a2a-exposed 0.8.22 → 0.8.23

package/worker/src/mcp.ts

@@ -355,8 +355,15 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		description: `Fetch the current state of a task you sent to a peer (from send) and record it in the history. ${RULES}`,
 		inputSchema: { type: "object", properties: { taskId: str("Task id returned by send") }, required: ["taskId"], additionalProperties: false } },
 	{ name: "list_peers", title: "List peers", annotations: ro,
-		description: "Peers you can send to (outbound, synced with `peers sync`) and the labels of agents holding a token for this A2A endpoint (inbound; who can message you). Token values are never shown.",
+		description: "Peers you can send to (outbound, synced with `peers sync`) and the labels of agents holding a token for this A2A endpoint (inbound; who can message you). Token values are never shown. An inbound peer with no card URL has no callback yet.",
 		inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+	{ name: "announce_address", title: "Announce address", annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+		description: `Tell paired peers this inbox's current https agent-card URL, using the pairing token already stored for each one. Pass to for one alias, or all: true. A peer checks that the card proves the same pairing identity before it switches. A peer that does not implement this keeps the current pairing. This does not approve a pairing. ${RULES}`,
+		inputSchema: { type: "object", properties: {
+			to: str("One synced peer alias"),
+			all: { type: "boolean", description: "Announce to every synced peer" },
+			reissue: { type: "boolean", description: "Mint a new return token after the owner revoked the previous one. Requires to, and only after the human asks." },
+		}, additionalProperties: false } },
 	{ name: "pairing_requests", title: "Pending pairing requests", annotations: ro,
 		description: "Agents asking to connect to this A2A endpoint (read-only). Show your human who is asking, the code and the link. NEVER approve or deny on your own. The owner approves with the approval password on the /device link, with the owner token, or on the dashboard when a Manage link is set (this tool's output names that link). The names and card URLs are claimed by the requester (untrusted).",
 		inputSchema: { type: "object", properties: {}, additionalProperties: false } },

package/worker/src/migrations.ts

@@ -13,6 +13,8 @@ import m0010 from "../migrations/0010_conversation_peer.sql?raw";
 import m0011 from "../migrations/0011_conversation_owner.sql?raw";
 import m0012 from "../migrations/0012_conversation_peer_owner.sql?raw";
 import m0013 from "../migrations/0013_reply_delivery.sql?raw";
+import m0014 from "../migrations/0014_peer_address.sql?raw";
+import m0015 from "../migrations/0015_outbound_source.sql?raw";
 import type { Migration } from "./storage.ts";
 
 export const MIGRATIONS: Migration[] = [
@@ -29,4 +31,6 @@ export const MIGRATIONS: Migration[] = [
 	{ name: "0011_conversation_owner.sql", sql: m0011 },
 	{ name: "0012_conversation_peer_owner.sql", sql: m0012 },
 	{ name: "0013_reply_delivery.sql", sql: m0013 },
+	{ name: "0014_peer_address.sql", sql: m0014 },
+	{ name: "0015_outbound_source.sql", sql: m0015 },
 ];

package/worker/src/owner-rpc.ts

@@ -29,6 +29,7 @@ const SECRET_KEYS = new Set([
 	"token", "access_token", "refresh_token", "device_code",
 	"ownertoken", "owner_token", "secretsenc", "secrets_enc",
 	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
+	"privatekey", "private_key",
 ]);
 
 /**
@@ -154,6 +155,11 @@ const ROUTES: RouteDef[] = [
 	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
 	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
 	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
+	{ method: "GET", name: "GET /owner/address", take: (s) => s.length === 2 && s[1] === "address", search: noQuery, path: () => "/owner/address" },
+	{ method: "GET", name: "GET /owner/identity", take: (s) => s.length === 2 && s[1] === "identity", search: noQuery, path: () => "/owner/identity" },
+	{ method: "POST", name: "POST /owner/peers/announce", take: (s) => s.length === 3 && s[1] === "peers" && s[2] === "announce", search: noQuery, path: () => "/owner/peers/announce" },
+	{ method: "PUT", name: "PUT /owner/address-forward", take: (s) => s.length === 2 && s[1] === "address-forward", search: noQuery, path: () => "/owner/address-forward" },
+	{ method: "DELETE", name: "DELETE /owner/address-forward", take: (s) => s.length === 2 && s[1] === "address-forward", search: noQuery, path: () => "/owner/address-forward" },
 	{ method: "GET", name: "GET /owner/peers", take: (s) => s.length === 2 && s[1] === "peers", search: noQuery, path: () => "/owner/peers" },
 	{ method: "DELETE", name: "DELETE /owner/peers/:label", take: (s) => s.length === 3 && s[1] === "peers" && LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/peers/${s[2]}` },
 	{ method: "GET", name: "GET /owner/pairing", take: (s) => s.length === 2 && s[1] === "pairing", search: noQuery, path: () => "/owner/pairing" },
@@ -164,6 +170,7 @@ const ROUTES: RouteDef[] = [
 	{ method: "POST", name: "POST /owner/mcp/send", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "send", search: noQuery, path: () => "/owner/mcp/send" },
 	{ method: "POST", name: "POST /owner/mcp/reply", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "reply", search: noQuery, path: () => "/owner/mcp/reply" },
 	{ method: "POST", name: "POST /owner/mcp/mark_working", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "mark_working", search: noQuery, path: () => "/owner/mcp/mark_working" },
+	{ method: "POST", name: "POST /owner/mcp/announce_address", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "announce_address", search: noQuery, path: () => "/owner/mcp/announce_address" },
 	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
 	{ method: "PUT", name: "PUT /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
 	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
@@ -232,14 +239,51 @@ function outboundPeerBody(body: unknown): { ok: true; value: Record<string, stri
 	return { ok: true, value };
 }
 
