a2a-exposed 0.7.12 → 0.7.13

package/lib/main.mjs

@@ -68,8 +68,11 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
-  wake preview                  rendered wake request (partially masked) + sha256 fingerprints of the
-                                uploaded URL/key/HMAC secret; compared with local env values if exported
+                                --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
+                                               which defaults to 25 when this is unset
+  wake preview                  rendered wake request (a credential is Bearer •••• or ••••, none of the secret)
+                                + sha256 fingerprints of the uploaded URL/key/HMAC secret; compared with
+                                local env values if exported
   wake fingerprint              fingerprints (first 12 hex of sha256) of WAKE_* in the local environment
   wake test                     send a test wake now and print the HTTP status
   wake unset                    remove wake secrets (fall back to polling)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.12",
+	"version": "0.7.13",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -49,7 +49,7 @@ const plain: Record<string, string> = {
 	// Hosted multi-tenant gates. All empty by default, and empty is omitted, so a self-host deploy is unchanged.
 	// TENANCY=host switches the entrypoint to src/hosted.ts and adds TENANT_DO + TENANT_DIRECTORY below.
 	// QUOTAS, USAGE_SINK, SIGNUP_URL and BRANDING are parsed and reserved.
-	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https (see wake-target.ts).
+	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https. The socket opens to an address from that check, and TLS names the hostname (see wake-target.ts).
 	// APPROVAL_OIDC_* turn on OpenID Connect approval when issuer, client id, secret and allowlist are all set.
 	TENANCY: v("TENANCY"),
 	TENANT_DOMAIN: v("TENANT_DOMAIN"),

package/worker/package.json

@@ -20,5 +20,8 @@
 		"miniflare": "^5.20261006.0-alpha",
 		"typescript": "^7.0.2",
 		"vite": "^8.3.0"
+	},
+	"dependencies": {
+		"tunnelfetch": "1.13.0"
 	}
 }

package/worker/src/index.ts

@@ -10,7 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, defaultDebounceSeconds, defaul
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
+import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
@@ -83,7 +83,17 @@ function wakeConfig(ctx: TenantContext): WakeConfig {
 }
 
 const debounceMs = (ctx: TenantContext) => Number(ctx.WAKE_DEBOUNCE_SECONDS || defaultDebounceSeconds(preset(ctx))) * 1000;
-const maxPerHour = (ctx: TenantContext) => Number(ctx.WAKE_MAX_PER_HOUR || defaultMaxPerHour(preset(ctx)));
+
+/**
+ * Hourly wake cap. 0 means unlimited, including an explicit "0".
+ * An empty or unset value uses the preset default (unlimited, or 25 for Claude Code).
+ */
+function maxPerHour(ctx: TenantContext): number {
+	const raw = (ctx.WAKE_MAX_PER_HOUR ?? "").trim();
+	const n = raw === "" ? defaultMaxPerHour(preset(ctx)) : Number(raw);
+	if (!Number.isFinite(n) || n <= 0) return 0;
+	return Math.floor(n);
+}
 
 async function wakeBudgetOk(ctx: TenantContext): Promise<boolean> {
 	const cap = maxPerHour(ctx);
@@ -118,7 +128,10 @@ async function sendWake(ctx: TenantContext, ectx: ExecutionContext, payload: Jso
 	try {
 		let r: Response;
 		if (ctx.gates.wakeTargetPolicy === "public-https") {
-			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body });
+			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body }, {
+				localHost: (() => { try { return new URL(ctx.PUBLIC_URL).host; } catch { return ""; } })(),
+				local: (url, init) => doFetch(ctx, ectx, url, init),
+			});
 			if ("refused" in checked) {
 				log("wake_refused", { preset: preset(ctx), contextId: ev.contextId, reason: checked.refused });
 				return { status: null, info: `refused: ${checked.refused}` };
@@ -906,6 +919,21 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	const seg = path.split("/").filter(Boolean).slice(1); // after "owner"
 	const body = async () => { const raw = await readBody(req, ctx); return raw ? JSON.parse(raw) : {}; };
 
+	if (seg[0] === "summary" && !seg[1] && m === "GET") {
+		// Counts only. Unlike GET /owner/inbox this does not return message text or clear a pending wake.
+		const known = ["submitted", "working", "input-required", "completed", "failed", "rejected", "canceled"];
+		const tasks: Record<string, number> = {};
+		for (const state of known) tasks[state] = 0;
+		const rows = await ctx.DB.prepare("SELECT state, COUNT(*) AS n FROM tasks GROUP BY state").all();
+		for (const r of rows.results as Json[]) {
+			if (typeof r.state !== "string" || !known.includes(r.state)) continue;
+			const n = Number(r.n);
+			if (Number.isSafeInteger(n) && n >= 0) tasks[r.state] = n;
+		}
+		const pending: Json = await ctx.DB.prepare("SELECT COUNT(*) AS n FROM device_requests WHERE status = 'pending' AND expires_ms > ?").bind(Date.now()).first();
+		const pairing = Number(pending?.n ?? 0);
+		return json({ tasks, pairingPending: Number.isSafeInteger(pairing) && pairing >= 0 ? pairing : 0 });
+	}
 	if (seg[0] === "inbox" && m === "GET") {
 		const contextFilter = url.searchParams.get("context");
 		const all = url.searchParams.get("all") === "1";
@@ -1019,7 +1047,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			return json({ revoked: true, label });
 		}
 	}
-	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body);
+	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body, trusted);
 	if (seg[0] === "mcp" && !seg[1] && m === "GET") {
 		const rows = await ctx.DB.prepare("SELECT label, client_id, client_name, redirect_host, scope, created_at, last_used_at, revoked_at, refresh_expires_ms FROM mcp_grants ORDER BY created_at").all();
 		return json({ enabled: mcpOn(ctx), url: oauthUrls(ctx).mcp, grants: (rows.results as Json[]).map((r) => ({ ...r, refresh_expires_ms: undefined,
@@ -1079,7 +1107,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		return json({ mode: "proxy", ...(await verifyUpstream(ctx)) });
 	}
 	if (seg[0] === "wake" && seg[1] === "preview" && m === "GET") {
-		// rendered wake request for a sample event, partially masked, plus short sha256 fingerprints of the
+		// rendered wake request for a sample event, credentials shown as Bearer •••• or ••••, plus short sha256 fingerprints of the
 		// uploaded secrets so the owner can compare them with local values without revealing them
 		const ev: WakeEvent = { contextId: "ctx-preview", taskId: "task-preview", taskIds: ["task-preview"], from: "example-peer",
 			preview: "Example message preview", kind: "test", publicUrl: ctx.PUBLIC_URL };
@@ -1576,7 +1604,7 @@ async function setupPage(req: Request, ctx: TenantContext, url: URL): Promise<Re
 }
 
