a2a-exposed 0.8.34 → 0.8.36

package/lib/hosted.mjs

@@ -194,6 +194,8 @@ export async function status(o = {}) {
 
 export async function wake(sub, o = {}) {
 	if (!["preview", "test", "set", "prepare", "remove", "unset"].includes(sub)) fail("usage", "Use wake preview|test|set|prepare|remove. List presets with hosted capabilities --json.");
+	if (sub === "set" && C.deploymentKind() === "hosted" && !o.agent)
+		fail("hosted_config", "This is a hosted config. Use dashboard Wake settings or hosted MCP set_wake; the human enters wake secrets on the confirmation page. For scoped CLI setup, run hosted capabilities --json, then hosted list --json to select an explicit --agent NAME before wake set --agent NAME --url URL --preset P --json. No wake settings were changed.");
 	const removing = sub === "remove" || sub === "unset";
  const preparingRemoval = sub === "prepare" && o.clear === true;
  if (o.clear && !preparingRemoval) fail("usage", "Use wake prepare --clear for an MCP removal reference, or wake remove --version N. Run wake preview --json to list the current version.");
@@ -266,7 +268,16 @@ export async function wake(sub, o = {}) {
 	// Do not print proofs, arbitrary service text, webhook URLs or unexpected fields.
 	const code = typeof result.code === "string" && /^(?:[1-5][0-9]{2}|access-40[13]|none|timeout|tls|private|dns|dns-missing|transport-delivery|transport-native|transport-socket|cloudflare-target-unsupported|connection|failed|unreadable|signing)$/.test(result.code) ? result.code : result.saved === true ? "saved" : "failed";
 	const ok = result.ok === true && (sub !== "set" || result.saved === true);
-	return { ok, code, saved: result.saved === true, next: ok ? sub === "set" ? "Check the receiver for the test wake." : "The draft passed. Run wake set with the same inputs to test and save." : code === "cloudflare-target-unsupported" ? "Use polling or a self-hosted Worker for this Cloudflare-proxied webhook." : "Saved settings were not changed. Check the receiver, credentials and draft, then test again." };
+	const recovery = {
+		"cloudflare-target-unsupported": "This hosted service cannot deliver to this Cloudflare-proxied webhook. Choose a supported public HTTPS route, polling, or an explicitly authorized self-hosted Worker; do not create another tunnel or weaken Access or hook authentication.",
+		"transport-socket": "The hosted service could not connect using its public-HTTPS socket transport. Check hosted route compatibility before changing the receiver. An owner-created Cloudflare Tunnel can pass local checks and still be unreachable by this transport; do not weaken Access or hook authentication.",
+		"dns": "The hosted service could not resolve the webhook hostname. Check its public DNS before testing again.",
+		"dns-missing": "The hosted service could not resolve the webhook hostname. Check its public DNS before testing again.",
+		"tls": "The hosted service could not establish TLS to the webhook. Check the hostname and certificate; keep HTTPS verification enabled.",
+		"access-401": "Cloudflare Access refused the test. Check the selected Access service token and policy without disabling Access or hook authentication.",
+		"access-403": "Cloudflare Access refused the test. Check the selected Access service token and policy without disabling Access or hook authentication.",
+	};
+	return { ok, code, saved: result.saved === true, next: ok ? sub === "set" ? "Check the receiver for the test wake." : "The draft passed. Run wake set with the same inputs to test and save." : `Saved settings were not changed. ${recovery[code] || "Check the receiver, credentials and draft, then test again."}` };
 }
 
 export async function output(run, o = {}) {

package/lib/main.mjs

@@ -131,7 +131,9 @@ https://github.com/telegraphic-dev/a2a-exposed/blob/main/docs/getting-started.md
   deploy [same flags]           redeploy with saved settings (secrets persist); tag the Worker version as a2a-exposed-<version>
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
-                                save wake settings, upload wake secrets from env, and redeploy (one step)
+                                self-hosted: save wake settings, upload wake secrets from env, and redeploy
+                                hosted config without --agent: stop with dashboard Wake settings / hosted MCP set_wake guidance
+                                hosted CLI: list hosted capabilities --json and hosted list --json, then select --agent NAME
                                 openbot: human supplies WAKE_HMAC_SECRET via protected env/secret storage, never chat or argv
                                 the Worker refuses unsigned openbot wakes (a webhook key is not a signing secret)
                                 --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
@@ -191,8 +193,11 @@ Status
                                 read selected hosted agent wake configuration; select NAME with hosted list --json.
                                 Uses setup approval or that agent's matching owner credential; no delivery test.
   Hosted-only configs report deployment: hosted and hosted recovery guidance.
+  Hosted status lists capability/preview next steps; saved wake settings do not prove delivery.
+  Offer webhook or polling after checking hook support and hosted route compatibility.
+  A listed OpenClaw preset does not prove route reachability; check delivery preflight before tunnel setup.
   status [--json]               deployment, Worker version, base URL, agent card check (fetched by the CLI), wake
-                                mode (webhook / tunnel / none = polling), tunnel state, proxy mode (--upstream):
+                                mode (webhook / tunnel / none = no webhook), tunnel state, proxy mode (--upstream):
                                 upstream card, Access credential and upstream bearer configured (separately), the
                                 live upstream check, the last failed peer call, card-leak check; warnings for peer
                                 token variables shadowing saved tokens; and the next step to run.
@@ -233,7 +238,9 @@ Inbox (owner side)
                                            requests (tell your human; the dashboard URL when MANAGE_URL is set;
                                            --json: rows on stdout, requests on stderr). Follows every page; past
                                            10000 pages it errors instead of a short list. Reading marks returned replies
-                                           seen and clears matching pending wakes; task state is unchanged
+                                           seen and clears matching pending wakes; task state is unchanged.
+                                           Direct reply messages are completed without a new-work wake;
+                                           read them with history or inbox --all
   show <taskId>                            full task JSON
   working <taskId>                         mark task working
   reply <taskId> (--text T | --stdin) [--state completed|input-required|rejected|failed|working]

