a2a-exposed 0.8.6 → 0.8.8

package/lib/tunnel.mjs

@@ -40,8 +40,11 @@ export const TUNNEL_KEYS = [
 const WORDS = ["amber", "brisk", "cedar", "delta", "ember", "fable", "gale", "harbor", "iris", "jade", "kelp", "lumen", "maple",
 	"nova", "onyx", "pebble", "quill", "raven", "sable", "tidal", "umber", "velvet", "willow", "zephyr", "otter", "lark", "fjord", "heron"];
 export function randomLabel(rand = crypto.randomInt) {
-	const w = () => WORDS[rand(WORDS.length)];
-	return `wake-${w()}-${w()}-${rand(0x10000).toString(16).padStart(4, "0")}`;
+	const a = rand(WORDS.length);
+	let b = rand(WORDS.length);
+	if (b === a) b = rand(WORDS.length);
+	if (b === a) b = (a + 1) % WORDS.length;
+	return `wake-${WORDS[a]}-${WORDS[b]}-${rand(0x10000).toString(16).padStart(4, "0")}`;
 }
 
 export const HOST_RE = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
@@ -62,8 +65,8 @@ export function noZoneHelp(zones) {
 		inactive.length
 			? `no active domain (zone) on this Cloudflare account (not active yet: ${inactive.map((z) => `${z.name} [${z.status}]`).join(", ")}).`
 			: "this Cloudflare account has no domain (zone).",
-		"The wake tunnel needs a zone anywhere on the account for its hostname and Access app (whether the inbox is on workers.dev or a custom hostname).",
-		"Without one, use scheduled polling: the inbox works as it is (setup skill: \"Agents without inbound webhooks: polling\").",
+		"The wake tunnel needs a zone anywhere on the account for its hostname and Access app (whether the A2A endpoint is on workers.dev or a custom hostname).",
+		"Without one, use scheduled polling. The A2A endpoint works as it is. Agents without inbound webhooks poll.",
 		`To use the tunnel later, add a domain to the account and run \`${CLI} tunnel create\` (no redeploy needed).`,
 	].join("\n");
 }
@@ -88,12 +91,12 @@ export function pickTunnelHostname({ tunnelHostname, tunnelZone, inboxHost, zone
 		return { hostname: `${label()}.${zone.name}`, zone, note: `wake hostname on the zone ${zone.name} (--tunnel-zone)` };
 	}
 	const own = inboxHost ? zoneFor(inboxHost, usable) : null;
-	if (own) return { hostname: `${label()}.${own.name}`, zone: own, note: `wake hostname on ${own.name}, the zone of the inbox hostname` };
+	if (own) return { hostname: `${label()}.${own.name}`, zone: own, note: `wake hostname on ${own.name}, the zone of the A2A endpoint hostname` };
 	if (usable.length === 1)
-		return { hostname: `${label()}.${usable[0].name}`, zone: usable[0], note: `the account has one zone, ${usable[0].name}: the wake hostname goes there (the inbox URL is unchanged)` };
+		return { hostname: `${label()}.${usable[0].name}`, zone: usable[0], note: `the account has one zone, ${usable[0].name}: the wake hostname goes there (the A2A endpoint URL is unchanged)` };
 	if (!usable.length) die(noZoneHelp(zones));
 	return die([
-		`this Cloudflare account has ${usable.length} zones; choose one for the wake hostname (the inbox URL is unchanged):`,
+		`this Cloudflare account has ${usable.length} zones; choose one for the wake hostname (the A2A endpoint URL is unchanged):`,
 		zoneList(usable),
 		"Re-run with --tunnel-zone <zone>  (or --tunnel-hostname wake-<name>.<zone>).",
 	].join("\n"));
@@ -164,6 +167,31 @@ export function cloudflareErrorCode(body) {
 	return m ? m[1] || m[2] || m[3] || m[4] : "";
 }
 
