a2a-exposed 0.7.11 → 0.7.13

package/worker/test/hosted.test.ts

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
 import { Miniflare, convertV4MiniflareOptions } from "miniflare";
 import worker from "../src/index.ts";
 import { sha256 } from "../src/a2a.ts";
+import { sealWakeSecrets } from "../src/wake-secrets.ts";
 import { d1 } from "./d1.ts";
 
 const require = createRequire(new URL("../package.json", import.meta.url));
@@ -213,6 +214,10 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	const aliceInbox = await (await call("https://alice.example.com/owner/inbox?all=1", "GET", `Bearer ${tokenA}`)).json() as { text: string }[];
 	assert.equal(aliceInbox.length, 1);
 	assert.match(aliceInbox[0]!.text, /hello alice/);
+	const aliceSummary = await (await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA}`)).json() as { tasks: { submitted: number }; pairingPending: number };
+	assert.equal(aliceSummary.tasks.submitted, 1);
+	assert.equal(aliceSummary.pairingPending, 0);
+	assert.equal(JSON.stringify(aliceSummary).includes("hello alice"), false);
 
 	// workerd's local runtime throws "Jurisdiction restrictions are not implemented" on namespace.jurisdiction().
 	// namespaceForRegion() is covered in tenancy.test.ts; production Durable Objects do honour eu / fedramp.
@@ -481,3 +486,226 @@ test("an apex issuer is fetched with that Host, and a control worker that does n
 	assert.equal(stalledPost.status, 502);
 	assert.match(await stalledPost.text(), /The identity provider could not be reached/);
 });
+
+test("TenantStore.owner runs an allowlisted owner call and does not return a peer token", async (t) => {
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+			OWNER_TOKEN: "platform-owner",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-owner-rpc" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-carol");
+	type OwnerStub = {
+		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown; actor?: string }): Promise<{ status: number; body: unknown }>;
+		storageStatus(): Promise<{ configured: boolean; tables: string[] }>;
+		pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }>;
+	};
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => {
+		lines.push(args.map((a) => String(a)).join(" "));
+		orig(...args);
+	};
+	t.after(() => { console.log = orig; });
+	// Workerd delivers console.log on a later turn. A busy runner (the storage-backend jobs) can
+	// return the RPC before that line is in this process.
+	const saw = async (part: string) => {
+		const start = Date.now();
+		while (!lines.some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
+	const sawAfter = async (from: number, part: string) => {
+		const start = Date.now();
+		while (!lines.slice(from).some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
+	const empty = ns.get(ns.idFromName("id-empty")) as unknown as OwnerStub;
+	const missing = await empty.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(missing.status, 404);
+	const emptyStatus = await empty.storageStatus();
+	assert.equal(emptyStatus.configured, false);
+	assert.deepEqual(emptyStatus.tables, []);
+	assert.equal(await saw('"reason":"absent"'), true);
+
+	const stub = ns.get(ns.idFromName("id-carol")) as unknown as OwnerStub;
+	await stub.pushConfig({
+		version: 1, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		approval: { issuer: "https://idp.example", clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["acct_carol"] },
+		config: { AGENT_NAME: "Carol" },
+	});
+	await kv.put("tenant:carol", JSON.stringify({ id: "id-carol", status: "active", region: "", version: 1 }));
+	const http = (method: string, path: string, auth: string, json?: unknown) => mf.dispatchFetch(`https://carol.example.com${path}`, {
+		method, headers: { authorization: auth, "content-type": "application/json" }, body: json === undefined ? undefined : JSON.stringify(json),
+	});
+	assert.equal((await http("POST", "/owner/peers", "Bearer platform-owner", { label: "nope" })).status, 401, "self-host owner token still does not unlock a tenant");
+	const issued = await (await http("POST", "/owner/peers", "Bearer owner-carol", { label: "ada" })).json() as { token?: string };