 /** Owner API: /owner/pairing (list, mode), /owner/pairing/password (set), /owner/pairing/<code>/approve|deny. */
-async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>): Promise<Response> {
+async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>, trusted = false): Promise<Response> {
 	const mode = pairingMode(ctx);
 	if (!seg[0] && m === "GET") {
 		const now = Date.now();
@@ -1627,9 +1655,12 @@ async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: st
 		const code = P.normUserCode(decodeURIComponent(seg[0]));
 		if (!code) return json({ error: "not a valid code (it looks like WDJB-4827)" }, 400);
 		const approve = seg[1] === "approve";
-		if (approve && mode !== "agent")
+		// The header is set only by runOwnerRpc for actor "human". A network request is not trusted, so the same
+		// header on /owner/* does not approve and does not change who is logged.
+		const dashboardHuman = trusted && req.headers.get(DASHBOARD_ACTOR_HEADER) === "human";
+		if (approve && mode !== "agent" && !dashboardHuman)
 			return json({ error: `approval mode is human: the owner approves on ${oauthUrls(ctx).page}?user_code=${P.formatUserCode(code)} with the approval password. \`pair approve\` works only after \`${cliCommand(ctx)} deploy --pairing-approval agent\`, and only if your human wants the agent to approve. \`pair deny\` works in every mode.` }, 403);
-		const d = await decide(ctx, code, approve, approve ? "agent" : "owner");
+		const d = await decide(ctx, code, approve, dashboardHuman ? "human" : approve ? "agent" : "owner");
 		if (!d.ok) return json({ error: d.error }, 409);
 		return json({ ok: true, decision: approve ? "approved" : "denied", userCode: P.formatUserCode(code), label: d.label || null,
 			clientName: d.request.client_name || d.request.client_id || null, replaced: !!d.replaced });
@@ -2098,13 +2129,19 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
 	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
 	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	const actor = (raw as { actor?: unknown } | null)?.actor;
+	if (actor !== undefined && actor !== "human") return refuse(400, "actor is invalid", "actor");
+	const pairingDecision = matched.route.name === "POST /owner/pairing/:code/approve" || matched.route.name === "POST /owner/pairing/:code/deny";
+	if (actor === "human" && !pairingDecision) return refuse(400, "actor is invalid", "actor");
 	let origin = "https://tenant.invalid";
 	try {
 		const u = new URL(ctx.PUBLIC_URL);
 		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
 	} catch { /* the handler reads the path, not this origin */ }
 	const url = new URL(origin + matched.route.path + matched.route.search);
-	const req = new Request(url, { method: matched.route.method, headers: { "content-type": "application/json" } });
+	const headers = new Headers({ "content-type": "application/json" });
+	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
+	const req = new Request(url, { method: matched.route.method, headers });
 	let res: Response;
 	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
 	catch (e: any) {
@@ -2114,7 +2151,7 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
 		return { status, body: { error } };
 	}
-	const data = await res.json().catch(() => null);
+	const data = scrubOwnerClaims(await res.json().catch(() => null));
 	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
 	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
 	return { status: res.status, body: data };

package/worker/src/owner-rpc.ts

@@ -4,7 +4,7 @@
 // token, or dump credential material (export) are not here. Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
-import { previewHeaderPlain } from "./wake.ts";
+import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
 
 /** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
 export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
@@ -25,6 +25,12 @@ const SECRET_KEYS = new Set([
 	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
 ]);
 
+/**
+ * Header `runOwnerRpc` sets when `actor` is `human`. `handleOwner` honors it only on an in-process call.
+ * A request from the network cannot become that decision by sending the header.
+ */
+export const DASHBOARD_ACTOR_HEADER = "x-a2a-dashboard-actor";
+
 export interface OwnerRpcRequest {
 	accountId: string;
 	method: string;
@@ -33,6 +39,11 @@ export interface OwnerRpcRequest {
 	query?: Record<string, string>;
 	/** Refused. The owner HTTP API is where a body is accepted. */
 	body?: unknown;
+	/**
+	 * Dashboard approve or deny after the control plane has checked a recent sign-in.
+	 * Any other value is refused. Absent keeps the owner HTTP API's actor (`agent` or `owner`).
+	 */
+	actor?: "human";
 }
 
 export interface OwnerRpcResult {
@@ -109,6 +120,7 @@ interface RouteDef {
 
 const ROUTES: RouteDef[] = [
 	{ method: "GET", name: "GET /owner/inbox", take: (s) => s.length === 2 && s[1] === "inbox", search: inboxQuery, path: () => "/owner/inbox" },
+	{ method: "GET", name: "GET /owner/summary", take: (s) => s.length === 2 && s[1] === "summary", search: noQuery, path: () => "/owner/summary" },
 	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
 	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
 	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
@@ -147,12 +159,36 @@ function stringLeaks(value: string, key: string | null): boolean {
 	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;
 }
 
+/** Claimed display fields. A token-shaped value is blanked so one request cannot withhold the list. */
+const CLAIM_KEYS = new Set(["clientname", "client_name", "clientid", "client_id", "agentcardurl", "agent_card_url"]);
+
+function claimLeaks(value: string): boolean {
+	return TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value);
+}
+
+/**
+ * Replace a claimed name, alias, or card that is shaped like a peer token, a setup secret, or URL
+ * userinfo with an empty string. Other keys are left for `ownerResponseLeaks`.
+ */
+export function scrubOwnerClaims(value: unknown, depth = 0): unknown {
+	if (value == null || depth > 20) return value;
+	if (Array.isArray(value)) return value.map((item) => scrubOwnerClaims(item, depth + 1));
+	if (typeof value !== "object") return value;
+	const out: Record<string, unknown> = {};
+	for (const [key, item] of Object.entries(value)) {
+		out[key] = typeof item === "string" && CLAIM_KEYS.has(key.toLowerCase()) && claimLeaks(item)
+			? ""
+			: scrubOwnerClaims(item, depth + 1);
+	}
+	return out;
+}
+
 /** A rendered wake whose credential header was not masked. The header name is the caller's choice. */
 function wakePreviewLeaks(value: object): boolean {
 	const headers = (value as { method?: unknown; headers?: unknown }).headers;
 	if ((value as { method?: unknown }).method !== "POST" || !headers || typeof headers !== "object" || Array.isArray(headers)) return false;
 	for (const [k, v] of Object.entries(headers)) {
-		if (typeof v !== "string" || previewHeaderPlain(k) || v.endsWith("…")) continue;
+		if (typeof v !== "string" || previewHeaderPlain(k) || credentialIsMasked(v)) continue;
 		return true;
 	}
 	return false;

package/worker/src/wake-target.ts

@@ -1,7 +1,14 @@
 // Wake URL checks for WAKE_TARGET_POLICY=public-https. Unset stays the previous fetch
 // (any URL the operator configured, redirects followed by the platform).
+//
+// The TCP connection is to an address from the DNS check. TLS is not the runtime's
+// startTls({ expectedServerHostname }): on the Workers edge that sends no SNI when the
+// socket was opened to an IP (cloudflare/workerd#6903), so the peer aborts before HTTP.
+// The handshake runs in-process, with the URL hostname as SNI, over that pinned socket.
+// A socket still cannot open a Cloudflare address, so a *.workers.dev target does not connect.
+import { CertificateError, Client, TlsError } from "tunnelfetch";
 import { isPrivateHost } from "./a2a.ts";
-import { isPublicIp, net, parseHttpResponse, type PinnedSocket } from "./mcp.ts";
+import { isPublicIp } from "./mcp.ts";
 
 /** DNS-over-HTTPS resolver. Same endpoint the client-metadata fetch uses. */
 export const DOH_URL = "https://cloudflare-dns.com/dns-query";
@@ -9,14 +16,33 @@ export const DOH_URL = "https://cloudflare-dns.com/dns-query";
 /** Original request plus this many redirects. Each hop is checked before it is requested. */
 const MAX_REDIRECTS = 3;
 
+const REQUEST_TIMEOUT_MS = 15_000;
+
 /** Host to addresses. `null` means the lookup failed and the caller must fail closed. */
 export type AddressLookup = (host: string) => Promise<string[] | null>;
 