+/** API token permission named in `[10000]` and `[7403]` errors, from the `cf` command. */
+export function cfPermission(args) {
+	const head = args[0];
+	if (head === "workers") return "Workers Scripts: Edit";
+	if (head === "d1") return "D1: Edit";
+	if (head === "dns") return "Zone DNS: Edit";
+	if (head === "zero-trust") return "Access: Edit";
+	if (head === "tunnels") return "Cloudflare Tunnel: Edit";
+	return "";
+}
+
+/** Append the token permission when Cloudflare returns code 10000 or 7403. */
+export function withPermissionHint(args, msg) {
+	if (!/\[(10000|7403)\]/.test(msg) || /The API token needs/.test(msg)) return msg;
+	const perm = cfPermission(args);
+	const text = String(msg || "").trim().replace(/[.]+$/, "");
+	return perm ? `${text}. The API token needs ${perm}.` : `${text}.`;
+}
+
+/** True when `cf` reports that this Worker does not exist (code 10007). */
+export function workerMissingError(err) {
+	const msg = err instanceof Error ? err.message : String(err || "");
+	return /\[10007\]/.test(msg) || /this worker does not exist/i.test(msg);
+}
+
 // ------------------------------------------------------------------ cf calls (JSON in, JSON out, errors captured)
 export function cfCall(dir, args, { body, file, allowNotFound = false } = {}) {
 	const full = [...args];
@@ -175,7 +203,7 @@ export function cfCall(dir, args, { body, file, allowNotFound = false } = {}) {
 		const err = (r.stderr || r.stdout || "").replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
 		if (allowNotFound && /404|not found|does not exist|could not be found/i.test(err)) return null;
 		const msg = (err.match(/\[\d+\][^\n]*/g) || [err.trim().split("\n").slice(-3).join(" ")]).join("; ");
-		throw new CliError(`cf ${args.slice(0, 3).join(" ")} failed: ${msg.slice(0, 400)}`);
+		throw new CliError(`cf ${args.slice(0, 3).join(" ")} failed: ${withPermissionHint(args, msg.slice(0, 400))}`);
 	}
 	const out = (r.stdout || "").trim();
 	if (!out) return {};
@@ -187,7 +215,7 @@ const ACCESS_HELP = (acct) => [
 	"  - dashboard: https://one.dash.cloudflare.com/ -> pick a team name and the Free plan (up to 50 users), then re-run",
 	"  - or let the CLI create the organization: re-run with --zero-trust-org <team-name>  (gives <team-name>.cloudflareaccess.com)",
 	`  account: ${acct || "(see cf auth whoami)"}`,
-	"No tunnel? Use scheduled polling instead (setup skill: \"Agents without inbound webhooks: polling\").",
+	"No tunnel? Use scheduled polling instead. Agents without inbound webhooks poll.",
 ].join("\n");
 
 function accessOrg(dir, o) {
@@ -226,7 +254,7 @@ export function cfWorkDir(preferred) {
 }
 
 function needDeployment(o) {
-	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`no saved deployment; run \`${CLI} init\` first`);
+	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`nothing is deployed from ${C.CONFIG_DIR}. Another deployment? Set A2A_CONFIG_DIR.`);
 	const dir = D.workerDir(o);
 	if (!fs.existsSync(dir)) die(`worker project not found at ${dir}; run \`${CLI} deploy\` once`);
 	return cfWorkDir(dir);
@@ -234,7 +262,7 @@ function needDeployment(o) {
 
 /** `cf` cwd for `tunnel rm` / `uninstall`. A missing Worker project uses a temp directory with a writable cache. */
 function cfDirForRemove(o, { allowMissingProject = false } = {}) {
-	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`no saved deployment; run \`${CLI} init\` first`);
+	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`nothing is deployed from ${C.CONFIG_DIR}. Another deployment? Set A2A_CONFIG_DIR.`);
 	const dir = D.workerDir(o);
 	if (!fs.existsSync(dir) && !allowMissingProject) die(`worker project not found at ${dir}; run \`${CLI} deploy\` once`);
 	return cfWorkDir(dir);
@@ -262,6 +290,11 @@ export async function create(o) {
 	if (tunnelStarted()) return resume(dir, o);
 	const { preset, origin, wpath } = preflight(o);
 	const worker = D.workerName();
+	try {
+		const preview = await owner("GET", "/owner/wake/preview");
+		if (preview && preview.configured)
+			console.error(`warning: the Worker already has a wake URL. tunnel create replaces it with the tunnel hostname. \`${CLI} tunnel rm\` removes that tunnel. It does not put the previous wake URL back.`);
+	} catch { /* Worker unreachable: the upload below reports it */ }
 
