a2a-exposed 0.7.11 → 0.7.13

package/lib/main.mjs

@@ -68,8 +68,11 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
-  wake preview                  rendered wake request (partially masked) + sha256 fingerprints of the
-                                uploaded URL/key/HMAC secret; compared with local env values if exported
+                                --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
+                                               which defaults to 25 when this is unset
+  wake preview                  rendered wake request (a credential is Bearer •••• or ••••, none of the secret)
+                                + sha256 fingerprints of the uploaded URL/key/HMAC secret; compared with
+                                local env values if exported
   wake fingerprint              fingerprints (first 12 hex of sha256) of WAKE_* in the local environment
   wake test                     send a test wake now and print the HTTP status
   wake unset                    remove wake secrets (fall back to polling)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.11",
+	"version": "0.7.13",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -49,7 +49,7 @@ const plain: Record<string, string> = {
 	// Hosted multi-tenant gates. All empty by default, and empty is omitted, so a self-host deploy is unchanged.
 	// TENANCY=host switches the entrypoint to src/hosted.ts and adds TENANT_DO + TENANT_DIRECTORY below.
 	// QUOTAS, USAGE_SINK, SIGNUP_URL and BRANDING are parsed and reserved.
-	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https (see wake-target.ts).
+	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https. The socket opens to an address from that check, and TLS names the hostname (see wake-target.ts).
 	// APPROVAL_OIDC_* turn on OpenID Connect approval when issuer, client id, secret and allowlist are all set.
 	TENANCY: v("TENANCY"),
 	TENANT_DOMAIN: v("TENANT_DOMAIN"),

package/worker/package.json

@@ -20,5 +20,8 @@
 		"miniflare": "^5.20261006.0-alpha",
 		"typescript": "^7.0.2",
 		"vite": "^8.3.0"
+	},
+	"dependencies": {
+		"tunnelfetch": "1.13.0"
 	}
 }

package/worker/src/hosted.ts

@@ -13,13 +13,15 @@
 // Usage push is not in this change. Approval OIDC, when configured (self-host settings, or the pushed tenant
 // `approval` object), uses the same pages as self-host.
 import { DurableObject } from "cloudflare:workers";
-import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite } from "./index.ts";
+import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite, runOwnerRpc } from "./index.ts";
+import { accountIdOf, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { doSqlD1, migrateDo, type SqlStorageLike, type TxRunner } from "./storage.ts";
 import { MIGRATIONS } from "./migrations.ts";
 import { bookmarkForTime as readBookmark, exportRows, restoreBookmark as applyBookmark, restartAfterResult, toSql, ExportError, type BookmarkStorage } from "./export.ts";
 import { hostedDailyBackup } from "./backup.ts";
 import { lookupDirectory, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME, type DirectoryEntry } from "./directory.ts";
 import { hostedTenantContext, namespaceForRegion, parseGates, type WorkerBindings } from "./tenancy.ts";
+import { WAKE_SECRET_KEYS, openWakeSecrets } from "./wake-secrets.ts";
 
 export { clearDirectoryCache, directoryKey, lookupDirectory, parseDirectoryEntry, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME } from "./directory.ts";
 export type { DirectoryEntry };
@@ -32,7 +34,7 @@ const gone = () => Response.json({ error: "this agent is gone" }, { status: 410,
 
 const TENANT_ID = /^[A-Za-z0-9._:-]{1,128}$/;
 
-/** Versioned config pushed by the control plane. `secretsEnc` is stored and not decrypted here. */
+/** Versioned config pushed by the control plane. `secretsEnc` is decrypted into the wake credentials when the context is built. */
 export interface TenantConfigPush {
 	version: number;
 	tenantId: string;
@@ -151,14 +153,29 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		});
 	}
 
