a2a-exposed 0.8.36 → 0.8.37

package/lib/hosted.mjs

@@ -5,6 +5,7 @@ import { controlOrigin, deviceLogin } from "./account.mjs";
 import { CliError, upstreamUrlProblem } from "./a2a.mjs";
 
 export const SETUP_SCOPES = ["agents:read", "agents:create", "agents:owner-token", "wake:write", "wake:test"];
+const SETUP_UNSUPPORTED = "This service does not expose scoped hosted setup capabilities. Check the --control-url service origin. Use the service dashboard to create an agent and configure Wake settings, or hosted MCP create_agent/set_wake with human confirmation and secret entry. Do not run init or deploy to repair a hosted address; no setup approval was requested.";
 const NEXT = "Run hosted capabilities --json to list scopes and presets; login --machine NAME --scopes SCOPES to approve setup.";
 const fail = (code, next) => { const error = new CliError(next); error.result = { ok: false, code, next }; throw error; };
 const printable = value => typeof value === "string" && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value);
@@ -34,14 +35,16 @@ function originFor(o = {}) {
 
 async function request(origin, path, { token = "", method = "GET", body, fetchImpl = fetch } = {}) {
 	let response, data;
+	const discovery = method === "GET" && path === "/api/v1/setup/capabilities";
 	try {
 		response = await fetchImpl(`${origin}${path}`, {
 			method, redirect: "error", signal: AbortSignal.timeout(30_000),
 			headers: { accept: "application/json", ...(token ? { authorization: `Bearer ${token}` } : {}), ...(body === undefined ? {} : { "content-type": "application/json" }) },
 			...(body === undefined ? {} : { body: JSON.stringify(body) }),
 		});
-		data = await response.json();
+		if (!(discovery && response.status === 404)) data = await response.json();
 	} catch { fail("unavailable", "Hosted setup did not answer with JSON. Check the service and try again. Do not repeat a create request until hosted list confirms its result."); }
+	if (discovery && response.status === 404) fail("unsupported", SETUP_UNSUPPORTED);
 	if (!data || typeof data !== "object" || Array.isArray(data)) fail("invalid_response", "The hosted service returned an invalid setup response.");
 	if (!response.ok) {
 		if (response.status === 429 && data.error === "too_many_references") {
@@ -70,7 +73,7 @@ async function request(origin, path, { token = "", method = "GET", body, fetchIm
 
 export async function capabilities(o = {}) {
 	const data = await request(originFor(o), "/api/v1/setup/capabilities");
-	if (!Array.isArray(data.scopes) || !Array.isArray(data.wake?.presets)) fail("unsupported", "This service does not expose hosted setup capabilities yet.");
+	if (!Array.isArray(data.scopes) || !Array.isArray(data.wake?.presets)) fail("unsupported", SETUP_UNSUPPORTED);
 	return { ok: true, code: "capabilities", next: "Select explicit scopes and a wake preset from this listing.", scopes: data.scopes.filter(s => SETUP_SCOPES.includes(s)), presets: data.wake.presets.filter(s => /^[a-z-]+$/.test(s)), preflight: data.preflight === true, secret_reference: data.wake.secret_reference === true, wake_removal: data.wake.removal === true, secure_link_create: data.wake.secure_link_create === true };
 }
 

package/lib/main.mjs

@@ -28,6 +28,7 @@ Setup options: --skip-install skips dependency installation when dependencies al
 
 Hosted setup:
   hosted capabilities --json   list setup scopes, wake presets and service capabilities
+                                unsupported/404: check --control-url; use dashboard or hosted MCP with human confirmation
   login --machine NAME --scopes SCOPES [--control-url URL] --json
                                 approve the explicit scopes using the printed website link once;
                                 save the scoped grant locally (mode 600), never print it