 	step("finding a zone for the wake hostname");
 	const { hostname, zone, note } = pickTunnelHostname({
@@ -278,6 +311,8 @@ export async function create(o) {
 	const label = `a2a-exposed wake ${worker}`;
 	const save = (u) => C.saveConfig(u);
 	save({ A2A_TUNNEL_HOSTNAME: hostname, A2A_TUNNEL_ORIGIN: origin, A2A_TUNNEL_PATH: wpath, A2A_TUNNEL_ZONE_ID: zone.id });
+	/** Secret names this run uploaded. Rollback deletes only these. */
+	let createdSecrets = [];
 	try {
 		step(`Access service token "${label}"`);
 		const st = cfCall(dir, ["zero-trust", "access", "service-tokens", "create"], { body: serviceTokenBody(label) });
@@ -308,16 +343,19 @@ export async function create(o) {
 		const secrets = { WAKE_WEBHOOK_URL: url, WAKE_ACCESS_CLIENT_ID: st.client_id, WAKE_ACCESS_CLIENT_SECRET: st.client_secret };
 		for (const k of ["WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET"]) if (process.env[k]) secrets[k] = process.env[k];
 		await putSecrets(dir, worker, secrets);
+		createdSecrets = Object.keys(secrets);
 
 		console.log(url);
-		console.error(`\ntunnel ready: wakes go to ${url} -> ${origin}${wpath} on the agent's machine`);
+		console.error(`\nAccess application "${label}" (id ${app.id}); service token id ${st.id}; tunnel id ${tun.id}.`);
+		console.error(`tunnel ready: wakes go to ${url} -> ${origin}${wpath} on the agent's machine`);
 		console.error(connectorInstructions(tokenFile, o["show-token"] ? token : ""));
-		console.error(`\nThen (Worker secrets apply within about 15 to 40 seconds): ${CLI} tunnel status   and   ${CLI} wake test`);
+		console.error(`\nTo undo this, run \`${CLI} tunnel rm\`.`);
+		console.error(`Then (Worker secrets apply within about 15 to 40 seconds; wait about 30 seconds): ${CLI} tunnel status   and   ${CLI} wake test`);
 		if (!process.env.WAKE_WEBHOOK_KEY && !process.env.WAKE_HMAC_SECRET && preset !== "generic")
 			console.error(`note: no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET in the environment; keep the ${preset} webhook's own auth too (export it and run \`wake set\`)`);
 	} catch (e) {
-		console.error(`error: ${e.message}\n==> rolling back what was created`);
-		await remove(o, { quiet: true }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`${CLI} tunnel rm\``));
+		console.error("==> rolling back what was created");
+		await remove(o, { quiet: true, secretNames: createdSecrets }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`${CLI} tunnel rm\``));
 		throw e;
 	}
 }
@@ -396,7 +434,7 @@ export async function status(o) {
 	const tid = C.get("A2A_TUNNEL_ID");
 	if (tid) {
 		const t = cfCall(dir, ["tunnels", "get", tid], { allowNotFound: true });
-		info.tunnel = t ? { id: tid, status: t.status, connections: (t.connections || []).length } : "missing";
+		info.tunnel = t ? { id: tid, status: t.status === "inactive" ? "never connected" : t.status, connections: (t.connections || []).length } : "missing";
 	}
 	const app = C.get("A2A_TUNNEL_ACCESS_APP_ID");
 	if (app) {
@@ -424,30 +462,54 @@ export async function status(o) {
 	console.log(JSON.stringify(info, null, 2));
 	const w = info.probe.withServiceToken || "";
 	if (/1033/.test(w)) console.error("connector not running: start cloudflared on the agent's machine (tunnel create printed the command)");
-	if (!/^HTTP 40[13]/.test(info.probe.withoutToken)) console.error("WARNING: the bare request was not blocked by Access; check the Access application");
+	const note = bareProbeNote(info.probe.withoutToken);
+	if (note) console.error(note);
+}
+
+/** What `tunnel status` prints about the request that carries no service token. A network error is DNS, not a missed Access block. */
+export function bareProbeNote(withoutToken) {
+	const bare = withoutToken || "";
+	if (/^network error:/.test(bare)) return "DNS may still be propagating; retry in 30 seconds";
+	if (!/^HTTP 40[13]/.test(bare)) return "WARNING: the bare request was not blocked by Access; check the Access application";
+	return "";
 }
 