-	#tenant(fallbackOrigin = "") {
+	async #tenant(fallbackOrigin = "") {
 		const row = this.#row;
 		if (!row) return null;
-		const domain = parseGates(this.env).gates.tenantDomain;
+		const parsed = parseGates(this.env);
+		const domain = parsed.gates.tenantDomain;
 		const publicUrl = domain ? `https://${row.name}.${domain}` : (fallbackOrigin || this.env.PUBLIC_URL || "");
+		const config = { ...row.config };
+		// Once a ciphertext is stored, the secret wake fields come only from it. A plaintext copy in
+		// config_json is ignored, and a blob that cannot be opened leaves those fields unset.
+		if (row.secretsEnc) {
+			const opened = await openWakeSecrets(parsed.secretsKey || "", row.tenantId, row.secretsEnc);
+			if (!opened) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "wake_secrets_unreadable", tenant: row.tenantId }));
+			}
+			for (const key of WAKE_SECRET_KEYS) {
+				const value = opened?.[key];
+				if (value) config[key] = value;
+				else delete config[key];
+			}
+		}
 		return hostedTenantContext(this.env, {
 			id: row.tenantId, db: this.#db, publicUrl, ownerTokenHash: row.ownerTokenHash,
-			config: row.config, limits: row.limits, approval: row.approval, status: row.status,
+			config, limits: row.limits, approval: row.approval, status: row.status,
 		});
 	}
 
@@ -198,7 +215,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 				await storage.deleteAlarm();
 				return;
 			}
-			const tenant = this.#tenant();
+			const tenant = await this.#tenant();
 			if (!tenant) return;
 			const at = await nextCronAt(tenant);
 			if (at == null || !Number.isFinite(at)) {
@@ -226,7 +243,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 	}
 
 	async #runAlarm(): Promise<void> {
-		const tenant = this.#row?.status === "active" ? this.#tenant() : null;
+		const tenant = this.#row?.status === "active" ? await this.#tenant() : null;
 		if (tenant) {
 			try { await cronFlush(tenant, this.#ectx()); }
 			catch (e) { console.log(JSON.stringify({ ts: new Date().toISOString(), event: "alarm_failed", error: String(e).slice(0, 200) })); }
@@ -337,6 +354,27 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		return out;
 	}
 
+	/**
+	 * Control-plane owner call. The caller has already checked that `accountId` owns this tenant.
+	 * The path is an allowlist, the account id is logged, and a response that contains a peer token
+	 * or a decrypted secret is withheld. The network owner API is unchanged and still needs the owner token.
+	 * An object with no config row answers 404 and writes nothing.
+	 */
+	async owner(input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+		if (!this.#row) {
+			const accountId = accountIdOf(input && typeof input === "object" ? (input as { accountId?: unknown }).accountId : undefined);
+			if (!accountId) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, reason: "account" }));
+				return { status: 400, body: { error: "accountId is invalid" } };
+			}
+			console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, accountId, reason: "absent" }));
+			return { status: 404, body: { error: "no such agent" } };
+		}
+		const tenant = await this.#tenant();
+		if (!tenant) return { status: 404, body: { error: "no such agent" } };
+		return runOwnerRpc(tenant, this.#ectx(), input);
+	}
+
 	async fetch(req: Request): Promise<Response> {
 		const row = this.#row;
 		if (!row) return notFound();
@@ -346,7 +384,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 			if (row.status === "deleting") return gone();
 			return notFound();
 		}
-		const tenant = this.#tenant(new URL(req.url).origin);
+		const tenant = await this.#tenant(new URL(req.url).origin);
 		if (!tenant) return notFound();
 		// Do not arm from the rows visible here. sendWake runs in waitUntil and, on 429/503, inserts the retry
 		// after this response returns. requeueWake arms in that insert. Arm again when those tasks finish so a

package/worker/src/index.ts

@@ -10,6 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, defaultDebounceSeconds, defaul
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
+import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
@@ -82,7 +83,17 @@ function wakeConfig(ctx: TenantContext): WakeConfig {
 }
 
 const debounceMs = (ctx: TenantContext) => Number(ctx.WAKE_DEBOUNCE_SECONDS || defaultDebounceSeconds(preset(ctx))) * 1000;
-const maxPerHour = (ctx: TenantContext) => Number(ctx.WAKE_MAX_PER_HOUR || defaultMaxPerHour(preset(ctx)));
+
+/**
+ * Hourly wake cap. 0 means unlimited, including an explicit "0".
+ * An empty or unset value uses the preset default (unlimited, or 25 for Claude Code).
+ */
+function maxPerHour(ctx: TenantContext): number {
+	const raw = (ctx.WAKE_MAX_PER_HOUR ?? "").trim();
+	const n = raw === "" ? defaultMaxPerHour(preset(ctx)) : Number(raw);
+	if (!Number.isFinite(n) || n <= 0) return 0;
+	return Math.floor(n);
+}
 