+/** `{ to }` or `{ all: true }` for an address announcement. No token, no private key. */
+function announceBody(body: unknown): { ok: true; value: Record<string, string> } | { ok: false; error: string } {
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "body must be an object" };
+	const keys = Object.keys(body);
+	if (keys.length > 3 || keys.some((key) => key !== "to" && key !== "all" && key !== "reissue")) return { ok: false, error: "body is not allowed" };
+	const raw = body as Record<string, unknown>;
+	const all = raw.all === true || raw.all === "true";
+	const reissue = raw.reissue === true || raw.reissue === "true";
+	const to = raw.to;
+	if (to !== undefined && (typeof to !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(to))) return { ok: false, error: "to is invalid" };
+	if (all === !!to) return { ok: false, error: "pass to (one alias) or all: true" };
+	if (reissue && (all || !to)) return { ok: false, error: "reissue needs one alias" };
+	const value: Record<string, string> = all ? { all: "true" } : { to: String(to) };
+	if (reissue) value.reissue = "true";
+	return { ok: true, value };
+}
+
+/** `{ cardUrl, hours? }` for the grace forward. The card URL is public. */
+function forwardBody(body: unknown): { ok: true; value: Record<string, string> } | { ok: false; error: string } {
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "body must be an object" };
+	const keys = Object.keys(body);
+	if (!keys.length || keys.length > 2 || keys.some((key) => key !== "cardUrl" && key !== "hours")) return { ok: false, error: "body is not allowed" };
+	const raw = body as Record<string, unknown>;
+	if (typeof raw.cardUrl !== "string" || !raw.cardUrl || raw.cardUrl.length > PEER_URL_MAX) return { ok: false, error: "cardUrl is invalid" };
+	const value: Record<string, string> = { cardUrl: raw.cardUrl };
+	if (raw.hours !== undefined) {
+		const hours = typeof raw.hours === "number" ? raw.hours : typeof raw.hours === "string" ? Number(raw.hours) : NaN;
+		if (!Number.isInteger(hours) || hours < 1 || hours > 720) return { ok: false, error: "hours is invalid" };
+		value.hours = String(hours);
+	}
+	return { ok: true, value };
+}
+
 /**
  * Body allowed on this owner RPC route.
- * MCP send, reply, and mark_working receive a flat object of tool arguments.
+ * MCP send, reply, mark_working, and announce_address receive a flat object of tool arguments.
  * PUT /owner/outbound-peers/:alias receives `{ url, token }`. The token is sealed before any log line.
+ * PUT /owner/address-forward receives `{ cardUrl, hours? }`. POST /owner/peers/announce receives `{ to }` or `{ all: true }`.
+ * The pairing identity private key is not accepted on this RPC.
  * Every other route accepts only an absent body.
  */
 export function ownerRpcBody(routeName: string, body: unknown): { ok: true; value?: Record<string, string> } | { ok: false; error: string } {
 	if (routeName === "PUT /owner/outbound-peers/:alias") return outboundPeerBody(body);
+	if (routeName === "POST /owner/peers/announce" || routeName === "POST /owner/mcp/announce_address") return announceBody(body);
+	if (routeName === "PUT /owner/address-forward") return forwardBody(body);
 	const spec = MCP_ARGS[routeName];
 	if (!spec) {
 		if (body !== undefined && body !== null) return { ok: false, error: "this call takes no body" };

package/worker/src/pairing.ts

@@ -202,7 +202,7 @@ function clockTime(ms: number, timeZone: string): string {
 	return `${hour}:${minute}`;
 }
 
