a2a-exposed 0.7.12 → 0.7.14

package/lib/main.mjs

@@ -68,8 +68,11 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
   wake set [--preset P] [--agent-id A] [--key-header H] [--key-prefix X] [--body-template JSON]
            [--cli-command CMD] [--debounce S] [--max-per-hour N]
                                 save wake settings, upload wake secrets from env, and redeploy (one step)
-  wake preview                  rendered wake request (partially masked) + sha256 fingerprints of the
-                                uploaded URL/key/HMAC secret; compared with local env values if exported
+                                --max-per-hour  hourly cap; 0 or unset is unlimited, except Claude Code,
+                                               which defaults to 25 when this is unset
+  wake preview                  rendered wake request (a credential is Bearer •••• or ••••, none of the secret)
+                                + sha256 fingerprints of the uploaded URL/key/HMAC secret; compared with
+                                local env values if exported
   wake fingerprint              fingerprints (first 12 hex of sha256) of WAKE_* in the local environment
   wake test                     send a test wake now and print the HTTP status
   wake unset                    remove wake secrets (fall back to polling)
@@ -179,8 +182,17 @@ Control plane account (only when that deployment's login is on)
                                 browser can follow the redirect. Buttons say Continue with that
                                 provider. Until the check finishes they stay muted and the page says
                                 Waiting for the check…. A reused token says The check expired. Please try again.
-                                After sign-in, /app shows the account and its agents. Sign out is on that
-                                page. Creating an agent shows the owner token once. That page is not stored.
+                                After sign-in, /app shows the account and its agents. Each name opens
+                                that agent's page: MCP connectors (revoke needs a recent sign-in), a
+                                message log that does not mark tasks seen, and a SQL download that
+                                replaces a pasted owner token and leaves other credential material out. Peer times are labeled UTC. A pairing
+                                token shows its code. An empty outbound list notes that peers the CLI
+                                added locally are not shown. Sign out is on that
+                                page. Creating an agent shows the owner token once. The agent page rotates
+                                that token after a confirmation and a recent sign-in. The new token is
+                                shown once on that agent's page. The previous one stops working immediately.
+                                The token is shown only when the stored hash is still that token.
+                                That page is not stored.
                                 FREE_AGENT_LIMIT=2 caps a free account at 2 agents. An account's own limit overrides it.
                                 Unset, there is no limit. The database rejects another insert.
                                 SIGNUP_ALLOWLIST, when set, admits only those verified emails. Unset, sign-in stays open.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.12",
+	"version": "0.7.14",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -49,7 +49,7 @@ const plain: Record<string, string> = {
 	// Hosted multi-tenant gates. All empty by default, and empty is omitted, so a self-host deploy is unchanged.
 	// TENANCY=host switches the entrypoint to src/hosted.ts and adds TENANT_DO + TENANT_DIRECTORY below.
 	// QUOTAS, USAGE_SINK, SIGNUP_URL and BRANDING are parsed and reserved.
-	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https (see wake-target.ts).
+	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https. The socket opens to an address from that check, and TLS names the hostname (see wake-target.ts).
 	// APPROVAL_OIDC_* turn on OpenID Connect approval when issuer, client id, secret and allowlist are all set.
 	TENANCY: v("TENANCY"),
 	TENANT_DOMAIN: v("TENANT_DOMAIN"),

package/worker/package.json

@@ -20,5 +20,8 @@
 		"miniflare": "^5.20261006.0-alpha",
 		"typescript": "^7.0.2",
 		"vite": "^8.3.0"
+	},
+	"dependencies": {
+		"tunnelfetch": "1.13.0"
 	}
 }

package/worker/src/export.ts

@@ -92,15 +92,80 @@ export async function exportRows(db: SqlDb, now = new Date()): Promise<ExportFil
 	return { format: "a2a-exposed-export", version: 1, exportedAt: now.toISOString(), tables };
 }
 
-/** DELETE then INSERT for every allowlisted table. Safe to run on a database that already has the schema. */
-export function toSql(file: ExportFile): string {
+/** Live-credential tables. A dashboard SQL copy skips them so the script does not delete rows it does not return. */
+export const REDACTED_SQL_SKIP = ["oauth_codes", "oidc_txns"] as const;
+
+const OMIT_COLUMNS: Record<string, readonly string[]> = {
+	tasks: ["push_configs_json"],
+	outbound: ["push_token_hash"],
+	mcp_grants: ["access_hash", "refresh_hash"],
+	outbound_peers: ["token_enc"],
+	device_requests: ["replaces_hash"],
+};
+
+const SETUP_SUB = /([?&])t=[A-Za-z0-9_-]{16,}/g;
+const USERINFO_SUB = /([a-z][a-z0-9+.-]*:\/\/)[^/?\s]*@/gi;
+
+/** Replace a peer token, a hosted owner token (`a2aot_`), a setup secret, or URL userinfo. The rest of the text stays. */
+export function scrubSecretText(value: string): string {
+	const tokens = /(?:a2aow_|s2a_|a2amcp_|a2amcpr_|a2aot_)[A-Za-z0-9_-]{20,}/g;
+	return value.replace(tokens, "[redacted]").replace(SETUP_SUB, "$1t=[redacted]").replace(USERINFO_SUB, "$1[redacted]@");
+}
+
+function placeholder(table: string, row: Record<string, unknown>, index: number): string {
+	const label = table === "peers" ? row.label : row.user_code;
+	const suffix = typeof label === "string" && label ? label : String(index);
+	return `redacted:${suffix}`;
+}
+
+/**
+ * A copy of `file` safe to show on the dashboard.
+ * Nullable credential columns are removed, including `device_requests.replaces_hash` (the hash of the token a re-pair would replace).
+ * `peers.token_hash` and `device_requests.device_hash` are NOT NULL, so they become `redacted:…` (not the hash, and not a token that authenticates).
+ * `oauth_codes` and `oidc_txns` are emptied. The approval-password row and the password-setup row (its value is the hash of the live setup token) are removed.
+ * Token-shaped text, including a hosted owner token (`a2aot_`), is scrubbed. The input is not changed: the CLI dump stays complete.
+ */
+export function redactExport(file: ExportFile): ExportFile {
+	if (file.format !== "a2a-exposed-export" || file.version !== 1) throw new ExportError("export: bad file");
+	if (!/^[\dTZ:.-]+$/.test(file.exportedAt)) throw new ExportError("export: bad timestamp");
+	const tables: ExportFile["tables"] = {};
+	for (const name of EXPORT_TABLES) {
+		if ((REDACTED_SQL_SKIP as readonly string[]).includes(name)) {
+			tables[name] = [];
+			continue;
+		}
+		const omit = new Set(OMIT_COLUMNS[name] ?? []);
+		const rows: Record<string, unknown>[] = [];
+		for (const [index, row] of (file.tables[name] ?? []).entries()) {
+			if (name === "settings" && (row.key === "approval_password" || row.key === "password_setup")) continue;
+			const out: Record<string, unknown> = {};
+			for (const [key, value] of Object.entries(row)) {
+				if (omit.has(key) || key.toLowerCase() === "replaces_hash") continue;
+				if ((name === "peers" && key === "token_hash") || (name === "device_requests" && key === "device_hash")) {
+					out[key] = placeholder(name, row, index);
+					continue;
+				}
+				out[key] = typeof value === "string" ? scrubSecretText(value) : value;
+			}
+			delete out.replaces_hash;
+			rows.push(out);
+		}
+		tables[name] = rows;
+	}
+	return { format: "a2a-exposed-export", version: 1, exportedAt: file.exportedAt, tables };
+}
+
+/** DELETE then INSERT for every allowlisted table. Safe to run on a database that already has the schema. `skip` leaves those tables out of the script. */
+export function toSql(file: ExportFile, options?: { skip?: readonly string[] }): string {
 	if (file.format !== "a2a-exposed-export" || file.version !== 1) throw new ExportError("export: bad file");
 	if (!/^[\dTZ:.-]+$/.test(file.exportedAt)) throw new ExportError("export: bad timestamp");
+	const skip = new Set(options?.skip ?? []);
 	const lines = [
 		`-- a2a-exposed-export ${file.version}`,
 		`-- exported_at ${file.exportedAt}`,
 	];
 	for (const name of EXPORT_TABLES) {
+		if (skip.has(name)) continue;
 		lines.push(`DELETE FROM ${quoteIdent(name)};`);
 		for (const row of file.tables[name] ?? []) {
 			const cols = Object.keys(row);