-type Connect = NonNullable<typeof net.connect>;
+type WakeSocket = {
+	readable: ReadableStream<Uint8Array>;
+	writable: WritableStream<Uint8Array>;
+	opened?: Promise<{ remoteAddress?: string | null }>;
+	close?: () => Promise<void>;
+};
+
+/** Raw TCP. Production uses `cloudflare:sockets`. Tests replace it. */
+export type WakeConnect = (address: { hostname: string; port: number }, options?: { secureTransport?: "off" | "on" | "starttls"; allowHalfOpen?: boolean }) => WakeSocket;
+
+/** One checked hop. `ip` is the address the socket must use. `hostname` is the TLS name. */
+export type CheckedDeliver = (url: string, init: RequestInit, target: { ip: string; hostname: string }) => Promise<Response>;
+
+export const wakeNet: { connect: null | WakeConnect; deliver: null | CheckedDeliver } = { connect: null, deliver: null };
 
 export type WakeDeps = {
 	lookup?: AddressLookup;
-	connect?: Connect;
+	connect?: WakeConnect;
+	deliver?: CheckedDeliver;
+	/** Deliver a URL on this host in-process. Used for a wake aimed at this inbox. */
+	localHost?: string;
+	local?: (url: string, init: RequestInit) => Promise<Response>;
 };
 
 function bareHost(host: string): string {
@@ -69,8 +95,8 @@ export async function publicWakeProblem(url: string, lookup: AddressLookup = loo
 	return "refused" in checked ? checked.refused : "";
 }
 
-/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
-export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+/** Every public address from one lookup. The socket uses the first. The TLS name is the URL host. */
+async function checkedWakeAddresses(url: string, lookup: AddressLookup): Promise<{ hostname: string; ips: string[] } | { refused: string }> {
 	let parsed: URL;
 	try { parsed = new URL(url); } catch { return { refused: "not a URL" }; }
 	if (parsed.protocol !== "https:") return { refused: "must be https" };
@@ -78,79 +104,99 @@ export async function checkedWakeAddress(url: string, lookup: AddressLookup = lo
 	const host = parsed.hostname;
 	if (!host || isPrivateHost(host)) return { refused: "private or internal host" };
 	const bare = bareHost(host);
-	if (isIpLiteral(host)) return isPublicIp(bare) ? { ip: bare } : { refused: "private or reserved address" };
+	if (isIpLiteral(host)) return isPublicIp(bare) ? { hostname: bare, ips: [bare] } : { refused: "private or reserved address" };
 	let ips: string[] | null;
 	try { ips = await lookup(host); } catch { return { refused: "its address could not be checked" }; }
 	if (ips == null) return { refused: "its address could not be checked" };
 	if (!ips.length) return { refused: "the host has no address" };
 	if (!ips.every((ip) => isPublicIp(ip))) return { refused: "resolves to a private or reserved address" };
-	return { ip: ips[0] };
+	return { hostname: host, ips };
 }
 
-function headerEntries(headers: HeadersInit | undefined): [string, string][] {
-	const out: [string, string][] = [];
-	const list = new Headers(headers);
-	list.forEach((value, key) => out.push([key, value]));
-	return out;
+/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
+export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+	const checked = await checkedWakeAddresses(url, lookup);
+	if ("refused" in checked) return checked;
+	return { ip: checked.ips[0]! };
 }
 
-function requestBytes(method: string, url: URL, headers: HeadersInit | undefined, body: Uint8Array): Uint8Array {
-	const lines = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
-	for (const [key, value] of headerEntries(headers)) {
-		if (key === "host" || key === "content-length" || key === "connection" || key === "transfer-encoding") continue;
-		if (/[\r\n]/.test(key) || /[\r\n]/.test(value)) throw new Error("invalid header");
-		lines.push(`${key}: ${value}`);
-	}
-	if (body.byteLength) lines.push(`content-length: ${body.byteLength}`);
-	lines.push("connection: close");
-	const head = new TextEncoder().encode(lines.join("\r\n") + "\r\n\r\n");
-	const raw = new Uint8Array(head.byteLength + body.byteLength);
-	raw.set(head);
-	raw.set(body, head.byteLength);
-	return raw;
+/**
+ * Dial `ip`, ignoring the hostname the TLS stack passes in. The handshake names that hostname
+ * itself; this function only chooses the TCP address.
+ */
+export function dialChecked(ip: string, connect: WakeConnect): WakeConnect {
+	return (addr) => connect({ hostname: ip, port: addr.port }, { secureTransport: "off", allowHalfOpen: false });
 }
 
-async function readSocket(sock: PinnedSocket, cap: number): Promise<Uint8Array> {
-	const reader = sock.readable.getReader();
-	const chunks: Uint8Array[] = [];
-	let n = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		n += value.byteLength;
-		if (n > cap) break;
-		chunks.push(value);
-	}
-	const raw = new Uint8Array(Math.min(n, cap));
-	let o = 0;
-	for (const chunk of chunks) {
-		const take = Math.min(chunk.byteLength, raw.byteLength - o);
-		raw.set(chunk.subarray(0, take), o);
-		o += take;
-	}
-	return raw;
+async function runtimeConnect(): Promise<WakeConnect> {
+	if (wakeNet.connect) return wakeNet.connect;
+	const sockets = await import("cloudflare:sockets");
+	return sockets.connect as unknown as WakeConnect;
 }
 
+/** Enough of an error body to recognise a Cloudflare status page. A success body is not kept. */
+const HINT_BYTES = 4096;
+
 /**
- * HTTPS to `ip`, with TLS checked for the URL's hostname. The platform does not resolve the name again.
+ * HTTPS to the checked IP, with SNI and certificate verification for the URL host.
+ * `forceTunnel` keeps the platform from fetching the hostname again.
+ * The body is copied before the client closes, because closing drops the socket.
  */
-async function pinnedRequest(ip: string, url: string, method: string, headers: HeadersInit | undefined, body: Uint8Array, connect: Connect): Promise<Response> {
-	const parsed = new URL(url);
-	const sock = connect({ hostname: ip, port: Number(parsed.port || 443) }, { secureTransport: "starttls" }).startTls({ expectedServerHostname: parsed.hostname });
+async function deliverPinned(url: string, init: RequestInit, target: { ip: string; hostname: string }, connect: WakeConnect): Promise<Response> {
+	const client = new Client({
+		connect: dialChecked(target.ip, connect),
+		forceTunnel: true,
+		maxRedirects: 0,
+		maxBodyBytes: Infinity,
+		http2: false,
+		keepAlive: false,
+		timeouts: { totalMs: REQUEST_TIMEOUT_MS },
+	});
 	try {
-		const writer = sock.writable.getWriter();
-		await writer.write(requestBytes(method, parsed, headers, body));
-		writer.releaseLock();
-		const raw = await readSocket(sock, 65536);
-		const message = parseHttpResponse(raw);
-		if (typeof message === "string") throw new Error(message);
-		const responseHeaders = new Headers();
-		for (const [key, value] of Object.entries(message.headers)) responseHeaders.set(key, value);
-		const payload = message.status === 204 || message.status === 304 ? null : message.body;
-		return new Response(payload, { status: message.status, headers: responseHeaders });
+		const res = await client.fetch(url, {
+			method: init.method,
+			headers: init.headers,
+			body: init.body,
+			redirect: "manual",
+		});
+		return await responseForCaller(res);
+	} catch (e) {
+		if (e instanceof TlsError || e instanceof CertificateError) throw new Error("TLS Handshake Failed.");
+		throw e;
 	} finally {
-		await sock.close().catch(() => {});
+		await client.close().catch(() => {});
+	}
+}
+
+/** Status and headers, plus the start of an error body. The live socket is not returned. */
+async function responseForCaller(res: Response): Promise<Response> {
+	const headers = new Headers(res.headers);
+	if (res.ok || !res.body) {
+		await res.body?.cancel().catch(() => {});
+		return new Response(null, { status: res.status, headers });
+	}
+	const reader = res.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		while (total < HINT_BYTES) {
+			const next = await reader.read();
+			if (next.done || !next.value) break;
+			chunks.push(next.value);
+			total += next.value.byteLength;
+		}
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	const merged = new Uint8Array(Math.min(total, HINT_BYTES));
+	let offset = 0;
+	for (const chunk of chunks) {
+		const take = Math.min(chunk.byteLength, merged.byteLength - offset);
+		if (take <= 0) break;
+		merged.set(chunk.subarray(0, take), offset);
+		offset += take;
 	}
+	return new Response(merged, { status: res.status, headers });
 }
 
 function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
@@ -161,8 +207,9 @@ function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
 }
 
