a2a-exposed 0.7.11 → 0.7.13

package/worker/src/wake-secrets.ts

@@ -0,0 +1,113 @@
+// Wake secrets sealed for one hosted tenant. The control plane writes `secrets_enc`; the tenant
+// object decrypts it when it builds the tenant context. Self-host does not use this.
+// Keep control/src/tenants/wake-secrets.ts in step with this file.
+
+const INFO = "tenant-wake-secrets v1";
+const SALT = "a2a-exposed";
+
+/** Secret wake fields. Anything else in the blob is ignored. */
+export const WAKE_SECRET_KEYS = [
+	"WAKE_WEBHOOK_KEY",
+	"WAKE_HMAC_SECRET",
+	"WAKE_ACCESS_CLIENT_ID",
+	"WAKE_ACCESS_CLIENT_SECRET",
+] as const;
+
+export type WakeSecretKey = (typeof WAKE_SECRET_KEYS)[number];
+export type WakeSecrets = Partial<Record<WakeSecretKey, string>>;
+
+/** One secret. The form uses the same cap. */
+export const MAX_WAKE_VALUE = 4096;
+
+/**
+ * Largest JSON payload `sealWakeSecrets` will write. A character can become `\u0000` (six characters),
+ * and every known field may be present. `openWakeSecrets` accepts this and nothing larger.
+ */
+export const MAX_WAKE_PLAIN = (() => {
+	let n = 2;
+	for (let i = 0; i < WAKE_SECRET_KEYS.length; i++) {
+		if (i) n += 1;
+		n += WAKE_SECRET_KEYS[i].length + 5 + MAX_WAKE_VALUE * 6;
+	}
+	return n;
+})();
+
+/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
+export const MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+
+function b64(bytes: Uint8Array): string {
+	let raw = "";
+	for (let i = 0; i < bytes.length; i += 0x8000) raw += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+	return btoa(raw);
+}
+const unb64 = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+
+async function derive(ikm: string, tenantId: string): Promise<CryptoKey | null> {
+	if (!ikm || !tenantId) return null;
+	const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(ikm), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey(
+		{ name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(SALT), info: new TextEncoder().encode(`${INFO}\0${tenantId}`) },
+		base, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"],
+	);
+}
+
+function payloadOf(secrets: WakeSecrets): Record<string, string> | null {
+	const payload: Record<string, string> = {};
+	for (const key of WAKE_SECRET_KEYS) {
+		const value = secrets[key];
+		if (value == null || value === "") continue;
+		if (typeof value !== "string" || value.length > MAX_WAKE_VALUE) return null;
+		payload[key] = value;
+	}
+	return payload;
+}
+
+/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null> {
+	const key = await derive(ikm, tenantId);
+	const payload = payloadOf(secrets);
+	if (!key || !payload) return null;
+	const json = JSON.stringify(payload);
+	const encoded = new TextEncoder().encode(json);
+	if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const ct = new Uint8Array(await crypto.subtle.encrypt(
+		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+		key,
+		encoded,
+	));
+	const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+	return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
+}
+
+/**
+ * The sealed fields, `{}` when there is nothing to open, or null when the blob cannot be read.
+ * A null result must not be treated as "no secrets": the caller keeps the previous ciphertext.
+ */
+export async function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null> {
+	if (sealed == null || sealed === "") return {};
+	if (sealed.length > MAX_WAKE_SEALED) return null;
+	const key = await derive(ikm, tenantId);
+	if (!key) return null;
+	const [version, iv, ct, extra] = sealed.split(".");
+	if (version !== "v1" || !iv || !ct || extra !== undefined) return null;
+	try {
+		const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+			{ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
+			key,
+			unb64(ct),
+		));
+		if (plain.length > MAX_WAKE_PLAIN) return null;
+		const parsed = JSON.parse(plain) as unknown;
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		const out: WakeSecrets = {};
+		for (const name of WAKE_SECRET_KEYS) {
+			const value = (parsed as Record<string, unknown>)[name];
+			if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+			out[name] = value;
+		}
+		return out;
+	} catch {
+		return null;
+	}
+}

