a2a-exposed 0.7.12 → 0.7.14

package/worker/test/hosted.test.ts

@@ -214,10 +214,21 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	const aliceInbox = await (await call("https://alice.example.com/owner/inbox?all=1", "GET", `Bearer ${tokenA}`)).json() as { text: string }[];
 	assert.equal(aliceInbox.length, 1);
 	assert.match(aliceInbox[0]!.text, /hello alice/);
+	const aliceSummary = await (await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA}`)).json() as { tasks: { submitted: number }; pairingPending: number };
+	assert.equal(aliceSummary.tasks.submitted, 1);
+	assert.equal(aliceSummary.pairingPending, 0);
+	assert.equal(JSON.stringify(aliceSummary).includes("hello alice"), false);
 
 	// workerd's local runtime throws "Jurisdiction restrictions are not implemented" on namespace.jurisdiction().
 	// namespaceForRegion() is covered in tenancy.test.ts; production Durable Objects do honour eu / fedramp.
-	await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
+	const tokenA2 = "owner-alice-2";
+	const hashA2 = await sha256(tokenA2);
+	const rotated = await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA2, config: { AGENT_NAME: "Alice 3" } });
+	assert.equal(rotated.applied, true);
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA}`)).status, 401, "the previous owner token stops working");
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA2}`)).status, 200);
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", "Bearer platform-owner")).status, 401, "self-host OWNER_TOKEN still does not unlock a tenant");
+	await alice.stub.pushConfig({ version: 5, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA2, config: { AGENT_NAME: "Alice 3" } });
 	assert.equal((await mf.dispatchFetch("https://alice.example.com/health")).status, 403, "the object enforces a newer status than the directory cache");
 });
 
@@ -500,7 +511,7 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
 	const hash = await sha256("owner-carol");
 	type OwnerStub = {
-		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown }): Promise<{ status: number; body: unknown }>;
+		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown; actor?: string }): Promise<{ status: number; body: unknown }>;
 		storageStatus(): Promise<{ configured: boolean; tables: string[] }>;
 		pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }>;
 	};
@@ -521,6 +532,14 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 		}
 		return true;
 	};
+	const sawAfter = async (from: number, part: string) => {
+		const start = Date.now();
+		while (!lines.slice(from).some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
 	const empty = ns.get(ns.idFromName("id-empty")) as unknown as OwnerStub;
 	const missing = await empty.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(missing.status, 404);
@@ -542,6 +561,18 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	assert.equal((await http("POST", "/owner/peers", "Bearer platform-owner", { label: "nope" })).status, 401, "self-host owner token still does not unlock a tenant");
 	const issued = await (await http("POST", "/owner/peers", "Bearer owner-carol", { label: "ada" })).json() as { token?: string };
 	assert.match(issued.token ?? "", /^a2aow_/, "the owner HTTP API still returns the new token");
+	const sentCarol = await http("POST", "/", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-carol", parts: [{ kind: "text", text: "hello from carol peer" }] } },
+	});
+	assert.equal(sentCarol.status, 200, await sentCarol.clone().text());
+	const summary = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/summary" });
+	assert.equal(summary.status, 200);
+	const summaryBody = summary.body as { tasks?: { submitted?: number }; pairingPending?: number };
+	assert.equal(summaryBody.tasks?.submitted, 1);
+	assert.equal(summaryBody.pairingPending, 0);
+	assert.equal(JSON.stringify(summary.body).includes("hello from carol peer"), false);
+	assert.equal(await saw('"route":"GET /owner/summary"'), true);
 