 /**
- * POST (or whatever `init` says) to `url` on the address that passed the public-https check.
- * A redirect is followed only when it stays on the same origin, and that hop is checked and pinned again.
+ * POST (or whatever `init` says) to `url` after the public-https check.
+ * The socket opens to an address from that check. TLS uses the hostname.
+ * A redirect is followed only when it stays on the same origin, and that hop is checked again.
  * A cross-origin redirect is refused, so wake credentials are not sent to another host.
  * 301, 302, and 303 drop the body. 307 and 308 keep it.
  */
@@ -172,24 +219,31 @@ export async function fetchCheckedWake(
 	deps: WakeDeps = {},
 ): Promise<{ response: Response } | { refused: string }> {
 	const lookup = deps.lookup ?? lookupAddresses;
-	const connect = async (): Promise<Connect> => {
-		if (deps.connect) return deps.connect;
-		if (net.connect) return net.connect;
-		return (await import("cloudflare:sockets")).connect as unknown as Connect;
-	};
 	let current = url;
 	let method = (init.method || "GET").toUpperCase();
 	let body = bodyBytes(method === "GET" || method === "HEAD" ? undefined : init.body);
 	for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-		const checked = await checkedWakeAddress(current, lookup);
+		const checked = await checkedWakeAddresses(current, lookup);
 		if ("refused" in checked) return checked;
-		const res = await pinnedRequest(checked.ip, current, method, init.headers, method === "GET" || method === "HEAD" ? new Uint8Array() : body, await connect());
+		const nextInit: RequestInit = {
+			method,
+			headers: init.headers,
+			body: method === "GET" || method === "HEAD" || body.byteLength === 0 ? undefined : body,
+			redirect: "manual",
+		};
+		const target = { ip: checked.ips[0]!, hostname: checked.hostname };
+		let res: Response;
+		if (deps.local && deps.localHost && new URL(current).host === deps.localHost) res = await deps.local(current, nextInit);
+		else if (deps.deliver) res = await deps.deliver(current, nextInit, target);
+		else if (wakeNet.deliver) res = await wakeNet.deliver(current, nextInit, target);
+		else res = await deliverPinned(current, nextInit, target, deps.connect ?? wakeNet.connect ?? await runtimeConnect());
 		const location = res.headers.get("location");
 		if (res.status < 300 || res.status >= 400 || !location) return { response: res };
+		await res.body?.cancel().catch(() => {});
 		if (hop === MAX_REDIRECTS) return { refused: "too many redirects" };
 		let next: URL;
 		try { next = new URL(location, current); } catch { return { refused: "not a URL" }; }
-		const ahead = await checkedWakeAddress(next.href, lookup);
+		const ahead = await checkedWakeAddresses(next.href, lookup);
 		if ("refused" in ahead) return ahead;
 		if (next.origin !== new URL(current).origin) return { refused: "cross-origin redirect" };
 		if (res.status === 303 || ((res.status === 301 || res.status === 302) && method !== "GET" && method !== "HEAD")) {

package/worker/src/wake.ts

@@ -51,7 +51,10 @@ export function defaultDebounceSeconds(preset: string): number {
 	return preset === "claude-code" ? 20 : 10;
 }
 
-/** Default hourly wake cap per preset (0 = unlimited). Claude Code routines allow 30 fires/hour. */
+/**
+ * Default hourly wake cap per preset. 0 means unlimited. Claude Code routines allow 30 fires/hour,
+ * so that preset defaults to 25 only when WAKE_MAX_PER_HOUR is unset. An explicit 0 stays unlimited.
+ */
 export function defaultMaxPerHour(preset: string): number {
 	return preset === "claude-code" ? 25 : 0;
 }
@@ -256,11 +259,21 @@ export function previewHeaderPlain(name: string): boolean {
 	return PREVIEW_PLAIN_HEADERS.has(name.toLowerCase());
 }
 
+/** A credential header safe to show. No character of the secret is kept. */
+export function maskedCredential(value: string): string {
+	return /^bearer\s/i.test(value) ? "Bearer ••••" : "••••";
+}
+
+/** True only for the exact value `maskedCredential` returns. A prefix plus an ellipsis is still a secret. */
+export function credentialIsMasked(value: string): boolean {
+	return value === "••••" || value === "Bearer ••••";
+}
+
 /** Copy of a rendered request with credentials masked (for previews/logs). */
 export function redact(req: WakeRequest): WakeRequest {
 	const h: Record<string, string> = {};
 	for (const [k, v] of Object.entries(req.headers))
-		h[k] = previewHeaderPlain(k) ? v : v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…");
+		h[k] = previewHeaderPlain(k) ? v : maskedCredential(v);
 	let url = req.url;
 	try { const u = new URL(req.url); url = `${u.protocol}//${u.host}${u.pathname.replace(/\/[^/]{16,}/g, "/…")}`; } catch { /* keep */ }
 	return { ...req, url, headers: h };

package/worker/test/alarms.test.ts

@@ -41,6 +41,23 @@ test("nextCronAt is the earliest wake, rate row, or expiry", async () => {
 	assert.equal(await nextCronAt(tenant, now), now + 801);
 });
 
+test("zero and an unset generic cap stay unlimited; an unset Claude cap is 25", async () => {
+	const now = 1_700_000_000_000;
+	const hour = Math.floor(now / 3600000);
+	const due = now - 60_000;
+	const open = due + 10_000;
+	async function arm(over: Record<string, string>, count: number) {
+		const { DB, tenant } = ctx(over);
+		await DB.prepare("INSERT INTO wake_budget (hour, count) VALUES (?, ?)").bind(hour, count).run();
+		await DB.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('c', ?, '{}', ?)").bind(due, now).run();
+		return nextCronAt(tenant, now);
+	}
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "" }, 25), (hour + 1) * 3600000);
+});
+
 test("an hourly cap holds an already-due wake until the next hour", async () => {
 	const now = 1_700_000_000_000;
 	const hour = Math.floor(now / 3600000);

package/worker/test/hosted.test.ts

@@ -214,6 +214,10 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	const aliceInbox = await (await call("https://alice.example.com/owner/inbox?all=1", "GET", `Bearer ${tokenA}`)).json() as { text: string }[];
 	assert.equal(aliceInbox.length, 1);
 	assert.match(aliceInbox[0]!.text, /hello alice/);
+	const aliceSummary = await (await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA}`)).json() as { tasks: { submitted: number }; pairingPending: number };
+	assert.equal(aliceSummary.tasks.submitted, 1);
+	assert.equal(aliceSummary.pairingPending, 0);
+	assert.equal(JSON.stringify(aliceSummary).includes("hello alice"), false);
 