package/worker/src/wake-target.ts

@@ -1,7 +1,14 @@
 // Wake URL checks for WAKE_TARGET_POLICY=public-https. Unset stays the previous fetch
 // (any URL the operator configured, redirects followed by the platform).
+//
+// The TCP connection is to an address from the DNS check. TLS is not the runtime's
+// startTls({ expectedServerHostname }): on the Workers edge that sends no SNI when the
+// socket was opened to an IP (cloudflare/workerd#6903), so the peer aborts before HTTP.
+// The handshake runs in-process, with the URL hostname as SNI, over that pinned socket.
+// A socket still cannot open a Cloudflare address, so a *.workers.dev target does not connect.
+import { CertificateError, Client, TlsError } from "tunnelfetch";
 import { isPrivateHost } from "./a2a.ts";
-import { isPublicIp, net, parseHttpResponse, type PinnedSocket } from "./mcp.ts";
+import { isPublicIp } from "./mcp.ts";
 
 /** DNS-over-HTTPS resolver. Same endpoint the client-metadata fetch uses. */
 export const DOH_URL = "https://cloudflare-dns.com/dns-query";
@@ -9,14 +16,33 @@ export const DOH_URL = "https://cloudflare-dns.com/dns-query";
 /** Original request plus this many redirects. Each hop is checked before it is requested. */
 const MAX_REDIRECTS = 3;
 
+const REQUEST_TIMEOUT_MS = 15_000;
+
 /** Host to addresses. `null` means the lookup failed and the caller must fail closed. */
 export type AddressLookup = (host: string) => Promise<string[] | null>;
 
-type Connect = NonNullable<typeof net.connect>;
+type WakeSocket = {
+	readable: ReadableStream<Uint8Array>;
+	writable: WritableStream<Uint8Array>;
+	opened?: Promise<{ remoteAddress?: string | null }>;
+	close?: () => Promise<void>;
+};
+
+/** Raw TCP. Production uses `cloudflare:sockets`. Tests replace it. */
+export type WakeConnect = (address: { hostname: string; port: number }, options?: { secureTransport?: "off" | "on" | "starttls"; allowHalfOpen?: boolean }) => WakeSocket;
+
+/** One checked hop. `ip` is the address the socket must use. `hostname` is the TLS name. */
+export type CheckedDeliver = (url: string, init: RequestInit, target: { ip: string; hostname: string }) => Promise<Response>;
+
+export const wakeNet: { connect: null | WakeConnect; deliver: null | CheckedDeliver } = { connect: null, deliver: null };
 
 export type WakeDeps = {
 	lookup?: AddressLookup;
-	connect?: Connect;
+	connect?: WakeConnect;
+	deliver?: CheckedDeliver;
+	/** Deliver a URL on this host in-process. Used for a wake aimed at this inbox. */
+	localHost?: string;
+	local?: (url: string, init: RequestInit) => Promise<Response>;
 };
 
 function bareHost(host: string): string {
@@ -69,8 +95,8 @@ export async function publicWakeProblem(url: string, lookup: AddressLookup = loo
 	return "refused" in checked ? checked.refused : "";
 }
 
-/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
-export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+/** Every public address from one lookup. The socket uses the first. The TLS name is the URL host. */
+async function checkedWakeAddresses(url: string, lookup: AddressLookup): Promise<{ hostname: string; ips: string[] } | { refused: string }> {
 	let parsed: URL;
 	try { parsed = new URL(url); } catch { return { refused: "not a URL" }; }
 	if (parsed.protocol !== "https:") return { refused: "must be https" };
@@ -78,79 +104,99 @@ export async function checkedWakeAddress(url: string, lookup: AddressLookup = lo
 	const host = parsed.hostname;
 	if (!host || isPrivateHost(host)) return { refused: "private or internal host" };
 	const bare = bareHost(host);
-	if (isIpLiteral(host)) return isPublicIp(bare) ? { ip: bare } : { refused: "private or reserved address" };
+	if (isIpLiteral(host)) return isPublicIp(bare) ? { hostname: bare, ips: [bare] } : { refused: "private or reserved address" };
 	let ips: string[] | null;
 	try { ips = await lookup(host); } catch { return { refused: "its address could not be checked" }; }
 	if (ips == null) return { refused: "its address could not be checked" };
 	if (!ips.length) return { refused: "the host has no address" };
 	if (!ips.every((ip) => isPublicIp(ip))) return { refused: "resolves to a private or reserved address" };
-	return { ip: ips[0] };
+	return { hostname: host, ips };
 }
 