package/lib/status.mjs

@@ -191,9 +191,12 @@ export async function checkCard(base) {
 
 /** One line describing how wakes reach the agent. */
 export function wakeLine(s) {
-	if (!s.wake) return "unknown (owner API not reachable)";
+	if (!s.wake) return s.deployment === "hosted" && s.ownerApi?.ok
+		? "unknown (hosted wake preview unavailable)" : "unknown (owner API not reachable)";
 	const w = s.wake;
-	if (!w.configured) return "none: no WAKE_WEBHOOK_URL on the Worker, so the agent is expected to poll the A2A endpoint";
+	if (!w.configured) return s.deployment === "hosted"
+		? "no webhook configured; choose delivery after checking hosted route compatibility"
+		: "none: no WAKE_WEBHOOK_URL on the Worker, so the agent is expected to poll the A2A endpoint";
 	const auth = [w.hasKey && "bearer/API key", w.hasHmacSecret && "HMAC signature", w.hasAccessServiceToken && "Access service token"].filter(Boolean);
 	return `webhook (preset ${w.preset}${s.tunnel ? ", through the tunnel" : ""}); auth: ${auth.join(" + ") || "none"}; URL fingerprint ${w.urlFingerprint || "-"}`;
 }
@@ -294,10 +297,13 @@ function nextStepCore(s) {
 		if (s.card.urlProblem) return fail(`the hosted agent card has a different endpoint: ${s.card.urlProblem}. Check the address with the hosted service.`);
 		if (!s.health?.ok) return fail("the hosted health check failed. Check the hosted service and run status again.");
 		if (!s.ownerApi.ok) return fail("the hosted owner API refused or could not check the saved credential. Check the hosted agent access with its owner.");
-		if (!s.wake) return done("the hosted endpoint is reachable and its owner credential is accepted. Wake preview is unavailable; check wake delivery through the hosted service.");
-		return done(s.wake?.configured
-			? "none: the hosted endpoint is reachable and its owner credential is accepted. Check wake delivery through the hosted service."
-			: "the hosted endpoint is reachable. Configure a public HTTPS webhook through the hosted service, or use polling. Cloudflare Tunnel delivery may be unavailable; do not provision a self-hosted tunnel for this address.");
+		const discover = `Run \`${CLI} hosted capabilities --json\` to list supported setup scopes and wake presets.`;
+		const fallback = "If unavailable, use hosted dashboard Wake settings or MCP set_wake.";
+		if (!s.wake) return done(`the hosted endpoint is reachable and its owner credential is accepted. Wake preview is unavailable; delivery is unverified. ${discover}`, [fallback]);
+		if (s.wake.configured) return done(`the hosted endpoint is reachable and wake settings are saved; status does not test delivery. ${discover}`, [fallback,
+			`When supported, read \`${CLI} wake preview --json\` for the saved agent before an authorized draft test, then verify an inbox-and-reply run.`]);
+		return done(`the hosted endpoint is reachable; no webhook is configured. ${discover}`, [fallback,
+			"Check hook support and hosted route compatibility, then offer webhook or polling with its interval and cost before configuring either. Do not provision a self-hosted tunnel for this address."]);
 	}
 	if (!s.deployed) return fail(`nothing is deployed from ${path.dirname(s.configFile)}. Run \`${CLI} init\` (see the quick start). Another deployment? Set A2A_CONFIG_DIR.`);
 	if (s.baseUrlEnv)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.34",
+	"version": "0.8.36",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/hosted.ts

@@ -163,9 +163,6 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		// config_json is ignored, and a blob that cannot be opened leaves those fields unset.
 		if (row.secretsEnc) {
 			const opened = await openWakeSecrets(parsed.secretsKey || "", row.tenantId, row.secretsEnc);
-			if (!opened) {
-				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "wake_secrets_unreadable", tenant: row.tenantId }));
-			}
 			for (const key of WAKE_SECRET_KEYS) {
 				const value = opened?.[key];
 				if (value) config[key] = value;