-export type PageRequest = { userCode: string; clientName: string; clientId: string; agentCardUrl: string; ip: string; country: string; createdMs: number; expiresMs: number; replacesLabel?: string; tokenLabel?: string };
+export type PageRequest = { userCode: string; clientName: string; clientId: string; agentCardUrl: string; ip: string; country: string; createdMs: number; expiresMs: number; replacesLabel?: string; tokenLabel?: string; identityFingerprint?: string };
 export type PageModel = {
 	agentName: string;
 	mode: Mode;
@@ -238,11 +238,12 @@ export function devicePage(m: PageModel, nonce: string): string {
 		["Requested from", `${[r.ip || "unknown address", r.country].filter(Boolean).join(", ")} (IP address of the machine that asked to connect)`],
 		["Expires", expiresText(r.expiresMs, Date.now(), m.timeZone)],
 		...(r.replacesLabel ? [["Replaces", `the active token "${r.replacesLabel}" (the requester proved it holds it); approving issues a new token under the same label and the old one stops working`]] : []),
+		...(r.identityFingerprint ? [["Pairing identity", r.identityFingerprint]] : []),
 	] : [];
 	const tokenLabel = r?.tokenLabel || "<label>";
 	const revoke = `${m.cli} token revoke ${tokenLabel}`;
 	const details = r ? `<table>${rows.map(([k, v]) => `<tr><th>${esc(k)}</th><td>${esc(v)}</td></tr>`).join("")}</table>
-<p class="w">Approve only if you expected this request and the code matches the one you were given. The name, alias and card URL are claimed by the requester. Approving gives it a token that can send messages and trigger wakes. Message text from peers is untrusted. Revoke the token ${esc(tokenLabel)} any time with <code>${esc(revoke)}</code>.</p>` : "";
+<p class="w">Approve only if you expected this request and the code matches the one you were given. The name, alias and card URL are claimed by the requester. Approving gives it a token that can send messages and trigger wakes. Message text from peers is untrusted. Revoke the token ${esc(tokenLabel)} any time with <code>${esc(revoke)}</code>.</p>${r.identityFingerprint ? `<p class="w">This request includes a pairing identity (<code>${esc(r.identityFingerprint)}</code>). Approving lets this inbox call that agent back at an address the same identity later proves, without a second pairing approval. The return credential is an ordinary peer token you can revoke. A change of host is shown to you.</p>` : ""}${r && !r.agentCardUrl ? `<p class="w">No agent card was given. This agent can send messages after approval. Replies stay stored on the task until it announces an address.</p>` : ""}` : "";
 	const noPassword = `<p class="n info">No approval password is set yet. Easiest: ask your agent to run <code>${esc(m.cli)} pair set-password --web</code> and send you the one-time link, then set the password on that page. Or run <code>${esc(m.cli)} pair set-password</code> yourself in a terminal on the owner's machine. Then reload this page. You can deny without a password.</p>`;
 	const denyOnly = `<form method="post" action="/device">
 <input type="hidden" name="csrf" value="${esc(m.csrf)}"><input type="hidden" name="user_code" value="${esc(r ? formatUserCode(r.userCode) : "")}">

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.22";
+export const VERSION = "0.8.23";

package/worker/src/wake-target.ts

@@ -217,7 +217,7 @@ async function deliverPinnedPeer(url: string, init: RequestInit, target: { ip: s
 		timeouts: { totalMs: REQUEST_TIMEOUT_MS },
 	});
 	try {
-		const res = await client.fetch(url, { method: init.method, headers: init.headers, body: init.body, redirect: "manual" });
+		const res = await client.fetch(url, { method: init.method, headers: init.headers, body: init.body, redirect: "manual", signal: init.signal ?? undefined });
 		return await peerResponseForCaller(res);
 	} catch (e) {
 		if (e instanceof TlsError || e instanceof CertificateError) throw new Error("TLS Handshake Failed.");
@@ -234,7 +234,9 @@ export async function fetchCheckedPeer(
 	init: RequestInit,
 	deps: Pick<WakeDeps, "lookup" | "connect" | "deliver"> = {},
 ): Promise<{ response: Response } | { refused: string }> {
-	const checked = await checkedWakeAddresses(url, deps.lookup ?? lookupAddresses);
+	init.signal?.throwIfAborted();
+	const checked = await checkedWakeAddresses(url, deps.lookup ?? ((host) => lookupAddresses(host, init.signal ?? undefined)));
+	init.signal?.throwIfAborted();
 	if ("refused" in checked) return checked;
 	const target = { ip: checked.ips[0]!, hostname: checked.hostname };
 	const nextInit: RequestInit = { ...init, redirect: "manual" };