-function headerEntries(headers: HeadersInit | undefined): [string, string][] {
-	const out: [string, string][] = [];
-	const list = new Headers(headers);
-	list.forEach((value, key) => out.push([key, value]));
-	return out;
+/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
+export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+	const checked = await checkedWakeAddresses(url, lookup);
+	if ("refused" in checked) return checked;
+	return { ip: checked.ips[0]! };
 }
 
-function requestBytes(method: string, url: URL, headers: HeadersInit | undefined, body: Uint8Array): Uint8Array {
-	const lines = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
-	for (const [key, value] of headerEntries(headers)) {
-		if (key === "host" || key === "content-length" || key === "connection" || key === "transfer-encoding") continue;
-		if (/[\r\n]/.test(key) || /[\r\n]/.test(value)) throw new Error("invalid header");
-		lines.push(`${key}: ${value}`);
-	}
-	if (body.byteLength) lines.push(`content-length: ${body.byteLength}`);
-	lines.push("connection: close");
-	const head = new TextEncoder().encode(lines.join("\r\n") + "\r\n\r\n");
-	const raw = new Uint8Array(head.byteLength + body.byteLength);
-	raw.set(head);
-	raw.set(body, head.byteLength);
-	return raw;
+/**
+ * Dial `ip`, ignoring the hostname the TLS stack passes in. The handshake names that hostname
+ * itself; this function only chooses the TCP address.
+ */
+export function dialChecked(ip: string, connect: WakeConnect): WakeConnect {
+	return (addr) => connect({ hostname: ip, port: addr.port }, { secureTransport: "off", allowHalfOpen: false });
 }
 
-async function readSocket(sock: PinnedSocket, cap: number): Promise<Uint8Array> {
-	const reader = sock.readable.getReader();
-	const chunks: Uint8Array[] = [];
-	let n = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		n += value.byteLength;
-		if (n > cap) break;
-		chunks.push(value);
-	}
-	const raw = new Uint8Array(Math.min(n, cap));
-	let o = 0;
-	for (const chunk of chunks) {
-		const take = Math.min(chunk.byteLength, raw.byteLength - o);
-		raw.set(chunk.subarray(0, take), o);
-		o += take;
-	}
-	return raw;
+async function runtimeConnect(): Promise<WakeConnect> {
+	if (wakeNet.connect) return wakeNet.connect;
+	const sockets = await import("cloudflare:sockets");
+	return sockets.connect as unknown as WakeConnect;
 }
 
+/** Enough of an error body to recognise a Cloudflare status page. A success body is not kept. */
+const HINT_BYTES = 4096;
+
 /**
- * HTTPS to `ip`, with TLS checked for the URL's hostname. The platform does not resolve the name again.
+ * HTTPS to the checked IP, with SNI and certificate verification for the URL host.
+ * `forceTunnel` keeps the platform from fetching the hostname again.
+ * The body is copied before the client closes, because closing drops the socket.
  */
-async function pinnedRequest(ip: string, url: string, method: string, headers: HeadersInit | undefined, body: Uint8Array, connect: Connect): Promise<Response> {
-	const parsed = new URL(url);
-	const sock = connect({ hostname: ip, port: Number(parsed.port || 443) }, { secureTransport: "starttls" }).startTls({ expectedServerHostname: parsed.hostname });
+async function deliverPinned(url: string, init: RequestInit, target: { ip: string; hostname: string }, connect: WakeConnect): Promise<Response> {
+	const client = new Client({
+		connect: dialChecked(target.ip, connect),
+		forceTunnel: true,
+		maxRedirects: 0,
+		maxBodyBytes: Infinity,
+		http2: false,
+		keepAlive: false,
+		timeouts: { totalMs: REQUEST_TIMEOUT_MS },
+	});
 	try {
-		const writer = sock.writable.getWriter();
-		await writer.write(requestBytes(method, parsed, headers, body));
-		writer.releaseLock();
-		const raw = await readSocket(sock, 65536);
-		const message = parseHttpResponse(raw);
-		if (typeof message === "string") throw new Error(message);
-		const responseHeaders = new Headers();
-		for (const [key, value] of Object.entries(message.headers)) responseHeaders.set(key, value);
-		const payload = message.status === 204 || message.status === 304 ? null : message.body;
-		return new Response(payload, { status: message.status, headers: responseHeaders });
+		const res = await client.fetch(url, {
+			method: init.method,
+			headers: init.headers,
+			body: init.body,
+			redirect: "manual",
+		});
+		return await responseForCaller(res);
+	} catch (e) {
+		if (e instanceof TlsError || e instanceof CertificateError) throw new Error("TLS Handshake Failed.");
+		throw e;
 	} finally {
-		await sock.close().catch(() => {});
+		await client.close().catch(() => {});
+	}
+}
+
+/** Status and headers, plus the start of an error body. The live socket is not returned. */
+async function responseForCaller(res: Response): Promise<Response> {
+	const headers = new Headers(res.headers);
+	if (res.ok || !res.body) {
+		await res.body?.cancel().catch(() => {});
+		return new Response(null, { status: res.status, headers });
+	}
+	const reader = res.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		while (total < HINT_BYTES) {
+			const next = await reader.read();
+			if (next.done || !next.value) break;
+			chunks.push(next.value);
+			total += next.value.byteLength;
+		}
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	const merged = new Uint8Array(Math.min(total, HINT_BYTES));
+	let offset = 0;
+	for (const chunk of chunks) {
+		const take = Math.min(chunk.byteLength, merged.byteLength - offset);
+		if (take <= 0) break;
+		merged.set(chunk.subarray(0, take), offset);
+		offset += take;
 	}
+	return new Response(merged, { status: res.status, headers });
 }
 