+	assert.match(issued.token ?? "", /^a2aow_/, "the owner HTTP API still returns the new token");
+	const sentCarol = await http("POST", "/", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-carol", parts: [{ kind: "text", text: "hello from carol peer" }] } },
+	});
+	assert.equal(sentCarol.status, 200, await sentCarol.clone().text());
+	const summary = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/summary" });
+	assert.equal(summary.status, 200);
+	const summaryBody = summary.body as { tasks?: { submitted?: number }; pairingPending?: number };
+	assert.equal(summaryBody.tasks?.submitted, 1);
+	assert.equal(summaryBody.pairingPending, 0);
+	assert.equal(JSON.stringify(summary.body).includes("hello from carol peer"), false);
+	assert.equal(await saw('"route":"GET /owner/summary"'), true);
+
+	const listed = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(listed.status, 200);
+	const peers = listed.body as { label: string; token?: string }[];
+	assert.deepEqual(peers.map((p) => p.label), ["ada"]);
+	assert.equal(JSON.stringify(listed.body).includes("a2aow_"), false);
+	assert.equal(await saw('"route":"GET /owner/peers"'), true);
+
+	const minted = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(minted.status, 404);
+	assert.equal(JSON.stringify(minted.body).includes("a2aow_"), false);
+	const withBody = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(withBody.status, 400);
+	const again = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers" });
+	assert.equal(again.status, 404);
+	const still = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.deepEqual((still.body as { label: string }[]).map((p) => p.label), ["ada"], "a refused call does not mint a token");
+
+	const setup = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/password-link" });
+	assert.equal(setup.status, 404);
+	const dumped = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export" });
+	assert.equal(dumped.status, 404);
+	const oddQuery = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/inbox", query: { format: "sql" } });
+	assert.equal(oddQuery.status, 400);
+	const pairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(pairing.status, 200);
+	assert.equal(JSON.stringify(pairing.body).includes("tenant-secret-value"), false);
+	const preview = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(preview.status, 200);
+	assert.equal(JSON.stringify(preview.body).includes("platform-secret"), false);
+	assert.equal(JSON.stringify(preview.body).includes("tenant-secret-value"), false);
+
+	const wakeKey = "z9Qx-secret-value-0199";
+	const sealed = await sealWakeSecrets("platform-secret", "id-carol", { WAKE_WEBHOOK_KEY: wakeKey });
+	assert.ok(sealed);
+	assert.equal(sealed!.includes(wakeKey), false);
+	await stub.pushConfig({
+		version: 2, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		secretsEnc: sealed,
+		config: {
+			AGENT_NAME: "Carol",
+			WAKE_WEBHOOK_URL: "https://hooks.example/wake",
+			WAKE_PRESET: "generic",
+			WAKE_KEY_HEADER: "X-Credential",
+			WAKE_WEBHOOK_KEY: "plaintext-key-should-not-appear",
+		},
+	});
+	const woken = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(woken.status, 200);
+	const wokenText = JSON.stringify(woken.body);
+	assert.equal(wokenText.includes(wakeKey), false);
+	assert.equal(wokenText.includes("plaintext-key-should-not-appear"), false);
+	assert.equal(wokenText.includes("platform-secret"), false);
+	const wokenBody = woken.body as { hasKey?: boolean; request?: { headers?: Record<string, string> } };
+	assert.equal(wokenBody.hasKey, true);
+	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer ••••");
+	assert.equal(wokenText.includes("z9Qx"), false);
+	const httpPreview = await (await http("GET", "/owner/wake/preview", "Bearer owner-carol")).json() as { hasKey?: boolean };
+	assert.equal(httpPreview.hasKey, true);
+	assert.equal(JSON.stringify(httpPreview).includes(wakeKey), false);
+
+	const started = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.20" },
+		body: "client_name=Barry+Bot&client_id=barry-alias&agent_card_url=https://barry.example/.well-known/agent-card.json",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	const code = device.user_code ?? "";
