a2a-exposed 0.8.20 → 0.8.22

package/lib/deploy.mjs

@@ -11,6 +11,14 @@ import { readHidden } from "./pair.mjs";
 import * as WD from "./workersdev.mjs";
 import { printStar } from "./feedback.mjs";
 
+export const VERSION = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+/** Arguments shared by deploy attempts, including workers.dev registration retries. */
+export function deployArgs(version, isoDate) {
+	if (!/^[A-Za-z0-9._-]+$/.test(version)) throw new Error("invalid Worker version tag");
+	return ["deploy", "--message", `a2a-exposed ${version} ${isoDate}`, "--tag", `a2a-exposed-${version}`];
+}
+
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 /** Each Claude Code routine fire is a new cloud session: a 2xx only means a session started. */
 export const CLAUDE_CODE_NOTE = [
@@ -392,7 +400,7 @@ function runTee(cmd, args, { cwd, env }) {
 /** cf deploy (secrets via a temporary chmod-600 file). If the account has no workers.dev subdomain yet and
  *  `register` names one, retry through cf's own registration prompt. Returns cf's output. */
 async function cfDeploy(dir, secrets, { register } = {}) {
-	const base = ["deploy", "--message", `a2a-exposed ${new Date().toISOString()}`];
+	const base = deployArgs(VERSION, new Date().toISOString());
 	const go = async (file) => {
 		const args = cfArgs(file ? [...base, "--secrets-file", file] : base);
 		let r = await runTee(cfBin(dir), args, { cwd: dir, env: deployEnv() });

package/lib/main.mjs

@@ -88,7 +88,7 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
                                                e.g. "node /path/to/repo/cli/bin/a2a-exposed.mjs")
                                 --worker-dir   where the Worker project (template copy) lives (default
                                                <config dir>/worker). The config dir is --config-dir / A2A_CONFIG_DIR
-  deploy [same flags]           redeploy with saved settings (secrets persist)
+  deploy [same flags]           redeploy with saved settings (secrets persist); tag the Worker version as a2a-exposed-<version>
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
@@ -145,11 +145,12 @@ Remove
                                 --dir and --worker-dir are the Worker project directory (default <config dir>/worker)
 
 Status
-  status [--json]               deployment, base URL, agent card check (fetched by the CLI: no curl needed), wake
+  status [--json]               deployment, Worker version, base URL, agent card check (fetched by the CLI), wake
                                 mode (webhook / tunnel / none = polling), tunnel state, proxy mode (--upstream):
                                 upstream card, Access credential and upstream bearer configured (separately), the
                                 live upstream check, the last failed peer call, card-leak check; warnings for peer
                                 token variables shadowing saved tokens; and the next step to run.
+                                Older Workers need deploy (exit 1); npm latest hints use the local update cache.
                                 When GET /owner/mcp reports enabled and the agent card is reachable, prints
                                 \`claude mcp add --transport http a2a-exposed <base URL>/mcp\`.
                                 A failed probe, an unreachable card, or a Worker that reports MCP off leaves that line out.

package/lib/status.mjs

@@ -8,6 +8,17 @@ import { CLI, cardUrlProblem, cfErrorCode, describeHttp, die, fingerprint, httpJ
 import { baseUrl, owner, ownerTry } from "./commands.mjs";
 import * as D from "./deploy.mjs";
 import * as T from "./tunnel.mjs";
+import { cacheFile, readCache, newer } from "./update.mjs";
+
+/** Public health probe. Only a valid health answer establishes missing version reporting. */
+export async function checkHealth(base) {
+	try {
+		const { status, data } = await httpJson(`${base}/health`, { timeout: 15000 });
+		if (status === 200 && data?.ok === true)
+			return { ok: true, version: typeof data.version === "string" && data.version ? data.version : null };
+	} catch { /* unreachable: version stays unknown */ }
+	return { ok: false, version: null };
+}
 