 function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
@@ -161,8 +207,9 @@ function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
 }
 
 /**
- * POST (or whatever `init` says) to `url` on the address that passed the public-https check.
- * A redirect is followed only when it stays on the same origin, and that hop is checked and pinned again.
+ * POST (or whatever `init` says) to `url` after the public-https check.
+ * The socket opens to an address from that check. TLS uses the hostname.
+ * A redirect is followed only when it stays on the same origin, and that hop is checked again.
  * A cross-origin redirect is refused, so wake credentials are not sent to another host.
  * 301, 302, and 303 drop the body. 307 and 308 keep it.
  */
@@ -172,24 +219,31 @@ export async function fetchCheckedWake(
 	deps: WakeDeps = {},
 ): Promise<{ response: Response } | { refused: string }> {
 	const lookup = deps.lookup ?? lookupAddresses;
-	const connect = async (): Promise<Connect> => {
-		if (deps.connect) return deps.connect;
-		if (net.connect) return net.connect;
-		return (await import("cloudflare:sockets")).connect as unknown as Connect;
-	};
 	let current = url;
 	let method = (init.method || "GET").toUpperCase();
 	let body = bodyBytes(method === "GET" || method === "HEAD" ? undefined : init.body);
 	for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-		const checked = await checkedWakeAddress(current, lookup);
+		const checked = await checkedWakeAddresses(current, lookup);
 		if ("refused" in checked) return checked;
-		const res = await pinnedRequest(checked.ip, current, method, init.headers, method === "GET" || method === "HEAD" ? new Uint8Array() : body, await connect());
+		const nextInit: RequestInit = {
+			method,
+			headers: init.headers,
+			body: method === "GET" || method === "HEAD" || body.byteLength === 0 ? undefined : body,
+			redirect: "manual",
+		};
+		const target = { ip: checked.ips[0]!, hostname: checked.hostname };
+		let res: Response;
+		if (deps.local && deps.localHost && new URL(current).host === deps.localHost) res = await deps.local(current, nextInit);
+		else if (deps.deliver) res = await deps.deliver(current, nextInit, target);
+		else if (wakeNet.deliver) res = await wakeNet.deliver(current, nextInit, target);
+		else res = await deliverPinned(current, nextInit, target, deps.connect ?? wakeNet.connect ?? await runtimeConnect());
 		const location = res.headers.get("location");
 		if (res.status < 300 || res.status >= 400 || !location) return { response: res };
+		await res.body?.cancel().catch(() => {});
 		if (hop === MAX_REDIRECTS) return { refused: "too many redirects" };
 		let next: URL;
 		try { next = new URL(location, current); } catch { return { refused: "not a URL" }; }
-		const ahead = await checkedWakeAddress(next.href, lookup);
+		const ahead = await checkedWakeAddresses(next.href, lookup);
 		if ("refused" in ahead) return ahead;
 		if (next.origin !== new URL(current).origin) return { refused: "cross-origin redirect" };
 		if (res.status === 303 || ((res.status === 301 || res.status === 302) && method !== "GET" && method !== "HEAD")) {

package/worker/src/wake.ts

@@ -51,7 +51,10 @@ export function defaultDebounceSeconds(preset: string): number {
 	return preset === "claude-code" ? 20 : 10;
 }
 