 	// workerd's local runtime throws "Jurisdiction restrictions are not implemented" on namespace.jurisdiction().
 	// namespaceForRegion() is covered in tenancy.test.ts; production Durable Objects do honour eu / fedramp.
@@ -500,7 +504,7 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
 	const hash = await sha256("owner-carol");
 	type OwnerStub = {
-		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown }): Promise<{ status: number; body: unknown }>;
+		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown; actor?: string }): Promise<{ status: number; body: unknown }>;
 		storageStatus(): Promise<{ configured: boolean; tables: string[] }>;
 		pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }>;
 	};
@@ -521,6 +525,14 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 		}
 		return true;
 	};
+	const sawAfter = async (from: number, part: string) => {
+		const start = Date.now();
+		while (!lines.slice(from).some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
 	const empty = ns.get(ns.idFromName("id-empty")) as unknown as OwnerStub;
 	const missing = await empty.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(missing.status, 404);
@@ -542,6 +554,18 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	assert.equal((await http("POST", "/owner/peers", "Bearer platform-owner", { label: "nope" })).status, 401, "self-host owner token still does not unlock a tenant");
 	const issued = await (await http("POST", "/owner/peers", "Bearer owner-carol", { label: "ada" })).json() as { token?: string };
 	assert.match(issued.token ?? "", /^a2aow_/, "the owner HTTP API still returns the new token");
+	const sentCarol = await http("POST", "/", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-carol", parts: [{ kind: "text", text: "hello from carol peer" }] } },
+	});
+	assert.equal(sentCarol.status, 200, await sentCarol.clone().text());
+	const summary = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/summary" });
+	assert.equal(summary.status, 200);
+	const summaryBody = summary.body as { tasks?: { submitted?: number }; pairingPending?: number };
+	assert.equal(summaryBody.tasks?.submitted, 1);
+	assert.equal(summaryBody.pairingPending, 0);
+	assert.equal(JSON.stringify(summary.body).includes("hello from carol peer"), false);
+	assert.equal(await saw('"route":"GET /owner/summary"'), true);
 
 	const listed = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(listed.status, 200);
@@ -597,11 +621,85 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	assert.equal(wokenText.includes("platform-secret"), false);
 	const wokenBody = woken.body as { hasKey?: boolean; request?: { headers?: Record<string, string> } };
 	assert.equal(wokenBody.hasKey, true);
-	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer z9Qx…");
+	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer ••••");
+	assert.equal(wokenText.includes("z9Qx"), false);
 	const httpPreview = await (await http("GET", "/owner/wake/preview", "Bearer owner-carol")).json() as { hasKey?: boolean };
 	assert.equal(httpPreview.hasKey, true);
 	assert.equal(JSON.stringify(httpPreview).includes(wakeKey), false);
 
+	const started = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.20" },
+		body: "client_name=Barry+Bot&client_id=barry-alias&agent_card_url=https://barry.example/.well-known/agent-card.json",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	const code = device.user_code ?? "";
+	assert.match(code, /^[BCDFGHJKLMNPQRSTVWXZ]{4}-[2-9]{4}$/);
+	const shapedName = "a2aow_" + "a".repeat(20);
+	const shapedCard = "https://card.example/card.json?t=" + "c".repeat(16);
+	const shapedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.23" },
+		body: `client_name=${encodeURIComponent(shapedName)}&client_id=shaped-alias&agent_card_url=${encodeURIComponent(shapedCard)}`,
+	});
+	assert.equal(shapedStart.status, 200);
+	const shapedList = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(shapedList.status, 200);
+	const shapedText = JSON.stringify(shapedList.body);
+	assert.equal(shapedText.includes(shapedName), false);
+	assert.equal(shapedText.includes("t=" + "c".repeat(16)), false);
+	assert.match(shapedText, /Barry Bot/);
+	const pendingPairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	const pending = (pendingPairing.body as { pending?: { userCode?: string; clientName?: string; clientId?: string; agentCardUrl?: string }[] }).pending ?? [];
+	assert.equal(pending.some((row) => row.userCode === code && row.clientName === "Barry Bot" && row.clientId === "barry-alias" && row.agentCardUrl === "https://barry.example/.well-known/agent-card.json"), true);
+	const refused = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve` });
+	assert.equal(refused.status, 403);
+	const httpSpoof = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-carol", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(httpSpoof.status, 403);
+	const approved = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve`, actor: "human" });
+	assert.equal(approved.status, 200);
+	assert.equal((approved.body as { decision?: string }).decision, "approved");
+	assert.equal(await saw('"event":"pairing_approved"'), true);
+	assert.equal(lines.some((line) => line.includes('"event":"pairing_approved"') && line.includes('"by":"human"')), true);
+
+	const deniedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
+		body: "client_name=Deny+Bot&client_id=deny-alias",
+	});
+	const deniedDevice = await deniedStart.json() as { user_code?: string };
+	assert.equal(deniedStart.status, 200);
+	const ownerDenyAt = lines.length;
+	const ownerDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${deniedDevice.user_code}/deny` });
+	assert.equal(ownerDenied.status, 200);
+	assert.equal(await saw('"event":"pairing_denied"'), true);
+	const ownerDenyLine = lines.slice(ownerDenyAt).find((line) => line.includes('"event":"pairing_denied"')) ?? "";
+	assert.match(ownerDenyLine, /"by":"owner"/);
+	assert.equal(ownerDenyLine.includes('"by":"human"'), false);
+
+	const humanDenyStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.22" },
+		body: "client_name=Human+Deny&client_id=human-deny",
+	});
+	const humanDenyDevice = await humanDenyStart.json() as { user_code?: string };
+	assert.equal(humanDenyStart.status, 200);
+	const humanDenyAt = lines.length;
+	const humanDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${humanDenyDevice.user_code}/deny`, actor: "human" });
+	assert.equal(humanDenied.status, 200);
+	assert.equal(await sawAfter(humanDenyAt, '"by":"human"'), true);
+	assert.equal(lines.slice(humanDenyAt).some((line) => line.includes('"event":"pairing_denied"') && line.includes('"by":"human"')), true);
+
+	const flagged = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", actor: "human" });
+	assert.equal(flagged.status, 400);
+	const badActor = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/WDJB-4827/approve", actor: "agent" });
+	assert.equal(badActor.status, 400);
+	assert.equal(await saw('"reason":"actor"'), true);
+
 	await stub.pushConfig({ version: 3, tenantId: "id-carol", name: "carol", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Carol" } });
 	const suspended = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(suspended.status, 403);

package/worker/test/owner-rpc.test.ts

@@ -1,7 +1,7 @@
 // Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks } from "../src/owner-rpc.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims } from "../src/owner-rpc.ts";
 