 async function wakeBudgetOk(ctx: TenantContext): Promise<boolean> {
 	const cap = maxPerHour(ctx);
@@ -117,7 +128,10 @@ async function sendWake(ctx: TenantContext, ectx: ExecutionContext, payload: Jso
 	try {
 		let r: Response;
 		if (ctx.gates.wakeTargetPolicy === "public-https") {
-			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body });
+			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body }, {
+				localHost: (() => { try { return new URL(ctx.PUBLIC_URL).host; } catch { return ""; } })(),
+				local: (url, init) => doFetch(ctx, ectx, url, init),
+			});
 			if ("refused" in checked) {
 				log("wake_refused", { preset: preset(ctx), contextId: ev.contextId, reason: checked.refused });
 				return { status: null, info: `refused: ${checked.refused}` };
@@ -898,12 +912,28 @@ function ownerTaskView(t: Json): Json {
 }
 
 async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionContext, path: string, url: URL, trusted = false): Promise<Response> {
-	// trusted: an in-process call from an MCP tool (fixed, allowlisted paths; see ownerCall), never from the network
+	// trusted: an in-process call. MCP tools use ownerCall (paths fixed in the tool code). The hosted
+	// owner() RPC uses runOwnerRpc, which has its own allowlist. A request from the network is never trusted.
 	if (!trusted && !(await isOwner(ctx, req.headers.get("authorization")))) return json({ error: "unauthorized" }, 401);
 	const m = req.method;
 	const seg = path.split("/").filter(Boolean).slice(1); // after "owner"
 	const body = async () => { const raw = await readBody(req, ctx); return raw ? JSON.parse(raw) : {}; };
 
+	if (seg[0] === "summary" && !seg[1] && m === "GET") {
+		// Counts only. Unlike GET /owner/inbox this does not return message text or clear a pending wake.
+		const known = ["submitted", "working", "input-required", "completed", "failed", "rejected", "canceled"];
+		const tasks: Record<string, number> = {};
+		for (const state of known) tasks[state] = 0;
+		const rows = await ctx.DB.prepare("SELECT state, COUNT(*) AS n FROM tasks GROUP BY state").all();
+		for (const r of rows.results as Json[]) {
+			if (typeof r.state !== "string" || !known.includes(r.state)) continue;
+			const n = Number(r.n);
+			if (Number.isSafeInteger(n) && n >= 0) tasks[r.state] = n;
+		}
+		const pending: Json = await ctx.DB.prepare("SELECT COUNT(*) AS n FROM device_requests WHERE status = 'pending' AND expires_ms > ?").bind(Date.now()).first();
+		const pairing = Number(pending?.n ?? 0);
+		return json({ tasks, pairingPending: Number.isSafeInteger(pairing) && pairing >= 0 ? pairing : 0 });
+	}
 	if (seg[0] === "inbox" && m === "GET") {
 		const contextFilter = url.searchParams.get("context");
 		const all = url.searchParams.get("all") === "1";
@@ -1017,7 +1047,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			return json({ revoked: true, label });
 		}
 	}
-	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body);
+	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body, trusted);
 	if (seg[0] === "mcp" && !seg[1] && m === "GET") {
 		const rows = await ctx.DB.prepare("SELECT label, client_id, client_name, redirect_host, scope, created_at, last_used_at, revoked_at, refresh_expires_ms FROM mcp_grants ORDER BY created_at").all();
 		return json({ enabled: mcpOn(ctx), url: oauthUrls(ctx).mcp, grants: (rows.results as Json[]).map((r) => ({ ...r, refresh_expires_ms: undefined,
@@ -1077,7 +1107,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		return json({ mode: "proxy", ...(await verifyUpstream(ctx)) });
 	}
 	if (seg[0] === "wake" && seg[1] === "preview" && m === "GET") {
-		// rendered wake request for a sample event, partially masked, plus short sha256 fingerprints of the
+		// rendered wake request for a sample event, credentials shown as Bearer •••• or ••••, plus short sha256 fingerprints of the
 		// uploaded secrets so the owner can compare them with local values without revealing them
 		const ev: WakeEvent = { contextId: "ctx-preview", taskId: "task-preview", taskIds: ["task-preview"], from: "example-peer",
 			preview: "Example message preview", kind: "test", publicUrl: ctx.PUBLIC_URL };
@@ -1574,7 +1604,7 @@ async function setupPage(req: Request, ctx: TenantContext, url: URL): Promise<Re
 }
 