-export async function remove(o, { quiet = false, allowMissingProject = false } = {}) {
+export async function remove(o, { quiet = false, allowMissingProject = false, skipSecrets = false, secretNames = undefined, rerun = "" } = {}) {
+	if (!TUNNEL_KEYS.some((k) => C.get(k))) {
+		if (!quiet) console.error("nothing to remove");
+		return;
+	}
 	const dir = cfDirForRemove(o, { allowMissingProject });
 	const worker = D.workerName();
 	const label = `a2a-exposed wake ${worker}`;
 	const failures = [];
+	const removedParts = [];
 	const attempt = async (what, key, fn) => {
 		if (key && !C.get(key)) return;
-		try { await fn(); if (key) C.saveConfig({ [key]: null }); step(`removed ${what}`); }
+		try { await fn(); if (key) C.saveConfig({ [key]: null }); step(`removed ${what}`); removedParts.push(what); }
 		catch (e) { failures.push(`${what}: ${e.message}`); }
 	};
 	const host = C.get("A2A_TUNNEL_HOSTNAME");
 	// 1. Worker secrets first, so no wake is sent to a half-removed hostname. WAKE_WEBHOOK_URL only if it is ours.
-	if (host) {
-		const names = ["WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET"];
-		let ours = false;
-		try { const p = await owner("GET", "/owner/wake/preview"); ours = p.fingerprints?.url === fingerprint(wakeUrl(host, C.get("A2A_TUNNEL_PATH") || "/")); }
-		catch { /* Worker unreachable: leave the URL */ }
-		if (ours) names.push("WAKE_WEBHOOK_URL");
-		await attempt(`Worker secrets for ${host} (${names.join(", ")})`, null, async () => {
+	// secretNames lists what this run created (rollback). Omitted: the usual tunnel-rm set. skipSecrets: the Worker is already gone.
+	const explicitSecrets = secretNames !== undefined;
+	const names = explicitSecrets ? [...secretNames] : ["WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET"];
+	if (host && !skipSecrets && names.length) {
+		if (!explicitSecrets) {
+			let ours = false;
+			try { const p = await owner("GET", "/owner/wake/preview"); ours = p.fingerprints?.url === fingerprint(wakeUrl(host, C.get("A2A_TUNNEL_PATH") || "/")); }
+			catch { /* Worker unreachable: leave the URL */ }
+			if (ours && !names.includes("WAKE_WEBHOOK_URL")) names.push("WAKE_WEBHOOK_URL");
+		}
+		try {
 			await putSecrets(dir, worker, Object.fromEntries(names.map((k) => [k, null])));
-		});
+			const secretsWhat = `Worker secrets for ${host} (${names.join(", ")})`;
+			step(`removed ${secretsWhat}`);
+			removedParts.push(secretsWhat);
+		} catch (e) {
+			if (workerMissingError(e)) step(`Worker for ${host} is already gone; its secrets went with it`);
+			else failures.push(`Worker secrets for ${host} (${names.join(", ")}): ${e.message}`);
+		}
 	}
 	// 2. DNS before Access, so the hostname never resolves without its Access app
 	await attempt(`DNS record ${host || C.get("A2A_TUNNEL_DNS_ID")}`, "A2A_TUNNEL_DNS_ID", () => cfCall(dir, ["dns", "records", "delete", C.get("A2A_TUNNEL_DNS_ID"), "-z", C.get("A2A_TUNNEL_ZONE_ID"), "--force"], { allowNotFound: true }));
@@ -464,7 +526,11 @@ export async function remove(o, { quiet = false, allowMissingProject = false } =
 		C.saveConfig({ A2A_TUNNEL_ACCESS_CLIENT_ID: null, A2A_TUNNEL_ACCESS_CLIENT_SECRET: null });
 	});
 	await attempt("tunnel token file", "A2A_TUNNEL_TOKEN_FILE", () => fs.rmSync(C.get("A2A_TUNNEL_TOKEN_FILE"), { force: true }));
-	if (failures.length) die(`some parts could not be removed (ids kept in ${C.CONFIG_FILE}; re-run \`tunnel rm\`):\n  ${failures.join("\n  ")}`);
+	if (failures.length) {
+		const err = new CliError(`some parts could not be removed (ids kept in ${C.CONFIG_FILE}; re-run ${rerun || "`tunnel rm`"}):\n  ${failures.join("\n  ")}`);
+		err.removed = removedParts;
+		throw err;
+	}
 	C.saveConfig(Object.fromEntries(TUNNEL_KEYS.map((k) => [k, null])));
 	if (!quiet) console.error("tunnel removed. Stop cloudflared on the agent's machine (and `cloudflared service uninstall` if installed). Wakes are off until you set a new WAKE_WEBHOOK_URL (or use polling).");
 }