package/worker/test/address.test.ts

@@ -0,0 +1,414 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { sha256 } from "../src/a2a.ts";
+import * as Addr from "../src/address.ts";
+import { clearDirectoryCache } from "../src/directory.ts";
+import { dispatch, runOwnerRpc } from "../src/index.ts";
+import { redactExport, exportRows } from "../src/export.ts";
+import { hostedTenantContext, type DoNamespace, type KvNamespace, type TenantContext, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const MIGRATIONS = new URL("../migrations/", import.meta.url);
+const ectx = { waitUntil(p: Promise<unknown>) { p.catch(() => {}); }, passThroughOnException() {} };
+
+test("address proofs: a card signature is bound to that URL and that key", async () => {
+	const id = await Addr.generateIdentity();
+	const cardUrl = "https://alice.example.com/.well-known/agent-card.json";
+	const signature = await Addr.signBytes(id.privateKey, Addr.identityMessage(cardUrl, id.publicKey));
+	assert.ok(signature);
+	const card = { capabilities: { extensions: [Addr.identityExtension(id.publicKey, cardUrl, signature!)] } };
+	assert.equal(await Addr.cardProves(card, id.publicKey, cardUrl), true);
+	assert.equal(await Addr.cardProves(card, id.publicKey, "https://evil.example.com/.well-known/agent-card.json"), false);
+	const other = await Addr.generateIdentity();
+	assert.equal(await Addr.cardProves(card, other.publicKey, cardUrl), false);
+	assert.equal(Addr.canonicalCardUrl("http://alice.example.com/.well-known/agent-card.json"), "");
+	assert.equal(Addr.canonicalCardUrl("https://alice.example.com/.well-known/agent-card.json?x=1"), "");
+	assert.equal(Addr.graceHours(undefined), 168);
+	assert.equal(Addr.graceHours(0), null);
+	assert.equal(Addr.announceOutcome(200, { result: { ok: true } }).status, "updated");
+	assert.equal(Addr.announceOutcome(200, { error: { code: -32601, message: "Method not found" } }).status, "unsupported");
+	assert.equal(Addr.cleanReverseToken("a2aow_" + "a".repeat(43)).length > 0, true);
+	assert.equal(Addr.cleanReverseToken("owner-secret-value"), "");
+});
+
+async function world(t: { after: (fn: () => void) => void }) {
+	clearDirectoryCache();
+	t.after(clearDirectoryCache);
+	const store = new Map<string, string>();
+	const kv: KvNamespace = {
+		async get(key: string, type?: "json") { const v = store.get(key); return v == null ? null : type === "json" ? JSON.parse(v) : v; },
+		async put(key: string, value: string) { store.set(key, value); },
+	};
+	const byId = new Map<string, TenantContext>();
+	const ns: DoNamespace = {
+		idFromName(name: string) { return name; },
+		get(id: unknown) {
+			return { async fetch(req: Request) {
+				const ctx = byId.get(String(id));
+				if (!ctx) return new Response("missing", { status: 404 });
+				return dispatch(req, ctx, ectx as never);
+			} };
+		},
+	};
+	const env = { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-key", DATA_REGION: "", TENANT_DIRECTORY: kv, TENANT_DO: ns } as WorkerBindings;
+	const make = async (name: string, ownerToken: string) => {
+		const db = d1(MIGRATIONS);
+		const ctx = hostedTenantContext(env, { id: `id-${name}`, db, publicUrl: `https://${name}.example.com`, ownerTokenHash: await sha256(ownerToken), status: "active", config: { AGENT_NAME: name } });
+		byId.set(`id-${name}`, ctx);
+		store.set(`tenant:${name}`, JSON.stringify({ id: `id-${name}`, status: "active", region: "default", version: 1 }));
+		return { ctx, db, ownerToken };
+	};
+	const alice = await make("alice", "owner-alice");
+	const bob = await make("bob", "owner-bob");
+	const carol = await make("carol", "owner-carol");
+	const call = async (ctx: TenantContext, path: string, init: RequestInit = {}) => {
+		const res = await dispatch(new Request(ctx.PUBLIC_URL + path, init), ctx, ectx as never);
+		const text = await res.text();
+		let data: any = null;
+		try { data = JSON.parse(text); } catch { data = text; }
+		return { status: res.status, data, headers: res.headers };
+	};
+	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) =>
+		runOwnerRpc(ctx, ectx as never, { accountId, method, path, ...(body === undefined ? {} : { body }) });
+	return { alice, bob, carol, call, owner };
+}
+
+async function pair(bob: { ctx: TenantContext; ownerToken: string }, call: (ctx: TenantContext, path: string, init?: RequestInit) => Promise<{ status: number; data: any }>, identity?: string) {
+	const started = await call(bob.ctx, "/oauth/device_authorization", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ client_name: "Alice", client_id: "alice", ...(identity ? { agent_identity: identity } : {}) }),
+	});
+	assert.equal(started.status, 200, JSON.stringify(started.data));
+	const code = String(started.data.user_code).replace("-", "");
+	const approved = await call(bob.ctx, `/owner/pairing/${code}/approve`, { method: "POST", headers: { authorization: `Bearer ${bob.ownerToken}` } });
+	assert.equal(approved.status, 200, JSON.stringify(approved.data));
+	const token = await call(bob.ctx, "/oauth/token", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: started.data.device_code }),
+	});
+	assert.equal(token.status, 200, JSON.stringify(token.data));
+	assert.match(token.data.access_token, /^a2aow_/);