 /** Owner API: /owner/pairing (list, mode), /owner/pairing/password (set), /owner/pairing/<code>/approve|deny. */
-async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>): Promise<Response> {
+async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>, trusted = false): Promise<Response> {
 	const mode = pairingMode(ctx);
 	if (!seg[0] && m === "GET") {
 		const now = Date.now();
@@ -1625,9 +1655,12 @@ async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: st
 		const code = P.normUserCode(decodeURIComponent(seg[0]));
 		if (!code) return json({ error: "not a valid code (it looks like WDJB-4827)" }, 400);
 		const approve = seg[1] === "approve";
-		if (approve && mode !== "agent")
+		// The header is set only by runOwnerRpc for actor "human". A network request is not trusted, so the same
+		// header on /owner/* does not approve and does not change who is logged.
+		const dashboardHuman = trusted && req.headers.get(DASHBOARD_ACTOR_HEADER) === "human";
+		if (approve && mode !== "agent" && !dashboardHuman)
 			return json({ error: `approval mode is human: the owner approves on ${oauthUrls(ctx).page}?user_code=${P.formatUserCode(code)} with the approval password. \`pair approve\` works only after \`${cliCommand(ctx)} deploy --pairing-approval agent\`, and only if your human wants the agent to approve. \`pair deny\` works in every mode.` }, 403);
-		const d = await decide(ctx, code, approve, approve ? "agent" : "owner");
+		const d = await decide(ctx, code, approve, dashboardHuman ? "human" : approve ? "agent" : "owner");
 		if (!d.ok) return json({ error: d.error }, 409);
 		return json({ ok: true, decision: approve ? "approved" : "denied", userCode: P.formatUserCode(code), label: d.label || null,
 			clientName: d.request.client_name || d.request.client_id || null, replaced: !!d.replaced });
@@ -2073,6 +2106,57 @@ async function mcpGrantOf(ctx: TenantContext, header: string | null): Promise<Js
 	return await ctx.DB.prepare("SELECT * FROM mcp_grants WHERE access_hash = ? AND revoked_at IS NULL AND access_expires_ms > ?").bind(await A.sha256(m[1]), Date.now()).first();
 }
 