package/worker/src/index.ts

@@ -698,6 +698,7 @@ type Rpc = (p: Json, label: string, version: string, ctx: TenantContext, ectx: E
 const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	const msg = A.normMessage(params.message);
 	if (msg.role !== "user") throw new RpcError(-32602, "message.role must be user");
+	const directReply = directReplyParams(params);
 	const conf = params.configuration || {};
 	const push = conf.taskPushNotificationConfig || conf.pushNotificationConfig;
 	const pushCfg = push ? normPushCfg(push, version) : null;
@@ -718,9 +719,11 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 	if (!task) task = { id: A.newId(), contextId, status: { state: "submitted", timestamp: ts }, artifacts: [], history: [], _peer: label, _protocol: version, _createdAt: ts, _push: [] };
 	msg.contextId = contextId; msg.taskId = task.id;
 	task.history.push(msg);
-	task.status = { state: "submitted", timestamp: ts };
+	task.status = { state: directReply ? "completed" : "submitted", timestamp: ts };
 	if (pushCfg) task._push = [...task._push.filter((c: Json) => c.id !== pushCfg.id), pushCfg];
 	if (params.metadata && typeof params.metadata === "object") task.metadata = { ...(task.metadata || {}), ...params.metadata };
+	// Keep the loop marker on the task even when it was supplied only on the message.
+	if (directReply) task.metadata = { ...(task.metadata || {}), [DIRECT_REPLY_META]: params.metadata?.[DIRECT_REPLY_META] || msg.metadata?.[DIRECT_REPLY_META] };
 	const preview = A.textOf(msg);
 	if (creating) {
 		const stored = await ctx.DB.batch([
@@ -738,7 +741,8 @@ const rpcSend: Rpc = async (params, label, version, ctx, ectx) => {
 		]);
 	}
 	log("message_received", { peer: label, contextId, taskId: task.id, chars: preview.length, version });
-	await wake(ctx, ectx, contextId, task.id, label, preview);
+	// Direct replies are stored for history, not scheduled as new work.
+	if (!directReply) await wake(ctx, ectx, contextId, task.id, label, preview);
 	const pt = A.publicTask(task, version, conf.historyLength);
 	return version.startsWith("1") ? { task: pt } : pt;
 };
@@ -1233,14 +1237,21 @@ async function withMovedHeader(ctx: TenantContext, res: Response): Promise<Respo
 	return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 
+/** Every hosted credential sealed by peerKey must retain the previous key during rotation. */
+async function openPeerSecret(ctx: TenantContext, aad: string, sealed: string): Promise<string | null> {
+	for (const key of await ctx.peerReadKeys()) {
+		const opened = await M.openPeerTokenWithKey(key, aad, sealed);
+		if (opened !== null) return opened;
+	}
+	return null;
+}
+
 type PairingIdentity = { publicKey: string; privateKey: string };
 
 async function readIdentity(ctx: TenantContext): Promise<PairingIdentity | null | "unreadable"> {
 	const row: Json = await ctx.DB.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first();
 	if (!row?.value) return null;
-	const key = await ctx.peerKey();
-	if (!key) return "unreadable";
-	const opened = await M.openPeerTokenWithKey(key, Addr.IDENTITY_AAD, row.value);
+	const opened = await openPeerSecret(ctx, Addr.IDENTITY_AAD, row.value);
 	if (!opened) return "unreadable";
 	try {
 		const parsed = JSON.parse(opened);
@@ -1411,8 +1422,7 @@ async function planReverse(ctx: TenantContext, alias: string): Promise<{ kind: "
 async function openReverse(ctx: TenantContext, label: string): Promise<string | null> {
 	const row: Json = await ctx.DB.prepare("SELECT token_enc, source, revoked_at FROM peers WHERE label = ?").bind(label).first();
 	if (!row || row.revoked_at || row.source !== "reverse" || !row.token_enc) return null;
-	const key = await ctx.peerKey();
-	return key ? await M.openPeerTokenWithKey(key, label, row.token_enc) : null;
+	return openPeerSecret(ctx, label, row.token_enc);
 }
 
 async function storeReverse(ctx: TenantContext, label: string, token: string, clientName: string, reissue = false): Promise<void> {
@@ -1544,8 +1554,7 @@ async function replyPeer(ctx: TenantContext, label: string): Promise<{ alias: st
 		 WHERE o.alias = ? AND o.token_enc IS NOT NULL AND p.revoked_at IS NULL`,
 	).bind(label).first();
 	if (!row) return null;
-	const key = await ctx.peerKey();
-	const token = key ? await M.openPeerTokenWithKey(key, row.alias, row.token_enc) : null;
+	const token = await openPeerSecret(ctx, row.alias, row.token_enc);
 	return token ? { alias: row.alias, url: row.url, token, identityKey: Addr.cleanPublicKey(row.identity_key), announced: row.source === "announce" } : null;
 }
 
@@ -3533,8 +3542,7 @@ async function outboundPeer(ctx: TenantContext, alias: string): Promise<{ alias:
 	if (!r) throw new ToolError(`no peer "${alias}" synced to this A2A endpoint. On the machine with the CLI: ${cliCommand(ctx)} peers sync ${alias}`);
 	let token: string | null = null;
 	if (r.token_enc) {
-		const peerKey = await ctx.peerKey();
-		token = peerKey ? await M.openPeerTokenWithKey(peerKey, alias, r.token_enc) : null;
+		token = await openPeerSecret(ctx, alias, r.token_enc);
 		if (!token) throw new ToolError(`the stored token for "${alias}" can't be read (the owner token was rotated since it was synced): run ${cliCommand(ctx)} peers sync ${alias} again`);
 	}
 	return { alias, url: r.url, token };

package/worker/src/tenancy.ts

@@ -11,6 +11,7 @@
 // and an allowlist are all set (approval-oidc.ts).
 