+	return { access: token.data.access_token as string, label: token.data.peer_label as string };
+}
+
+async function send(bob: TenantContext, token: string, text: string, contextId: string) {
+	const res = await dispatch(new Request(bob.PUBLIC_URL + "/", {
+		method: "POST",
+		headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "s", method: "message/send", params: { message: { kind: "message", role: "user", messageId: `m-${text}`, contextId, parts: [{ kind: "text", text }] }, configuration: { blocking: false } } }),
+	}), bob, ectx as never);
+	const data = await res.json() as any;
+	assert.equal(res.status, 200, JSON.stringify(data));
+	return data.result.id as string;
+}
+
+test("an agent with no address can pair and send; replies stay on the task until a verified announcement", async (t) => {
+	const { alice, bob, call, owner } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	const installed = await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ publicKey: ident.publicKey, privateKey: ident.privateKey }),
+	});
+	assert.equal(installed.status, 200, JSON.stringify(installed.data));
+	assert.equal(JSON.stringify(installed.data).includes(ident.privateKey), false);
+	const paired = await pair(bob, call, ident.publicKey);
+	const taskId = await send(bob.ctx, paired.access, "question", "ctx-none");
+	const logs: string[] = [];
+	const orig = console.log;
+	console.log = (line?: unknown) => { logs.push(String(line)); };
+	let first: any;
+	try {
+		first = await owner(bob.ctx, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "stored answer", state: "completed" });
+	} finally { console.log = orig; }
+	assert.equal(first.status, 200, JSON.stringify(first.body));
+	assert.equal(first.body.structuredContent.status, "stored-only");
+	assert.equal(JSON.stringify(first.body).includes("a2aow_"), false);
+	const got = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "g", method: "tasks/get", params: { id: taskId } }),
+	});
+	assert.equal(got.status, 200, JSON.stringify(got.data));
+	assert.match(JSON.stringify(got.data), /stored answer/);
+	const cardUrl = "https://alice.example.com/.well-known/agent-card.json";
+	const card = await call(alice.ctx, "/.well-known/agent-card.json");
+	assert.equal(await Addr.cardProves(card.data, ident.publicKey, cardUrl), true);
+	const forged = await Addr.generateIdentity();
+	const badSig = await Addr.signBytes(forged.privateKey, Addr.updateMessage(cardUrl, ident.publicKey, "-"));
+	const bad = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "bad", method: "PeerAddressUpdate", params: { agentCardUrl: cardUrl, publicKey: ident.publicKey, announcementSignature: badSig } }),
+	});
+	assert.equal(bad.data.error.code, -32602);
+	assert.equal((await bob.db.prepare("SELECT card_url FROM peers WHERE label = ?").bind(paired.label).first() as any).card_url, null);
+	const reverse = (await call(alice.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "bob" }),
+	})).data.token as string;
+	const reverseHash = await sha256(reverse);
+	const signature = await Addr.signBytes(ident.privateKey, Addr.updateMessage(cardUrl, ident.publicKey, reverseHash));
+	const logs2: string[] = [];
+	console.log = (line?: unknown) => { logs2.push(String(line)); };
+	let updated: any;
+	try {
+		updated = await call(bob.ctx, "/", {
+			method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+			body: JSON.stringify({ jsonrpc: "2.0", id: "up", method: "PeerAddressUpdate", params: { agentCardUrl: cardUrl, publicKey: ident.publicKey, announcementSignature: signature, reverseToken: reverse } }),
+		});
+	} finally { console.log = orig; }
+	assert.equal(updated.data.result?.ok, true, JSON.stringify(updated.data));
+	assert.equal(JSON.stringify(updated.data).includes(reverse), false);
+	assert.equal(logs2.join("\n").includes(reverse), false);
+	assert.equal(logs2.join("\n").includes(ident.privateKey), false);
+	const row = await bob.db.prepare("SELECT url, token_enc FROM outbound_peers WHERE alias = ?").bind(paired.label).first() as { url: string; token_enc: string };
+	assert.equal(row.url, "https://alice.example.com");
+	assert.ok(row.token_enc);
+	assert.equal(String(row.token_enc).includes(reverse), false);
+	const wrongKey = await Addr.generateIdentity();
+	const wrongSig = await Addr.signBytes(wrongKey.privateKey, Addr.updateMessage(cardUrl, wrongKey.publicKey, "-"));
+	const mismatch = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "mm", method: "PeerAddressUpdate", params: { agentCardUrl: "https://carol.example.com/.well-known/agent-card.json", publicKey: wrongKey.publicKey, announcementSignature: wrongSig } }),
+	});
+	assert.equal(mismatch.data.error.code, -32602);
+	assert.equal((await bob.db.prepare("SELECT url FROM outbound_peers WHERE alias = ?").bind(paired.label).first() as any).url, "https://alice.example.com");
+	const task2 = await send(bob.ctx, paired.access, "second", "ctx-none");
+	const second = await owner(bob.ctx, "acct-bob", "POST", "/owner/mcp/reply", { taskId: task2, text: "delivered answer", state: "completed" });
+	assert.equal(second.body.structuredContent.status, "delivered", JSON.stringify(second.body));
+	assert.equal(second.body.structuredContent.target.host, "alice.example.com");
+	assert.equal(JSON.stringify(second.body).includes(reverse), false);
