a2a-exposed 0.8.2 → 0.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.2",
+	"version": "0.8.3",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -1312,7 +1312,7 @@ async function tokenEndpoint(req: Request, ctx: TenantContext): Promise<Response
 	if (now >= r.expires_ms) return oauthError("expired_token", "the device_code expired; start again");
 	if (r.status === "denied") {
 		await ctx.DB.prepare("DELETE FROM device_requests WHERE device_hash = ?").bind(hash).run();
-		return oauthError("access_denied", "the inbox owner denied this request");
+		return oauthError("access_denied", "the agent owner denied this request");
 	}
 	if (r.status === "pending") {
 		// RFC 8628 §3.5: polling faster than the interval -> slow_down, and the interval grows by 5 s for good
@@ -1321,7 +1321,7 @@ async function tokenEndpoint(req: Request, ctx: TenantContext): Promise<Response
 			return oauthError("slow_down", `polling too fast; wait at least ${r.interval_s + 5} seconds between requests`);
 		}
 		await ctx.DB.prepare("UPDATE device_requests SET last_poll_ms = ? WHERE device_hash = ?").bind(now, hash).run();
-		return oauthError("authorization_pending", "waiting for the inbox owner to approve");
+		return oauthError("authorization_pending", "waiting for the agent owner to approve");
 	}
 	// approved: single use. Only the request that flips the row gets the token; the row is then deleted.
 	const claimed = await ctx.DB.prepare("UPDATE device_requests SET status = 'redeemed' WHERE device_hash = ? AND status = 'approved'").bind(hash).run();
@@ -2029,7 +2029,7 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL, head =
 		return show(403, { kind: "error", text: "This form expired or came from another site. Start connecting again from your MCP client." });
 	if (form.decision === "deny") {
 		log("mcp_authorization_denied", { ip, clientName: c.client!.client_name });
-		return redirectWith(ctx, c.redirect!, { error: "access_denied", error_description: "the inbox owner denied access", state: c.params.state });
+		return redirectWith(ctx, c.redirect!, { error: "access_denied", error_description: "the agent owner denied access", state: c.params.state });
 	}
 	if (form.decision === "oidc") {
 		const started = await O.startOidc(ctx, {

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.2";
+export const VERSION = "0.8.3";

package/worker/test/mcp.test.ts

@@ -231,7 +231,7 @@ test("authorization: consent page, CSP allows the redirect origin, password requ
 	c = await s.consent(q, "", "deny");
 	assert.equal(c.post.status, 302);
 	const den = new URL(c.post.headers.get("location")!);
-	assert.deepEqual([den.origin + den.pathname, den.searchParams.get("error"), den.searchParams.get("state"), den.searchParams.get("iss")], [CLAUDE_CB, "access_denied", "xyz", BASE]);
+	assert.deepEqual([den.origin + den.pathname, den.searchParams.get("error"), den.searchParams.get("error_description"), den.searchParams.get("state"), den.searchParams.get("iss")], [CLAUDE_CB, "access_denied", "the agent owner denied access", "xyz", BASE]);
 	// CSRF: a POST without the cookie is refused
 	const forged = await s.call("POST", "/oauth/authorize", { form: { ...q, csrf: "x".repeat(24), password: PASSWORD, decision: "approve" }, headers: { origin: BASE } });
 	assert.equal(forged.status, 403);

package/worker/test/pairing.test.ts

@@ -271,7 +271,7 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.match(w.pairing.instructions, /never approve on your own[\s\S]*give them this link/);
 
 	let p = await s.poll(d.device_code);
-	assert.deepEqual([p.status, p.data.error], [400, "authorization_pending"]);
+	assert.deepEqual([p.status, p.data.error, p.data.error_description], [400, "authorization_pending", "waiting for the agent owner to approve"]);
 	p = await s.poll(d.device_code);
 	assert.deepEqual([p.status, p.data.error], [400, "slow_down"], "polled again at once");
 	assert.match(p.data.error_description, /at least 10 seconds/);
@@ -390,7 +390,8 @@ test("human mode: the owner token approves and denies; the device poll returns t
 	assert.equal(denied.data.decision, "denied");
 	const denyRow = s.DB.db.prepare("SELECT decided_by FROM device_requests WHERE user_code = ?").get(deny.user_code.replace("-", "")) as { decided_by: string };
 	assert.equal(denyRow.decided_by, "owner");
-	assert.equal((await s.poll(deny.device_code)).data.error, "access_denied");
+	const deniedPoll = await s.poll(deny.device_code);
+	assert.deepEqual([deniedPoll.data.error, deniedPoll.data.error_description], ["access_denied", "the agent owner denied this request"]);
 });
 
 test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {