a2a-exposed 0.7.12 → 0.7.14

package/worker/src/wake-target.ts

@@ -1,7 +1,14 @@
 // Wake URL checks for WAKE_TARGET_POLICY=public-https. Unset stays the previous fetch
 // (any URL the operator configured, redirects followed by the platform).
+//
+// The TCP connection is to an address from the DNS check. TLS is not the runtime's
+// startTls({ expectedServerHostname }): on the Workers edge that sends no SNI when the
+// socket was opened to an IP (cloudflare/workerd#6903), so the peer aborts before HTTP.
+// The handshake runs in-process, with the URL hostname as SNI, over that pinned socket.
+// A socket still cannot open a Cloudflare address, so a *.workers.dev target does not connect.
+import { CertificateError, Client, TlsError } from "tunnelfetch";
 import { isPrivateHost } from "./a2a.ts";
-import { isPublicIp, net, parseHttpResponse, type PinnedSocket } from "./mcp.ts";
+import { isPublicIp } from "./mcp.ts";
 
 /** DNS-over-HTTPS resolver. Same endpoint the client-metadata fetch uses. */
 export const DOH_URL = "https://cloudflare-dns.com/dns-query";
@@ -9,14 +16,33 @@ export const DOH_URL = "https://cloudflare-dns.com/dns-query";
 /** Original request plus this many redirects. Each hop is checked before it is requested. */
 const MAX_REDIRECTS = 3;
 
+const REQUEST_TIMEOUT_MS = 15_000;
+
 /** Host to addresses. `null` means the lookup failed and the caller must fail closed. */
 export type AddressLookup = (host: string) => Promise<string[] | null>;
 
-type Connect = NonNullable<typeof net.connect>;
+type WakeSocket = {
+	readable: ReadableStream<Uint8Array>;
+	writable: WritableStream<Uint8Array>;
+	opened?: Promise<{ remoteAddress?: string | null }>;
+	close?: () => Promise<void>;
+};
+
+/** Raw TCP. Production uses `cloudflare:sockets`. Tests replace it. */
+export type WakeConnect = (address: { hostname: string; port: number }, options?: { secureTransport?: "off" | "on" | "starttls"; allowHalfOpen?: boolean }) => WakeSocket;
+
+/** One checked hop. `ip` is the address the socket must use. `hostname` is the TLS name. */
+export type CheckedDeliver = (url: string, init: RequestInit, target: { ip: string; hostname: string }) => Promise<Response>;
+
+export const wakeNet: { connect: null | WakeConnect; deliver: null | CheckedDeliver } = { connect: null, deliver: null };
 
 export type WakeDeps = {
 	lookup?: AddressLookup;
-	connect?: Connect;
+	connect?: WakeConnect;
+	deliver?: CheckedDeliver;
+	/** Deliver a URL on this host in-process. Used for a wake aimed at this inbox. */
+	localHost?: string;
+	local?: (url: string, init: RequestInit) => Promise<Response>;
 };
 
 function bareHost(host: string): string {
@@ -69,8 +95,8 @@ export async function publicWakeProblem(url: string, lookup: AddressLookup = loo
 	return "refused" in checked ? checked.refused : "";
 }
 
-/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
-export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+/** Every public address from one lookup. The socket uses the first. The TLS name is the URL host. */
+async function checkedWakeAddresses(url: string, lookup: AddressLookup): Promise<{ hostname: string; ips: string[] } | { refused: string }> {
 	let parsed: URL;
 	try { parsed = new URL(url); } catch { return { refused: "not a URL" }; }
 	if (parsed.protocol !== "https:") return { refused: "must be https" };
@@ -78,79 +104,99 @@ export async function checkedWakeAddress(url: string, lookup: AddressLookup = lo
 	const host = parsed.hostname;
 	if (!host || isPrivateHost(host)) return { refused: "private or internal host" };
 	const bare = bareHost(host);
-	if (isIpLiteral(host)) return isPublicIp(bare) ? { ip: bare } : { refused: "private or reserved address" };
+	if (isIpLiteral(host)) return isPublicIp(bare) ? { hostname: bare, ips: [bare] } : { refused: "private or reserved address" };
 	let ips: string[] | null;
 	try { ips = await lookup(host); } catch { return { refused: "its address could not be checked" }; }
 	if (ips == null) return { refused: "its address could not be checked" };
 	if (!ips.length) return { refused: "the host has no address" };
 	if (!ips.every((ip) => isPublicIp(ip))) return { refused: "resolves to a private or reserved address" };
-	return { ip: ips[0] };
+	return { hostname: host, ips };
 }
 
-function headerEntries(headers: HeadersInit | undefined): [string, string][] {
-	const out: [string, string][] = [];
-	const list = new Headers(headers);
-	list.forEach((value, key) => out.push([key, value]));
-	return out;
+/** The address the next request must use. A name is resolved once; the returned IP is from that answer. */
+export async function checkedWakeAddress(url: string, lookup: AddressLookup = lookupAddresses): Promise<{ ip: string } | { refused: string }> {
+	const checked = await checkedWakeAddresses(url, lookup);
+	if ("refused" in checked) return checked;
+	return { ip: checked.ips[0]! };
 }
 
-function requestBytes(method: string, url: URL, headers: HeadersInit | undefined, body: Uint8Array): Uint8Array {
-	const lines = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
-	for (const [key, value] of headerEntries(headers)) {
-		if (key === "host" || key === "content-length" || key === "connection" || key === "transfer-encoding") continue;
-		if (/[\r\n]/.test(key) || /[\r\n]/.test(value)) throw new Error("invalid header");
-		lines.push(`${key}: ${value}`);
-	}
-	if (body.byteLength) lines.push(`content-length: ${body.byteLength}`);
-	lines.push("connection: close");
-	const head = new TextEncoder().encode(lines.join("\r\n") + "\r\n\r\n");
-	const raw = new Uint8Array(head.byteLength + body.byteLength);
-	raw.set(head);
-	raw.set(body, head.byteLength);
-	return raw;
+/**
+ * Dial `ip`, ignoring the hostname the TLS stack passes in. The handshake names that hostname
+ * itself; this function only chooses the TCP address.
+ */
+export function dialChecked(ip: string, connect: WakeConnect): WakeConnect {
+	return (addr) => connect({ hostname: ip, port: addr.port }, { secureTransport: "off", allowHalfOpen: false });
 }
 
-async function readSocket(sock: PinnedSocket, cap: number): Promise<Uint8Array> {
-	const reader = sock.readable.getReader();
-	const chunks: Uint8Array[] = [];
-	let n = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		n += value.byteLength;
-		if (n > cap) break;
-		chunks.push(value);
-	}
-	const raw = new Uint8Array(Math.min(n, cap));
-	let o = 0;
-	for (const chunk of chunks) {
-		const take = Math.min(chunk.byteLength, raw.byteLength - o);
-		raw.set(chunk.subarray(0, take), o);
-		o += take;
-	}
-	return raw;
+async function runtimeConnect(): Promise<WakeConnect> {
+	if (wakeNet.connect) return wakeNet.connect;
+	const sockets = await import("cloudflare:sockets");
+	return sockets.connect as unknown as WakeConnect;
 }
 