 /** Presets whose webhook usually listens only locally: wakes need the tunnel (or another reverse proxy). */
 export const LOCAL_PRESETS = ["openclaw-wake", "openclaw-agent", "hermes"];
@@ -111,6 +122,9 @@ export function secretsPropagating(tunnel, now = Date.now()) {
  *  as separate lines (so the next step stays one short instruction). */
 export function nextStep(s) {
 	const n = nextStepCore(s);
+	const version = s.cliVersion || D.VERSION;
+	if (s.workerVersion && s.latestVersion && newer(s.latestVersion, s.workerVersion) && !newer(s.workerVersion, version))
+		n.also.push(`a2a-exposed ${s.latestVersion} is available: run npx -y a2a-exposed@latest deploy`);
 	const sh = (s.peerTokenShadowed || []).map((k) => `${k} is set in the environment and overrides the different peer token saved in ${s.configFile} (e.g. a stale value from before \`connect\` stored a new one): send/poll use the environment value. Unset ${k} where it is set to use the saved token`);
 	return sh.length ? { ...n, also: [...n.also, ...sh] } : n;
 }
@@ -133,6 +147,11 @@ function nextStepCore(s) {
 		return fail(/HTTP 401/.test(s.ownerApi.error)
 			? `the owner token in ${s.configFile} does not match the Worker: run \`${CLI} init --rotate-owner-token\` from the machine that owns this deployment`
 			: `the owner API failed (${s.ownerApi.error}): run \`${CLI} deploy\``);
+	const version = s.cliVersion || D.VERSION;
+	if (s.workerVersion && newer(version, s.workerVersion))
+		return fail(`the deployed Worker is ${s.workerVersion}, older than this CLI (${version}): run \`${CLI} deploy\``);
+	if (s.health?.ok && s.health.version === null)
+		return fail(`the deployed Worker predates version reporting (older than ${version}): run \`${CLI} deploy\``);
 	// proxy / expose mode: the upstream answers peers, so wakes are optional (pairing notifications only)
 	const fc = s.facade;
 	if (fc) {
@@ -220,12 +239,14 @@ export async function collect() {
 		upstream: C.get("A2A_UPSTREAM_URL") || null, facade: null, upstreamVerify: null, upstreamVerifyError: "", facadePeerAuth: null,
 		upstreamNoToken: C.get("A2A_UPSTREAM_NO_TOKEN") === "1", localUpstreamToken: fingerprint(process.env.UPSTREAM_TOKEN),
 		peerTokenShadowed: shadowedPeerTokens(),
-		mcp: "unknown",
+		mcp: "unknown", health: null, workerVersion: null, cliVersion: D.VERSION, latestVersion: readCache(cacheFile())?.latest || null,
 	};
 	const envBase = (process.env.A2A_BASE_URL || "").replace(/\/$/, "");
 	if (envBase && envBase !== s.baseUrlSaved) s.baseUrlEnv = envBase;
 	if (!s.deployed || !s.baseUrl) return s;
 	s.card = await checkCard(s.baseUrl);
+	s.health = await checkHealth(s.baseUrl);
+	s.workerVersion = s.health.version;
 	if (s.hasOwnerToken) {
 		try {
 			const p = await owner("GET", "/owner/wake/preview");
@@ -335,6 +356,7 @@ export async function status(o) {
 		if (s.deployed && s.baseUrl) {
 			rows.push(["agent card", !s.card.ok ? `FAILED: ${s.card.error}` : s.card.urlProblem ? `WRONG URL: "${s.card.name}", but ${s.card.urlProblem}`
 				: `OK: "${s.card.name}" (A2A ${s.card.versions.join(", ") || "?"})`]);
+			rows.push(["worker version", `${s.workerVersion || "unknown"} (CLI ${s.cliVersion})`]);
 			rows.push(["owner API", s.ownerApi.ok ? "OK" : `FAILED: ${s.ownerApi.error}`]);
 			if (s.upstream) {
 				const f = s.facade || {};

package/lib/update.mjs

@@ -36,7 +36,7 @@ export function notice(current, cache) {
 
 export const due = (cache, now = Date.now()) => !cache || !(now - (cache.checkedAt || 0) < CHECK_INTERVAL_MS);
 
-function readCache(file) {
+export function readCache(file) {
 	try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.20",
+	"version": "0.8.22",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -4,6 +4,7 @@
 // Worker serves a rewritten agent card and device-flow pairing, and forwards authenticated JSON-RPC to the upstream.
 // Handlers take a TenantContext (tenancy.ts) built from the Worker bindings. With the hosted gates unset, that
 // context is the single self-host tenant and behaviour matches a Worker that read env.* directly.
+import { VERSION } from "./version.ts";
 import * as A from "./a2a.ts";
 import * as F from "./facade.ts";
 import { renderWake, redact, cloudflareErrorHint, wakeUrlIsTunnelHost, defaultDebounceSeconds, defaultMaxPerHour, type WakeConfig, type WakeEvent } from "./wake.ts";
@@ -1338,22 +1339,31 @@ function changed(res: { meta?: { changes?: number } } | null | undefined): numbe
 	return Number(res?.meta?.changes ?? 0);
 }
 