+/**
+ * Hosted owner RPC. The control plane has already checked that `accountId` owns this tenant.
+ * Only an allowlisted path runs, and the response is withheld when it contains a peer token or a secret.
+ * Self-host (`mode` single) is refused here; its owner API stays the bearer check in `handleOwner`.
+ */
+export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+	const raw = input && typeof input === "object" ? input as OwnerRpcRequest & { body?: unknown } : null;
+	const accountId = accountIdOf(raw?.accountId);
+	const tenant = ctx.id || null;
+	const refuse = (status: number, error: string, reason: string): OwnerRpcResult => {
+		log("owner_rpc_refused", { tenant, ...(accountId ? { accountId } : {}), reason });
+		return { status, body: { error } };
+	};
+	if (!accountId) return refuse(400, "accountId is invalid", "account");
+	if (ctx.mode !== "host") return refuse(404, "not found", "tenancy");
+	if (ctx.status !== "active") {
+		const status = ctx.status === "suspended" ? 403 : ctx.status === "deleting" ? 410 : 404;
+		const error = ctx.status === "suspended" ? "this agent is suspended" : ctx.status === "deleting" ? "this agent is gone" : "no such agent";
+		return refuse(status, error, "status");
+	}
+	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
+	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
+	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	const actor = (raw as { actor?: unknown } | null)?.actor;
+	if (actor !== undefined && actor !== "human") return refuse(400, "actor is invalid", "actor");
+	const pairingDecision = matched.route.name === "POST /owner/pairing/:code/approve" || matched.route.name === "POST /owner/pairing/:code/deny";
+	if (actor === "human" && !pairingDecision) return refuse(400, "actor is invalid", "actor");
+	let origin = "https://tenant.invalid";
+	try {
+		const u = new URL(ctx.PUBLIC_URL);
+		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
+	} catch { /* the handler reads the path, not this origin */ }
+	const url = new URL(origin + matched.route.path + matched.route.search);
+	const headers = new Headers({ "content-type": "application/json" });
+	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
+	const req = new Request(url, { method: matched.route.method, headers });
+	let res: Response;
+	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
+	catch (e: any) {
+		const status = e instanceof HttpError ? e.status : 400;
+		const error = String(e?.message || "bad request").slice(0, 200);
+		if (ownerResponseLeaks(error)) return refuse(500, "response withheld", "secret");
+		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
+		return { status, body: { error } };
+	}
+	const data = scrubOwnerClaims(await res.json().catch(() => null));
+	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
+	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
+	return { status: res.status, body: data };
+}
+
 /** Call an owner API route in-process (MCP tools only; the paths are fixed in the tool code). */
 async function ownerCall(ctx: TenantContext, ectx: ExecutionContext, method: string, path: string, body?: Json): Promise<{ status: number; data: Json }> {
 	const url = new URL(ctx.PUBLIC_URL.replace(/\/$/, "") + path);