package/worker/src/index.ts

@@ -10,9 +10,9 @@ import { renderWake, redact, cloudflareErrorHint, defaultDebounceSeconds, defaul
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
+import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
-import { exportRows, toSql } from "./export.ts";
+import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
 import * as O from "./approval-oidc.ts";
 type Json = any;
@@ -83,7 +83,17 @@ function wakeConfig(ctx: TenantContext): WakeConfig {
 }
 
 const debounceMs = (ctx: TenantContext) => Number(ctx.WAKE_DEBOUNCE_SECONDS || defaultDebounceSeconds(preset(ctx))) * 1000;
-const maxPerHour = (ctx: TenantContext) => Number(ctx.WAKE_MAX_PER_HOUR || defaultMaxPerHour(preset(ctx)));
+
+/**
+ * Hourly wake cap. 0 means unlimited, including an explicit "0".
+ * An empty or unset value uses the preset default (unlimited, or 25 for Claude Code).
+ */
+function maxPerHour(ctx: TenantContext): number {
+	const raw = (ctx.WAKE_MAX_PER_HOUR ?? "").trim();
+	const n = raw === "" ? defaultMaxPerHour(preset(ctx)) : Number(raw);
+	if (!Number.isFinite(n) || n <= 0) return 0;
+	return Math.floor(n);
+}
 
 async function wakeBudgetOk(ctx: TenantContext): Promise<boolean> {
 	const cap = maxPerHour(ctx);
@@ -118,7 +128,10 @@ async function sendWake(ctx: TenantContext, ectx: ExecutionContext, payload: Jso
 	try {
 		let r: Response;
 		if (ctx.gates.wakeTargetPolicy === "public-https") {
-			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body });
+			const checked = await fetchCheckedWake(req.url, { method: "POST", headers: req.headers, body: req.body }, {
+				localHost: (() => { try { return new URL(ctx.PUBLIC_URL).host; } catch { return ""; } })(),
+				local: (url, init) => doFetch(ctx, ectx, url, init),
+			});
 			if ("refused" in checked) {
 				log("wake_refused", { preset: preset(ctx), contextId: ev.contextId, reason: checked.refused });
 				return { status: null, info: `refused: ${checked.refused}` };
@@ -906,6 +919,21 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 	const seg = path.split("/").filter(Boolean).slice(1); // after "owner"
 	const body = async () => { const raw = await readBody(req, ctx); return raw ? JSON.parse(raw) : {}; };
 