+	const view = await owner(bob.ctx, "acct-bob", "GET", "/owner/address");
+	assert.equal(view.status, 200, JSON.stringify(view.body));
+	assert.equal(JSON.stringify(view.body).includes(reverse), false);
+	assert.equal(JSON.stringify(view.body).includes(ident.privateKey), false);
+});
+
+test("a legacy pairing binds an identity once, and a later key is refused", async (t) => {
+	const { alice, bob, call } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	assert.equal((await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	const paired = await pair(bob, call);
+	assert.equal((await bob.db.prepare("SELECT identity_key FROM peers WHERE label = ?").bind(paired.label).first() as any).identity_key, null);
+	const cardUrl = "https://alice.example.com/.well-known/agent-card.json";
+	const signature = await Addr.signBytes(ident.privateKey, Addr.updateMessage(cardUrl, ident.publicKey, "-"));
+	const bound = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "b", method: "PeerAddressUpdate", params: { agentCardUrl: cardUrl, publicKey: ident.publicKey, announcementSignature: signature } }),
+	});
+	assert.equal(bound.data.result?.ok, true, JSON.stringify(bound.data));
+	const other = await Addr.generateIdentity();
+	await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(other),
+	});
+	const again = await Addr.signBytes(other.privateKey, Addr.updateMessage(cardUrl, other.publicKey, "-"));
+	const refused = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${paired.access}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "r", method: "PeerAddressUpdate", params: { agentCardUrl: cardUrl, publicKey: other.publicKey, announcementSignature: again } }),
+	});
+	assert.equal(refused.data.error.code, -32602);
+	assert.equal((await bob.db.prepare("SELECT identity_key FROM peers WHERE label = ?").bind(paired.label).first() as any).identity_key, ident.publicKey);
+});
+
+test("the old address forwards a direct reply and answers with a moved pointer", async (t) => {
+	const { alice, bob, call } = await world(t as never);
+	const cardUrl = "https://alice.example.com/.well-known/agent-card.json";
+	const ident = await Addr.generateIdentity();
+	const set = await call(bob.ctx, "/owner/address-forward", {
+		method: "PUT", headers: { authorization: `Bearer ${bob.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ cardUrl, hours: 24 }),
+	});
+	assert.equal(set.status, 200, JSON.stringify(set.data));
+	const moved = await call(bob.ctx, "/.well-known/a2a-moved.json");
+	assert.equal(moved.data.cardUrl, cardUrl);
+	const token = (await call(bob.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${bob.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "carol" }),
+	})).data.token as string;
+	const same = await sha256(token);
+	await alice.db.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('carol', ?, ?)").bind(same, new Date().toISOString()).run();
+	const early = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "early", method: "message/send", params: {
+			message: { kind: "message", role: "user", messageId: "m-early", contextId: "ctx-early", parts: [{ kind: "text", text: "before proof" }], metadata: { "a2a.exposed/reply-delivery": { taskId: "t0", messageId: "m0", state: "completed" } } },
+			metadata: { "a2a.exposed/reply-delivery": { taskId: "t0", messageId: "m0", state: "completed" } },
+		} }),
+	});
+	assert.equal(early.data.error.code, Addr.MOVED_CODE);
+	assert.equal((await alice.db.prepare("SELECT COUNT(*) AS n FROM tasks").first() as { n: number }).n, 0);
+	assert.equal((await call(bob.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${bob.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	assert.equal((await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	const reply = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "fwd", method: "message/send", params: {
+			message: { kind: "message", role: "user", messageId: "m-fwd", contextId: "ctx-fwd", parts: [{ kind: "text", text: "please forward" }], metadata: { "a2a.exposed/reply-delivery": { taskId: "t", messageId: "m", state: "completed" } } },
+			metadata: { "a2a.exposed/reply-delivery": { taskId: "t", messageId: "m", state: "completed" } },
+		} }),
+	});
+	assert.equal(reply.headers.get("a2a-moved"), cardUrl);
+	assert.equal(reply.status, 200);
+	assert.equal(JSON.stringify(reply.data).includes(token), false);
+	assert.equal((await alice.db.prepare("SELECT COUNT(*) AS n FROM tasks").first() as { n: number }).n, 1);
+	const stranger = (await call(bob.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${bob.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "stranger" }),
+	})).data.token as string;
+	const pointer = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${stranger}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "ptr", method: "message/send", params: {
+			message: { kind: "message", role: "user", messageId: "m-ptr", contextId: "ctx-ptr", parts: [{ kind: "text", text: "no token there" }], metadata: { "a2a.exposed/reply-delivery": { taskId: "t2", messageId: "m2", state: "completed" } } },
+			metadata: { "a2a.exposed/reply-delivery": { taskId: "t2", messageId: "m2", state: "completed" } },
+		} }),
+	});