+/** Enough of an error body to recognise a Cloudflare status page. A success body is not kept. */
+const HINT_BYTES = 4096;
+
 /**
- * HTTPS to `ip`, with TLS checked for the URL's hostname. The platform does not resolve the name again.
+ * HTTPS to the checked IP, with SNI and certificate verification for the URL host.
+ * `forceTunnel` keeps the platform from fetching the hostname again.
+ * The body is copied before the client closes, because closing drops the socket.
  */
-async function pinnedRequest(ip: string, url: string, method: string, headers: HeadersInit | undefined, body: Uint8Array, connect: Connect): Promise<Response> {
-	const parsed = new URL(url);
-	const sock = connect({ hostname: ip, port: Number(parsed.port || 443) }, { secureTransport: "starttls" }).startTls({ expectedServerHostname: parsed.hostname });
+async function deliverPinned(url: string, init: RequestInit, target: { ip: string; hostname: string }, connect: WakeConnect): Promise<Response> {
+	const client = new Client({
+		connect: dialChecked(target.ip, connect),
+		forceTunnel: true,
+		maxRedirects: 0,
+		maxBodyBytes: Infinity,
+		http2: false,
+		keepAlive: false,
+		timeouts: { totalMs: REQUEST_TIMEOUT_MS },
+	});
 	try {
-		const writer = sock.writable.getWriter();
-		await writer.write(requestBytes(method, parsed, headers, body));
-		writer.releaseLock();
-		const raw = await readSocket(sock, 65536);
-		const message = parseHttpResponse(raw);
-		if (typeof message === "string") throw new Error(message);
-		const responseHeaders = new Headers();
-		for (const [key, value] of Object.entries(message.headers)) responseHeaders.set(key, value);
-		const payload = message.status === 204 || message.status === 304 ? null : message.body;
-		return new Response(payload, { status: message.status, headers: responseHeaders });
+		const res = await client.fetch(url, {
+			method: init.method,
+			headers: init.headers,
+			body: init.body,
+			redirect: "manual",
+		});
+		return await responseForCaller(res);
+	} catch (e) {
+		if (e instanceof TlsError || e instanceof CertificateError) throw new Error("TLS Handshake Failed.");
+		throw e;
 	} finally {
-		await sock.close().catch(() => {});
+		await client.close().catch(() => {});
+	}
+}
+
+/** Status and headers, plus the start of an error body. The live socket is not returned. */
+async function responseForCaller(res: Response): Promise<Response> {
+	const headers = new Headers(res.headers);
+	if (res.ok || !res.body) {
+		await res.body?.cancel().catch(() => {});
+		return new Response(null, { status: res.status, headers });
+	}
+	const reader = res.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		while (total < HINT_BYTES) {
+			const next = await reader.read();
+			if (next.done || !next.value) break;
+			chunks.push(next.value);
+			total += next.value.byteLength;
+		}
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	const merged = new Uint8Array(Math.min(total, HINT_BYTES));
+	let offset = 0;
+	for (const chunk of chunks) {
+		const take = Math.min(chunk.byteLength, merged.byteLength - offset);
+		if (take <= 0) break;
+		merged.set(chunk.subarray(0, take), offset);
+		offset += take;
 	}
+	return new Response(merged, { status: res.status, headers });
 }
 
 function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
@@ -161,8 +207,9 @@ function bodyBytes(body: BodyInit | null | undefined): Uint8Array {
 }
 