 	const listed = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(listed.status, 200);
@@ -562,8 +593,42 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 
 	const setup = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/password-link" });
 	assert.equal(setup.status, 404);
+	const pasted = "a2aow_" + "b".repeat(20);
+	const sentPaste = await http("POST", "/", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 2, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-paste", parts: [{ kind: "text", text: `note ${pasted} end` }] } },
+	});
+	assert.equal(sentPaste.status, 200, await sentPaste.clone().text());
+	const httpExport = await (await http("GET", "/owner/export", "Bearer owner-carol")).json() as { tables?: { peers?: { token_hash?: string }[] } };
+	assert.match(httpExport.tables?.peers?.[0]?.token_hash ?? "", /^[0-9a-f]{64}$/);
+	assert.equal(JSON.stringify(httpExport).includes(pasted), true, "the owner HTTP export stays the full dump");
 	const dumped = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export" });
-	assert.equal(dumped.status, 404);
+	assert.equal(dumped.status, 200);
+	const dumpedText = JSON.stringify(dumped.body);
+	assert.match(dumpedText, /"token_hash":"redacted:ada"/);
+	assert.match(dumpedText, /note \[redacted\] end/);
+	assert.equal(dumpedText.includes(pasted), false);
+	assert.equal(dumpedText.includes(issued.token ?? ""), false);
+	assert.equal(dumpedText.includes("tenant-secret-value"), false);
+	assert.equal(dumpedText.includes(httpExport.tables?.peers?.[0]?.token_hash ?? "missing-hash"), false);
+	const sqlDump = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export", query: { format: "sql" } });
+	assert.equal(sqlDump.status, 200);
+	const sql = (sqlDump.body as { sql?: string }).sql ?? "";
+	assert.match(sql, /note \[redacted\] end/);
+	assert.match(sql, /redacted:ada/);
+	assert.match(sql, /Do not load it onto a live inbox/);
+	assert.equal(sql.includes(pasted), false);
+	assert.equal(sql.includes("oauth_codes"), false);
+	assert.equal(sql.includes("oidc_txns"), false);
+	assert.equal(sql.includes(issued.token ?? ""), false);
+	const badFormat = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export", query: { format: "json" } });
+	assert.equal(badFormat.status, 400);
+	const logged = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/log" });
+	assert.equal(logged.status, 200);
+	const loggedText = JSON.stringify(logged.body);
+	assert.match(loggedText, /note \[redacted\] end/);
+	assert.equal(loggedText.includes(pasted), false);
+	assert.equal(loggedText.includes("data_json"), false);
 	const oddQuery = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/inbox", query: { format: "sql" } });
 	assert.equal(oddQuery.status, 400);
 	const pairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
@@ -597,11 +662,85 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 	assert.equal(wokenText.includes("platform-secret"), false);
 	const wokenBody = woken.body as { hasKey?: boolean; request?: { headers?: Record<string, string> } };
 	assert.equal(wokenBody.hasKey, true);
-	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer z9Qx…");
+	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer ••••");
+	assert.equal(wokenText.includes("z9Qx"), false);
 	const httpPreview = await (await http("GET", "/owner/wake/preview", "Bearer owner-carol")).json() as { hasKey?: boolean };
 	assert.equal(httpPreview.hasKey, true);
 	assert.equal(JSON.stringify(httpPreview).includes(wakeKey), false);
 
