a2a-exposed 0.7.13 → 0.7.14

package/lib/main.mjs

@@ -182,8 +182,17 @@ Control plane account (only when that deployment's login is on)
                                 browser can follow the redirect. Buttons say Continue with that
                                 provider. Until the check finishes they stay muted and the page says
                                 Waiting for the check…. A reused token says The check expired. Please try again.
-                                After sign-in, /app shows the account and its agents. Sign out is on that
-                                page. Creating an agent shows the owner token once. That page is not stored.
+                                After sign-in, /app shows the account and its agents. Each name opens
+                                that agent's page: MCP connectors (revoke needs a recent sign-in), a
+                                message log that does not mark tasks seen, and a SQL download that
+                                replaces a pasted owner token and leaves other credential material out. Peer times are labeled UTC. A pairing
+                                token shows its code. An empty outbound list notes that peers the CLI
+                                added locally are not shown. Sign out is on that
+                                page. Creating an agent shows the owner token once. The agent page rotates
+                                that token after a confirmation and a recent sign-in. The new token is
+                                shown once on that agent's page. The previous one stops working immediately.
+                                The token is shown only when the stored hash is still that token.
+                                That page is not stored.
                                 FREE_AGENT_LIMIT=2 caps a free account at 2 agents. An account's own limit overrides it.
                                 Unset, there is no limit. The database rejects another insert.
                                 SIGNUP_ALLOWLIST, when set, admits only those verified emails. Unset, sign-in stays open.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.13",
+	"version": "0.7.14",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/export.ts

@@ -92,15 +92,80 @@ export async function exportRows(db: SqlDb, now = new Date()): Promise<ExportFil
 	return { format: "a2a-exposed-export", version: 1, exportedAt: now.toISOString(), tables };
 }
 
-/** DELETE then INSERT for every allowlisted table. Safe to run on a database that already has the schema. */
-export function toSql(file: ExportFile): string {
+/** Live-credential tables. A dashboard SQL copy skips them so the script does not delete rows it does not return. */
+export const REDACTED_SQL_SKIP = ["oauth_codes", "oidc_txns"] as const;
+
+const OMIT_COLUMNS: Record<string, readonly string[]> = {
+	tasks: ["push_configs_json"],
+	outbound: ["push_token_hash"],
+	mcp_grants: ["access_hash", "refresh_hash"],
+	outbound_peers: ["token_enc"],
+	device_requests: ["replaces_hash"],
+};
+
+const SETUP_SUB = /([?&])t=[A-Za-z0-9_-]{16,}/g;
+const USERINFO_SUB = /([a-z][a-z0-9+.-]*:\/\/)[^/?\s]*@/gi;
+
+/** Replace a peer token, a hosted owner token (`a2aot_`), a setup secret, or URL userinfo. The rest of the text stays. */
+export function scrubSecretText(value: string): string {
+	const tokens = /(?:a2aow_|s2a_|a2amcp_|a2amcpr_|a2aot_)[A-Za-z0-9_-]{20,}/g;
+	return value.replace(tokens, "[redacted]").replace(SETUP_SUB, "$1t=[redacted]").replace(USERINFO_SUB, "$1[redacted]@");
+}
+
+function placeholder(table: string, row: Record<string, unknown>, index: number): string {
+	const label = table === "peers" ? row.label : row.user_code;
+	const suffix = typeof label === "string" && label ? label : String(index);
+	return `redacted:${suffix}`;
+}
+
+/**
+ * A copy of `file` safe to show on the dashboard.
+ * Nullable credential columns are removed, including `device_requests.replaces_hash` (the hash of the token a re-pair would replace).
+ * `peers.token_hash` and `device_requests.device_hash` are NOT NULL, so they become `redacted:…` (not the hash, and not a token that authenticates).
+ * `oauth_codes` and `oidc_txns` are emptied. The approval-password row and the password-setup row (its value is the hash of the live setup token) are removed.
+ * Token-shaped text, including a hosted owner token (`a2aot_`), is scrubbed. The input is not changed: the CLI dump stays complete.
+ */
+export function redactExport(file: ExportFile): ExportFile {
+	if (file.format !== "a2a-exposed-export" || file.version !== 1) throw new ExportError("export: bad file");
+	if (!/^[\dTZ:.-]+$/.test(file.exportedAt)) throw new ExportError("export: bad timestamp");
+	const tables: ExportFile["tables"] = {};
+	for (const name of EXPORT_TABLES) {
+		if ((REDACTED_SQL_SKIP as readonly string[]).includes(name)) {
+			tables[name] = [];
+			continue;
+		}
+		const omit = new Set(OMIT_COLUMNS[name] ?? []);
+		const rows: Record<string, unknown>[] = [];
+		for (const [index, row] of (file.tables[name] ?? []).entries()) {
+			if (name === "settings" && (row.key === "approval_password" || row.key === "password_setup")) continue;
+			const out: Record<string, unknown> = {};
+			for (const [key, value] of Object.entries(row)) {
+				if (omit.has(key) || key.toLowerCase() === "replaces_hash") continue;
+				if ((name === "peers" && key === "token_hash") || (name === "device_requests" && key === "device_hash")) {
+					out[key] = placeholder(name, row, index);
+					continue;
+				}
+				out[key] = typeof value === "string" ? scrubSecretText(value) : value;
+			}
+			delete out.replaces_hash;
+			rows.push(out);
+		}
+		tables[name] = rows;
+	}
+	return { format: "a2a-exposed-export", version: 1, exportedAt: file.exportedAt, tables };
+}
+
+/** DELETE then INSERT for every allowlisted table. Safe to run on a database that already has the schema. `skip` leaves those tables out of the script. */
+export function toSql(file: ExportFile, options?: { skip?: readonly string[] }): string {
 	if (file.format !== "a2a-exposed-export" || file.version !== 1) throw new ExportError("export: bad file");
 	if (!/^[\dTZ:.-]+$/.test(file.exportedAt)) throw new ExportError("export: bad timestamp");
+	const skip = new Set(options?.skip ?? []);
 	const lines = [
 		`-- a2a-exposed-export ${file.version}`,
 		`-- exported_at ${file.exportedAt}`,
 	];
 	for (const name of EXPORT_TABLES) {
+		if (skip.has(name)) continue;
 		lines.push(`DELETE FROM ${quoteIdent(name)};`);
 		for (const row of file.tables[name] ?? []) {
 			const cols = Object.keys(row);