 /**
- * POST (or whatever `init` says) to `url` on the address that passed the public-https check.
- * A redirect is followed only when it stays on the same origin, and that hop is checked and pinned again.
+ * POST (or whatever `init` says) to `url` after the public-https check.
+ * The socket opens to an address from that check. TLS uses the hostname.
+ * A redirect is followed only when it stays on the same origin, and that hop is checked again.
  * A cross-origin redirect is refused, so wake credentials are not sent to another host.
  * 301, 302, and 303 drop the body. 307 and 308 keep it.
  */
@@ -172,24 +219,31 @@ export async function fetchCheckedWake(
 	deps: WakeDeps = {},
 ): Promise<{ response: Response } | { refused: string }> {
 	const lookup = deps.lookup ?? lookupAddresses;
-	const connect = async (): Promise<Connect> => {
-		if (deps.connect) return deps.connect;
-		if (net.connect) return net.connect;
-		return (await import("cloudflare:sockets")).connect as unknown as Connect;
-	};
 	let current = url;
 	let method = (init.method || "GET").toUpperCase();
 	let body = bodyBytes(method === "GET" || method === "HEAD" ? undefined : init.body);
 	for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-		const checked = await checkedWakeAddress(current, lookup);
+		const checked = await checkedWakeAddresses(current, lookup);
 		if ("refused" in checked) return checked;
-		const res = await pinnedRequest(checked.ip, current, method, init.headers, method === "GET" || method === "HEAD" ? new Uint8Array() : body, await connect());
+		const nextInit: RequestInit = {
+			method,
+			headers: init.headers,
+			body: method === "GET" || method === "HEAD" || body.byteLength === 0 ? undefined : body,
+			redirect: "manual",
+		};
+		const target = { ip: checked.ips[0]!, hostname: checked.hostname };
+		let res: Response;
+		if (deps.local && deps.localHost && new URL(current).host === deps.localHost) res = await deps.local(current, nextInit);
+		else if (deps.deliver) res = await deps.deliver(current, nextInit, target);
+		else if (wakeNet.deliver) res = await wakeNet.deliver(current, nextInit, target);
+		else res = await deliverPinned(current, nextInit, target, deps.connect ?? wakeNet.connect ?? await runtimeConnect());
 		const location = res.headers.get("location");
 		if (res.status < 300 || res.status >= 400 || !location) return { response: res };
+		await res.body?.cancel().catch(() => {});
 		if (hop === MAX_REDIRECTS) return { refused: "too many redirects" };
 		let next: URL;
 		try { next = new URL(location, current); } catch { return { refused: "not a URL" }; }
-		const ahead = await checkedWakeAddress(next.href, lookup);
+		const ahead = await checkedWakeAddresses(next.href, lookup);
 		if ("refused" in ahead) return ahead;
 		if (next.origin !== new URL(current).origin) return { refused: "cross-origin redirect" };
 		if (res.status === 303 || ((res.status === 301 || res.status === 302) && method !== "GET" && method !== "HEAD")) {

package/worker/src/wake.ts

@@ -51,7 +51,10 @@ export function defaultDebounceSeconds(preset: string): number {
 	return preset === "claude-code" ? 20 : 10;
 }
 
-/** Default hourly wake cap per preset (0 = unlimited). Claude Code routines allow 30 fires/hour. */
+/**
+ * Default hourly wake cap per preset. 0 means unlimited. Claude Code routines allow 30 fires/hour,
+ * so that preset defaults to 25 only when WAKE_MAX_PER_HOUR is unset. An explicit 0 stays unlimited.
+ */
 export function defaultMaxPerHour(preset: string): number {
 	return preset === "claude-code" ? 25 : 0;
 }
@@ -256,11 +259,21 @@ export function previewHeaderPlain(name: string): boolean {
 	return PREVIEW_PLAIN_HEADERS.has(name.toLowerCase());
 }
 
+/** A credential header safe to show. No character of the secret is kept. */
+export function maskedCredential(value: string): string {
+	return /^bearer\s/i.test(value) ? "Bearer ••••" : "••••";
+}
+
+/** True only for the exact value `maskedCredential` returns. A prefix plus an ellipsis is still a secret. */
+export function credentialIsMasked(value: string): boolean {
+	return value === "••••" || value === "Bearer ••••";
+}
+
 /** Copy of a rendered request with credentials masked (for previews/logs). */
 export function redact(req: WakeRequest): WakeRequest {
 	const h: Record<string, string> = {};
 	for (const [k, v] of Object.entries(req.headers))
-		h[k] = previewHeaderPlain(k) ? v : v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…");
+		h[k] = previewHeaderPlain(k) ? v : maskedCredential(v);
 	let url = req.url;
 	try { const u = new URL(req.url); url = `${u.protocol}//${u.host}${u.pathname.replace(/\/[^/]{16,}/g, "/…")}`; } catch { /* keep */ }
 	return { ...req, url, headers: h };

package/worker/test/alarms.test.ts

@@ -41,6 +41,23 @@ test("nextCronAt is the earliest wake, rate row, or expiry", async () => {
 	assert.equal(await nextCronAt(tenant, now), now + 801);
 });
 