+/** Outbound rows whose peer label is still active. A row with no inbound label stays eligible, because send does not require one. */
+const LIVE_OUTBOUND = "SELECT o.* FROM outbound o LEFT JOIN peers p ON p.label = o.peer WHERE p.revoked_at IS NULL";
+
 /** The outbound row this push may update. A callback that arrives before SendMessage returns matches the
  *  pending row by token hash and claims the peer's task id. A row already stored under that id must
- *  present the same hash. */
+ *  present the same hash. A revoked peer matches neither, so the handler returns 401 and stores nothing. */
 async function outboundForPush(ctx: TenantContext, taskId: string, givenHash: string): Promise<Json | null> {
 	if (!givenHash) return null;
-	const rec: Json = await ctx.DB.prepare("SELECT * FROM outbound WHERE task_id = ?").bind(taskId).first();
-	if (rec) return rec.push_token_hash && A.timingSafeEqualStr(rec.push_token_hash, givenHash) ? rec : null;
-	const pending: Json = await ctx.DB.prepare("SELECT * FROM outbound WHERE push_token_hash = ? AND task_id LIKE 'pend.%'").bind(givenHash).first();
-	if (!pending?.push_token_hash || !A.timingSafeEqualStr(pending.push_token_hash, givenHash)) return null;
+	const same = (row: Json | null) => row?.push_token_hash && A.timingSafeEqualStr(row.push_token_hash, givenHash) ? row : null;
+	const rec: Json = await ctx.DB.prepare(`${LIVE_OUTBOUND} AND o.task_id = ?`).bind(taskId).first();
+	if (rec) return same(rec);
+	const pending: Json = await ctx.DB.prepare(`${LIVE_OUTBOUND} AND o.push_token_hash = ? AND o.task_id LIKE 'pend.%'`).bind(givenHash).first();
+	if (!same(pending)) return null;
 	try {
-		const renamed = await ctx.DB.prepare("UPDATE outbound SET task_id = ? WHERE task_id = ? AND push_token_hash = ?")
-			.bind(taskId, pending.task_id, givenHash).run();
-		if (changed(renamed) === 1) return { ...pending, task_id: taskId };
+		const renamed = await ctx.DB.prepare(
+			`UPDATE outbound SET task_id = ? WHERE task_id = ? AND push_token_hash = ?
+			 AND NOT EXISTS (SELECT 1 FROM peers WHERE label = outbound.peer AND revoked_at IS NOT NULL)`,
+		).bind(taskId, pending.task_id, givenHash).run();
+		if (changed(renamed) === 1) {
+			const claimed: Json = await ctx.DB.prepare(`${LIVE_OUTBOUND} AND o.task_id = ?`).bind(taskId).first();
+			return same(claimed);
+		}
 	} catch { /* the send path already stored this task id */ }
-	const now: Json = await ctx.DB.prepare("SELECT * FROM outbound WHERE task_id = ?").bind(taskId).first();
-	return now?.push_token_hash && A.timingSafeEqualStr(now.push_token_hash, givenHash) ? now : null;
+	const now: Json = await ctx.DB.prepare(`${LIVE_OUTBOUND} AND o.task_id = ?`).bind(taskId).first();
+	return same(now);
 }
 