+	assert.match(code, /^[BCDFGHJKLMNPQRSTVWXZ]{4}-[2-9]{4}$/);
+	const shapedName = "a2aow_" + "a".repeat(20);
+	const shapedCard = "https://card.example/card.json?t=" + "c".repeat(16);
+	const shapedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.23" },
+		body: `client_name=${encodeURIComponent(shapedName)}&client_id=shaped-alias&agent_card_url=${encodeURIComponent(shapedCard)}`,
+	});
+	assert.equal(shapedStart.status, 200);
+	const shapedList = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(shapedList.status, 200);
+	const shapedText = JSON.stringify(shapedList.body);
+	assert.equal(shapedText.includes(shapedName), false);
+	assert.equal(shapedText.includes("t=" + "c".repeat(16)), false);
+	assert.match(shapedText, /Barry Bot/);
+	const pendingPairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	const pending = (pendingPairing.body as { pending?: { userCode?: string; clientName?: string; clientId?: string; agentCardUrl?: string }[] }).pending ?? [];
+	assert.equal(pending.some((row) => row.userCode === code && row.clientName === "Barry Bot" && row.clientId === "barry-alias" && row.agentCardUrl === "https://barry.example/.well-known/agent-card.json"), true);
+	const refused = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve` });
+	assert.equal(refused.status, 403);
+	const httpSpoof = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-carol", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(httpSpoof.status, 403);
+	const approved = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve`, actor: "human" });
+	assert.equal(approved.status, 200);
+	assert.equal((approved.body as { decision?: string }).decision, "approved");
+	assert.equal(await saw('"event":"pairing_approved"'), true);
+	assert.equal(lines.some((line) => line.includes('"event":"pairing_approved"') && line.includes('"by":"human"')), true);
+
+	const deniedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
+		body: "client_name=Deny+Bot&client_id=deny-alias",
+	});
+	const deniedDevice = await deniedStart.json() as { user_code?: string };
+	assert.equal(deniedStart.status, 200);
+	const ownerDenyAt = lines.length;
+	const ownerDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${deniedDevice.user_code}/deny` });
+	assert.equal(ownerDenied.status, 200);
+	assert.equal(await saw('"event":"pairing_denied"'), true);
+	const ownerDenyLine = lines.slice(ownerDenyAt).find((line) => line.includes('"event":"pairing_denied"')) ?? "";
+	assert.match(ownerDenyLine, /"by":"owner"/);
+	assert.equal(ownerDenyLine.includes('"by":"human"'), false);
+
+	const humanDenyStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.22" },
+		body: "client_name=Human+Deny&client_id=human-deny",
+	});
+	const humanDenyDevice = await humanDenyStart.json() as { user_code?: string };
+	assert.equal(humanDenyStart.status, 200);
+	const humanDenyAt = lines.length;
+	const humanDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${humanDenyDevice.user_code}/deny`, actor: "human" });
+	assert.equal(humanDenied.status, 200);
+	assert.equal(await sawAfter(humanDenyAt, '"by":"human"'), true);
+	assert.equal(lines.slice(humanDenyAt).some((line) => line.includes('"event":"pairing_denied"') && line.includes('"by":"human"')), true);
+
+	const flagged = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", actor: "human" });
+	assert.equal(flagged.status, 400);
+	const badActor = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/WDJB-4827/approve", actor: "agent" });
+	assert.equal(badActor.status, 400);
+	assert.equal(await saw('"reason":"actor"'), true);
+
+	await stub.pushConfig({ version: 3, tenantId: "id-carol", name: "carol", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Carol" } });
+	const suspended = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(suspended.status, 403);
+	assert.equal(await saw('"reason":"status"'), true);
+	const badAccount = await stub.owner({ accountId: "../acct", method: "GET", path: "/owner/peers" });
+	assert.equal(badAccount.status, 400);
+	assert.equal(await saw('"reason":"account"'), true);
+	assert.equal(lines.some((l) => l.includes("../acct")), false);
+});