 import * as A from "./a2a.ts";
+import { tenantSecretsMaterials } from "./wake-secrets.ts";
 
 /** Subset of D1 used by the handlers. A Durable Object adapter satisfies the same shape. */
 export interface SqlDb {
@@ -489,10 +490,20 @@ export class TenantContext implements ConfigFields {
 		return this.#peerKey;
 	}
 
+	/** Read-only keys for hosted outbound tokens during rotation; self-host keeps OWNER_TOKEN semantics. */
+	async peerReadKeys(): Promise<CryptoKey[]> {
+		const active = await this.peerKey();
+		if (!active) return [];
+		if (this.mode === "single") return [active];
+		const previous = tenantSecretsMaterials(this.#secretsKey || "").slice(1);
+		return [active, ...await Promise.all(previous.map((material) => derivePeerKey(material, peerKeyInfoForTenant(this.id))))];
+	}
+
 	async #derivePeerKey(): Promise<CryptoKey | null> {
 		if (this.mode === "single") return this.#ownerToken ? derivePeerKey(this.#ownerToken) : null;
 		if (!this.#secretsKey || !this.id) return null;
-		return derivePeerKey(this.#secretsKey, peerKeyInfoForTenant(this.id));
+		const material = tenantSecretsMaterials(this.#secretsKey)[0];
+		return material ? derivePeerKey(material, peerKeyInfoForTenant(this.id)) : null;
 	}
 }
 

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.34";
+export const VERSION = "0.8.36";

package/worker/src/wake-secrets.ts

@@ -36,8 +36,47 @@ export const MAX_WAKE_PLAIN = (() => {
 	return n;
 })();
 
-/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
-export const MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+/** Longest envelope: `v2.<64-char kid>.<iv>.<ciphertext>`. */
+export const MAX_WAKE_SEALED = 3 + 64 + 1 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+
+/** A bounded keyring lives in the existing secret binding, never in public config. */
+export interface TenantSecretsKeyring {
+	active: string;
+	keys: Record<string, string>;
+	legacy: boolean;
+}
+
+/** Raw keys preserve v1 writes for a reader-first rollout. JSON keyrings enable v2 writes. */
+export function tenantSecretsKeyring(input: string): TenantSecretsKeyring | null {
+	if (!input) return null;
+	if (!input.trimStart().startsWith("{")) return { active: "", keys: { "": input }, legacy: true };
+	if (input.length > 65536) return null;
+	try {
+		const value = JSON.parse(input);
+		if (!value || value.v !== 2 || typeof value.active !== "string" ||
+			!value.keys || typeof value.keys !== "object" || Array.isArray(value.keys) ||
+			Object.keys(value).some((name) => !["v", "active", "keys"].includes(name))) return null;
+		const entries = Object.entries(value.keys);
+		if (entries.length < 1 || entries.length > 2 || !Object.hasOwn(value.keys, value.active)) return null;
+		for (const [kid, key] of entries) {
+			if (!/^[A-Za-z0-9_-]{1,64}$/.test(kid) || typeof key !== "string" || !key.trim() || key.length > 4096) return null;
+		}
+		return { active: value.active, keys: value.keys, legacy: false };
+	} catch { return null; }
+}
+
+/** Current material first, then the single read-only rotation key. No caller may log these values. */
+export function tenantSecretsMaterials(input: string): string[] {
+	const ring = tenantSecretsKeyring(input);
+	if (!ring) return [];
+	return [ring.keys[ring.active], ...Object.entries(ring.keys).filter(([kid]) => kid !== ring.active).map(([, key]) => key)];
+}
+
+function unreadable(): null {
+	// Only a fixed event: ciphertext, key ids, credentials and tenant identifiers never enter logs.
+	console.error(JSON.stringify({ event: "wake_secrets_unreadable", level: "error" }));
+	return null;
+}
 
 function b64(bytes: Uint8Array): string {
 	let raw = "";
@@ -77,21 +116,24 @@ function payloadOf(secrets: WakeSecrets): Record<string, string> | null {
 	return payload;
 }
 
-/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+/** `v2.<kid>.<iv>.<ciphertext>` for keyrings; raw keys keep v1 writes until rollout completes. */
 export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null> {
-	const key = await derive(ikm, tenantId);
+	const ring = tenantSecretsKeyring(ikm);
+	const key = ring ? await derive(ring.keys[ring.active], tenantId) : null;
 	const payload = payloadOf(secrets);
 	if (!key || !payload) return null;
 	const json = JSON.stringify(payload);
 	const encoded = new TextEncoder().encode(json);
 	if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+	const prefix = ring!.legacy ? "v1" : `v2.${ring!.active}`;
+	const aad = ring!.legacy ? tenantId : `${prefix}\0${tenantId}`;
 	const iv = crypto.getRandomValues(new Uint8Array(12));
 	const ct = new Uint8Array(await crypto.subtle.encrypt(
-		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(aad) },
 		key,
 		encoded,
 	));
-	const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+	const sealed = `${prefix}.${b64(iv)}.${b64(ct)}`;
 	return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
 }
 