 /** Move a pending push row onto the peer's task id without dropping an update that already arrived. */
@@ -1690,8 +1700,17 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		}
 		if (m === "DELETE" && seg[1]) {
 			const label = decodeURIComponent(seg[1]);
-			const r = await ctx.DB.prepare("UPDATE peers SET revoked_at = ? WHERE label = ? AND revoked_at IS NULL").bind(A.nowIso(), label).run();
-			if (r.meta.changes !== 1) {
+			const now = A.nowIso();
+			// Drop push hashes only while this label is still active, in the same transaction as the revoke.
+			// An unknown or already-revoked label leaves every outbound row alone, including an alias of the same name.
+			const [, revoked] = await ctx.DB.batch([
+				ctx.DB.prepare(
+					`UPDATE outbound SET push_token_hash = NULL
+					 WHERE peer = ? AND EXISTS (SELECT 1 FROM peers WHERE label = ? AND revoked_at IS NULL)`,
+				).bind(label, label),
+				ctx.DB.prepare("UPDATE peers SET revoked_at = ? WHERE label = ? AND revoked_at IS NULL").bind(now, label),
+			]);
+			if (changed(revoked) !== 1) {
 				const ex: Json = await ctx.DB.prepare("SELECT revoked_at FROM peers WHERE label = ?").bind(label).first();
 				return json({ revoked: false, error: ex ? `the token with label ${label} was already revoked (${ex.revoked_at})` : `no active token with label ${label} (see token list)` }, 404);
 			}
@@ -3404,7 +3423,7 @@ async function handle(req: Request, ctx: TenantContext, ectx: ExecutionContext,
 		// legacy discovery path (A2A 0.2): the 0.3-shaped card that clients of that era parse
 		if (req.method === "GET" && path === "/.well-known/agent.json")
 			return json(agentCard03(ctx, await agentCard(ctx)), 200, { "access-control-allow-origin": "*", "cache-control": cardCacheControl(ctx) });
-		if (req.method === "GET" && path === "/health") return json({ ok: true, publicUrl: ctx.PUBLIC_URL, mode: proxyMode(ctx) ? "proxy" : "inbox", mcp: mcpOn(ctx) });
+		if (req.method === "GET" && path === "/health") return json({ ok: true, version: VERSION, publicUrl: ctx.PUBLIC_URL, mode: proxyMode(ctx) ? "proxy" : "inbox", mcp: mcpOn(ctx) });
 		if (path === "/mcp") return mcpOn(ctx) ? await handleMcp(req, ctx, ectx, url) : json({ error: "not_found", error_description: "the MCP server is turned off on this A2A endpoint (MCP=off)" }, 404);
 		if (mcpOn(ctx)) {
 			if (req.method === "GET" && path === "/.well-known/oauth-protected-resource/mcp") return json(mcpResourceMetadata(ctx), 200, { "access-control-allow-origin": "*" });

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.20";
+export const VERSION = "0.8.22";

package/worker/test/hosted.test.ts

@@ -7,6 +7,7 @@ import path from "node:path";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { Miniflare, convertV4MiniflareOptions } from "miniflare";
+import { VERSION } from "../src/version.ts";
 import worker from "../src/index.ts";
 import { sha256 } from "../src/a2a.ts";
 import { sealWakeSecrets } from "../src/wake-secrets.ts";
@@ -81,6 +82,7 @@ test("gates unset: the hosted entry matches the self-host handler, including TEN
 	const base = "https://agent.example.com";
 	const nodeEnv = { DB: d1(MIGRATIONS), PUBLIC_URL: base, OWNER_TOKEN: "owner-secret" };
 	const nodeHealth = await text(await worker.fetch(new Request(base + "/health"), nodeEnv as never, ectx as never));
+	assert.deepEqual(JSON.parse(nodeHealth), { ok: true, version: VERSION, publicUrl: base, mode: "inbox", mcp: true });
 	const nodeDenied = await text(await worker.fetch(new Request(base + "/", {
 		method: "POST", headers: { "content-type": "application/json" },
 		body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: {} }),
@@ -180,6 +182,9 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	assert.equal(bobPush.result.applied, true, JSON.stringify(bobPush.result));
 	await kv.put("tenant:bobby", JSON.stringify({ id: "id-bobby", status: "active", region: "", version: 1 }));
 
+	assert.deepEqual(await (await mf.dispatchFetch("https://alice.example.com/health")).json(),
+		{ ok: true, version: VERSION, publicUrl: "https://alice.example.com", mode: "inbox", mcp: true });
+
 	const card = async (name: string, headers?: HeadersInit) => (await mf.dispatchFetch(`https://${name}.example.com/.well-known/agent-card.json`, { headers })).json() as Promise<{ name: string }>;
 	const aliceCard = await mf.dispatchFetch("https://alice.example.com/.well-known/agent-card.json");
 	assert.equal(aliceCard.headers.get("cache-control"), "public, max-age=60");