+	const started = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.20" },
+		body: "client_name=Barry+Bot&client_id=barry-alias&agent_card_url=https://barry.example/.well-known/agent-card.json",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	const code = device.user_code ?? "";
+	assert.match(code, /^[BCDFGHJKLMNPQRSTVWXZ]{4}-[2-9]{4}$/);
+	const shapedName = "a2aow_" + "a".repeat(20);
+	const shapedCard = "https://card.example/card.json?t=" + "c".repeat(16);
+	const shapedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.23" },
+		body: `client_name=${encodeURIComponent(shapedName)}&client_id=shaped-alias&agent_card_url=${encodeURIComponent(shapedCard)}`,
+	});
+	assert.equal(shapedStart.status, 200);
+	const shapedList = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(shapedList.status, 200);
+	const shapedText = JSON.stringify(shapedList.body);
+	assert.equal(shapedText.includes(shapedName), false);
+	assert.equal(shapedText.includes("t=" + "c".repeat(16)), false);
+	assert.match(shapedText, /Barry Bot/);
+	const pendingPairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	const pending = (pendingPairing.body as { pending?: { userCode?: string; clientName?: string; clientId?: string; agentCardUrl?: string }[] }).pending ?? [];
+	assert.equal(pending.some((row) => row.userCode === code && row.clientName === "Barry Bot" && row.clientId === "barry-alias" && row.agentCardUrl === "https://barry.example/.well-known/agent-card.json"), true);
+	const refused = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve` });
+	assert.equal(refused.status, 403);
+	const httpSpoof = await mf.dispatchFetch(`https://carol.example.com/owner/pairing/${code}/approve`, {
+		method: "POST",
+		headers: { authorization: "Bearer owner-carol", "content-type": "application/json", "x-a2a-dashboard-actor": "human" },
+	});
+	assert.equal(httpSpoof.status, 403);
+	const approved = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${code}/approve`, actor: "human" });
+	assert.equal(approved.status, 200);
+	assert.equal((approved.body as { decision?: string }).decision, "approved");
+	assert.equal(await saw('"event":"pairing_approved"'), true);
+	assert.equal(lines.some((line) => line.includes('"event":"pairing_approved"') && line.includes('"by":"human"')), true);
+
+	const deniedStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
+		body: "client_name=Deny+Bot&client_id=deny-alias",
+	});
+	const deniedDevice = await deniedStart.json() as { user_code?: string };
+	assert.equal(deniedStart.status, 200);
+	const ownerDenyAt = lines.length;
+	const ownerDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${deniedDevice.user_code}/deny` });
+	assert.equal(ownerDenied.status, 200);
+	assert.equal(await saw('"event":"pairing_denied"'), true);
+	const ownerDenyLine = lines.slice(ownerDenyAt).find((line) => line.includes('"event":"pairing_denied"')) ?? "";
+	assert.match(ownerDenyLine, /"by":"owner"/);
+	assert.equal(ownerDenyLine.includes('"by":"human"'), false);
+
+	const humanDenyStart = await mf.dispatchFetch("https://carol.example.com/oauth/device_authorization", {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.22" },
+		body: "client_name=Human+Deny&client_id=human-deny",
+	});
+	const humanDenyDevice = await humanDenyStart.json() as { user_code?: string };
+	assert.equal(humanDenyStart.status, 200);
+	const humanDenyAt = lines.length;
+	const humanDenied = await stub.owner({ accountId: "acct_carol", method: "POST", path: `/owner/pairing/${humanDenyDevice.user_code}/deny`, actor: "human" });
+	assert.equal(humanDenied.status, 200);
+	assert.equal(await sawAfter(humanDenyAt, '"by":"human"'), true);
+	assert.equal(lines.slice(humanDenyAt).some((line) => line.includes('"event":"pairing_denied"') && line.includes('"by":"human"')), true);
+
+	const flagged = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", actor: "human" });
+	assert.equal(flagged.status, 400);
+	const badActor = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/WDJB-4827/approve", actor: "agent" });
+	assert.equal(badActor.status, 400);
+	assert.equal(await saw('"reason":"actor"'), true);
+
 	await stub.pushConfig({ version: 3, tenantId: "id-carol", name: "carol", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Carol" } });
 	const suspended = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
 	assert.equal(suspended.status, 403);

package/worker/test/owner-rpc.test.ts

@@ -1,7 +1,7 @@
 // Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks } from "../src/owner-rpc.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims } from "../src/owner-rpc.ts";
 