+test("zero and an unset generic cap stay unlimited; an unset Claude cap is 25", async () => {
+	const now = 1_700_000_000_000;
+	const hour = Math.floor(now / 3600000);
+	const due = now - 60_000;
+	const open = due + 10_000;
+	async function arm(over: Record<string, string>, count: number) {
+		const { DB, tenant } = ctx(over);
+		await DB.prepare("INSERT INTO wake_budget (hour, count) VALUES (?, ?)").bind(hour, count).run();
+		await DB.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('c', ?, '{}', ?)").bind(due, now).run();
+		return nextCronAt(tenant, now);
+	}
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_MAX_PER_HOUR: "" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "0" }, 100), open);
+	assert.equal(await arm({ WAKE_PRESET: "claude-code", WAKE_MAX_PER_HOUR: "" }, 25), (hour + 1) * 3600000);
+});
+
 test("an hourly cap holds an already-due wake until the next hour", async () => {
 	const now = 1_700_000_000_000;
 	const hour = Math.floor(now / 3600000);

package/worker/test/export.test.ts

@@ -10,7 +10,8 @@ import { Miniflare, convertV4MiniflareOptions } from "miniflare";
 import worker from "../src/index.ts";
 import { d1 } from "./d1.ts";
 import { sha256 } from "../src/a2a.ts";
-import { exportRows, toSql, bookmarkForTime, restoreBookmark, restartAfterResult, ExportError, EXPORT_TABLES, RESTORE_RESTART_DELAY_MS } from "../src/export.ts";
+import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql, bookmarkForTime, restoreBookmark, restartAfterResult, ExportError, EXPORT_TABLES, RESTORE_RESTART_DELAY_MS } from "../src/export.ts";
+import { ownerResponseLeaks, TOKEN_PREFIXES } from "../src/owner-rpc.ts";
 import { doSqlD1, type SqlStorageLike, type TxRunner } from "../src/storage.ts";
 import { backupDatabase, backupDirectory, exportTenantSql, hostedDailyBackup, olderThanRetention, pruneSnapshots, snapshotKey, DAILY_CRON, type R2BucketLike } from "../src/backup.ts";
 import { namespaceForRegion, type DoNamespace } from "../src/tenancy.ts";
@@ -70,6 +71,121 @@ test("export SQL writes a NUL byte as char(0) so the script stays valid", () =>
 	assert.equal(hex.h, Buffer.from(raw, "utf8").toString("hex").toUpperCase());
 });
 