 test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
 	const ok = (method: string, path: string, query?: Record<string, string>) => {
@@ -10,6 +10,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 		return m.ok ? m.route : null;
 	};
 	assert.equal(ok("GET", "/owner/inbox")?.name, "GET /owner/inbox");
+	assert.equal(ok("GET", "/owner/summary")?.name, "GET /owner/summary");
 	assert.equal(ok("GET", "/owner/inbox", { context: "ctx-1", all: "1" })?.search, "?context=ctx-1&all=1");
 	assert.equal(ok("GET", "/owner/tasks/task-1")?.path, "/owner/tasks/task-1");
 	assert.equal(ok("GET", "/owner/history/ctx-1", { n: "50" })?.search, "?n=50");
@@ -43,6 +44,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.deepEqual(refused("GET", "/owner/inbox?all=1"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/pairing/AEIO-4827/approve"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/inbox", { format: "sql" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/summary", { all: "1" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("GET", "/owner/history/ctx-1", { n: "1001" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("GET", "/owner/history/.."), { ok: false, reason: "path" });
 	assert.equal(accountIdOf("acct_carol"), "acct_carol");
@@ -60,13 +62,46 @@ test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	assert.equal(ownerResponseLeaks({ clientSecret: "tenant-secret-value" }), true);
 	assert.equal(ownerResponseLeaks({ secretsEnc: "v1.ciphertext-value" }), true);
 	assert.equal(ownerResponseLeaks("https://user:pass@hooks.example/wake"), true);
-	assert.equal(ownerResponseLeaks({ authorization: "Bearer abcd…" }), false);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer abcd…" } }), true);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer ••••" } }), false);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { "x-credential": "••••" } }), false);
 	assert.equal(ownerResponseLeaks({
 		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supersecretvalue", "content-type": "application/json" }, body: "{}" },
 	}), true);
 	assert.equal(ownerResponseLeaks({
-		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supe…", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "Bearer ••••", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
 	}), false);
 	assert.equal(ownerResponseLeaks({ fingerprints: { url: "0123456789ab", key: null } }), false);
 	assert.equal(ownerResponseLeaks({ token_hash: "ab".repeat(32) }), false);
+});
+
+test("a token-shaped claim is blanked and the rest of the list is returned", () => {
+	const token = "a2aow_" + "a".repeat(20);
+	const setup = "https://card.example/card.json?t=" + "c".repeat(16);
+	const userinfo = "https://user:secret@card.example/card.json";
+	const raw = {
+		pending: [
+			{ userCode: "WDJB-4827", clientName: token, clientId: "barry-alias", agentCardUrl: setup },
+			{ userCode: "BCDF-2345", clientName: "Barry Bot", clientId: token, agentCardUrl: "https://barry.example/card.json" },
+			{ client_name: token, agent_card_url: userinfo },
+		],
+		token,
+	};
+	assert.equal(ownerResponseLeaks(raw), true);
+	const scrubbed = scrubOwnerClaims(raw) as { pending: { clientName: string; clientId: string; agentCardUrl: string; client_name?: string; agent_card_url?: string }[]; token: string };
+	assert.equal(scrubbed.pending[0]!.clientName, "");
+	assert.equal(scrubbed.pending[0]!.clientId, "barry-alias");
+	assert.equal(scrubbed.pending[0]!.agentCardUrl, "");
+	assert.equal(scrubbed.pending[1]!.clientName, "Barry Bot");
+	assert.equal(scrubbed.pending[1]!.clientId, "");
+	assert.equal(scrubbed.pending[1]!.agentCardUrl, "https://barry.example/card.json");
+	assert.equal(scrubbed.pending[2]!.client_name, "");
+	assert.equal(scrubbed.pending[2]!.agent_card_url, "");
+	assert.equal(scrubbed.token, token);
+	assert.equal(ownerResponseLeaks(scrubbed), true, "a real token under another key is still withheld");
+	const listed = scrubOwnerClaims({ pending: raw.pending });
+	assert.equal(ownerResponseLeaks(listed), false);
+	assert.equal(JSON.stringify(listed).includes(token), false);
+	assert.equal(JSON.stringify(listed).includes("t=" + "c".repeat(16)), false);
+	assert.equal(JSON.stringify(listed).includes("user:secret"), false);
 });

package/worker/test/pairing.test.ts

@@ -3,6 +3,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import worker from "../src/index.ts";
+import { DASHBOARD_ACTOR_HEADER } from "../src/owner-rpc.ts";
 import * as P from "../src/pairing.ts";
 import { wakeSummary, renderWake, type WakeEvent } from "../src/wake.ts";
 import { d1 } from "./d1.ts";
@@ -221,10 +222,13 @@ test("human approval: pending, slow_down, page approve with the password, single
 	advance(16);
 	assert.equal((await s.poll(d.device_code)).data.error, "authorization_pending");
 
-	// human mode: the owner API (the agent) cannot approve
+	// human mode: the owner API (the agent) cannot approve, and the dashboard header does not change that
 	const oa = await s.owner("POST", `/owner/pairing/${d.user_code}/approve`);
 	assert.equal(oa.status, 403);
 	assert.match(oa.data.error, /approval mode is human: the owner approves on https:\/\/agent\.example\.com\/device\?user_code=/);
+	const spoofed = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
+	assert.equal(spoofed.status, 403);
+	assert.match(spoofed.data.error, /approval mode is human/);
 	const list = await s.owner("GET", "/owner/pairing");
 	assert.deepEqual([list.data.mode, list.data.passwordSet, list.data.pending.length, list.data.pending[0].userCode], ["human", false, 1, d.user_code]);
 
@@ -289,10 +293,19 @@ test("human approval: pending, slow_down, page approve with the password, single
 });
 
 test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => { lines.push(args.map((part) => String(part)).join(" ")); orig(...args); };
+	t.after(() => { console.log = orig; });
 	const s = setup({ PAIRING_APPROVAL: "agent" }); t.after(s.restore);
 	const first = (await s.start({ client_name: "tester-alpha", client_id: "other-alias" }, "203.0.113.40")).data;
-	const approved = await s.owner("POST", `/owner/pairing/${first.user_code}/approve`);
+	const approved = await s.call("POST", `/owner/pairing/${first.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
 	assert.equal(approved.data.label, "tester-alpha");
+	const decided = s.DB.db.prepare("SELECT decided_by FROM device_requests WHERE user_code = ?").get(first.user_code.replace("-", "")) as { decided_by: string };
+	assert.equal(decided.decided_by, "agent");
+	const logged = lines.find((line) => line.includes("pairing_approved"));
+	assert.match(logged ?? "", /"by":"agent"/);
+	assert.equal((logged ?? "").includes('"by":"human"'), false);
 	const token = (await s.poll(first.device_code)).data.access_token;
 	const sent = await s.call("POST", "/", {
 		json: { jsonrpc: "2.0", id: 1, method: "SendMessage", params: { message: { role: "ROLE_USER", parts: [{ text: "hello" }] } } },
@@ -681,3 +694,31 @@ test("GET / with pairing off: no /device link, says to ask the operator", async
 	assert.match(h.text, /ask this agent's operator for a bearer token/);
 	assert.equal((await s.call("GET", "/")).data.pairing, undefined);
 });
+
+test("owner summary counts tasks and pending pairing requests without their text", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const started = await s.start();
+	assert.equal(started.status, 200);
+	const issued = await s.owner("POST", "/owner/peers", { label: "ada" });
+	assert.match(issued.data.token, /^a2aow_/);
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m1", parts: [{ kind: "text", text: "secret plan from ada" }] } } },
+		headers: { authorization: `Bearer ${issued.data.token}` },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const taskId = sent.data.result.id;
+	const pending = JSON.stringify({ taskIds: [taskId] });
+	const now = Date.now();
+	s.DB.db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)").run("ctx-keep", now, pending, now);
+	const summary = await s.owner("GET", "/owner/summary");
+	assert.equal(summary.status, 200);
+	assert.equal(summary.data.tasks.submitted, 1);
+	assert.equal(summary.data.tasks.working, 0);
+	assert.equal(summary.data.pairingPending, 1);
+	const text = JSON.stringify(summary.data);
+	assert.equal(text.includes("secret plan"), false);
+	assert.equal(text.includes(started.data.user_code), false);
+	assert.equal(text.includes(started.data.device_code), false);
+	assert.equal(text.includes(taskId), false);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
+});