@@ -101,28 +143,47 @@ export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: Wa
  */
 export async function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null> {
 	if (sealed == null || sealed === "") return {};
-	if (sealed.length > MAX_WAKE_SEALED) return null;
-	const key = await derive(ikm, tenantId);
-	if (!key) return null;
-	const [version, iv, ct, extra] = sealed.split(".");
-	if (version !== "v1" || !iv || !ct || extra !== undefined) return null;
-	try {
-		const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
-			{ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
-			key,
-			unb64(ct),
-		));
-		if (plain.length > MAX_WAKE_PLAIN) return null;
-		const parsed = JSON.parse(plain) as unknown;
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-		const out: WakeSecrets = {};
-		for (const name of WAKE_SECRET_KEYS) {
-			const value = (parsed as Record<string, unknown>)[name];
-			if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
-			out[name] = value;
-		}
-		return out;
-	} catch {
-		return null;
+	if (typeof sealed !== "string" || sealed.length > MAX_WAKE_SEALED) return unreadable();
+	const ring = tenantSecretsKeyring(ikm);
+	if (!ring || !tenantId) return unreadable();
+	const parts = sealed.split(".");
+	const version = parts[0];
+	const kid = version === "v2" ? parts[1] : "";
+	if (version !== "v1" && version !== "v2") return unreadable();
+	if (parts.length !== (version === "v2" ? 4 : 3)) return unreadable();
+	const [iv, ct] = parts.slice(version === "v2" ? 2 : 1);
+	if (!iv || !ct || (version === "v2" && (ring.legacy || !Object.hasOwn(ring.keys, kid)))) return unreadable();
+	const materials = version === "v2" ? [ring.keys[kid]] : tenantSecretsMaterials(ikm);
+	const aad = version === "v2" ? `v2.${kid}\0${tenantId}` : tenantId;
+	for (const material of materials) {
+		try {
+			const key = await derive(material, tenantId);
+			if (!key) continue;
+			const ivBytes = unb64(iv);
+			if (ivBytes.length !== 12) return unreadable();
+			const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+				{ name: "AES-GCM", iv: ivBytes, additionalData: new TextEncoder().encode(aad) },
+				key,
+				unb64(ct),
+			));
+			if (plain.length > MAX_WAKE_PLAIN) return unreadable();
+			const parsed = JSON.parse(plain) as unknown;
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return unreadable();
+			const out: WakeSecrets = {};
+			for (const name of WAKE_SECRET_KEYS) {
+				const value = (parsed as Record<string, unknown>)[name];
+				if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+				out[name] = value;
+			}
+			return out;
+		} catch { /* Try the previous key only for an unlabelled v1 blob. */ }
 	}
+	return unreadable();
+}
+
+/** Pure maintenance helper. The caller must CAS the original blob and queue the new tenant config. */
+export async function rewrapWakeSecrets(ikm: string, tenantId: string, sealed: string): Promise<string | null> {
+	if (!sealed) return null;
+	const secrets = await openWakeSecrets(ikm, tenantId, sealed);
+	return secrets ? sealWakeSecrets(ikm, tenantId, secrets) : null;
 }

package/worker/test/address.test.ts

@@ -7,6 +7,7 @@ import { dispatch, runOwnerRpc } from "../src/index.ts";
 import { redactExport, exportRows } from "../src/export.ts";
 import { hostedTenantContext, type DoNamespace, type KvNamespace, type TenantContext, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
+import { openPeerTokenWithKey } from "../src/mcp.ts";
 
 const MIGRATIONS = new URL("../migrations/", import.meta.url);
 const ectx = { waitUntil(p: Promise<unknown>) { p.catch(() => {}); }, passThroughOnException() {} };
@@ -70,7 +71,14 @@ async function world(t: { after: (fn: () => void) => void }) {
 	};
 	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) =>
 		runOwnerRpc(ctx, ectx as never, { accountId, method, path, ...(body === undefined ? {} : { body }) });
-	return { alice, bob, carol, call, owner };
+	const rotate = async (agent: typeof alice, secretsKey: string) => {
+		agent.ctx = hostedTenantContext({ ...env, TENANT_SECRETS_KEY: secretsKey }, {
+			id: agent.ctx.id, db: agent.db, publicUrl: agent.ctx.PUBLIC_URL,
+			ownerTokenHash: await sha256(agent.ownerToken), status: "active", config: { AGENT_NAME: "fixture" },
+		});
+		byId.set(agent.ctx.id, agent.ctx);
+	};
+	return { alice, bob, carol, call, owner, rotate };
 }
 