package/worker/test/owner-rpc.test.ts

@@ -0,0 +1,107 @@
+// Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims } from "../src/owner-rpc.ts";
+
+test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
+	const ok = (method: string, path: string, query?: Record<string, string>) => {
+		const m = matchOwnerRpc(method, path, query);
+		assert.equal(m.ok, true, `${method} ${path}`);
+		return m.ok ? m.route : null;
+	};
+	assert.equal(ok("GET", "/owner/inbox")?.name, "GET /owner/inbox");
+	assert.equal(ok("GET", "/owner/summary")?.name, "GET /owner/summary");
+	assert.equal(ok("GET", "/owner/inbox", { context: "ctx-1", all: "1" })?.search, "?context=ctx-1&all=1");
+	assert.equal(ok("GET", "/owner/tasks/task-1")?.path, "/owner/tasks/task-1");
+	assert.equal(ok("GET", "/owner/history/ctx-1", { n: "50" })?.search, "?n=50");
+	assert.equal(ok("GET", "/owner/outbound/task-1")?.name, "GET /owner/outbound/:id");
+	assert.equal(ok("GET", "/owner/peers")?.name, "GET /owner/peers");
+	assert.equal(ok("DELETE", "/owner/peers/ada")?.path, "/owner/peers/ada");
+	assert.equal(ok("GET", "/owner/pairing")?.name, "GET /owner/pairing");
+	assert.equal(ok("POST", "/owner/pairing/WDJB-4827/approve")?.name, "POST /owner/pairing/:code/approve");
+	assert.equal(ok("POST", "/owner/pairing/wdjb4827/deny")?.name, "POST /owner/pairing/:code/deny");
+	assert.equal(ok("GET", "/owner/mcp")?.name, "GET /owner/mcp");
+	assert.equal(ok("DELETE", "/owner/mcp/mcp-claude")?.path, "/owner/mcp/mcp-claude");
+	assert.equal(ok("GET", "/owner/outbound-peers")?.name, "GET /owner/outbound-peers");
+	assert.equal(ok("DELETE", "/owner/outbound-peers/ada.bot")?.path, "/owner/outbound-peers/ada.bot");
+	assert.equal(ok("GET", "/owner/facade")?.name, "GET /owner/facade");
+	assert.equal(ok("POST", "/owner/facade/verify")?.name, "POST /owner/facade/verify");
+	assert.equal(ok("GET", "/owner/wake/preview")?.name, "GET /owner/wake/preview");
+	assert.equal(ok("POST", "/owner/wake/test")?.name, "POST /owner/wake/test");
+	assert.equal(ok("GET", "/owner/contexts")?.name, "GET /owner/contexts");
+
+	const refused = (method: string, path: string, query?: Record<string, string>) => matchOwnerRpc(method, path, query);
+	assert.deepEqual(refused("POST", "/owner/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/password-link"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/pairing/password"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/outbound-peers/ada"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/peers/../export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/%2e%2e/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox?all=1"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/AEIO-4827/approve"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox", { format: "sql" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/summary", { all: "1" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/ctx-1", { n: "1001" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/.."), { ok: false, reason: "path" });
+	assert.equal(accountIdOf("acct_carol"), "acct_carol");
+	assert.equal(accountIdOf("../acct"), null);
+	assert.equal(accountIdOf(""), null);
+});
+
+test("owner RPC withholds peer tokens and decrypted secrets", () => {
+	const token = "a2aow_" + "a".repeat(43);
+	assert.equal(ownerResponseLeaks({ label: "ada", revoked_at: null }), false);
+	assert.equal(ownerResponseLeaks([{ text: "hello" }]), false);
+	assert.equal(ownerResponseLeaks({ token }), true);
+	assert.equal(ownerResponseLeaks({ nested: { access_token: "a2amcp_" + "b".repeat(30) } }), true);
+	assert.equal(ownerResponseLeaks({ url: "https://agent.example/device/setup?t=" + "c".repeat(20) }), true);
+	assert.equal(ownerResponseLeaks({ clientSecret: "tenant-secret-value" }), true);
+	assert.equal(ownerResponseLeaks({ secretsEnc: "v1.ciphertext-value" }), true);
+	assert.equal(ownerResponseLeaks("https://user:pass@hooks.example/wake"), true);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer abcd…" } }), true);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer ••••" } }), false);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { "x-credential": "••••" } }), false);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supersecretvalue", "content-type": "application/json" }, body: "{}" },
+	}), true);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "Bearer ••••", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
+	}), false);
+	assert.equal(ownerResponseLeaks({ fingerprints: { url: "0123456789ab", key: null } }), false);
+	assert.equal(ownerResponseLeaks({ token_hash: "ab".repeat(32) }), false);
+});
+
+test("a token-shaped claim is blanked and the rest of the list is returned", () => {
+	const token = "a2aow_" + "a".repeat(20);
+	const setup = "https://card.example/card.json?t=" + "c".repeat(16);
+	const userinfo = "https://user:secret@card.example/card.json";
+	const raw = {
+		pending: [
+			{ userCode: "WDJB-4827", clientName: token, clientId: "barry-alias", agentCardUrl: setup },
+			{ userCode: "BCDF-2345", clientName: "Barry Bot", clientId: token, agentCardUrl: "https://barry.example/card.json" },
+			{ client_name: token, agent_card_url: userinfo },
+		],
+		token,
+	};
+	assert.equal(ownerResponseLeaks(raw), true);
+	const scrubbed = scrubOwnerClaims(raw) as { pending: { clientName: string; clientId: string; agentCardUrl: string; client_name?: string; agent_card_url?: string }[]; token: string };
+	assert.equal(scrubbed.pending[0]!.clientName, "");
+	assert.equal(scrubbed.pending[0]!.clientId, "barry-alias");
+	assert.equal(scrubbed.pending[0]!.agentCardUrl, "");
+	assert.equal(scrubbed.pending[1]!.clientName, "Barry Bot");
+	assert.equal(scrubbed.pending[1]!.clientId, "");
+	assert.equal(scrubbed.pending[1]!.agentCardUrl, "https://barry.example/card.json");
+	assert.equal(scrubbed.pending[2]!.client_name, "");
+	assert.equal(scrubbed.pending[2]!.agent_card_url, "");
+	assert.equal(scrubbed.token, token);
+	assert.equal(ownerResponseLeaks(scrubbed), true, "a real token under another key is still withheld");
+	const listed = scrubOwnerClaims({ pending: raw.pending });
+	assert.equal(ownerResponseLeaks(listed), false);
+	assert.equal(JSON.stringify(listed).includes(token), false);
+	assert.equal(JSON.stringify(listed).includes("t=" + "c".repeat(16)), false);
+	assert.equal(JSON.stringify(listed).includes("user:secret"), false);
+});