+	if (seg[0] === "summary" && !seg[1] && m === "GET") {
+		// Counts only. Unlike GET /owner/inbox this does not return message text or clear a pending wake.
+		const known = ["submitted", "working", "input-required", "completed", "failed", "rejected", "canceled"];
+		const tasks: Record<string, number> = {};
+		for (const state of known) tasks[state] = 0;
+		const rows = await ctx.DB.prepare("SELECT state, COUNT(*) AS n FROM tasks GROUP BY state").all();
+		for (const r of rows.results as Json[]) {
+			if (typeof r.state !== "string" || !known.includes(r.state)) continue;
+			const n = Number(r.n);
+			if (Number.isSafeInteger(n) && n >= 0) tasks[r.state] = n;
+		}
+		const pending: Json = await ctx.DB.prepare("SELECT COUNT(*) AS n FROM device_requests WHERE status = 'pending' AND expires_ms > ?").bind(Date.now()).first();
+		const pairing = Number(pending?.n ?? 0);
+		return json({ tasks, pairingPending: Number.isSafeInteger(pairing) && pairing >= 0 ? pairing : 0 });
+	}
 	if (seg[0] === "inbox" && m === "GET") {
 		const contextFilter = url.searchParams.get("context");
 		const all = url.searchParams.get("all") === "1";
@@ -1019,7 +1047,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 			return json({ revoked: true, label });
 		}
 	}
-	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body);
+	if (seg[0] === "pairing") return await ownerPairing(req, ctx, m, seg.slice(1), body, trusted);
 	if (seg[0] === "mcp" && !seg[1] && m === "GET") {
 		const rows = await ctx.DB.prepare("SELECT label, client_id, client_name, redirect_host, scope, created_at, last_used_at, revoked_at, refresh_expires_ms FROM mcp_grants ORDER BY created_at").all();
 		return json({ enabled: mcpOn(ctx), url: oauthUrls(ctx).mcp, grants: (rows.results as Json[]).map((r) => ({ ...r, refresh_expires_ms: undefined,
@@ -1079,7 +1107,7 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		return json({ mode: "proxy", ...(await verifyUpstream(ctx)) });
 	}
 	if (seg[0] === "wake" && seg[1] === "preview" && m === "GET") {
-		// rendered wake request for a sample event, partially masked, plus short sha256 fingerprints of the
+		// rendered wake request for a sample event, credentials shown as Bearer •••• or ••••, plus short sha256 fingerprints of the
 		// uploaded secrets so the owner can compare them with local values without revealing them
 		const ev: WakeEvent = { contextId: "ctx-preview", taskId: "task-preview", taskIds: ["task-preview"], from: "example-peer",
 			preview: "Example message preview", kind: "test", publicUrl: ctx.PUBLIC_URL };
@@ -1118,6 +1146,27 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		const rows = await ctx.DB.prepare("SELECT context_id, COUNT(*) AS entries, MAX(ts) AS last FROM history GROUP BY context_id ORDER BY last DESC LIMIT 100").all();
 		return json(rows.results);
 	}
+	if (seg[0] === "log" && !seg[1] && m === "GET") {
+		// Recent history, newest first. Unlike GET /owner/inbox this does not clear a pending wake, and it does not return data_json.
+		const clip = (v: unknown, max: number) => typeof v === "string" ? scrubSecretText(v).slice(0, max) : null;
+		const rows = await ctx.DB.prepare(
+			"SELECT seq, context_id, ts, dir, peer, task_id, role, state, event, text FROM history ORDER BY seq DESC LIMIT 100",
+		).all();
+		return json({
+			entries: (rows.results as Json[]).map((r) => ({
+				seq: typeof r.seq === "number" ? r.seq : Number(r.seq),
+				contextId: clip(r.context_id, 200),
+				ts: clip(r.ts, 40),
+				dir: clip(r.dir, 16),
+				peer: clip(r.peer, 200),
+				taskId: clip(r.task_id, 200),
+				role: clip(r.role, 32),
+				state: clip(r.state, 32),
+				event: clip(r.event, 64),
+				text: clip(r.text, 2000),
+			})),
+		});
+	}
 	if (seg[0] === "export" && !seg[1] && m === "GET") {
 		const file = await exportRows(ctx.DB);
 		if (url.searchParams.get("format") === "sql") {
@@ -1576,7 +1625,7 @@ async function setupPage(req: Request, ctx: TenantContext, url: URL): Promise<Re
 }
 