+test("redactExport drops credential material and leaves the full dump unchanged", async () => {
+	const DB = db();
+	const now = "2026-10-11T00:00:00.000Z";
+	const token = "a2aow_" + "a".repeat(20);
+	const owner = "a2aot_" + "Q".repeat(43);
+	const hash = "ab".repeat(32);
+	const replaces = "cd".repeat(32);
+	const setupHash = "ef".repeat(32);
+	const setup = "c".repeat(16);
+	await DB.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('ada', ?, ?)").bind(hash, now).run();
+	await DB.prepare("INSERT INTO history (context_id, ts, dir, text) VALUES ('ctx-1', ?, 'in', ?)").bind(now, `see ${token} and ${owner} at https://user:secret@hooks.example/wake?t=${setup}`).run();
+	await DB.prepare("INSERT INTO history (context_id, ts, dir, text) VALUES ('ctx-owner', ?, 'in', ?)").bind(now, owner).run();
+	await DB.prepare("INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, push_configs_json) VALUES ('task-1', 'ctx-1', 'ada', 'submitted', '1.0', ?, ?, '{}', '[]', ?)").bind(now, now, JSON.stringify([{ token }])).run();
+	await DB.prepare("INSERT INTO outbound (task_id, context_id, peer, push_token_hash, sent_at, task_json) VALUES ('task-1', 'ctx-1', 'ada', 'push-hash-secret', ?, ?)").bind(now, JSON.stringify({ token })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('approval_password', ?)").bind(JSON.stringify({ hash: "x".repeat(40) })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('password_setup', ?)").bind(JSON.stringify({ hash: setupHash, createdMs: 1, expiresMs: 2, failures: 0 })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('theme', 'kept')").run();
+	await DB.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s, replaces_label, replaces_hash) VALUES ('device-hash-secret', 'WDJB4827', 'pending', 1, 2, 5, 'ada', ?)").bind(replaces).run();
+	await DB.prepare("INSERT INTO oauth_codes (code_hash, client_id, redirect_uri, code_challenge, scope, resource, created_ms, expires_ms) VALUES ('code-hash', 'client', 'https://client.example/cb', 'challenge-secret-value', 'mcp', 'https://agent.example/mcp', 1, 2)").run();
+	await DB.prepare("INSERT INTO mcp_grants (label, client_id, scope, access_hash, refresh_hash, created_at) VALUES ('mcp-claude', 'client', 'mcp', 'access-hash-secret', 'refresh-hash-secret', ?)").bind(now).run();
+	await DB.prepare("INSERT INTO outbound_peers (alias, url, token_enc, created_at, updated_at) VALUES ('ada', 'https://ada.example', 'ciphertext-secret-value', ?, ?)").bind(now, now).run();
+	await DB.prepare("INSERT INTO oidc_txns (state, nonce, verifier, kind, csrf, payload_json, expires_ms) VALUES ('state-1', 'nonce-1', 'verifier-secret-value', 'device', 'csrf-secret-value', '{}', 1)").run();
+	const file = await exportRows(DB, new Date(now));
+	const redacted = redactExport(file);
+	assert.equal(file.tables.peers?.[0]?.token_hash, hash, "the CLI dump still has the hash");
+	assert.equal(file.tables.device_requests?.[0]?.replaces_hash, replaces);
+	assert.equal(file.tables.settings?.some((row) => row.key === "password_setup"), true);
+	assert.equal(file.tables.oidc_txns?.[0]?.verifier, "verifier-secret-value");
+	assert.equal(redacted.tables.peers?.[0]?.token_hash, "redacted:ada");
+	assert.equal(redacted.tables.peers?.[0]?.label, "ada");
+	assert.equal(redacted.tables.device_requests?.[0]?.device_hash, "redacted:WDJB4827");
+	assert.equal(redacted.tables.device_requests?.[0]?.replaces_hash, undefined);
+	assert.equal(redacted.tables.device_requests?.[0]?.replaces_label, "ada");
+	assert.equal(redacted.tables.device_requests?.[0]?.user_code, "WDJB4827");
+	assert.equal(redacted.tables.tasks?.[0]?.push_configs_json, undefined);
+	assert.equal(redacted.tables.outbound?.[0]?.push_token_hash, undefined);
+	assert.equal(redacted.tables.outbound?.[0]?.task_json, JSON.stringify({ token: "[redacted]" }));
+	assert.equal(redacted.tables.mcp_grants?.[0]?.access_hash, undefined);
+	assert.equal(redacted.tables.mcp_grants?.[0]?.refresh_hash, undefined);