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.36",
+	"version": "0.8.37",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -1147,7 +1147,7 @@ async function checkedPeerFetch(ctx: TenantContext, ectx: ExecutionContext, base
 	try { baseUrl = new URL(base); target = new URL(url); } catch { throw new ToolError("peer endpoint is not a URL"); }
 	if (target.origin !== baseUrl.origin) throw new ToolError("peer card endpoint refused: it is on a different origin");
 	const why = peerUrlProblem(target.href);
-	if (why) throw new ToolError(`peer endpoint ${target.href} refused: ${why}`);
+	if (why) throw new ToolError(`peer endpoint ${target.host} refused: ${why}`);
 	const internal = await fetchTenant(ctx, target, { ...init, redirect: "manual" });
 	if (internal) {
 		if (internal.status >= 300 && internal.status < 400) throw new ToolError("peer endpoint refused: redirects are not allowed");
@@ -1563,10 +1563,12 @@ async function deliverReplyMessage(ctx: TenantContext, ectx: ExecutionContext, t
 		const pushed = await notifyPeer(ctx, ectx, task, signal);
 		const failed = pushed.find((x: Json) => !x.ok);
 		const target = safeTarget(undefined, String((failed || pushed[0])?.url || ""));
-		const http = /HTTP (\d{3})/.exec(String((failed || pushed[0])?.info || ""));
+		const info = String((failed || pushed[0])?.info || "");
+		const http = /^HTTP (\d{3})$/.exec(info);
+		const httpStatus = http && http[0] === info ? Number(http[1]) : undefined;
 		return {
 			status: failed ? "delivery-failed" : "delivered", method: "push", taskId: task.id, state,
-			...(target ? { target } : {}), ...(http ? { httpStatus: Number(http[1]) } : {}),
+			...(target ? { target } : {}), ...(httpStatus !== undefined && httpStatus >= 100 && httpStatus <= 599 ? { httpStatus } : {}),
 			detail: failed ? "A task push failed; the reply remains stored on the task." : "Delivered as the task's existing push update.",
 		};
 	}

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.36";
+export const VERSION = "0.8.37";

package/worker/test/reply-delivery.test.ts

@@ -259,3 +259,36 @@ for (const version of ["0.3", "1.0"]) {
 		});
 	}
 }
+
+
+test("push status only accepts an exact HTTP result in the output schema range", async (t) => {
+	const s = await fixture(t as never);
+	const originalFetch = globalThis.fetch;
+	t.after(() => { globalThis.fetch = originalFetch; });
+	for (const value of [200, 307, 401, 599, 99, 600, 999, "HTTP 999", "prefix HTTP 401 suffix", "HTTP 401\n"]) {
+		globalThis.fetch = (async () => {
+			if (typeof value === "string") throw value;
+			const response = new Response(null);
+			Object.defineProperty(response, "status", { value });
+			return response;
+		}) as typeof fetch;
+		const taskId = await s.sendToBob("status " + value, crypto.randomUUID(), { id: "cfg", url: "https://push.example.net/update" });
+		const result = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "stored answer" });
+		const delivery = (result.body as any).structuredContent as Delivery;
+		assert.equal(delivery.httpStatus, typeof value === "number" && value >= 100 && value <= 599 ? value : undefined, String(value));
+		assert.equal(delivery.status, value === 200 ? "delivered" : "delivery-failed");
+		const stored = await s.dbB.prepare("SELECT state FROM tasks WHERE id = ?").bind(taskId).first() as { state: string };
+		assert.equal(stored.state, "completed");
+	}
+});
+
+test("direct reply refusal reports only the endpoint host", async (t) => {
+	const s = await fixture(t as never);
+	await s.dbB.prepare("UPDATE outbound_peers SET url = 'http://alice.example.com/private-path?private-query=yes' WHERE alias = 'alice'").run();
+	const taskId = await s.sendToBob("refused endpoint", "ctx-refused-url");
+	const result = await s.owner(s.b, "acct-bob", "POST", "/owner/mcp/reply", { taskId, text: "stored answer" });
+	const delivery = (result.body as any).structuredContent;
+	assert.equal(delivery.status, "delivery-failed");
+	assert.match(delivery.detail, /peer endpoint alice\.example\.com refused/);
+	assert.doesNotMatch(JSON.stringify(result.body), /private-path|private-query|http:\/\//);
+});