package/worker/test/wake-target.test.ts

@@ -2,13 +2,17 @@
 // Unset keeps today's fetch. Run: npm test
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import net from "node:net";
+import { Duplex } from "node:stream";
 import worker from "../src/index.ts";
 import { d1 } from "./d1.ts";
 import * as M from "../src/mcp.ts";
-import { fetchCheckedWake, publicWakeProblem, type AddressLookup, type WakeDeps } from "../src/wake-target.ts";
+import { dialChecked, fetchCheckedWake, publicWakeProblem, wakeNet, type AddressLookup, type CheckedDeliver, type WakeConnect } from "../src/wake-target.ts";
 
 const publicLookup: AddressLookup = async (host) => {
 	if (host === "hook.example" || host === "also.example") return ["1.2.3.4"];
+	if (host === "round.example") return ["1.2.3.4", "1.2.3.5"];
+	if (host === "v6.example") return ["2606:4700:4700::1111"];
 	if (host === "split.example") return ["1.2.3.4", "10.0.0.1"];
 	if (host === "meta.example") return ["169.254.169.254"];
 	if (host === "missing.example") return [];
@@ -46,65 +50,155 @@ test("public-https refuses private, metadata, and non-https URLs before any requ
 	assert.equal(await publicWakeProblem("https://unknown.example/wake", publicLookup), "its address could not be checked");
 });
 
-function pinned(answer: (request: string) => { status: number; location?: string }) {
-	const calls: { ip: string; sni: string; request: string }[] = [];
-	const connect: NonNullable<WakeDeps["connect"]> = (addr) => ({
-		startTls: ({ expectedServerHostname: sni }) => {
-			let req = "";
-			let respond!: (bytes: Uint8Array) => void;
-			const ready = new Promise<Uint8Array>((resolve) => { respond = resolve; });
-			const writable = new WritableStream<Uint8Array>({
-				write(chunk) {
-					req += new TextDecoder().decode(chunk);
-					if (!req.includes("\r\n\r\n")) return;
-					calls.push({ ip: addr.hostname, sni, request: req });
-					const made = answer(req);
-					const headers = [`HTTP/1.1 ${made.status} X`, "content-length: 0"];
-					if (made.location) headers.push(`location: ${made.location}`);
-					headers.push("connection: close", "", "");
-					respond(new TextEncoder().encode(headers.join("\r\n")));
-				},
-			});
-			const readable = new ReadableStream<Uint8Array>({
-				async start(controller) {
-					controller.enqueue(await ready);
-					controller.close();
-				},
-			});
-			return { readable, writable, close: async () => {} };
-		},
-	});
-	return { connect, calls };
+function recorded(answer: (call: { url: string }) => { status: number; location?: string }) {
+	const calls: { url: string; ip: string; hostname: string; authorization: string; body: string; redirect: string }[] = [];
+	const deliver: CheckedDeliver = async (url, init, target) => {
+		const headers = new Headers(init.headers);
+		const call = {
+			url,
+			ip: target.ip,
+			hostname: target.hostname,
+			authorization: headers.get("authorization") ?? "",
+			body: typeof init.body === "string" ? init.body : init.body instanceof Uint8Array ? new TextDecoder().decode(init.body) : "",
+			redirect: init.redirect ?? "",
+		};
+		calls.push(call);
+		const made = answer(call);
+		return new Response(null, { status: made.status, headers: made.location ? { location: made.location } : {} });
+	};
+	return { deliver, calls };
+}
+
+test("the dial uses the checked address and leaves TLS to name the host", () => {
+	const seen: { hostname: string; secure?: string }[] = [];
+	const base: WakeConnect = (addr, options) => {
+		seen.push({ hostname: addr.hostname, secure: options?.secureTransport });
+		return { readable: new ReadableStream(), writable: new WritableStream(), async close() {} };
+	};
+	dialChecked("1.2.3.4", base)({ hostname: "hook.example", port: 443 }, { secureTransport: "on" });
+	assert.deepEqual(seen, [{ hostname: "1.2.3.4", secure: "off" }]);
+});
+
+/** Server names from a TLS ClientHello. Empty when the bytes are not one. */
+function clientHelloNames(buf: Buffer): string[] {
+	if (buf.length < 5 || buf[0] !== 0x16) return [];
+	const recordLen = buf.readUInt16BE(3);
+	if (buf.length < 5 + recordLen) return [];
+	const hs = buf.subarray(5, 5 + recordLen);
+	if (hs.length < 4 || hs[0] !== 1) return [];
+	let i = 4 + 2 + 32;
+	if (i >= hs.length) return [];
+	const sidLen = hs[i]!;
+	i += 1 + sidLen;
+	if (i + 2 > hs.length) return [];
+	const csLen = hs.readUInt16BE(i);
+	i += 2 + csLen;
+	if (i >= hs.length) return [];
+	const compLen = hs[i]!;
+	i += 1 + compLen;
+	if (i + 2 > hs.length) return [];
+	const extEnd = i + 2 + hs.readUInt16BE(i);
+	i += 2;
+	const names: string[] = [];
+	while (i + 4 <= extEnd && i + 4 <= hs.length) {
+		const type = hs.readUInt16BE(i);
+		const len = hs.readUInt16BE(i + 2);
+		i += 4;
+		if (i + len > hs.length) break;
+		if (type === 0 && len >= 2) {
+			const list = hs.subarray(i, i + len);
+			let j = 2;
+			while (j + 3 <= list.length) {
+				const nameType = list[j]!;
+				const nlen = list.readUInt16BE(j + 1);
+				j += 3;
+				if (j + nlen > list.length) break;
+				if (nameType === 0) names.push(list.subarray(j, j + nlen).toString());
+				j += nlen;
+			}
+		}
+		i += len;
+	}
+	return names;
 }
 
-test("a redirect to a private address is not connected, and the first hop uses the checked IP", async () => {
-	const socket = pinned(() => ({ status: 302, location: "http://169.254.169.254/latest/meta-data" }));
-	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, connect: socket.connect });
-	assert.equal(socket.calls.length, 1);
-	assert.equal(socket.calls[0].ip, "1.2.3.4");
-	assert.equal(socket.calls[0].sni, "hook.example");
-	assert.match(socket.calls[0].request, /^POST \/wake HTTP\/1\.1/);
-	assert.match(socket.calls[0].request, /authorization: Bearer secret/i);
+test("delivery sends the hostname in the ClientHello on a socket to the checked address", async () => {
+	const chunks: Buffer[] = [];
+	const server = net.createServer((socket) => {
+		socket.on("data", (data) => {
+			chunks.push(data);
+			const hello = Buffer.concat(chunks);
+			if (hello.length >= 5 && hello[0] === 0x16 && hello.length >= 5 + hello.readUInt16BE(3)) socket.destroy();
+		});
+	});
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("no port");
+	const dialed: { hostname: string; secure?: string }[] = [];
+	const connect: WakeConnect = (addr, options) => {
+		dialed.push({ hostname: addr.hostname, secure: options?.secureTransport });
+		const socket = net.connect({ host: "127.0.0.1", port: address.port });
+		const web = Duplex.toWeb(socket);
+		return {
+			readable: web.readable,
+			writable: web.writable,
+			opened: new Promise((resolve, reject) => {
+				socket.once("connect", () => resolve({ remoteAddress: "127.0.0.1" }));
+				socket.once("error", reject);
+			}),
+			async close() { socket.destroy(); },
+		};
+	};
+	try {
+		await assert.rejects(
+			() => fetchCheckedWake("https://hook.example/wake", {
+				method: "POST",
+				headers: { authorization: "Bearer secret" },
+				body: "{}",
+			}, { lookup: publicLookup, connect }),
+			(err: unknown) => err instanceof Error && err.message === "TLS Handshake Failed.",
+		);
+	} finally {
+		server.close();
+	}
+	const wire = Buffer.concat(chunks);
+	assert.deepEqual(dialed, [{ hostname: "1.2.3.4", secure: "off" }]);
+	assert.deepEqual(clientHelloNames(wire), ["hook.example"]);
+	assert.equal(wire.includes(Buffer.from("POST /wake")), false);
+	assert.equal(wire.includes(Buffer.from("secret")), false);
+});
+
+test("a redirect to a private address is not requested, and the first hop is pinned to the checked address", async () => {
+	const hop = recorded(() => ({ status: 302, location: "http://169.254.169.254/latest/meta-data" }));
+	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, deliver: hop.deliver });
+	assert.equal(hop.calls.length, 1);
+	assert.equal(hop.calls[0].url, "https://hook.example/wake");
+	assert.equal(hop.calls[0].ip, "1.2.3.4");
+	assert.equal(hop.calls[0].hostname, "hook.example");
+	assert.equal(hop.calls[0].redirect, "manual");
+	assert.equal(hop.calls[0].authorization, "Bearer secret");
 	assert.equal("refused" in result && result.refused, "must be https");
 });
 