 async function pair(bob: { ctx: TenantContext; ownerToken: string }, call: (ctx: TenantContext, path: string, init?: RequestInit) => Promise<{ status: number; data: any }>, identity?: string) {
@@ -474,3 +482,53 @@ test("export omits the sealed pairing identity and a stored return token", async
 	assert.equal(JSON.stringify(redacted).includes(ident.privateKey), false);
 	assert.equal(JSON.stringify(redacted).includes("sealed-return"), false);
 });
+
+
+test("hosted key rotation preserves identity proofs, reverse tokens and direct replies", async (t) => {
+	const { alice, carol, call, owner, rotate } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	const putIdentity = () => call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	});
+	assert.equal((await putIdentity()).status, 200);
+	const paired = await pair(carol, call, ident.publicKey);
+	assert.equal((await owner(alice.ctx, "acct-alice", "PUT", `/owner/outbound-peers/${paired.label}`, { url: carol.ctx.PUBLIC_URL, token: paired.access })).status, 200);
+	const announce = () => owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: paired.label });
+	const firstAnnouncement = await announce();
+	assert.equal(firstAnnouncement.body.results[0].status, "updated", JSON.stringify(firstAnnouncement.body));
+	const reverseBefore = await alice.db.prepare("SELECT token_hash, token_enc FROM peers WHERE label = ? AND source = 'reverse'").bind(paired.label).first() as { token_hash: string; token_enc: string };
+	assert.ok(reverseBefore.token_enc);
+	const identityBefore = await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first() as { value: string };
+	const ring = JSON.stringify({ v: 2, active: "current", keys: { previous: "platform-key", current: "new-platform-key" } });
+	await rotate(alice, ring);
+	await rotate(carol, ring);
+	const cardUrl = Addr.cardUrlFor(alice.ctx.PUBLIC_URL);
+	const card = await call(alice.ctx, "/.well-known/agent-card.json");
+	assert.equal(await Addr.cardProves(card.data, ident.publicKey, cardUrl), true, "the stored old-key identity still signs the card");
+	assert.deepEqual(await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first(), identityBefore, "a public read never rewrites identity storage");
+	const taskId = await send(carol.ctx, paired.access, "rotation question", "ctx-rotation");
+	const reply = await owner(carol.ctx, "acct-carol", "POST", "/owner/mcp/reply", { taskId, text: "rotation answer", state: "completed" });
+	assert.equal(reply.body.structuredContent.status, "delivered", JSON.stringify(reply.body));
+	assert.equal((await announce()).body.results[0].status, "updated", "the old-key identity and outbound token remain usable");
+	const reverseAfter = await alice.db.prepare("SELECT token_hash, token_enc FROM peers WHERE label = ? AND source = 'reverse'").bind(paired.label).first() as typeof reverseBefore;
+	assert.equal(reverseAfter.token_hash, reverseBefore.token_hash, "rotation must preserve the existing return token");
+	assert.notEqual(reverseAfter.token_enc, reverseBefore.token_enc);
+	assert.ok(await openPeerTokenWithKey((await alice.ctx.peerKey())!, paired.label, reverseAfter.token_enc), "authorized announcement reseals the same reverse token with the active key");
+	// Existing owner-only identity installation reseals the SAME validated identity; it never regenerates it.
+	const unauthorized = await call(alice.ctx, "/owner/identity", { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify(ident) });
+	assert.equal(unauthorized.status, 401);
+	const resealed = await putIdentity();
+	assert.equal(resealed.status, 200);
+	assert.equal(resealed.data.publicKey, ident.publicKey);
+	assert.equal(JSON.stringify(resealed.data).includes(ident.privateKey), false);
+	const onlyCurrent = JSON.stringify({ v: 2, active: "current", keys: { current: "new-platform-key" } });
+	await rotate(alice, onlyCurrent);
+	const retiredCard = await call(alice.ctx, "/.well-known/agent-card.json");
+	assert.equal(await Addr.cardProves(retiredCard.data, ident.publicKey, cardUrl), true, "owner reseal keeps the identity readable after retirement");
+	const identityAfter = await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first() as { value: string };
+	assert.notEqual(identityAfter.value, identityBefore.value);
+	const other = await Addr.generateIdentity();
+	const replacement = await call(alice.ctx, "/owner/identity", { method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" }, body: JSON.stringify(other) });
+	assert.equal(replacement.status, 409, "rotation never authorizes replacing the identity");
+});

package/worker/test/hosted.test.ts

@@ -933,8 +933,10 @@ test("self-host workerd: human mode owner token approves, the device poll return
 
 test("sealed upstream and wake Access credentials reach only their tenant context in workerd", async (t) => {
 	const received: { origin: string; bearer: string | null; id: string | null; secret: string | null }[] = [];
+	const keys = { previous: "platform-secret", current: "next-platform-secret" };
+	const keyring = (active: string) => JSON.stringify({ v: 2, active, keys });
 	const mf = await start({
-		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: keyring("current") },
 		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
 		outboundService: async (request: Request) => {
 			received.push({ origin: new URL(request.url).origin, bearer: request.headers.get("authorization"), id: request.headers.get("cf-access-client-id"), secret: request.headers.get("cf-access-client-secret") });
@@ -966,9 +968,22 @@ test("sealed upstream and wake Access credentials reach only their tenant contex
 	assert.equal(preview.status, 200);
 	assert.equal((preview.body as { hasAccessServiceToken: boolean }).hasAccessServiceToken, true);
 	for (const value of Object.values(secrets)) assert.equal(JSON.stringify([facade.body, preview.body]).includes(value), false);
+	let version = 1;
+	for (const active of ["previous", "current"]) {
+		const v2 = await sealWakeSecrets(keyring(active), "sealed-tenant", secrets);
+		assert.ok(v2?.startsWith(`v2.${active}.`));
+		assert.equal((await push(++version, v2)).applied, true);
+		const facadeV2 = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/facade" });
+		assert.equal((facadeV2.body as { hasUpstreamToken: boolean }).hasUpstreamToken, true);
+		assert.equal(received.at(-1)?.bearer, "Bearer dummy-bearer");
+		const wakeV2 = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/wake/preview" });
+		assert.equal((wakeV2.body as { hasAccessServiceToken: boolean }).hasAccessServiceToken, true);
+		for (const value of Object.values(secrets)) assert.equal(JSON.stringify([facadeV2.body, wakeV2.body]).includes(value), false);
+	}
+
 	const otherTenantBlob = await sealWakeSecrets("platform-secret", "another-tenant", secrets);
 	assert.ok(otherTenantBlob);
-	assert.equal((await push(2, otherTenantBlob)).applied, true);
+	assert.equal((await push(++version, otherTenantBlob)).applied, true);
 	const rejected = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/facade" });
 	assert.equal((rejected.body as { hasUpstreamToken: boolean }).hasUpstreamToken, false);
 	assert.equal((rejected.body as { hasUpstreamAccessServiceToken: boolean }).hasUpstreamAccessServiceToken, false);