package/worker/test/pairing.test.ts

@@ -3,6 +3,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import worker from "../src/index.ts";
+import { DASHBOARD_ACTOR_HEADER } from "../src/owner-rpc.ts";
 import * as P from "../src/pairing.ts";
 import { wakeSummary, renderWake, type WakeEvent } from "../src/wake.ts";
 import { d1 } from "./d1.ts";
@@ -221,10 +222,13 @@ test("human approval: pending, slow_down, page approve with the password, single
 	advance(16);
 	assert.equal((await s.poll(d.device_code)).data.error, "authorization_pending");
 
-	// human mode: the owner API (the agent) cannot approve
+	// human mode: the owner API (the agent) cannot approve, and the dashboard header does not change that
 	const oa = await s.owner("POST", `/owner/pairing/${d.user_code}/approve`);
 	assert.equal(oa.status, 403);
 	assert.match(oa.data.error, /approval mode is human: the owner approves on https:\/\/agent\.example\.com\/device\?user_code=/);
+	const spoofed = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
+	assert.equal(spoofed.status, 403);
+	assert.match(spoofed.data.error, /approval mode is human/);
 	const list = await s.owner("GET", "/owner/pairing");
 	assert.deepEqual([list.data.mode, list.data.passwordSet, list.data.pending.length, list.data.pending[0].userCode], ["human", false, 1, d.user_code]);
 
@@ -289,10 +293,19 @@ test("human approval: pending, slow_down, page approve with the password, single
 });
 