package/worker/src/index.ts

@@ -12,7 +12,7 @@ import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
 import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
-import { exportRows, toSql } from "./export.ts";
+import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
 import * as O from "./approval-oidc.ts";
 type Json = any;
@@ -1146,6 +1146,27 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		const rows = await ctx.DB.prepare("SELECT context_id, COUNT(*) AS entries, MAX(ts) AS last FROM history GROUP BY context_id ORDER BY last DESC LIMIT 100").all();
 		return json(rows.results);
 	}
+	if (seg[0] === "log" && !seg[1] && m === "GET") {
+		// Recent history, newest first. Unlike GET /owner/inbox this does not clear a pending wake, and it does not return data_json.
+		const clip = (v: unknown, max: number) => typeof v === "string" ? scrubSecretText(v).slice(0, max) : null;
+		const rows = await ctx.DB.prepare(
+			"SELECT seq, context_id, ts, dir, peer, task_id, role, state, event, text FROM history ORDER BY seq DESC LIMIT 100",
+		).all();
+		return json({
+			entries: (rows.results as Json[]).map((r) => ({
+				seq: typeof r.seq === "number" ? r.seq : Number(r.seq),
+				contextId: clip(r.context_id, 200),
+				ts: clip(r.ts, 40),
+				dir: clip(r.dir, 16),
+				peer: clip(r.peer, 200),
+				taskId: clip(r.task_id, 200),
+				role: clip(r.role, 32),
+				state: clip(r.state, 32),
+				event: clip(r.event, 64),
+				text: clip(r.text, 2000),
+			})),
+		});
+	}
 	if (seg[0] === "export" && !seg[1] && m === "GET") {
 		const file = await exportRows(ctx.DB);
 		if (url.searchParams.get("format") === "sql") {
@@ -2138,7 +2159,9 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 		const u = new URL(ctx.PUBLIC_URL);
 		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
 	} catch { /* the handler reads the path, not this origin */ }
-	const url = new URL(origin + matched.route.path + matched.route.search);
+	// format=sql is text/plain on the HTTP API. The RPC always reads the JSON dump, then redacts, then builds SQL.
+	const search = matched.route.path === "/owner/export" ? "" : matched.route.search;
+	const url = new URL(origin + matched.route.path + search);
 	const headers = new Headers({ "content-type": "application/json" });
 	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
 	const req = new Request(url, { method: matched.route.method, headers });
@@ -2151,7 +2174,22 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
 		return { status, body: { error } };
 	}
-	const data = scrubOwnerClaims(await res.json().catch(() => null));
+	let data = scrubOwnerClaims(await res.json().catch(() => null));
+	if (matched.route.path === "/owner/export" && res.ok && data && typeof data === "object") {
+		try {
+			const file = redactExport(data as Parameters<typeof redactExport>[0]);
+			data = matched.route.search === "?format=sql"
+				? {
+					exportedAt: file.exportedAt,
+					sql: "-- Dashboard copy. This is not a backup. Do not load it onto a live inbox.\n"
+						+ "-- Stored token hashes are replaced with redacted: values that do not authenticate, or left out. Ciphertext, push tokens, re-pair hashes, OAuth codes, the approval-password hash, password-setup hashes, and OpenID Connect sign-in rows are omitted.\n"
+						+ toSql(file, { skip: REDACTED_SQL_SKIP }),
+				}
+				: file;
+		} catch {
+			return refuse(500, "response withheld", "secret");
+		}
+	}
 	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
 	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
 	return { status: res.status, body: data };