package/worker/test/owner-mcp.test.ts

@@ -95,6 +95,17 @@ test("hosted control plane send, reply, and mark_working", async (t) => {
 	assert.equal(viaHttp.text.includes("tok-alpha"), false);
 	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "from the owner token");
 
+	// A hosted rotation keeps stored outbound tokens readable through the actual owner send path.
+	const rotating = hostedTenantContext({ ...env, TENANT_SECRETS_KEY: JSON.stringify({
+		v: 2, active: "next", keys: { old: "platform-key", next: "next-platform-key" },
+	}) }, { id: "ten_carol", db: DB, publicUrl: BASE, ownerTokenHash: hash, status: "active" });
+	const afterRotation = await runOwnerRpc(rotating, ectx as any, {
+		accountId: "acct_carol", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "after rotation" },
+	});
+	assert.equal(afterRotation.status, 200);
+	assert.equal((afterRotation.body as any).isError, false, JSON.stringify(afterRotation.body));
+	assert.equal(peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+
 	const withBody = await runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
 	assert.equal(withBody.status, 400);
 	assert.equal((withBody.body as { error?: string }).error, "this call takes no body");

package/worker/test/reply-delivery.test.ts

@@ -55,8 +55,10 @@ async function fixture(t: Parameters<typeof test>[1] extends (t: infer T) => unk
 	byId.set("id-alice", a); byId.set("id-bob", b);
 	store.set("tenant:alice", JSON.stringify({ id: "id-alice", status: "active", region: "default", version: 1 }));
 	store.set("tenant:bob", JSON.stringify({ id: "id-bob", status: "active", region: "default", version: 1 }));
-	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) =>
-		runOwnerRpc(ctx, ectx as never, { accountId, method, path, ...(body === undefined ? {} : { body }) });
+	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) => {
+		const url = new URL(path, ctx.PUBLIC_URL);
+		return runOwnerRpc(ctx, ectx as never, { accountId, method, path: url.pathname, query: Object.fromEntries(url.searchParams), ...(body === undefined ? {} : { body }) });
+	};
 	const issue = async (ctx: TenantContext, ownerToken: string, label: string) => {
 		const r = await dispatch(new Request(ctx.PUBLIC_URL + "/owner/peers", { method: "POST", headers: { authorization: `Bearer ${ownerToken}`, "content-type": "application/json" }, body: JSON.stringify({ label }) }), ctx, ectx as never);
 		return (await r.json() as { token: string }).token;
@@ -71,7 +73,7 @@ async function fixture(t: Parameters<typeof test>[1] extends (t: infer T) => unk
 		assert.equal(r.status, 200, JSON.stringify(data));
 		return data.result.id as string;
 	};
-	return { a, b, dbA, dbB, owner, sendToBob, cards, missingCard() { missingCard = true; }, get directPosts() { return directPosts; }, get aborted() { return aborted; }, blockDirect() {
+	return { a, b, dbA, dbB, owner, sendToBob, bobAtAlice, otherAtAlice: () => issue(a, ownerA, "other"), cards, missingCard() { missingCard = true; }, get directPosts() { return directPosts; }, get aborted() { return aborted; }, blockDirect() {
 		let release!: () => void;
 		hold = new Promise<void>((resolve) => { release = resolve; });
 		const started = new Promise<void>((resolve) => { posted = resolve; });
@@ -91,15 +93,20 @@ test("reply delivers once to an exact paired peer in the same context and a dire
 	assert.equal(JSON.stringify(first.body).includes("a2aow_"), false);
 	assert.equal(s.directPosts, 1);
 