 test("a cross-origin redirect is not followed, so credentials stay on the first host", async () => {
-	const socket = pinned(() => ({ status: 307, location: "https://also.example/wake" }));
-	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, connect: socket.connect });
-	assert.equal(socket.calls.length, 1);
-	assert.equal(socket.calls[0].ip, "1.2.3.4");
+	const hop = recorded(() => ({ status: 307, location: "https://also.example/wake" }));
+	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, deliver: hop.deliver });
+	assert.equal(hop.calls.length, 1);
+	assert.equal(hop.calls[0].ip, "1.2.3.4");
 	assert.equal("refused" in result && result.refused, "cross-origin redirect");
 });
 
-test("a same-origin redirect is pinned again and keeps the wake headers", async () => {
-	const socket = pinned((request) => request.startsWith("POST /wake ")
+test("a same-origin redirect is checked again and keeps the wake headers", async () => {
+	const hop = recorded((call) => call.url.endsWith("/wake")
 		? { status: 307, location: "https://hook.example/next" }
 		: { status: 200 });
-	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, connect: socket.connect });
-	assert.equal(socket.calls.length, 2);
-	assert.deepEqual(socket.calls.map((call) => call.ip), ["1.2.3.4", "1.2.3.4"]);
-	assert.match(socket.calls[1].request, /^POST \/next HTTP\/1\.1/);
-	assert.match(socket.calls[1].request, /authorization: Bearer secret/i);
+	const result = await fetchCheckedWake("https://hook.example/wake", { method: "POST", headers: { authorization: "Bearer secret" }, body: "{}" }, { lookup: publicLookup, deliver: hop.deliver });
+	assert.deepEqual(hop.calls.map((call) => [call.url, call.ip]), [
+		["https://hook.example/wake", "1.2.3.4"],
+		["https://hook.example/next", "1.2.3.4"],
+	]);
+	assert.equal(hop.calls[1].authorization, "Bearer secret");
+	assert.equal(hop.calls[1].body, "{}");
 	assert.equal("response" in result && result.response.status, 200);
 });
 
@@ -168,20 +262,33 @@ test("public-https does not request a metadata address, and does post to a check
 	assert.equal(requested.some((url) => url.includes("169.254.169.254")), false);
 
 	requested.length = 0;
-	const socket = pinned(() => ({ status: 200 }));
-	M.net.connect = socket.connect;
+	const hop = recorded(() => ({ status: 200 }));
+	// The runtime startTls pin sends no SNI. Delivery must dial the checked IP and name the host itself.
+	M.net.connect = () => { throw new Error("wake delivery must not use startTls on the resolved IP"); };
+	wakeNet.deliver = hop.deliver;
 	try {
 		const allowed = await wakeTest({
 			DB: db(), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", WAKE_PRESET: "generic",
 			WAKE_WEBHOOK_URL: "https://hook.example/wake", WAKE_WEBHOOK_KEY: "hook-key", WAKE_TARGET_POLICY: "public-https",
 		}, fetchImpl);
 		assert.equal(allowed.status, 200);
-		assert.equal(requested.every((url) => url.startsWith("https://cloudflare-dns.com/")), true);
-		assert.equal(socket.calls.length, 1);
-		assert.equal(socket.calls[0].ip, "1.2.3.4");
-		assert.equal(socket.calls[0].sni, "hook.example");
-		assert.match(socket.calls[0].request, /authorization: Bearer hook-key/i);
+		assert.equal(hop.calls.length, 1);
+		assert.equal(hop.calls[0].ip, "1.2.3.4");
+		assert.equal(hop.calls[0].hostname, "hook.example");
+		assert.equal(hop.calls[0].authorization, "Bearer hook-key");
+		assert.equal(requested.some((url) => new URL(url).hostname === "hook.example"), false);
+		assert.equal(requested.some((url) => url.startsWith("https://cloudflare-dns.com/dns-query")), true);
 	} finally {
 		M.net.connect = null;
+		wakeNet.deliver = null;
 	}
+
+	wakeNet.deliver = async () => { throw new Error("TLS Handshake Failed."); };
+	const tls = await wakeTest({
+		DB: db(), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", WAKE_PRESET: "generic",
+		WAKE_WEBHOOK_URL: "https://hook.example/wake", WAKE_WEBHOOK_KEY: "hook-key", WAKE_TARGET_POLICY: "public-https",
+	}, fetchImpl);
+	wakeNet.deliver = null;
+	assert.equal(tls.status, null);
+	assert.equal(tls.info, "Error: TLS Handshake Failed.");
 });

package/worker/test/wake.test.ts

@@ -120,14 +120,15 @@ test("a key header the preview shows in full is not used for the key", async ()
 	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "Content-Type", keyPrefix: "" }, ev))!;
 	assert.equal(req.headers["authorization"], "supersecretvalue");
 	assert.equal(req.headers["content-type"], "application/json");
-	assert.equal(redact(req).headers["authorization"], "supe…");
+	assert.equal(redact(req).headers["authorization"], "••••");
+	assert.equal(JSON.stringify(redact(req)).includes("supe"), false);
 });
 
 test("generic key header is redacted even when its name is not a secret word", async () => {
 	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "X-Credential", keyPrefix: "" }, ev))!;
 	assert.equal(req.headers["x-credential"], "supersecretvalue");
 	const red = redact(req);
-	assert.equal(red.headers["x-credential"], "supe…");
+	assert.equal(red.headers["x-credential"], "••••");
 	assert.equal(red.headers["content-type"], "application/json");
 	assert.ok(!JSON.stringify(red).includes("supersecretvalue"));
 });
@@ -160,8 +161,9 @@ test("hermes HMAC is computed over the body only, unaffected by Access headers",
 
 test("redact masks both Access headers", async () => {
 	const r = redact((await renderWake({ preset: "openclaw-wake", url: "https://wake-x.example.com/hooks/wake", key: "hooks-token", ...ACCESS }, ev))!);
-	assert.equal(r.headers["CF-Access-Client-Id"], "abc1…");
-	assert.equal(r.headers["CF-Access-Client-Secret"], "s3cr…");
+	assert.equal(r.headers["CF-Access-Client-Id"], "••••");
+	assert.equal(r.headers["CF-Access-Client-Secret"], "••••");
+	assert.equal(r.headers["authorization"], "Bearer ••••");
 	assert.ok(!JSON.stringify(r).includes("s3cr3t-value"));
 });