 test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
 	const ok = (method: string, path: string, query?: Record<string, string>) => {
@@ -10,6 +10,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 		return m.ok ? m.route : null;
 	};
 	assert.equal(ok("GET", "/owner/inbox")?.name, "GET /owner/inbox");
+	assert.equal(ok("GET", "/owner/summary")?.name, "GET /owner/summary");
 	assert.equal(ok("GET", "/owner/inbox", { context: "ctx-1", all: "1" })?.search, "?context=ctx-1&all=1");
 	assert.equal(ok("GET", "/owner/tasks/task-1")?.path, "/owner/tasks/task-1");
 	assert.equal(ok("GET", "/owner/history/ctx-1", { n: "50" })?.search, "?n=50");
@@ -28,13 +29,19 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(ok("GET", "/owner/wake/preview")?.name, "GET /owner/wake/preview");
 	assert.equal(ok("POST", "/owner/wake/test")?.name, "POST /owner/wake/test");
 	assert.equal(ok("GET", "/owner/contexts")?.name, "GET /owner/contexts");
+	assert.equal(ok("GET", "/owner/log")?.name, "GET /owner/log");
+	assert.equal(ok("GET", "/owner/export")?.name, "GET /owner/export");
+	assert.equal(ok("GET", "/owner/export", { format: "sql" })?.search, "?format=sql");
 
 	const refused = (method: string, path: string, query?: Record<string, string>) => matchOwnerRpc(method, path, query);
 	assert.deepEqual(refused("POST", "/owner/peers"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/pairing/password-link"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("PUT", "/owner/pairing/password"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("PUT", "/owner/outbound-peers/ada"), { ok: false, reason: "path" });
-	assert.deepEqual(refused("GET", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/export", { format: "json" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/export", { format: "sql", n: "1" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("POST", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/log", { n: "10" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
@@ -43,6 +50,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.deepEqual(refused("GET", "/owner/inbox?all=1"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/pairing/AEIO-4827/approve"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/inbox", { format: "sql" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/summary", { all: "1" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("GET", "/owner/history/ctx-1", { n: "1001" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("GET", "/owner/history/.."), { ok: false, reason: "path" });
 	assert.equal(accountIdOf("acct_carol"), "acct_carol");
@@ -52,6 +60,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 
 test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	const token = "a2aow_" + "a".repeat(43);
+	assert.equal(ownerResponseLeaks("a2aot_" + "Q".repeat(43)), true);
 	assert.equal(ownerResponseLeaks({ label: "ada", revoked_at: null }), false);
 	assert.equal(ownerResponseLeaks([{ text: "hello" }]), false);
 	assert.equal(ownerResponseLeaks({ token }), true);
@@ -60,13 +69,46 @@ test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	assert.equal(ownerResponseLeaks({ clientSecret: "tenant-secret-value" }), true);
 	assert.equal(ownerResponseLeaks({ secretsEnc: "v1.ciphertext-value" }), true);
 	assert.equal(ownerResponseLeaks("https://user:pass@hooks.example/wake"), true);
-	assert.equal(ownerResponseLeaks({ authorization: "Bearer abcd…" }), false);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer abcd…" } }), true);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { authorization: "Bearer ••••" } }), false);
+	assert.equal(ownerResponseLeaks({ method: "POST", headers: { "x-credential": "••••" } }), false);
 	assert.equal(ownerResponseLeaks({
 		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supersecretvalue", "content-type": "application/json" }, body: "{}" },
 	}), true);
 	assert.equal(ownerResponseLeaks({
-		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supe…", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "Bearer ••••", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
 	}), false);
 	assert.equal(ownerResponseLeaks({ fingerprints: { url: "0123456789ab", key: null } }), false);
 	assert.equal(ownerResponseLeaks({ token_hash: "ab".repeat(32) }), false);
+});
+
+test("a token-shaped claim is blanked and the rest of the list is returned", () => {
+	const token = "a2aow_" + "a".repeat(20);
+	const setup = "https://card.example/card.json?t=" + "c".repeat(16);
+	const userinfo = "https://user:secret@card.example/card.json";
+	const raw = {
+		pending: [
+			{ userCode: "WDJB-4827", clientName: token, clientId: "barry-alias", agentCardUrl: setup },
+			{ userCode: "BCDF-2345", clientName: "Barry Bot", clientId: token, agentCardUrl: "https://barry.example/card.json" },
+			{ client_name: token, agent_card_url: userinfo },
+		],
+		token,
+	};
+	assert.equal(ownerResponseLeaks(raw), true);
+	const scrubbed = scrubOwnerClaims(raw) as { pending: { clientName: string; clientId: string; agentCardUrl: string; client_name?: string; agent_card_url?: string }[]; token: string };
+	assert.equal(scrubbed.pending[0]!.clientName, "");
+	assert.equal(scrubbed.pending[0]!.clientId, "barry-alias");
+	assert.equal(scrubbed.pending[0]!.agentCardUrl, "");
+	assert.equal(scrubbed.pending[1]!.clientName, "Barry Bot");
+	assert.equal(scrubbed.pending[1]!.clientId, "");
+	assert.equal(scrubbed.pending[1]!.agentCardUrl, "https://barry.example/card.json");
+	assert.equal(scrubbed.pending[2]!.client_name, "");
+	assert.equal(scrubbed.pending[2]!.agent_card_url, "");
+	assert.equal(scrubbed.token, token);
+	assert.equal(ownerResponseLeaks(scrubbed), true, "a real token under another key is still withheld");
+	const listed = scrubOwnerClaims({ pending: raw.pending });
+	assert.equal(ownerResponseLeaks(listed), false);
+	assert.equal(JSON.stringify(listed).includes(token), false);
+	assert.equal(JSON.stringify(listed).includes("t=" + "c".repeat(16)), false);
+	assert.equal(JSON.stringify(listed).includes("user:secret"), false);
 });