package/lib/uninstall.mjs

@@ -1,45 +1,155 @@
-// `uninstall`: remove the wake tunnel (when one is saved), the Worker, and the D1 database for this config.
+// `uninstall`: remove the Worker, the wake tunnel (when one is saved), and the D1 database for this config.
 import readline from "node:readline/promises";
-import { CliError } from "./a2a.mjs";
+import { CLI, CliError } from "./a2a.mjs";
 import * as C from "./config.mjs";
 import * as D from "./deploy.mjs";
 import * as T from "./tunnel.mjs";
 
 const step = (s) => console.error(`==> ${s}`);
 
+/** Saved Worker, D1 id, or tunnel: something this config deployed. */
+export function deploymentSaved() {
+	return !!(C.get("A2A_WORKER_NAME") || C.get("A2A_D1_ID") || T.TUNNEL_KEYS.some((k) => C.get(k)));
+}
+
+/** Lines printed before the prompt and by `--dry-run`. The wake line is present only when a tunnel is saved. */
+export function uninstallPlan() {
+	const lines = ["This removes:"];
+	lines.push(`Worker: ${C.get("A2A_WORKER_NAME") || "(none saved)"}`);
+	const d1 = [C.get("A2A_D1_NAME"), C.get("A2A_D1_ID")].filter(Boolean).join(" ");
+	lines.push(`D1: ${d1 || "(none saved)"}`);
+	lines.push(`Account: ${C.get("CLOUDFLARE_ACCOUNT_ID") || "(none saved)"}`);
+	if (T.TUNNEL_KEYS.some((k) => C.get(k))) {
+		const host = C.get("A2A_TUNNEL_HOSTNAME");
+		const id = C.get("A2A_TUNNEL_ID");
+		const worker = C.get("A2A_WORKER_NAME");
+		const label = worker ? `a2a-exposed wake ${worker}` : "(none saved)";
+		lines.push(`Wake: ${[host, id && `tunnel ${id}`].filter(Boolean).join(", ") || "(tunnel saved)"}`);
+		const app = C.get("A2A_TUNNEL_ACCESS_APP_ID");
+		const token = C.get("A2A_TUNNEL_ACCESS_TOKEN_ID");
+		const dns = C.get("A2A_TUNNEL_DNS_ID");
+		lines.push(`Access application: ${app ? `${label} (${app})` : "(none saved)"}`);
+		lines.push(`Service token: ${token ? `${label} (${token})` : "(none saved)"}`);
+		lines.push(`DNS record: ${[host, dns && `id ${dns}`].filter(Boolean).join(", ") || "(none saved)"}`);
+	}
+	lines.push("Removal is permanent. It takes the messages and the paired peers with it.");
+	return lines.join("\n");
+}
+
 /** Ask before deleting. On a terminal, wait for y or yes unless `yes` is set. Off a terminal, `--yes` is required. */
 export async function confirmUninstall(yes, input = process.stdin, output = process.stderr) {
 	if (yes) return;
 	if (!input.isTTY) throw new CliError("uninstall removes the Worker, the D1 database, and the wake tunnel. Pass --yes.");
 	const rl = readline.createInterface({ input, output });
 	try {
-		const answer = (await rl.question("Remove the Worker, the D1 database, and the wake tunnel? [y/N] ")).trim().toLowerCase();
+		const answer = (await rl.question("Remove the Worker, D1 database and wake tunnel listed above? [y/N] ")).trim().toLowerCase();
 		if (answer !== "y" && answer !== "yes") throw new CliError("uninstall cancelled");
 	} finally {
 		rl.close();
 	}
 }
 