package/worker/src/owner-rpc.ts

@@ -1,7 +1,7 @@
 // Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
 // the account owns the tenant. This list is the only paths that call may run, and it is stricter than
-// the owner HTTP API: routes that mint a peer token, return a setup secret, accept a plaintext peer
-// token, or dump credential material (export) are not here. Self-host never calls this.
+// the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
+// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first. Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
 import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
@@ -15,7 +15,9 @@ const ALIAS = /^[A-Za-z0-9_.-]{1,64}$/;
 /** Display form WDJB-4827 or the stored form WDJB4827. Vowels and 0/1 are not in a real code. */
 const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-?[2-9]{4}$/i;
 
-const TOKEN_RE = /^(?:a2aow_|s2a_|a2amcp_|a2amcpr_)[A-Za-z0-9_-]{20,}$/;
+/** Peer tokens, MCP tokens, and the hosted owner token (`a2aot_`). */
+export const TOKEN_PREFIXES = ["a2aow_", "s2a_", "a2amcp_", "a2amcpr_", "a2aot_"] as const;
+const TOKEN_RE = new RegExp(`^(?:${TOKEN_PREFIXES.join("|")})[A-Za-z0-9_-]{20,}$`);
 const SETUP_RE = /(?:\?|&)t=[A-Za-z0-9_-]{16,}/;
 const USERINFO_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?\s]*@/i;
 /** A non-empty string under one of these keys is a secret, even when it is not a token shape. */
@@ -110,6 +112,14 @@ function historyQuery(q: Record<string, string>): string | null {
 	return `?n=${q.n}`;
 }
 
+/** `format=sql` is the only export query. The RPC still calls the JSON handler and redacts before building SQL. */
+function exportQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "format") return null;
+	if (q.format === undefined) return "";
+	if (q.format !== "sql") return null;
+	return "?format=sql";
+}
+
 interface RouteDef {
 	method: "GET" | "POST" | "DELETE";
 	name: string;
@@ -138,6 +148,8 @@ const ROUTES: RouteDef[] = [
 	{ method: "GET", name: "GET /owner/wake/preview", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "preview", search: noQuery, path: () => "/owner/wake/preview" },
 	{ method: "POST", name: "POST /owner/wake/test", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "test", search: noQuery, path: () => "/owner/wake/test" },
 	{ method: "GET", name: "GET /owner/contexts", take: (s) => s.length === 2 && s[1] === "contexts", search: noQuery, path: () => "/owner/contexts" },
+	{ method: "GET", name: "GET /owner/log", take: (s) => s.length === 2 && s[1] === "log", search: noQuery, path: () => "/owner/log" },
+	{ method: "GET", name: "GET /owner/export", take: (s) => s.length === 2 && s[1] === "export", search: exportQuery, path: () => "/owner/export" },
 ];
 