package/worker/src/owner-rpc.ts

@@ -0,0 +1,211 @@
+// Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
+// the account owns the tenant. This list is the only paths that call may run, and it is stricter than
+// the owner HTTP API: routes that mint a peer token, return a setup secret, accept a plaintext peer
+// token, or dump credential material (export) are not here. Self-host never calls this.
+
+import { ID_RE } from "./a2a.ts";
+import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
+
+/** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
+export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+const LABEL = /^[A-Za-z0-9_-]{1,32}$/;
+const MCP_LABEL = /^[A-Za-z0-9_-]{1,64}$/;
+const ALIAS = /^[A-Za-z0-9_.-]{1,64}$/;
+/** Display form WDJB-4827 or the stored form WDJB4827. Vowels and 0/1 are not in a real code. */
+const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-?[2-9]{4}$/i;
+
+const TOKEN_RE = /^(?:a2aow_|s2a_|a2amcp_|a2amcpr_)[A-Za-z0-9_-]{20,}$/;
+const SETUP_RE = /(?:\?|&)t=[A-Za-z0-9_-]{16,}/;
+const USERINFO_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?\s]*@/i;
+/** A non-empty string under one of these keys is a secret, even when it is not a token shape. */
+const SECRET_KEYS = new Set([
+	"token", "access_token", "refresh_token", "device_code",
+	"ownertoken", "owner_token", "secretsenc", "secrets_enc",
+	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
+]);
+
+/**
+ * Header `runOwnerRpc` sets when `actor` is `human`. `handleOwner` honors it only on an in-process call.
+ * A request from the network cannot become that decision by sending the header.
+ */
+export const DASHBOARD_ACTOR_HEADER = "x-a2a-dashboard-actor";
+
+export interface OwnerRpcRequest {
+	accountId: string;
+	method: string;
+	path: string;
+	/** Allowlisted query parameters only. */
+	query?: Record<string, string>;
+	/** Refused. The owner HTTP API is where a body is accepted. */
+	body?: unknown;
+	/**
+	 * Dashboard approve or deny after the control plane has checked a recent sign-in.
+	 * Any other value is refused. Absent keeps the owner HTTP API's actor (`agent` or `owner`).
+	 */
+	actor?: "human";
+}
+
+export interface OwnerRpcResult {
+	status: number;
+	body: unknown;
+}
+
+export interface OwnerRoute {
+	method: "GET" | "POST" | "DELETE";
+	path: string;
+	search: string;
+	/** Log name. Ids and codes are not included. */
+	name: string;
+}
+
+export type OwnerMatch = { ok: true; route: OwnerRoute } | { ok: false; reason: "path" | "query" };
+
+export function accountIdOf(v: unknown): string | null {
+	return typeof v === "string" && ACCOUNT_ID_RE.test(v) ? v : null;
+}
+
+function segments(path: unknown): string[] | null {
+	if (typeof path !== "string" || path.length > 300 || !path.startsWith("/owner/")) return null;
+	if (path.includes("%") || path.includes("\\") || path.includes("?") || path.includes("#") || path.includes("//")) return null;
+	const seg = path.split("/").filter(Boolean);
+	if (seg[0] !== "owner" || seg.some((s) => s === "." || s === "..")) return null;
+	return seg;
+}
+
+function queryRecord(query: unknown): Record<string, string> | null {
+	if (query == null) return {};
+	if (typeof query !== "object" || Array.isArray(query)) return null;
+	const out: Record<string, string> = {};
+	for (const [k, v] of Object.entries(query)) {
+		if (typeof v !== "string" || v.length > 128) return null;
+		out[k] = v;
+	}
+	return out;
+}
+
+function idOk(s: string): boolean {
+	return ID_RE.test(s) && s !== "." && s !== "..";
+}
+
+function noQuery(q: Record<string, string>): string | null {
+	return Object.keys(q).length === 0 ? "" : null;
+}
+
+function inboxQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "context" && k !== "all") return null;
+	if (q.context !== undefined && !idOk(q.context)) return null;
+	if (q.all !== undefined && q.all !== "1") return null;
+	const sp = new URLSearchParams();
+	if (q.context) sp.set("context", q.context);
+	if (q.all) sp.set("all", "1");
+	const s = sp.toString();
+	return s ? `?${s}` : "";
+}
+
+function historyQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "n") return null;
+	if (q.n === undefined) return "";
+	if (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000) return null;
+	return `?n=${q.n}`;
+}
+
+interface RouteDef {
+	method: "GET" | "POST" | "DELETE";
+	name: string;
+	take: (seg: string[]) => boolean;
+	search: (q: Record<string, string>) => string | null;
+	path: (seg: string[]) => string;
+}
+
+const ROUTES: RouteDef[] = [
+	{ method: "GET", name: "GET /owner/inbox", take: (s) => s.length === 2 && s[1] === "inbox", search: inboxQuery, path: () => "/owner/inbox" },
+	{ method: "GET", name: "GET /owner/summary", take: (s) => s.length === 2 && s[1] === "summary", search: noQuery, path: () => "/owner/summary" },
+	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
+	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
+	{ method: "GET", name: "GET /owner/peers", take: (s) => s.length === 2 && s[1] === "peers", search: noQuery, path: () => "/owner/peers" },
+	{ method: "DELETE", name: "DELETE /owner/peers/:label", take: (s) => s.length === 3 && s[1] === "peers" && LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/pairing", take: (s) => s.length === 2 && s[1] === "pairing", search: noQuery, path: () => "/owner/pairing" },