+	assert.equal(pointer.data.error.code, Addr.MOVED_CODE);
+	assert.equal(pointer.data.error.data.movedTo, cardUrl);
+	assert.equal(pointer.headers.get("a2a-moved"), cardUrl);
+	assert.equal(JSON.stringify(pointer.data).includes(stranger), false);
+});
+
+test("announce does not store a return token when the peer does not accept the update", async (t) => {
+	const { alice, bob, call, owner } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	});
+	const token = "a2aow_" + "b".repeat(43);
+	await bob.db.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('old', ?, ?)").bind(await sha256(token), new Date().toISOString()).run();
+	// A peer that answers method-not-found. Carol's worker understands the method, so this stub is the old peer.
+	const oldUrl = "https://old.example.com";
+	assert.equal((await owner(alice.ctx, "acct-alice", "PUT", "/owner/outbound-peers/old", { url: oldUrl, token })).status, 200);
+	const announced = await owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: "old" });
+	assert.equal(announced.status, 200, JSON.stringify(announced.body));
+	const row = (announced.body as any).results[0];
+	assert.equal(row.status === "unsupported" || row.status === "failed", true, JSON.stringify(row));
+	assert.equal(JSON.stringify(announced.body).includes(token), false);
+	assert.equal((await alice.db.prepare("SELECT COUNT(*) AS n FROM peers WHERE source = 'reverse'").first() as any).n, 0);
+	const view = await call(alice.ctx, "/owner/address", { headers: { authorization: `Bearer ${alice.ownerToken}` } });
+	assert.equal(view.data.announcePending[0].alias, "old");
+	assert.equal(JSON.stringify(view.data).includes(ident.privateKey), false);
+});
+
+test("a reply follows a moved card only when the new card proves the stored identity", async (t) => {
+	const { alice, bob, carol, call, owner } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	assert.equal((await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	assert.equal((await call(carol.ctx, "/owner/address-forward", {
+		method: "PUT", headers: { authorization: `Bearer ${carol.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ cardUrl: "https://alice.example.com/.well-known/agent-card.json", hours: 48 }),
+	})).status, 200);
+	const inbound = (await call(bob.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${bob.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "mover" }),
+	})).data.token as string;
+	await bob.db.prepare("UPDATE peers SET identity_key = ? WHERE label = 'mover'").bind(ident.publicKey).run();
+	const callback = (await call(alice.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "bob" }),
+	})).data.token as string;
+	assert.equal((await owner(bob.ctx, "acct-bob", "PUT", "/owner/outbound-peers/mover", { url: "https://carol.example.com", token: callback })).status, 200);
+	await bob.db.prepare("UPDATE outbound_peers SET source = 'announce' WHERE alias = 'mover'").run();
+	const taskId = await send(bob.ctx, inbound, "where", "ctx-move");
+	const reply = await owner(bob.ctx, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "followed", state: "completed" });
+	assert.equal(reply.body.structuredContent.status, "delivered", JSON.stringify(reply.body));
+	assert.equal(reply.body.structuredContent.target.host, "alice.example.com");
+	assert.equal((await bob.db.prepare("SELECT url FROM outbound_peers WHERE alias = 'mover'").first() as { url: string }).url, "https://alice.example.com");
+	assert.equal(JSON.stringify(reply.body).includes(callback), false);
+});
+
+test("an announcement cannot take over an outbound alias or keep its token", async (t) => {
+	const { alice, bob, call } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	assert.equal((await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	const now = new Date().toISOString();
+	await bob.db.prepare("INSERT INTO outbound_peers (alias, url, token_enc, created_at, updated_at) VALUES ('carol', 'https://carol.example.com', 'sealed-carol-token', ?, ?)").bind(now, now).run();
+	const started = await call(bob.ctx, "/oauth/device_authorization", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ client_name: "carol", client_id: "carol", agent_identity: ident.publicKey }),
+	});
+	assert.equal(started.status, 200, JSON.stringify(started.data));
+	const code = String(started.data.user_code).replace("-", "");
+	assert.equal((await call(bob.ctx, `/owner/pairing/${code}/approve`, { method: "POST", headers: { authorization: `Bearer ${bob.ownerToken}` } })).status, 200);
+	const redeemed = await call(bob.ctx, "/oauth/token", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: started.data.device_code }),
+	});
+	assert.equal(redeemed.data.peer_label, "carol-2");
+	assert.equal((await bob.db.prepare("SELECT url, token_enc FROM outbound_peers WHERE alias = 'carol'").first() as { url: string; token_enc: string }).url, "https://carol.example.com");
+	const planted = "a2aow_" + "d".repeat(43);
+	await bob.db.prepare("INSERT INTO peers (label, token_hash, created_at, source) VALUES ('carol', ?, ?, 'pairing')").bind(await sha256(planted), now).run();
+	const cardUrl = "https://alice.example.com/.well-known/agent-card.json";
+	const signature = await Addr.signBytes(ident.privateKey, Addr.updateMessage(cardUrl, ident.publicKey, "-"));