 /** Method + path (+ query) on the owner RPC allowlist, or why it is not. */

package/worker/test/export.test.ts

@@ -10,7 +10,8 @@ import { Miniflare, convertV4MiniflareOptions } from "miniflare";
 import worker from "../src/index.ts";
 import { d1 } from "./d1.ts";
 import { sha256 } from "../src/a2a.ts";
-import { exportRows, toSql, bookmarkForTime, restoreBookmark, restartAfterResult, ExportError, EXPORT_TABLES, RESTORE_RESTART_DELAY_MS } from "../src/export.ts";
+import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql, bookmarkForTime, restoreBookmark, restartAfterResult, ExportError, EXPORT_TABLES, RESTORE_RESTART_DELAY_MS } from "../src/export.ts";
+import { ownerResponseLeaks, TOKEN_PREFIXES } from "../src/owner-rpc.ts";
 import { doSqlD1, type SqlStorageLike, type TxRunner } from "../src/storage.ts";
 import { backupDatabase, backupDirectory, exportTenantSql, hostedDailyBackup, olderThanRetention, pruneSnapshots, snapshotKey, DAILY_CRON, type R2BucketLike } from "../src/backup.ts";
 import { namespaceForRegion, type DoNamespace } from "../src/tenancy.ts";
@@ -70,6 +71,121 @@ test("export SQL writes a NUL byte as char(0) so the script stays valid", () =>
 	assert.equal(hex.h, Buffer.from(raw, "utf8").toString("hex").toUpperCase());
 });
 