 /** Owner API: /owner/pairing (list, mode), /owner/pairing/password (set), /owner/pairing/<code>/approve|deny. */
-async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>): Promise<Response> {
+async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: string[], body: () => Promise<Json>, trusted = false): Promise<Response> {
 	const mode = pairingMode(ctx);
 	if (!seg[0] && m === "GET") {
 		const now = Date.now();
@@ -1627,9 +1676,12 @@ async function ownerPairing(req: Request, ctx: TenantContext, m: string, seg: st
 		const code = P.normUserCode(decodeURIComponent(seg[0]));
 		if (!code) return json({ error: "not a valid code (it looks like WDJB-4827)" }, 400);
 		const approve = seg[1] === "approve";
-		if (approve && mode !== "agent")
+		// The header is set only by runOwnerRpc for actor "human". A network request is not trusted, so the same
+		// header on /owner/* does not approve and does not change who is logged.
+		const dashboardHuman = trusted && req.headers.get(DASHBOARD_ACTOR_HEADER) === "human";
+		if (approve && mode !== "agent" && !dashboardHuman)
 			return json({ error: `approval mode is human: the owner approves on ${oauthUrls(ctx).page}?user_code=${P.formatUserCode(code)} with the approval password. \`pair approve\` works only after \`${cliCommand(ctx)} deploy --pairing-approval agent\`, and only if your human wants the agent to approve. \`pair deny\` works in every mode.` }, 403);
-		const d = await decide(ctx, code, approve, approve ? "agent" : "owner");
+		const d = await decide(ctx, code, approve, dashboardHuman ? "human" : approve ? "agent" : "owner");
 		if (!d.ok) return json({ error: d.error }, 409);
 		return json({ ok: true, decision: approve ? "approved" : "denied", userCode: P.formatUserCode(code), label: d.label || null,
 			clientName: d.request.client_name || d.request.client_id || null, replaced: !!d.replaced });
@@ -2098,13 +2150,21 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
 	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
 	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	const actor = (raw as { actor?: unknown } | null)?.actor;
+	if (actor !== undefined && actor !== "human") return refuse(400, "actor is invalid", "actor");
+	const pairingDecision = matched.route.name === "POST /owner/pairing/:code/approve" || matched.route.name === "POST /owner/pairing/:code/deny";
+	if (actor === "human" && !pairingDecision) return refuse(400, "actor is invalid", "actor");
 	let origin = "https://tenant.invalid";
 	try {
 		const u = new URL(ctx.PUBLIC_URL);
 		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
 	} catch { /* the handler reads the path, not this origin */ }
-	const url = new URL(origin + matched.route.path + matched.route.search);
-	const req = new Request(url, { method: matched.route.method, headers: { "content-type": "application/json" } });
+	// format=sql is text/plain on the HTTP API. The RPC always reads the JSON dump, then redacts, then builds SQL.
+	const search = matched.route.path === "/owner/export" ? "" : matched.route.search;
+	const url = new URL(origin + matched.route.path + search);
+	const headers = new Headers({ "content-type": "application/json" });
+	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
+	const req = new Request(url, { method: matched.route.method, headers });
 	let res: Response;
 	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
 	catch (e: any) {
@@ -2114,7 +2174,22 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
 		return { status, body: { error } };
 	}
-	const data = await res.json().catch(() => null);
+	let data = scrubOwnerClaims(await res.json().catch(() => null));
+	if (matched.route.path === "/owner/export" && res.ok && data && typeof data === "object") {
+		try {
+			const file = redactExport(data as Parameters<typeof redactExport>[0]);
+			data = matched.route.search === "?format=sql"
+				? {
+					exportedAt: file.exportedAt,
+					sql: "-- Dashboard copy. This is not a backup. Do not load it onto a live inbox.\n"
+						+ "-- Stored token hashes are replaced with redacted: values that do not authenticate, or left out. Ciphertext, push tokens, re-pair hashes, OAuth codes, the approval-password hash, password-setup hashes, and OpenID Connect sign-in rows are omitted.\n"
+						+ toSql(file, { skip: REDACTED_SQL_SKIP }),
+				}
+				: file;
+		} catch {
+			return refuse(500, "response withheld", "secret");
+		}
+	}
 	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
 	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
 	return { status: res.status, body: data };

package/worker/src/owner-rpc.ts

@@ -1,10 +1,10 @@
 // Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
 // the account owns the tenant. This list is the only paths that call may run, and it is stricter than
-// the owner HTTP API: routes that mint a peer token, return a setup secret, accept a plaintext peer
-// token, or dump credential material (export) are not here. Self-host never calls this.
+// the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
+// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first. Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
-import { previewHeaderPlain } from "./wake.ts";
+import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
 
 /** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
 export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
@@ -15,7 +15,9 @@ const ALIAS = /^[A-Za-z0-9_.-]{1,64}$/;
 /** Display form WDJB-4827 or the stored form WDJB4827. Vowels and 0/1 are not in a real code. */
 const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-?[2-9]{4}$/i;
 
-const TOKEN_RE = /^(?:a2aow_|s2a_|a2amcp_|a2amcpr_)[A-Za-z0-9_-]{20,}$/;
+/** Peer tokens, MCP tokens, and the hosted owner token (`a2aot_`). */
+export const TOKEN_PREFIXES = ["a2aow_", "s2a_", "a2amcp_", "a2amcpr_", "a2aot_"] as const;
+const TOKEN_RE = new RegExp(`^(?:${TOKEN_PREFIXES.join("|")})[A-Za-z0-9_-]{20,}$`);
 const SETUP_RE = /(?:\?|&)t=[A-Za-z0-9_-]{16,}/;
 const USERINFO_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?\s]*@/i;
 /** A non-empty string under one of these keys is a secret, even when it is not a token shape. */
@@ -25,6 +27,12 @@ const SECRET_KEYS = new Set([
 	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
 ]);
 