-/** Default hourly wake cap per preset (0 = unlimited). Claude Code routines allow 30 fires/hour. */
+/**
+ * Default hourly wake cap per preset. 0 means unlimited. Claude Code routines allow 30 fires/hour,
+ * so that preset defaults to 25 only when WAKE_MAX_PER_HOUR is unset. An explicit 0 stays unlimited.
+ */
 export function defaultMaxPerHour(preset: string): number {
 	return preset === "claude-code" ? 25 : 0;
 }
@@ -203,7 +206,11 @@ export async function renderWake(cfg: WakeConfig, ev: WakeEvent, opts: { nowMs?:
 			break;
 		case "generic":
 		default: {
-			if (cfg.key) headers[(cfg.keyHeader || "authorization").toLowerCase()] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			// A header the preview shows in full must not carry the key.
+			if (cfg.key) {
+				const requested = (cfg.keyHeader || "authorization").toLowerCase();
+				headers[previewHeaderPlain(requested) ? "authorization" : requested] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			}
 			headers["x-request-id"] = requestId;
 			body = cfg.bodyTemplate ? renderTemplate(cfg.bodyTemplate, ev, cli) : JSON.stringify(wakePayload(ev, cli));
 			if (cfg.hmacSecret) await hermesSign(headers, cfg.hmacSecret, body, nowMs);
@@ -243,11 +250,30 @@ export function cloudflareErrorHint(status: number, body: string): string {
 	return "";
 }
 
+/** Headers a wake preview may show in full. Every other header carries a credential, whatever its name. */
+export const PREVIEW_PLAIN_HEADERS = new Set([
+	"content-type", "user-agent", "x-request-id", "idempotency-key", "anthropic-version", "x-webhook-timestamp",
+]);
+
+export function previewHeaderPlain(name: string): boolean {
+	return PREVIEW_PLAIN_HEADERS.has(name.toLowerCase());
+}
+
+/** A credential header safe to show. No character of the secret is kept. */
+export function maskedCredential(value: string): string {
+	return /^bearer\s/i.test(value) ? "Bearer ••••" : "••••";
+}
+
+/** True only for the exact value `maskedCredential` returns. A prefix plus an ellipsis is still a secret. */
+export function credentialIsMasked(value: string): boolean {
+	return value === "••••" || value === "Bearer ••••";
+}
+
 /** Copy of a rendered request with credentials masked (for previews/logs). */
 export function redact(req: WakeRequest): WakeRequest {
 	const h: Record<string, string> = {};
 	for (const [k, v] of Object.entries(req.headers))
-		h[k] = /authorization|key|token|secret|signature|access-client-id/i.test(k) && !/^idempotency-key$/i.test(k) ? v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…") : v;
+		h[k] = previewHeaderPlain(k) ? v : maskedCredential(v);
 	let url = req.url;
 	try { const u = new URL(req.url); url = `${u.protocol}//${u.host}${u.pathname.replace(/\/[^/]{16,}/g, "/…")}`; } catch { /* keep */ }
 	return { ...req, url, headers: h };

package/worker/test/alarms.test.ts

@@ -41,6 +41,23 @@ test("nextCronAt is the earliest wake, rate row, or expiry", async () => {
 	assert.equal(await nextCronAt(tenant, now), now + 801);
 });
 
+test("zero and an unset generic cap stay unlimited; an unset Claude cap is 25", async () => {
+	const now = 1_700_000_000_000;
+	const hour = Math.floor(now / 3600000);
+	const due = now - 60_000;
+	const open = due + 10_000;
+	async function arm(over: Record<string, string>, count: number) {
+		const { DB, tenant } = ctx(over);
+		await DB.prepare("INSERT INTO wake_budget (hour, count) VALUES (?, ?)").bind(hour, count).run();
+		await DB.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('c', ?, '{}', ?)").bind(due, now).run();
+		return nextCronAt(tenant, now);
+	}
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "" }, 25), (hour + 1) * 3600000);
+});
+
 test("an hourly cap holds an already-due wake until the next hour", async () => {
 	const now = 1_700_000_000_000;
 	const hour = Math.floor(now / 3600000);