+test("redactExport drops credential material and leaves the full dump unchanged", async () => {
+	const DB = db();
+	const now = "2026-10-11T00:00:00.000Z";
+	const token = "a2aow_" + "a".repeat(20);
+	const owner = "a2aot_" + "Q".repeat(43);
+	const hash = "ab".repeat(32);
+	const replaces = "cd".repeat(32);
+	const setupHash = "ef".repeat(32);
+	const setup = "c".repeat(16);
+	await DB.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('ada', ?, ?)").bind(hash, now).run();
+	await DB.prepare("INSERT INTO history (context_id, ts, dir, text) VALUES ('ctx-1', ?, 'in', ?)").bind(now, `see ${token} and ${owner} at https://user:secret@hooks.example/wake?t=${setup}`).run();
+	await DB.prepare("INSERT INTO history (context_id, ts, dir, text) VALUES ('ctx-owner', ?, 'in', ?)").bind(now, owner).run();
+	await DB.prepare("INSERT INTO tasks (id, context_id, peer, state, protocol, created_at, updated_at, status_json, artifacts_json, push_configs_json) VALUES ('task-1', 'ctx-1', 'ada', 'submitted', '1.0', ?, ?, '{}', '[]', ?)").bind(now, now, JSON.stringify([{ token }])).run();
+	await DB.prepare("INSERT INTO outbound (task_id, context_id, peer, push_token_hash, sent_at, task_json) VALUES ('task-1', 'ctx-1', 'ada', 'push-hash-secret', ?, ?)").bind(now, JSON.stringify({ token })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('approval_password', ?)").bind(JSON.stringify({ hash: "x".repeat(40) })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('password_setup', ?)").bind(JSON.stringify({ hash: setupHash, createdMs: 1, expiresMs: 2, failures: 0 })).run();
+	await DB.prepare("INSERT INTO settings (key, value) VALUES ('theme', 'kept')").run();
+	await DB.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s, replaces_label, replaces_hash) VALUES ('device-hash-secret', 'WDJB4827', 'pending', 1, 2, 5, 'ada', ?)").bind(replaces).run();
+	await DB.prepare("INSERT INTO oauth_codes (code_hash, client_id, redirect_uri, code_challenge, scope, resource, created_ms, expires_ms) VALUES ('code-hash', 'client', 'https://client.example/cb', 'challenge-secret-value', 'mcp', 'https://agent.example/mcp', 1, 2)").run();
+	await DB.prepare("INSERT INTO mcp_grants (label, client_id, scope, access_hash, refresh_hash, created_at) VALUES ('mcp-claude', 'client', 'mcp', 'access-hash-secret', 'refresh-hash-secret', ?)").bind(now).run();
+	await DB.prepare("INSERT INTO outbound_peers (alias, url, token_enc, created_at, updated_at) VALUES ('ada', 'https://ada.example', 'ciphertext-secret-value', ?, ?)").bind(now, now).run();
+	await DB.prepare("INSERT INTO oidc_txns (state, nonce, verifier, kind, csrf, payload_json, expires_ms) VALUES ('state-1', 'nonce-1', 'verifier-secret-value', 'device', 'csrf-secret-value', '{}', 1)").run();
+	const file = await exportRows(DB, new Date(now));
+	const redacted = redactExport(file);
+	assert.equal(file.tables.peers?.[0]?.token_hash, hash, "the CLI dump still has the hash");
+	assert.equal(file.tables.device_requests?.[0]?.replaces_hash, replaces);
+	assert.equal(file.tables.settings?.some((row) => row.key === "password_setup"), true);
+	assert.equal(file.tables.oidc_txns?.[0]?.verifier, "verifier-secret-value");
+	assert.equal(redacted.tables.peers?.[0]?.token_hash, "redacted:ada");
+	assert.equal(redacted.tables.peers?.[0]?.label, "ada");
+	assert.equal(redacted.tables.device_requests?.[0]?.device_hash, "redacted:WDJB4827");
+	assert.equal(redacted.tables.device_requests?.[0]?.replaces_hash, undefined);
+	assert.equal(redacted.tables.device_requests?.[0]?.replaces_label, "ada");
+	assert.equal(redacted.tables.device_requests?.[0]?.user_code, "WDJB4827");
+	assert.equal(redacted.tables.tasks?.[0]?.push_configs_json, undefined);
+	assert.equal(redacted.tables.outbound?.[0]?.push_token_hash, undefined);
+	assert.equal(redacted.tables.outbound?.[0]?.task_json, JSON.stringify({ token: "[redacted]" }));
+	assert.equal(redacted.tables.mcp_grants?.[0]?.access_hash, undefined);
+	assert.equal(redacted.tables.mcp_grants?.[0]?.refresh_hash, undefined);
+	assert.equal(redacted.tables.mcp_grants?.[0]?.label, "mcp-claude");
+	assert.equal(redacted.tables.outbound_peers?.[0]?.token_enc, undefined);
+	assert.equal(redacted.tables.outbound_peers?.[0]?.alias, "ada");
+	assert.deepEqual(redacted.tables.oauth_codes, []);
+	assert.deepEqual(redacted.tables.oidc_txns, []);
+	assert.deepEqual(redacted.tables.settings?.map((row) => row.key), ["theme"]);
+	const history = redacted.tables.history ?? [];
+	assert.equal(history.find((row) => row.context_id === "ctx-1")?.text, "see [redacted] and [redacted] at https://[redacted]@hooks.example/wake?t=[redacted]");
+	assert.equal(history.find((row) => row.context_id === "ctx-owner")?.text, "[redacted]");
+	const dumped = JSON.stringify(redacted);
+	for (const secret of [token, owner, hash, replaces, setupHash, "device-hash-secret", "ciphertext-secret-value", "verifier-secret-value", "csrf-secret-value", "challenge-secret-value", "access-hash-secret", "refresh-hash-secret", "push-hash-secret", "approval_password", "password_setup", "user:secret", `t=${setup}`]) {
+		assert.equal(dumped.includes(secret), false, secret);
+	}
+	assert.equal(ownerResponseLeaks(owner), true);
+	assert.equal(ownerResponseLeaks(redacted), false, "a pasted hosted owner token is redacted, so the dashboard export is returned");
+	const sql = toSql(redacted, { skip: REDACTED_SQL_SKIP });
+	assert.match(sql, /redacted:ada/);
+	assert.equal(sql.includes("oauth_codes"), false);
+	assert.equal(sql.includes("oidc_txns"), false);
+	assert.equal(sql.includes("replaces_hash"), false);
+	assert.equal(sql.includes("password_setup"), false);
+	assert.equal(ownerResponseLeaks({ sql }), false);
+	for (const secret of [token, owner, hash, replaces, setupHash]) {
+		assert.equal(sql.includes(secret), false, secret);
+	}
+	assert.match(toSql(file), /verifier-secret-value/);
+	assert.match(toSql(file), new RegExp(hash));
+	assert.match(toSql(file), /replaces_hash/);
+});
+
+test("scrubSecretText redacts a hosted owner token on the log and export paths", () => {
+	assert.ok(TOKEN_PREFIXES.includes("a2aot_"));
+	for (const prefix of TOKEN_PREFIXES) {
+		const token = prefix + "Q".repeat(43);
+		assert.equal(scrubSecretText(`see ${token} end`), "see [redacted] end", prefix);
+		assert.equal(scrubSecretText(token), "[redacted]", prefix);
+		assert.equal(ownerResponseLeaks(token), true, prefix);
+	}
+	const owner = "a2aot_" + "Q".repeat(43);
+	const redacted = redactExport({
+		format: "a2a-exposed-export",
+		version: 1,
+		exportedAt: "2026-10-11T00:00:00.000Z",
+		tables: { history: [{ context_id: "ctx-owner", ts: "2026-10-11T00:00:00.000Z", dir: "in", text: owner }] },
+	});
+	assert.equal(redacted.tables.history?.[0]?.text, "[redacted]");
+	assert.equal(toSql(redacted, { skip: REDACTED_SQL_SKIP }).includes(owner), false);
+	assert.equal(ownerResponseLeaks(redacted), false);
+});
+
+test("redactExport removes device_requests.replaces_hash", () => {
+	const replaces = "cd".repeat(32);
+	const redacted = redactExport({
+		format: "a2a-exposed-export",
+		version: 1,
+		exportedAt: "2026-10-11T00:00:00.000Z",
+		tables: {
+			device_requests: [{
+				device_hash: "device-hash-secret",
+				user_code: "WDJB4827",
+				status: "pending",
+				replaces_label: "ada",
+				replaces_hash: replaces,
+			}],
+		},
+	});
+	const row = redacted.tables.device_requests?.[0] ?? {};
+	assert.equal(Object.hasOwn(row, "replaces_hash"), false);
+	assert.equal(row.replaces_label, "ada");
+	assert.equal(row.device_hash, "redacted:WDJB4827");
+	const sql = toSql(redacted, { skip: REDACTED_SQL_SKIP });
+	assert.equal(sql.includes("replaces_hash"), false);
+	assert.equal(sql.includes(replaces), false);
+	assert.equal(JSON.stringify(redacted).includes(replaces), false);
+});
+
 test("exportRows reads every application table in one batch", async () => {
 	const DB = db();
 	await DB.prepare("INSERT INTO peers (label, token_hash, created_at) VALUES ('ada', 'h', 't')").run();