package/worker/test/outbound-push.test.ts

@@ -2,6 +2,7 @@
 // A connector send attaches a push config only when the peer card advertises it, and stores the token
 // hash before SendMessage returns. Inbox marks a reply seen only when the stored update is still the
 // snapshot that response returned, on every storage backend this file runs against.
+// Revoking the peer label clears that peer's push hashes. A later push with the old token is 401.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { sha256 } from "../src/a2a.ts";
@@ -340,3 +341,192 @@ test("message and artifactUpdate pushes supply inbox text", async () => {
 		assert.equal((history.data as Hist[]).some((r) => r.event === "push" && r.text === c.text && r.state === c.state), true, history.text);
 	}
 });
+
+type OutSnap = {
+	task_id?: string;
+	context_id?: string;
+	peer?: string;
+	task_json?: string | null;
+	updates_json?: string;
+	updates_seen?: number;
+	hash_cleared?: number;
+};
+
+test("revoking a peer rejects its old push token on the self-hosted and hosted paths", async (t) => {
+	const logs: string[] = [];
+	const origLog = console.log;
+	console.log = (...args: unknown[]) => {
+		logs.push(args.map((a) => String(a)).join(" "));
+		origLog(...args);
+	};
+	const pushByHost = new Map<string, string>();
+	const origFetch = globalThis.fetch;
+	globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+		const url = new URL(reqUrl(input));
+		if (init?.method !== "POST") {
+			return new Response(JSON.stringify(card(`https://${url.host}`, "1.0", true)), { status: 200, headers: { "content-type": "application/json" } });
+		}
+		const body = JSON.parse(String(init.body)) as { params?: { configuration?: { taskPushNotificationConfig?: { token?: string } } } };
+		const token = body.params?.configuration?.taskPushNotificationConfig?.token || "";
+		pushByHost.set(url.host, token);
+		const taskId = url.host.startsWith("bea.") ? "task-bea" : "task-ada";
+		const contextId = url.host.startsWith("bea.") ? "ctx-bea" : "ctx-ada";
+		return new Response(JSON.stringify({ jsonrpc: "2.0", id: "1", result: taskResult(taskId, contextId, "1.0") }), { status: 200, headers: { "content-type": "application/json" } });
+	}) as typeof fetch;
+	t.after(() => {
+		globalThis.fetch = origFetch;
+		console.log = origLog;
+	});
+
+	const secrets: string[] = [];
+	const outputs: string[] = [];
+	const hides = (blob: string, where: string) => {
+		for (const secret of secrets) assert.equal(secret.length > 0 && blob.includes(secret), false, `${where} contains a token`);
+	};
+
+	for (const mode of ["single", "host"] as const) {
+		pushByHost.clear();
+		const db = d1(MIGRATIONS);
+		const publicUrl = "https://owner.example.net";
+		const ctx = mode === "single"
+			? resolveTenant({ DB: db, PUBLIC_URL: publicUrl, OWNER_TOKEN: OWNER, AGENT_NAME: "Owner" } as WorkerBindings)
+			: hostedTenantContext({
+				DB: db, TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", PUBLIC_URL: publicUrl, OWNER_TOKEN: "platform-owner",
+			} as WorkerBindings, {
+				id: "ten_revoke_push", db, publicUrl, ownerTokenHash: await sha256(OWNER), status: "active", config: { AGENT_NAME: "Owner" },
+			});
+		const http = (method: string, path: string, body?: unknown) => owner(ctx, method, path, body);
+		const call = async (method: string, path: string, body?: unknown) => {
+			if (mode === "single") return http(method, path, body);
+			const res = await runOwnerRpc(ctx, ectx as never, {
+				accountId: "acct_owner", method, path, ...(body === undefined ? {} : { body }),
+			});
+			const text = JSON.stringify(res.body);
+			return { status: res.status, data: res.body, text };
+		};
+		const note = (res: { text: string }) => { outputs.push(res.text); return res; };
+
+		const issue = async (label: string) => {
+			const issued = await http("POST", "/owner/peers", { label });
+			assert.equal(issued.status, 200, issued.text);
+			const token = (issued.data as { token?: string }).token || "";