-const kept = () => `config directory kept at ${C.CONFIG_DIR} (owner token and peer tokens). Remove that directory to delete them.`;
+const kept = () => `Config directory kept at ${C.CONFIG_DIR}. The owner token and WAKE_* values stay in config.env. A later init reuses the owner token. Peer tokens stay in this directory too. Remove the directory to delete them.`;
+
+/** A tunnel failure names the DNS record when that is the only object left. */
+function tunnelLeft(err) {
+	const msg = err instanceof Error ? err.message : String(err);
+	const names = msg.split("\n").slice(1).map((l) => l.trim().split(":")[0].trim()).filter(Boolean);
+	if (names.length && names.every((n) => n.startsWith("DNS record"))) return names.join("; ");
+	return "wake tunnel";
+}
+
+/** [10000] / [7403], a Worker that is still there, a DNS failure, and a D1 failure after the Worker is gone, say how to continue. */
+function removalError(err, { removed, left, workerGone, workerStill }) {
+	const msg = err instanceof Error ? err.message : String(err);
+	const code = /\[(10000|7403)\]/.test(msg);
+	const d1Failed = /cf d1 delete/i.test(msg);
+	const dnsFailed = /DNS record/i.test(msg);
+	if (!code && !(d1Failed && workerGone) && !dnsFailed && !workerStill) throw err instanceof CliError ? err : new CliError(msg);
+	const lines = [msg];
+	if (!/uninstall --yes/.test(msg))
+		lines.push(`Run \`${CLI} uninstall --yes\` again. A rerun continues from what is left.`);
+	lines.push(`Removed: ${removed.length ? removed.join("; ") : "nothing"}.`);
+	lines.push(`Not removed: ${left.length ? left.join("; ") : "nothing"}.`);
+	if (d1Failed && workerGone) lines.push("The Worker is already gone. A rerun removes the D1 database.");
+	if (workerStill) lines.push("The Worker is still there, so the D1 database was left in place. A rerun is safe.");
+	throw new CliError(lines.join("\n"));
+}
 
-/** One line per removal. A 404 counts as already gone. The config directory stays. */
+/** One line per removal. A missing Worker or D1 counts as already gone. The config directory stays. */
 export async function uninstall(o) {
+	if (!deploymentSaved())
+		throw new CliError(`nothing is deployed from ${C.CONFIG_DIR}. Another deployment? Set A2A_CONFIG_DIR.`);
+	console.error(uninstallPlan());
+	if (o["dry-run"]) {
+		console.error("Nothing was changed.");
+		return;
+	}
 	await confirmUninstall(Boolean(o.yes));
-	const tunnelish = T.TUNNEL_KEYS.some((k) => C.get(k));
-	if (tunnelish) await T.remove(o, { allowMissingProject: true });
-	else step("no tunnel to remove");
 
