0].authorization, "Bearer peer-secret");
+	assert.equal("refused" in redirected && redirected.refused, "redirects are not allowed");
+
+	let calls = 0;
+	const never: CheckedDeliver = async () => { calls++; return new Response(null, { status: 200 }); };
+	for (const url of ["https://split.example/a2a", "https://meta.example/a2a", "https://missing.example/a2a", "https://unknown.example/a2a"]) {
+		const result = await fetchCheckedPeer(url, { method: "POST", headers: { authorization: "Bearer peer-secret" }, body: "{}" }, { lookup: publicLookup, deliver: never });
+		assert.equal("refused" in result, true, url);
+	}
+	assert.equal(calls, 0, "no socket is opened after a failed address check");
+});
+
 test("a same-origin redirect is checked again and keeps the wake headers", async () => {
 	const hop = recorded((call) => call.url.endsWith("/wake")
 		? { status: 307, location: "https://hook.example/next" }

package/worker/test/wake.test.ts

@@ -2,7 +2,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { createHmac } from "node:crypto";
-import { renderWake, renderTemplate, wakeSummary, redact, addAccessHeaders, cloudflareErrorHint, PRESETS, type WakeEvent } from "../src/wake.ts";
+import { renderWake, renderTemplate, wakeSummary, redact, addAccessHeaders, cloudflareErrorHint, PRESETS, wakePayload, type WakeEvent } from "../src/wake.ts";
 
 const ev: WakeEvent = {
 	contextId: "ctx-1", taskId: "t-2", taskIds: ["t-1", "t-2"], from: "peer-a",
@@ -144,6 +144,7 @@ test("Access service-token headers are added for every preset, next to the prese
 		assert.equal(r.headers["CF-Access-Client-Id"], "abc123.access", preset);
 		assert.equal(r.headers["CF-Access-Client-Secret"], "s3cr3t-value-0123456789", preset);
 		if (preset === "hermes") assert.ok(r.headers["X-Webhook-Signature-V2"], "hermes keeps its HMAC");
+		else if (preset === "openbot") assert.ok(r.headers["x-openbot-signature"], "openbot keeps its HMAC");
 		else assert.ok(r.headers["authorization"], `${preset} keeps its bearer`);
 	}
 });
@@ -180,3 +181,38 @@ test("cloudflareErrorHint explains tunnel / Access failures", () => {
 	assert.match(cloudflareErrorHint(530, "error code: 1016", { tunnel: true }), /tunnel hostname has no matching DNS record/);
 });
 
+
+// Fixed vector independently generated with Python hashlib/hmac.
+test("openbot: envelope and signature cover the exact body and delivery ID", async () => {
+	assert.ok(PRESETS.includes("openbot"));
+	const req = (await renderWake({ preset: "openbot", url: "https://hooks.example.com/a2a", hmacSecret: "openbot-test-secret", key: "unused-key" }, ev,
+		{ nowMs: 1760000000000, requestId: "delivery-1" }))!;
+	assert.deepEqual(JSON.parse(req.body), { type: "a2a_wake", occurredAt: "2025-10-09T08:53:20.000Z", data: wakePayload(ev, "npx -y a2a-exposed@latest") });
+	assert.equal(req.headers["x-openbot-timestamp"], "1760000000");
+	assert.equal(req.headers["x-openbot-delivery-id"], "delivery-1");
+	assert.equal(req.headers["x-openbot-signature"], "sha256=8d28056bd4d5f700fd49865a0cc240bd769462d6e75aac4aa15fc7051c3ecc26");
+	assert.equal(req.headers["authorization"], undefined);
+	assert.equal(req.headers["X-Webhook-Signature-V2"], undefined);
+	const preview = redact(req);
+	assert.equal(preview.headers["x-openbot-delivery-id"], "delivery-1");
+	assert.equal(preview.headers["x-openbot-timestamp"], "1760000000");
+	assert.equal(preview.headers["x-openbot-signature"], "••••");
+	assert.ok(!JSON.stringify(preview).includes("openbot-test-secret"));
+	const unicode = (await renderWake({ preset: "openbot", url: req.url, hmacSecret: "s" }, { ...ev, preview: '雪 "quoted"\ntext' },
+		{ nowMs: 1760000000000, requestId: "delivery-2" }))!;
+	assert.equal(unicode.headers["x-openbot-signature"], "sha256=" + createHmac("sha256", "s").update(`1760000000.delivery-2.${unicode.body}`).digest("hex"));
+});
+
+test("OpenBot refuses unsigned requests; a webhook key or Access credentials cannot replace signing", async () => {
+	for (const hmacSecret of [undefined, "", "   "]) {
+		await assert.rejects(renderWake({ preset: "openbot", url: "https://hooks.example.com/wake", key: "wrong-auth", ...ACCESS, hmacSecret }, ev), /OpenBot requires WAKE_HMAC_SECRET/);
+	}
+	assert.equal(await renderWake({ preset: "openbot" }, ev), null);
+});
+
+test("OpenBot assigns a fresh delivery ID to every rendered attempt", async () => {
+	const cfg = { preset: "openbot", url: "https://hooks.example.com/wake", hmacSecret: "dummy" };
+	const first = (await renderWake(cfg, ev))!;
+	const second = (await renderWake(cfg, ev))!;
+	assert.notEqual(first.headers["x-openbot-delivery-id"], second.headers["x-openbot-delivery-id"]);
+});