 test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => { lines.push(args.map((part) => String(part)).join(" ")); orig(...args); };
+	t.after(() => { console.log = orig; });
 	const s = setup({ PAIRING_APPROVAL: "agent" }); t.after(s.restore);
 	const first = (await s.start({ client_name: "tester-alpha", client_id: "other-alias" }, "203.0.113.40")).data;
-	const approved = await s.owner("POST", `/owner/pairing/${first.user_code}/approve`);
+	const approved = await s.call("POST", `/owner/pairing/${first.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
 	assert.equal(approved.data.label, "tester-alpha");
+	const decided = s.DB.db.prepare("SELECT decided_by FROM device_requests WHERE user_code = ?").get(first.user_code.replace("-", "")) as { decided_by: string };
+	assert.equal(decided.decided_by, "agent");
+	const logged = lines.find((line) => line.includes("pairing_approved"));
+	assert.match(logged ?? "", /"by":"agent"/);
+	assert.equal((logged ?? "").includes('"by":"human"'), false);
 	const token = (await s.poll(first.device_code)).data.access_token;
 	const sent = await s.call("POST", "/", {
 		json: { jsonrpc: "2.0", id: 1, method: "SendMessage", params: { message: { role: "ROLE_USER", parts: [{ text: "hello" }] } } },
@@ -681,3 +694,31 @@ test("GET / with pairing off: no /device link, says to ask the operator", async
 	assert.match(h.text, /ask this agent's operator for a bearer token/);
 	assert.equal((await s.call("GET", "/")).data.pairing, undefined);
 });
+
+test("owner summary counts tasks and pending pairing requests without their text", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const started = await s.start();
+	assert.equal(started.status, 200);
+	const issued = await s.owner("POST", "/owner/peers", { label: "ada" });
+	assert.match(issued.data.token, /^a2aow_/);
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m1", parts: [{ kind: "text", text: "secret plan from ada" }] } } },
+		headers: { authorization: `Bearer ${issued.data.token}` },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const taskId = sent.data.result.id;
+	const pending = JSON.stringify({ taskIds: [taskId] });
+	const now = Date.now();
+	s.DB.db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)").run("ctx-keep", now, pending, now);
+	const summary = await s.owner("GET", "/owner/summary");
+	assert.equal(summary.status, 200);
+	assert.equal(summary.data.tasks.submitted, 1);
+	assert.equal(summary.data.tasks.working, 0);
+	assert.equal(summary.data.pairingPending, 1);
+	const text = JSON.stringify(summary.data);
+	assert.equal(text.includes("secret plan"), false);
+	assert.equal(text.includes(started.data.user_code), false);
+	assert.equal(text.includes(started.data.device_code), false);
+	assert.equal(text.includes(taskId), false);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
+});

package/worker/test/wake-secrets.test.ts

@@ -0,0 +1,49 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { MAX_WAKE_SEALED, MAX_WAKE_VALUE, openWakeSecrets, sealWakeSecrets, WAKE_SECRET_KEYS } from "../src/wake-secrets.ts";
+
+const key = "platform-secret";
+const tenant = "ten_a";
+
+test("wake secrets round-trip for one tenant and stay unreadable for another", async () => {
+	const secrets = { WAKE_WEBHOOK_KEY: "z9Qx-secret-value-0199", WAKE_HMAC_SECRET: "hmac-value" };
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.equal(sealed!.includes("z9Qx-secret-value-0199"), false);
+	assert.equal(sealed!.startsWith("v1."), true);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, "ten_b", sealed), null);
+	assert.equal(await openWakeSecrets("other-key", tenant, sealed), null);
+	assert.equal(await openWakeSecrets("", tenant, sealed), null);
+	assert.deepEqual(await openWakeSecrets(key, tenant, null), {});
+	assert.equal(await openWakeSecrets(key, tenant, sealed + ".extra"), null);
+	assert.equal(await openWakeSecrets(key, tenant, "v1.not-base64.nope"), null);
+});
+
+test("a wake secret blob keeps only the known fields", async () => {
+	const sealed = await sealWakeSecrets(key, tenant, {
+		WAKE_WEBHOOK_KEY: "hook-key",
+		WAKE_ACCESS_CLIENT_SECRET: "access-secret",
+	});
+	const opened = await openWakeSecrets(key, tenant, sealed);
+	assert.deepEqual(opened, { WAKE_WEBHOOK_KEY: "hook-key", WAKE_ACCESS_CLIENT_SECRET: "access-secret" });
+	assert.equal(await sealWakeSecrets(key, tenant, { WAKE_WEBHOOK_KEY: "x".repeat(4097) }), null);
+});
+
+test("four maximum-length wake secrets round-trip", async () => {
+	const value = "x".repeat(MAX_WAKE_VALUE);
+	const secrets = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, value]));
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.ok(sealed!.length > 16384);
+	assert.ok(sealed!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, tenant, "v1." + "a".repeat(MAX_WAKE_SEALED)), null);
+
+	const escaped = "\u0000".repeat(MAX_WAKE_VALUE);
+	const worst = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, escaped]));
+	const sealedWorst = await sealWakeSecrets(key, tenant, worst);
+	assert.ok(sealedWorst);
+	assert.ok(sealedWorst!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealedWorst), worst);
+});