+	assert.equal(redacted.tables.mcp_grants?.[0]?.label, "mcp-claude");
+	assert.equal(redacted.tables.outbound_peers?.[0]?.token_enc, undefined);
+	assert.equal(redacted.tables.outbound_peers?.[0]?.alias, "ada");
+	assert.deepEqual(redacted.tables.oauth_codes, []);
+	assert.deepEqual(redacted.tables.oidc_txns, []);
+	assert.deepEqual(redacted.tables.settings?.map((row) => row.key), ["theme"]);
+	const history = redacted.tables.history ?? [];
+	assert.equal(history.find((row) => row.context_id === "ctx-1")?.text, "see [redacted] and [redacted] at https://[redacted]@hooks.example/wake?t=[redacted]");
+	assert.equal(history.find((row) => row.context_id === "ctx-owner")?.text, "[redacted]");
+	const dumped = JSON.stringify(redacted);
+	for (const secret of [token, owner, hash, replaces, setupHash, "device-hash-secret", "ciphertext-secret-value", "verifier-secret-value", "csrf-secret-value", "challenge-secret-value", "access-hash-secret", "refresh-hash-secret", "push-hash-secret", "approval_password", "password_setup", "user:secret", `t=${setup}`]) {
+		assert.equal(dumped.includes(secret), false, secret);
+	}
+	assert.equal(ownerResponseLeaks(owner), true);
+	assert.equal(ownerResponseLeaks(redacted), false, "a pasted hosted owner token is redacted, so the dashboard export is returned");
+	const sql = toSql(redacted, { skip: REDACTED_SQL_SKIP });
+	assert.match(sql, /redacted:ada/);
+	assert.equal(sql.includes("oauth_codes"), false);
+	assert.equal(sql.includes("oidc_txns"), false);
+	assert.equal(sql.includes("replaces_hash"), false);
+	assert.equal(sql.includes("password_setup"), false);
+	assert.equal(ownerResponseLeaks({ sql }), false);
+	for (const secret of [token, owner, hash, replaces, setupHash]) {
+		assert.equal(sql.includes(secret), false, secret);
+	}
+	assert.match(toSql(file), /verifier-secret-value/);
+	assert.match(toSql(file), new RegExp(hash));
+	assert.match(toSql(file), /replaces_hash/);
+});
+
+test("scrubSecretText redacts a hosted owner token on the log and export paths", () => {
+	assert.ok(TOKEN_PREFIXES.includes("a2aot_"));
+	for (const prefix of TOKEN_PREFIXES) {
+		const token = prefix + "Q".repeat(43);
+		assert.equal(scrubSecretText(`see ${token} end`), "see [redacted] end", prefix);
+		assert.equal(scrubSecretText(token), "[redacted]", prefix);
+		assert.equal(ownerResponseLeaks(token), true, prefix);
+	}
+	const owner = "a2aot_" + "Q".repeat(43);
+	const redacted = redactExport({
+		format: "a2a-exposed-export",
+		version: 1,
+		exportedAt: "2026-10-11T00:00:00.000Z",
+		tables: { history: [{ context_id: "ctx-owner", ts: "2026-10-11T00:00:00.000Z", dir: "in", text: owner }] },
+	});
+	assert.equal(redacted.tables.history?.[0]?.text, "[redacted]");
+	assert.equal(toSql(redacted, { skip: REDACTED_SQL_SKIP }).includes(owner), false);
+	assert.equal(ownerResponseLeaks(redacted), false);
+});
+
+test("redactExport removes device_requests.replaces_hash", () => {
+	const replaces = "cd".repeat(32);
+	const redacted = redactExport({
+		format: "a2a-exposed-export",
+		version: 1,
+		exportedAt: "2026-10-11T00:00:00.000Z",
+		tables: {
+			device_requests: [{
+				device_hash: "device-hash-secret",
+				user_code: "WDJB4827",
+				status: "pending",
+				replaces_label: "ada",
+				replaces_hash: replaces,
+			}],
+		},
+	});
+	const row = redacted.tables.device_requests?.[0] ?? {};
+	assert.equal(Object.hasOwn(row, "replaces_hash"), false);
+	assert.equal(row.replaces_label, "ada");
+	assert.equal(row.device_hash, "redacted:WDJB4827");
+	const sql = toSql(redacted, { skip: REDACTED_SQL_SKIP });
+	assert.equal(sql.includes("replaces_hash"), false);
+	assert.equal(sql.includes(replaces), false);
+	assert.equal(JSON.stringify(redacted).includes(replaces), false);
+});
+
 test("exportRows reads every application table in one batch", async () => {
 	const DB = db();
 	await DB.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('ada', 'h', 't')").run();