+			assert.match(token, /^a2aow_/);
+			secrets.push(token);
+			return token;
+		};
+		const beaBearer = await issue("bea");
+		const adaBearer = await issue("ada");
+		for (const [alias, bearer] of [["bea", beaBearer], ["ada", adaBearer]] as const) {
+			const synced = note(await call("PUT", `/owner/outbound-peers/${alias}`, { url: `https://${alias}.example.net`, token: bearer }));
+			assert.equal(synced.status, 200, synced.text);
+			assert.equal(JSON.stringify(synced.data).includes(bearer), false);
+		}
+		for (const alias of ["bea", "ada"] as const) {
+			const sent = note(await call("POST", "/owner/mcp/send", { to: alias, text: `hello ${alias}`, contextId: `ctx-${alias}` }));
+			assert.equal(sent.status, 200, sent.text);
+			assert.equal((sent.data as SendBody).isError, false, sent.text);
+			assert.match((sent.data as SendBody).text || "", new RegExp(`task task-${alias}`));
+		}
+		const beaPush = pushByHost.get("bea.example.net") || "";
+		const adaPush = pushByHost.get("ada.example.net") || "";
+		assert.equal(beaPush.length > 0 && adaPush.length > 0 && beaPush !== adaPush, true);
+		secrets.push(beaPush, adaPush);
+		const pendingToken = "pending-push-token";
+		secrets.push(pendingToken);
+		await db.prepare(
+			`INSERT INTO outbound (task_id, context_id, peer, endpoint, protocol, push_token_hash, sent_at, updates_json, updates_seen)
+			 VALUES ('pend.revoked', 'ctx-bea', 'bea', 'https://bea.example.net/', '1.0', ?, '2026-01-01T00:00:00.000Z', '[]', 0)`,
+		).bind(await sha256(pendingToken)).run();
+
+		const missed = note(await call("DELETE", "/owner/peers/nobody"));
+		assert.equal(missed.status, 404, missed.text);
+		const beforeRevoke = await db.prepare("SELECT push_token_hash IS NULL AS cleared FROM outbound WHERE task_id = ?").bind("task-bea").first() as { cleared?: number };
+		assert.equal(Number(beforeRevoke.cleared), 0);
+
+		const revoked = note(await call("DELETE", "/owner/peers/bea"));
+		assert.equal(revoked.status, 200, revoked.text);
+		assert.deepEqual(revoked.data, { revoked: true, label: "bea" });
+		const again = note(await call("DELETE", "/owner/peers/bea"));
+		assert.equal(again.status, 404, again.text);
+
+		const cleared = async (taskId: string) => Number((await db.prepare("SELECT push_token_hash IS NULL AS cleared FROM outbound WHERE task_id = ?").bind(taskId).first() as { cleared?: number }).cleared);
+		assert.equal(await cleared("task-bea"), 1);
+		assert.equal(await cleared("pend.revoked"), 1);
+		assert.equal(await cleared("task-ada"), 0);
+
+		const snap = async (taskId: string) => await db.prepare(
+			`SELECT task_id, context_id, peer, task_json, updates_json, updates_seen, push_token_hash IS NULL AS hash_cleared
+			 FROM outbound WHERE task_id = ?`,
+		).bind(taskId).first() as OutSnap;
+		const histCount = async (contextId: string) => Number((await db.prepare("SELECT COUNT(*) AS n FROM history WHERE context_id = ?").bind(contextId).first() as { n: number }).n);
+		const taskCount = async () => Number((await db.prepare("SELECT COUNT(*) AS n FROM tasks").first() as { n: number }).n);
+		const beaBefore = await snap("task-bea");
+		const beaHist = await histCount("ctx-bea");
+		const tasksBefore = await taskCount();
+		const push = async (token: string, taskId: string, text: string) => {
+			const res = await dispatch(new Request("https://owner.example.net/push", {
+				method: "POST",
+				headers: { "content-type": "application/json", "x-a2a-notification-token": token },
+				body: JSON.stringify({ task: { id: taskId, contextId: "ctx-bea", status: { state: "completed", message: { parts: [{ text }] } } } }),
+			}), ctx, ectx as never);
+			const body = await res.text();
+			outputs.push(body);
+			return { status: res.status, body };
+		};
+		const rejected = await push(beaPush, "task-bea", "revoked reply");
+		assert.equal(rejected.status, 401);
+		assert.equal(rejected.body, '{"error":"unauthorized"}');
+		assert.deepEqual(await snap("task-bea"), beaBefore);