+	{ method: "POST", name: "POST /owner/pairing/:code/approve", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "approve", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/approve` },
+	{ method: "POST", name: "POST /owner/pairing/:code/deny", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "deny", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/deny` },
+	{ method: "GET", name: "GET /owner/mcp", take: (s) => s.length === 2 && s[1] === "mcp", search: noQuery, path: () => "/owner/mcp" },
+	{ method: "DELETE", name: "DELETE /owner/mcp/:label", take: (s) => s.length === 3 && s[1] === "mcp" && MCP_LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/mcp/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
+	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
+	{ method: "POST", name: "POST /owner/facade/verify", take: (s) => s.length === 3 && s[1] === "facade" && s[2] === "verify", search: noQuery, path: () => "/owner/facade/verify" },
+	{ method: "GET", name: "GET /owner/wake/preview", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "preview", search: noQuery, path: () => "/owner/wake/preview" },
+	{ method: "POST", name: "POST /owner/wake/test", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "test", search: noQuery, path: () => "/owner/wake/test" },
+	{ method: "GET", name: "GET /owner/contexts", take: (s) => s.length === 2 && s[1] === "contexts", search: noQuery, path: () => "/owner/contexts" },
+];
+
+/** Method + path (+ query) on the owner RPC allowlist, or why it is not. */
+export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): OwnerMatch {
+	if (method !== "GET" && method !== "POST" && method !== "DELETE") return { ok: false, reason: "path" };
+	const seg = segments(path);
+	if (!seg) return { ok: false, reason: "path" };
+	const def = ROUTES.find((r) => r.method === method && r.take(seg));
+	if (!def) return { ok: false, reason: "path" };
+	const q = queryRecord(query);
+	if (!q) return { ok: false, reason: "query" };
+	const search = def.search(q);
+	if (search === null) return { ok: false, reason: "query" };
+	return { ok: true, route: { method, path: def.path(seg), search, name: def.name } };
+}
+
+function stringLeaks(value: string, key: string | null): boolean {
+	if (TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value)) return true;
+	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;
+}
+
+/** Claimed display fields. A token-shaped value is blanked so one request cannot withhold the list. */
+const CLAIM_KEYS = new Set(["clientname", "client_name", "clientid", "client_id", "agentcardurl", "agent_card_url"]);
+
+function claimLeaks(value: string): boolean {
+	return TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value);
+}
+
+/**
+ * Replace a claimed name, alias, or card that is shaped like a peer token, a setup secret, or URL
+ * userinfo with an empty string. Other keys are left for `ownerResponseLeaks`.
+ */
+export function scrubOwnerClaims(value: unknown, depth = 0): unknown {
+	if (value == null || depth > 20) return value;
+	if (Array.isArray(value)) return value.map((item) => scrubOwnerClaims(item, depth + 1));
+	if (typeof value !== "object") return value;
+	const out: Record<string, unknown> = {};
+	for (const [key, item] of Object.entries(value)) {
+		out[key] = typeof item === "string" && CLAIM_KEYS.has(key.toLowerCase()) && claimLeaks(item)
+			? ""
+			: scrubOwnerClaims(item, depth + 1);
+	}
+	return out;
+}
+
+/** A rendered wake whose credential header was not masked. The header name is the caller's choice. */
+function wakePreviewLeaks(value: object): boolean {
+	const headers = (value as { method?: unknown; headers?: unknown }).headers;
+	if ((value as { method?: unknown }).method !== "POST" || !headers || typeof headers !== "object" || Array.isArray(headers)) return false;
+	for (const [k, v] of Object.entries(headers)) {
+		if (typeof v !== "string" || previewHeaderPlain(k) || credentialIsMasked(v)) continue;
+		return true;
+	}
+	return false;
+}
+
+/** True when a JSON value carries a peer token, a setup secret, a URL userinfo, or a secret field. */
+export function ownerResponseLeaks(value: unknown, depth = 0, key: string | null = null): boolean {
+	if (depth > 20) return true;
+	if (typeof value === "string") return stringLeaks(value, key);
+	if (typeof value === "number" || typeof value === "boolean" || value == null) return false;
+	if (Array.isArray(value)) return value.some((v) => ownerResponseLeaks(v, depth + 1, null));
+	if (typeof value === "object") {
+		if (wakePreviewLeaks(value)) return true;
+		for (const [k, v] of Object.entries(value)) {
+			if (ownerResponseLeaks(v, depth + 1, k)) return true;
+		}
+		return false;
+	}
+	return true;
+}

package/worker/src/tenancy.ts

@@ -47,8 +47,9 @@ export type ConfigFields = { [K in ConfigKey]?: string };
 
 /**
  * Non-secret platform defaults a hosted tenant inherits when its pushed config omits them.
- * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited: in hosted mode they come only from the
- * tenant overlay (or not at all). Decrypting `secrets_enc` into wake credentials is a follow-up.
+ * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited. In hosted mode the secret wake
+ * fields come from decrypting `secrets_enc` (see the tenant object). A plaintext copy in the pushed
+ * config is used only when that ciphertext is absent.
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];