package/worker/test/pairing.test.ts

@@ -3,6 +3,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import worker from "../src/index.ts";
+import { DASHBOARD_ACTOR_HEADER } from "../src/owner-rpc.ts";
 import * as P from "../src/pairing.ts";
 import { wakeSummary, renderWake, type WakeEvent } from "../src/wake.ts";
 import { d1 } from "./d1.ts";
@@ -221,10 +222,13 @@ test("human approval: pending, slow_down, page approve with the password, single
 	advance(16);
 	assert.equal((await s.poll(d.device_code)).data.error, "authorization_pending");
 
-	// human mode: the owner API (the agent) cannot approve
+	// human mode: the owner API (the agent) cannot approve, and the dashboard header does not change that
 	const oa = await s.owner("POST", `/owner/pairing/${d.user_code}/approve`);
 	assert.equal(oa.status, 403);
 	assert.match(oa.data.error, /approval mode is human: the owner approves on https:\/\/agent\.example\.com\/device\?user_code=/);
+	const spoofed = await s.call("POST", `/owner/pairing/${d.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
+	assert.equal(spoofed.status, 403);
+	assert.match(spoofed.data.error, /approval mode is human/);
 	const list = await s.owner("GET", "/owner/pairing");
 	assert.deepEqual([list.data.mode, list.data.passwordSet, list.data.pending.length, list.data.pending[0].userCode], ["human", false, 1, d.user_code]);
 
@@ -289,10 +293,19 @@ test("human approval: pending, slow_down, page approve with the password, single
 });
 