 	const name = C.get("A2A_WORKER_NAME");
 	const d1 = C.get("A2A_D1_ID");
-	const dir = name || d1 ? T.cfWorkDir(D.workerDir(o)) : "";
+	const d1Label = C.get("A2A_D1_NAME") || d1;
+	const tunnelish = T.TUNNEL_KEYS.some((k) => C.get(k));
+	const removed = [];
+	const dir = name || d1 || tunnelish ? T.cfWorkDir(D.workerDir(o)) : "";
+	let workerGone = !name;
+	let workerDeletedThisRun = false;
+	let workerError = null;
 	if (name) {
-		const r = T.cfCall(dir, ["workers", "delete", name, "--force"], { allowNotFound: true });
-		step(r === null ? `Worker ${name} is already gone` : `removed Worker ${name}`);
-	} else step("no Worker name saved");
+		try {
+			const r = T.cfCall(dir, ["workers", "delete", name, "--force"], { allowNotFound: true });
+			workerGone = true;
+			workerDeletedThisRun = r !== null;
+			const line = r === null ? `Worker ${name} is already gone` : `Worker ${name}`;
+			step(r === null ? line : `removed ${line}`);
+			removed.push(line);
+		} catch (e) { workerError = e; }
+	}
+	// A 10000 on the Worker delete is the same missing Workers Scripts permission the secrets
+	// upload would hit. Skip that upload so the tunnel can still be removed. The Worker is
+	// still there, so the D1 database stays until a later run deletes the Worker.
+	const workerAuth = workerError && /\[10000\]/.test(workerError.message || "") && /cf workers delete/i.test(workerError.message || "");
+	let tunnelError = null;
+	if (tunnelish) {
+		try {
+			await T.remove(o, { allowMissingProject: true, skipSecrets: workerGone || workerAuth, quiet: !!name, rerun: `${CLI} uninstall --yes` });
+			removed.push("wake tunnel");
+		} catch (e) {
+			tunnelError = e;
+			if (Array.isArray(e.removed)) removed.push(...e.removed);
+		}
+	} else step("no tunnel to remove");
+	if (workerError) {
+		const left = [d1 && `D1 ${d1Label} (untouched)`, name && `Worker ${name}`, tunnelError && tunnelLeft(tunnelError)].filter(Boolean);
+		const err = tunnelError ? new CliError(`${workerError.message}\n${tunnelError.message}`) : workerError;
+		removalError(err, { removed, left, workerGone: false, workerStill: true });
+	}
+	if (tunnelError) {
+		// The Worker delete did not happen in this run only when this call did not delete it (already gone, or no Worker name).
+		const d1Left = d1 && (workerDeletedThisRun
+			? `D1 ${d1Label}`
+			: `D1 ${d1Label} (untouched because the Worker delete did not happen in this run)`);
+		const left = [d1Left, tunnelLeft(tunnelError)].filter(Boolean);
+		removalError(tunnelError, { removed, left, workerGone });
+	}
+
 	if (d1) {
-		const r = T.cfCall(dir, ["d1", "delete", d1, "--force"], { allowNotFound: true });
-		step(r === null ? `D1 database ${d1} is already gone` : `removed D1 database ${d1}`);
+		try {
+			const r = T.cfCall(dir, ["d1", "delete", d1, "--force"], { allowNotFound: true });
+			const line = r === null ? `D1 database ${d1} is already gone` : `D1 database ${d1}`;
+			step(r === null ? line : `removed ${line}`);
+			removed.push(line);
+			C.saveConfig({ A2A_D1_ID: null, A2A_D1_NAME: null });
+		} catch (e) {
+			removalError(e, { removed, left: [`D1 ${C.get("A2A_D1_NAME") || d1} (untouched)`, workerError && name && `Worker ${name}`].filter(Boolean), workerGone });
+		}
 	} else step("no D1 database id saved");
+	if (workerError || tunnelError) {
+		const err = workerError && tunnelError ? new CliError(`${workerError.message}\n${tunnelError.message}`) : (workerError || tunnelError);
+		const left = [workerError && name && `Worker ${name}`, tunnelError && "wake tunnel"].filter(Boolean);
+		removalError(err, { removed, left, workerGone });
+	}
 	C.saveConfig({
 		A2A_WORKER_NAME: null, A2A_D1_ID: null, A2A_D1_NAME: null, A2A_BASE_URL: null, A2A_HOSTNAME: null,
 		A2A_WORKER_DIR: null, A2A_WORKERS_DEV_SUBDOMAIN: null,

package/lib/workersdev.mjs

@@ -31,7 +31,7 @@ export function noSubdomainHelp(accountId) {
 	return [
 		"this Cloudflare account has no workers.dev subdomain yet. Create one (once per account), then re-run:",
 		`  - let the CLI do it:   re-run with --workers-dev-subdomain <name>   (gives https://<worker>.<name>.workers.dev)`,
-		`  - or in the dashboard: ${onboardingUrl(accountId)}  (the first visit to Workers & Pages asks for it)`,
+		`  - or in the dashboard: ${onboardingUrl(accountId)}  (the first visit to the Workers section asks for it)`,
 		`  - or the API:          PUT /accounts/<account-id>/workers/subdomain  {"subdomain":"<name>"}`,
 		`  docs: ${DOCS}`,
 	].join("\n");