+	const taken = await call(bob.ctx, "/", {
+		method: "POST", headers: { authorization: `Bearer ${planted}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: "take", method: "PeerAddressUpdate", params: { agentCardUrl: cardUrl, publicKey: ident.publicKey, announcementSignature: signature } }),
+	});
+	assert.equal(taken.data.error.code, -32602, JSON.stringify(taken.data));
+	const row = await bob.db.prepare("SELECT url, token_enc FROM outbound_peers WHERE alias = 'carol'").first() as { url: string; token_enc: string };
+	assert.equal(row.url, "https://carol.example.com");
+	assert.equal(row.token_enc, "sealed-carol-token");
+});
+
+test("revoking a return token stays revoked until an explicit reissue", async (t) => {
+	const { alice, carol, call, owner } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	assert.equal((await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	})).status, 200);
+	const carolToken = (await call(carol.ctx, "/owner/peers", {
+		method: "POST", headers: { authorization: `Bearer ${carol.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify({ label: "alice" }),
+	})).data.token as string;
+	assert.equal((await owner(alice.ctx, "acct-alice", "PUT", "/owner/outbound-peers/carol", { url: "https://carol.example.com", token: carolToken })).status, 200);
+	const first = await owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: "carol" });
+	assert.equal((first.body as any).results[0].status, "updated", JSON.stringify(first.body));
+	const before = await alice.db.prepare("SELECT token_hash, revoked_at FROM peers WHERE label = 'carol' AND source = 'reverse'").first() as { token_hash: string; revoked_at: string | null };
+	assert.equal(before.revoked_at, null);
+	assert.equal((await call(alice.ctx, "/owner/peers/carol", { method: "DELETE", headers: { authorization: `Bearer ${alice.ownerToken}` } })).status, 200);
+	const again = await owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: "carol" });
+	assert.equal((again.body as any).results[0].status, "revoked", JSON.stringify(again.body));
+	const stuck = await alice.db.prepare("SELECT token_hash, revoked_at FROM peers WHERE label = 'carol'").first() as { token_hash: string; revoked_at: string | null };
+	assert.equal(stuck.token_hash, before.token_hash);
+	assert.ok(stuck.revoked_at);
+	const reissued = await owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: "carol", reissue: true });
+	assert.equal((reissued.body as any).results[0].status, "updated", JSON.stringify(reissued.body));
+	const after = await alice.db.prepare("SELECT token_hash, revoked_at FROM peers WHERE label = 'carol'").first() as { token_hash: string; revoked_at: string | null };
+	assert.equal(after.revoked_at, null);
+	assert.notEqual(after.token_hash, before.token_hash);
+	assert.equal(JSON.stringify(again.body).includes("a2aow_"), false);
+	assert.equal((await carol.db.prepare("SELECT source FROM outbound_peers WHERE alias = 'alice'").first() as { source: string }).source, "announce");
+	assert.equal((await call(carol.ctx, "/owner/peers/alice", { method: "DELETE", headers: { authorization: `Bearer ${carol.ownerToken}` } })).status, 200);
+	assert.equal((await carol.db.prepare("SELECT COUNT(*) AS n FROM outbound_peers WHERE alias = 'alice'").first() as { n: number }).n, 0);
+	assert.equal((await alice.db.prepare("SELECT revoked_at FROM peers WHERE label = 'carol'").first() as { revoked_at: string | null }).revoked_at, null);
+});
+
+test("export omits the sealed pairing identity and a stored return token", async (t) => {
+	const { alice, call } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	await call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	});
+	await alice.db.prepare("INSERT INTO peers (label, token_hash, created_at, source, token_enc) VALUES ('bob', 'h', 't', 'reverse', 'sealed-return')").run();
+	const file = await exportRows(alice.db as never);
+	const redacted = redactExport(file);
+	assert.equal(redacted.tables.settings?.some((row) => row.key === "peer_identity"), false);
+	assert.equal(redacted.tables.peers?.[0]?.token_enc, undefined);
+	assert.equal(JSON.stringify(redacted).includes(ident.privateKey), false);
+	assert.equal(JSON.stringify(redacted).includes("sealed-return"), false);
+});

package/worker/test/mcp.test.ts

@@ -329,7 +329,7 @@ test("scope: the MCP token is not an owner or peer token, and peer/owner tokens
 	assert.equal((await s.call("GET", "/mcp", { headers: { authorization: `Bearer ${a.access_token}` } })).status, 405);
 	// tools can't administer tokens or pairings
 	const names = (await s.mcp(a.access_token, "tools/list")).data.result.tools.map((x: any) => x.name);
-	assert.deepEqual(names, ["inbox", "show_task", "history", "mark_working", "reply", "send", "poll_outbound", "list_peers", "pairing_requests", "send_feedback"]);
+	assert.deepEqual(names, ["inbox", "show_task", "history", "mark_working", "reply", "send", "poll_outbound", "list_peers", "announce_address", "pairing_requests", "send_feedback"]);
 	assert.ok(!names.some((n: string) => /approve|deny|token|revoke|issue|password/.test(n)));
 	const unknown = await s.mcp(a.access_token, "tools/call", { name: "approve_pairing", arguments: { code: "X" } });
 	assert.equal(unknown.data.error.code, -32602);