+		assert.equal(await histCount("ctx-bea"), beaHist);
+		assert.equal(await taskCount(), tasksBefore);
+		const wake = await db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind("ctx-bea").first() as { pending_json?: string | null } | null;
+		assert.equal(wake?.pending_json ?? null, null);
+
+		const pending = await push(pendingToken, "task-claimed", "pending reply");
+		assert.equal(pending.status, 401);
+		assert.equal(pending.body, '{"error":"unauthorized"}');
+		assert.equal(await cleared("pend.revoked"), 1);
+		const claimed = await db.prepare("SELECT task_id FROM outbound WHERE task_id = ?").bind("task-claimed").first();
+		assert.equal(claimed, null);
+		assert.equal(await histCount("ctx-bea"), beaHist);
+		assert.deepEqual(await snap("task-bea"), beaBefore);
+
+		const standin = "restored-push-token";
+		secrets.push(standin);
+		await db.prepare("UPDATE outbound SET push_token_hash = ? WHERE task_id = ?").bind(await sha256(standin), "task-bea").run();
+		const restored = await push(standin, "task-bea", "restored reply");
+		assert.equal(restored.status, 401);
+		assert.equal(restored.body, '{"error":"unauthorized"}');
+		const afterRestore = await snap("task-bea");
+		assert.equal(Number(afterRestore.hash_cleared), 0);
+		assert.equal(afterRestore.task_json, beaBefore.task_json);
+		assert.equal(afterRestore.updates_json, beaBefore.updates_json);
+		assert.equal(afterRestore.updates_seen, beaBefore.updates_seen);
+		assert.equal(await histCount("ctx-bea"), beaHist);
+
+		const accepted = await dispatch(new Request("https://owner.example.net/push", {
+			method: "POST",
+			headers: { "content-type": "application/json", "x-a2a-notification-token": adaPush },
+			body: JSON.stringify({ task: { id: "task-ada", contextId: "ctx-ada", status: { state: "completed", message: { parts: [{ text: "ada reply" }] } } } }),
+		}), ctx, ectx as never);
+		const acceptedText = await accepted.text();
+		outputs.push(acceptedText);
+		assert.equal(accepted.status, 200, acceptedText);
+		const adaRow = await snap("task-ada");
+		assert.match(String(adaRow.updates_json), /ada reply/);
+		assert.equal(Number(adaRow.hash_cleared), 0);
+		const adaHist = note(await call("GET", "/owner/history/ctx-ada"));
+		assert.equal((adaHist.data as Hist[]).some((r) => r.event === "push" && r.text === "ada reply"), true, adaHist.text);
+		const beaHistory = note(await call("GET", "/owner/history/ctx-bea"));
+		assert.equal((beaHistory.data as Hist[]).some((r) => r.text === "revoked reply" || r.text === "pending reply" || r.text === "restored reply"), false, beaHistory.text);
+		assert.deepEqual(await snap("task-bea"), afterRestore);
+	}
+
+	hides(outputs.join("\n"), "response");
+	hides(logs.join("\n"), "log");
+	for (const secret of secrets) {
+		const hash = await sha256(secret);
+		assert.equal(outputs.join("\n").includes(hash), false, "response contains a token hash");
+		assert.equal(logs.join("\n").includes(hash), false, "log contains a token hash");
+	}
+});

package/worker/test/tenancy.test.ts

@@ -1,5 +1,6 @@
 // Tenant context: gates default off, self-host owner auth and peer-token key stay compatible, hosted uses a hash
 // and TENANT_SECRETS_KEY. Run: npm test
+import { VERSION } from "../src/version.ts";
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import worker from "../src/index.ts";
@@ -258,7 +259,7 @@ test("fetch path: gates set or unset, the self-host Worker still answers from OW
 	const plain = await call(base, "/health");
 	const reserved = await call({ ...base, ...gates }, "/health");
 	const empty = await call({ ...base, TENANCY: "", QUOTAS: "", DATA_REGION: "", SIGNUP_URL: "" }, "/health");
-	assert.deepEqual(plain.data, { ok: true, publicUrl: BASE, mode: "inbox", mcp: true });
+	assert.deepEqual(plain.data, { ok: true, version: VERSION, publicUrl: BASE, mode: "inbox", mcp: true });
 	assert.deepEqual(reserved.data, plain.data);
 	assert.deepEqual(empty.data, plain.data);