-	const inbox = await s.owner(s.a, "acct-alice", "GET", "/owner/inbox");
+	const inbox = await s.owner(s.a, "acct-alice", "GET", "/owner/inbox?all=1");
 	const delivered = (inbox.body as any[]).find((row) => row.text === "answer");
 	assert.equal(delivered.contextId, "ctx-direct");
+	assert.equal(delivered.state, "completed");
+	assert.deepEqual((await s.dbA.prepare("SELECT * FROM wakes").all()).results, []);
+	const openInbox = await s.owner(s.a, "acct-alice", "GET", "/owner/inbox");
+	assert.deepEqual(openInbox.body, []);
 	const stored = await s.dbA.prepare("SELECT metadata_json FROM tasks WHERE id = ?").bind(delivered.taskId).first() as { metadata_json?: string };
 	const metadata = JSON.parse(stored.metadata_json || "{}");
 	assert.deepEqual(metadata["a2a.exposed/reply-delivery"].taskId, taskId);
 
 	const noLoop = await s.owner(s.a, "acct-alice", "POST", "/owner/mcp/reply", { taskId: delivered.taskId, text: "ack", state: "completed" });
-	assert.equal((noLoop.body as any).structuredContent.status, "stored-only");
+	assert.equal((noLoop.body as any).isError, true);
+	assert.match(String((noLoop.body as any).text), /already completed/);
 	assert.equal(s.directPosts, 1, "a directly delivered reply is never delivered back");
 
 	const retry = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "answer", state: "completed" });
@@ -219,3 +226,36 @@ test("reply discovers one canonical card and uses the paired base when it is mis
 	assert.deepEqual(s.cards, ["/.well-known/agent-card.json"]);
 	assert.equal(s.directPosts, 1);
 });
+
+for (const version of ["0.3", "1.0"]) {
+	for (const placement of ["request", "message"]) {
+		test(`direct reply metadata on ${placement} auto-completes without waking (${version})`, async (t) => {
+			const s = await fixture(t as never);
+			const contextId = "ctx-marker";
+			const marker = { "a2a.exposed/reply-delivery": { taskId: "remote-task", messageId: "remote-message", state: "working" } };
+			const send = async (metadata: unknown, taskId?: string, token = s.bobAtAlice) => {
+				const message = { role: version === "1.0" ? "ROLE_USER" : "user", messageId: crypto.randomUUID(), contextId,
+					parts: [{ kind: "text", text: "reply text" }], ...(taskId ? { taskId } : {}), ...(placement === "message" ? { metadata } : {}) };
+				const r = await dispatch(new Request(s.a.PUBLIC_URL, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+					body: JSON.stringify({ jsonrpc: "2.0", id: "marker", method: version === "1.0" ? "SendMessage" : "message/send", params: { message, ...(placement === "request" ? { metadata } : {}) } }) }), s.a, ectx as never);
+				return await r.json() as any;
+			};
+			const result = await send(marker);
+			const task = version === "1.0" ? result.result.task : result.result;
+			assert.equal(task.status.state, version === "1.0" ? "TASK_STATE_COMPLETED" : "completed");
+			assert.deepEqual(task.metadata, marker);
+			assert.deepEqual((await s.owner(s.a, "acct-alice", "GET", "/owner/inbox")).body, []);
+			assert.deepEqual((await s.dbA.prepare("SELECT * FROM wakes").all()).results, []);
+			const history = await s.owner(s.a, "acct-alice", "GET", `/owner/history/${contextId}?from=bob`);
+			assert.match(JSON.stringify(history.body), /reply text/);
+			const unauthorized = await send(marker, task.id, await s.otherAtAlice());
+			assert.equal(unauthorized.error.code, -32001);
+			for (const metadata of [{ other: {} }, { "a2a.exposed/reply-delivery": "completed" }]) {
+				const normal = await send(metadata);
+				assert.equal((version === "1.0" ? normal.result.task : normal.result).status.state, version === "1.0" ? "TASK_STATE_SUBMITTED" : "submitted");
+			}
+			assert.equal(((await s.owner(s.a, "acct-alice", "GET", "/owner/inbox")).body as any[]).length, 2);
+			assert.equal((await s.dbA.prepare("SELECT COUNT(*) AS n FROM wakes").first() as any).n, 1);
+		});
+	}
+}

package/worker/test/tenancy.test.ts

@@ -268,3 +268,20 @@ test("fetch path: gates set or unset, the self-host Worker still answers from OW
 	const no = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer platform-key" });
 	assert.equal(no.status, 401);
 });
+
+test("hosted peer token keys follow the active ring key and keep the previous key for reads", async () => {
+	const make = (key: string, id = "ten_a") => hostedTenantContext(selfEnv({ TENANT_SECRETS_KEY: key }), { id, db: dummy, publicUrl: BASE });
+	const old = make("old-platform-key");
+	const ring = JSON.stringify({ v: 2, active: "current", keys: { previous: "old-platform-key", current: "new-platform-key" } });
+	const rotating = make(ring);
+	const oldToken = await sealPeerTokenWithKey((await old.peerKey())!, "alpha", "fixture-old-token");
+	const keys = await rotating.peerReadKeys();
+	assert.equal(keys.length, 2);
+	assert.equal(await openPeerTokenWithKey(keys[0], "alpha", oldToken), null);
+	assert.equal(await openPeerTokenWithKey(keys[1], "alpha", oldToken), "fixture-old-token");
+	const newToken = await sealPeerTokenWithKey((await rotating.peerKey())!, "alpha", "fixture-new-token");
+	assert.equal(await openPeerTokenWithKey((await make("new-platform-key").peerKey())!, "alpha", newToken), "fixture-new-token");
+	for (const key of await make(ring, "ten_b").peerReadKeys()) assert.equal(await openPeerTokenWithKey(key, "alpha", oldToken), null);
+	assert.deepEqual(await make('{"v":2}').peerReadKeys(), []);
+	assert.equal((await resolveTenant(selfEnv()).peerReadKeys()).length, 1);
+});