+/**
+ * Header `runOwnerRpc` sets when `actor` is `human`. `handleOwner` honors it only on an in-process call.
+ * A request from the network cannot become that decision by sending the header.
+ */
+export const DASHBOARD_ACTOR_HEADER = "x-a2a-dashboard-actor";
+
 export interface OwnerRpcRequest {
 	accountId: string;
 	method: string;
@@ -33,6 +41,11 @@ export interface OwnerRpcRequest {
 	query?: Record<string, string>;
 	/** Refused. The owner HTTP API is where a body is accepted. */
 	body?: unknown;
+	/**
+	 * Dashboard approve or deny after the control plane has checked a recent sign-in.
+	 * Any other value is refused. Absent keeps the owner HTTP API's actor (`agent` or `owner`).
+	 */
+	actor?: "human";
 }
 
 export interface OwnerRpcResult {
@@ -99,6 +112,14 @@ function historyQuery(q: Record<string, string>): string | null {
 	return `?n=${q.n}`;
 }
 
+/** `format=sql` is the only export query. The RPC still calls the JSON handler and redacts before building SQL. */
+function exportQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "format") return null;
+	if (q.format === undefined) return "";
+	if (q.format !== "sql") return null;
+	return "?format=sql";
+}
+
 interface RouteDef {
 	method: "GET" | "POST" | "DELETE";
 	name: string;
@@ -109,6 +130,7 @@ interface RouteDef {
 
 const ROUTES: RouteDef[] = [
 	{ method: "GET", name: "GET /owner/inbox", take: (s) => s.length === 2 && s[1] === "inbox", search: inboxQuery, path: () => "/owner/inbox" },
+	{ method: "GET", name: "GET /owner/summary", take: (s) => s.length === 2 && s[1] === "summary", search: noQuery, path: () => "/owner/summary" },
 	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
 	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
 	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
@@ -126,6 +148,8 @@ const ROUTES: RouteDef[] = [
 	{ method: "GET", name: "GET /owner/wake/preview", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "preview", search: noQuery, path: () => "/owner/wake/preview" },
 	{ method: "POST", name: "POST /owner/wake/test", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "test", search: noQuery, path: () => "/owner/wake/test" },
 	{ method: "GET", name: "GET /owner/contexts", take: (s) => s.length === 2 && s[1] === "contexts", search: noQuery, path: () => "/owner/contexts" },
+	{ method: "GET", name: "GET /owner/log", take: (s) => s.length === 2 && s[1] === "log", search: noQuery, path: () => "/owner/log" },
+	{ method: "GET", name: "GET /owner/export", take: (s) => s.length === 2 && s[1] === "export", search: exportQuery, path: () => "/owner/export" },
 ];
 
 /** Method + path (+ query) on the owner RPC allowlist, or why it is not. */
@@ -147,12 +171,36 @@ function stringLeaks(value: string, key: string | null): boolean {
 	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;
 }
 
+/** Claimed display fields. A token-shaped value is blanked so one request cannot withhold the list. */
+const CLAIM_KEYS = new Set(["clientname", "client_name", "clientid", "client_id", "agentcardurl", "agent_card_url"]);
+
+function claimLeaks(value: string): boolean {
+	return TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value);
+}
+
+/**
+ * Replace a claimed name, alias, or card that is shaped like a peer token, a setup secret, or URL
+ * userinfo with an empty string. Other keys are left for `ownerResponseLeaks`.
+ */
+export function scrubOwnerClaims(value: unknown, depth = 0): unknown {
+	if (value == null || depth > 20) return value;
+	if (Array.isArray(value)) return value.map((item) => scrubOwnerClaims(item, depth + 1));
+	if (typeof value !== "object") return value;
+	const out: Record<string, unknown> = {};
+	for (const [key, item] of Object.entries(value)) {
+		out[key] = typeof item === "string" && CLAIM_KEYS.has(key.toLowerCase()) && claimLeaks(item)
+			? ""
+			: scrubOwnerClaims(item, depth + 1);
+	}
+	return out;
+}
+
 /** A rendered wake whose credential header was not masked. The header name is the caller's choice. */
 function wakePreviewLeaks(value: object): boolean {
 	const headers = (value as { method?: unknown; headers?: unknown }).headers;
 	if ((value as { method?: unknown }).method !== "POST" || !headers || typeof headers !== "object" || Array.isArray(headers)) return false;
 	for (const [k, v] of Object.entries(headers)) {
-		if (typeof v !== "string" || previewHeaderPlain(k) || v.endsWith("…")) continue;
+		if (typeof v !== "string" || previewHeaderPlain(k) || credentialIsMasked(v)) continue;
 		return true;
 	}
 	return false;