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.6",
-	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
+	"version": "0.8.8",
+	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {
 		"a2a-exposed": "bin/a2a-exposed.mjs"

package/worker/cloudflare.config.ts

@@ -62,6 +62,8 @@ const plain: Record<string, string> = {
 	APPROVAL_OIDC_CLIENT_ID: v("APPROVAL_OIDC_CLIENT_ID"),
 	APPROVAL_OIDC_ALLOWED_SUBJECTS: v("APPROVAL_OIDC_ALLOWED_SUBJECTS"),
 	APPROVAL_METHODS: v("APPROVAL_METHODS"),
+	// Optional https URL of this agent's dashboard page. A pairing wake and the MCP inbox line include it as manageUrl.
+	MANAGE_URL: v("MANAGE_URL"),
 };
 const hosted = v("TENANCY") === "host";
 // Daily R2 snapshots. Unset: no binding and no extra cron, so a self-host deploy stays the single-tenant Worker.

package/worker/deploy.env.example

@@ -34,7 +34,7 @@ WAKE_PRESET=generic
 #
 # WAKE_TARGET_POLICY=public-https requires a wake to be https to a public address. The Worker
 # connects to an address from that check. A redirect is followed only on the same origin. Leave it
-# unset for a self-hosted inbox.
+# unset for a self-hosted A2A endpoint.
 # WAKE_TARGET_POLICY=public-https
 # OpenID Connect approval (optional). All four of issuer, client id, allowlist and the client secret
 # must be set or the pages stay password-only. APPROVAL_METHODS=oidc hides the password once that
@@ -44,6 +44,9 @@ WAKE_PRESET=generic
 # APPROVAL_OIDC_ALLOWED_SUBJECTS=
 # APPROVAL_METHODS=password
 # Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET.
+# Optional https URL of this agent's dashboard page. When set, a pairing wake and the MCP inbox line
+# include it as manageUrl.
+# MANAGE_URL=https://example.com/app/agents/name#pairing
 # Daily SQL snapshots to R2. Unset: no BACKUP_BUCKET binding and no extra cron. The minute wake cron stays A2A_ENABLE_CRON.
 # A2A_BACKUP_BUCKET=1
 # A2A_BACKUP_BUCKET_NAME=a2a-exposed-backups

package/worker/package.json

@@ -2,7 +2,7 @@
 	"name": "a2a-exposed-worker",
 	"private": true,
 	"type": "module",
-	"description": "Cloudflare Worker for a2a-exposed: public A2A endpoint, D1 inbox, wake webhooks, owner API",
+	"description": "Cloudflare Worker for a2a-exposed: public A2A endpoint, D1 database, wake webhooks, owner API",
 	"license": "MIT",
 	"scripts": {
 		"build": "cf build",

package/worker/src/feedback.ts

@@ -41,7 +41,7 @@ export function feedbackToolDescription(repo: string): string {
 	const note = REPO_RE.test(repo) && !repo.includes("..")
 		? publicIssueNote(repo)
 		: "This report is filed as a public GitHub issue on this deployment's configured feedback repository. The result names that repository. Do not include confidential information: secrets, tokens, owner or pairing tokens, private URLs or hostnames, message contents, or personal data.";
-	return `${note} Redact before sending. Report a bug or an idea about this inbox to its developers. A bug requires reproduction steps. Include exact commands, error output with tokens and secrets removed, which agent you are, and where you run (local, cloud VM, CI, cloud agent sandbox, or other). Version, connection (webhook, proxy, or polling), and deployment (hosted or self-hosted) are filled by the inbox when you omit them. When this deployment does not file the report, the result is a link to the bug report form. You do not open a browser.`;
+	return `${note} Redact before sending. Report a bug or an idea about this A2A endpoint to its developers. A bug requires reproduction steps. Include exact commands, error output with tokens and secrets removed, which agent you are, and where you run (local, cloud VM, CI, cloud agent sandbox, or other). Version, connection (webhook, proxy, or polling), and deployment (hosted or self-hosted) are filled by the A2A endpoint when you omit them. When this deployment does not file the report, the result is a link to the bug report form. You do not open a browser.`;
 }
 /** Inbox build. The same value as `version` in cli/package.json. */
 export const WORKER_VERSION = VERSION;