 test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => { lines.push(args.map((part) => String(part)).join(" ")); orig(...args); };
+	t.after(() => { console.log = orig; });
 	const s = setup({ PAIRING_APPROVAL: "agent" }); t.after(s.restore);
 	const first = (await s.start({ client_name: "tester-alpha", client_id: "other-alias" }, "203.0.113.40")).data;
-	const approved = await s.owner("POST", `/owner/pairing/${first.user_code}/approve`);
+	const approved = await s.call("POST", `/owner/pairing/${first.user_code}/approve`, { headers: { authorization: "Bearer owner-secret", [DASHBOARD_ACTOR_HEADER]: "human" } });
 	assert.equal(approved.data.label, "tester-alpha");
+	const decided = s.DB.db.prepare("SELECT decided_by FROM device_requests WHERE user_code = ?").get(first.user_code.replace("-", "")) as { decided_by: string };
+	assert.equal(decided.decided_by, "agent");
+	const logged = lines.find((line) => line.includes("pairing_approved"));
+	assert.match(logged ?? "", /"by":"agent"/);
+	assert.equal((logged ?? "").includes('"by":"human"'), false);
 	const token = (await s.poll(first.device_code)).data.access_token;
 	const sent = await s.call("POST", "/", {
 		json: { jsonrpc: "2.0", id: 1, method: "SendMessage", params: { message: { role: "ROLE_USER", parts: [{ text: "hello" }] } } },
@@ -681,3 +694,63 @@ test("GET / with pairing off: no /device link, says to ask the operator", async
 	assert.match(h.text, /ask this agent's operator for a bearer token/);
 	assert.equal((await s.call("GET", "/")).data.pairing, undefined);
 });
+
+test("owner summary counts tasks and pending pairing requests without their text", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const started = await s.start();
+	assert.equal(started.status, 200);
+	const issued = await s.owner("POST", "/owner/peers", { label: "ada" });
+	assert.match(issued.data.token, /^a2aow_/);
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m1", parts: [{ kind: "text", text: "secret plan from ada" }] } } },
+		headers: { authorization: `Bearer ${issued.data.token}` },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const taskId = sent.data.result.id;
+	const pending = JSON.stringify({ taskIds: [taskId] });
+	const now = Date.now();
+	s.DB.db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)").run("ctx-keep", now, pending, now);
+	const summary = await s.owner("GET", "/owner/summary");
+	assert.equal(summary.status, 200);
+	assert.equal(summary.data.tasks.submitted, 1);
+	assert.equal(summary.data.tasks.working, 0);
+	assert.equal(summary.data.pairingPending, 1);
+	const text = JSON.stringify(summary.data);
+	assert.equal(text.includes("secret plan"), false);
+	assert.equal(text.includes(started.data.user_code), false);
+	assert.equal(text.includes(started.data.device_code), false);
+	assert.equal(text.includes(taskId), false);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
+});
+
+test("owner log lists history without data_json and does not clear a pending wake", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const issued = await s.owner("POST", "/owner/peers", { label: "ada" });
+	assert.match(issued.data.token, /^a2aow_/);
+	const pasted = "a2aow_" + "b".repeat(20);
+	const owner = "a2aot_" + "Q".repeat(43);
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m-log", parts: [{ kind: "text", text: "hello from ada" }] } } },
+		headers: { authorization: `Bearer ${issued.data.token}` },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const taskId = sent.data.result.id;
+	const pending = JSON.stringify({ taskIds: [taskId] });
+	const now = Date.now();
+	s.DB.db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)").run("ctx-keep", now, pending, now);
+	const secret = JSON.stringify({ token: pasted, messageId: "m-log" });
+	s.DB.db.prepare("UPDATE history SET text = ?, data_json = ? WHERE dir = 'in'").run(`hello ${pasted} and ${owner} there`, secret);
+	const log = await s.owner("GET", "/owner/log");
+	assert.equal(log.status, 200);
+	const text = JSON.stringify(log.data);
+	assert.match(text, /hello \[redacted\] and \[redacted\] there/);
+	assert.equal(text.includes(pasted), false);
+	assert.equal(text.includes(owner), false);
+	assert.equal(text.includes(secret), false);
+	assert.equal(text.includes("data_json"), false);
+	assert.equal(text.includes('"data"'), false);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
+	const inbox = await s.owner("GET", "/owner/inbox");
+	assert.equal(inbox.status, 200);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, null);
+});