package/worker/test/hosted.test.ts

@@ -221,7 +221,14 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 
 	// workerd's local runtime throws "Jurisdiction restrictions are not implemented" on namespace.jurisdiction().
 	// namespaceForRegion() is covered in tenancy.test.ts; production Durable Objects do honour eu / fedramp.
-	await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
+	const tokenA2 = "owner-alice-2";
+	const hashA2 = await sha256(tokenA2);
+	const rotated = await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA2, config: { AGENT_NAME: "Alice 3" } });
+	assert.equal(rotated.applied, true);
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA}`)).status, 401, "the previous owner token stops working");
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", `Bearer ${tokenA2}`)).status, 200);
+	assert.equal((await call("https://alice.example.com/owner/summary", "GET", "Bearer platform-owner")).status, 401, "self-host OWNER_TOKEN still does not unlock a tenant");
+	await alice.stub.pushConfig({ version: 5, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA2, config: { AGENT_NAME: "Alice 3" } });
 	assert.equal((await mf.dispatchFetch("https://alice.example.com/health")).status, 403, "the object enforces a newer status than the directory cache");
 });
 
@@ -586,8 +593,42 @@ test("TenantStore.owner runs an allowlisted owner call and does not return a pee
 
 	const setup = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/password-link" });
 	assert.equal(setup.status, 404);
+	const pasted = "a2aow_" + "b".repeat(20);
+	const sentPaste = await http("POST", "/", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 2, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-paste", parts: [{ kind: "text", text: `note ${pasted} end` }] } },
+	});
+	assert.equal(sentPaste.status, 200, await sentPaste.clone().text());
+	const httpExport = await (await http("GET", "/owner/export", "Bearer owner-carol")).json() as { tables?: { peers?: { token_hash?: string }[] } };
+	assert.match(httpExport.tables?.peers?.[0]?.token_hash ?? "", /^[0-9a-f]{64}$/);
+	assert.equal(JSON.stringify(httpExport).includes(pasted), true, "the owner HTTP export stays the full dump");
 	const dumped = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export" });
-	assert.equal(dumped.status, 404);
+	assert.equal(dumped.status, 200);
+	const dumpedText = JSON.stringify(dumped.body);
+	assert.match(dumpedText, /"token_hash":"redacted:ada"/);
+	assert.match(dumpedText, /note \[redacted\] end/);
+	assert.equal(dumpedText.includes(pasted), false);
+	assert.equal(dumpedText.includes(issued.token ?? ""), false);
+	assert.equal(dumpedText.includes("tenant-secret-value"), false);
+	assert.equal(dumpedText.includes(httpExport.tables?.peers?.[0]?.token_hash ?? "missing-hash"), false);
+	const sqlDump = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export", query: { format: "sql" } });
+	assert.equal(sqlDump.status, 200);
+	const sql = (sqlDump.body as { sql?: string }).sql ?? "";
+	assert.match(sql, /note \[redacted\] end/);
+	assert.match(sql, /redacted:ada/);
+	assert.match(sql, /Do not load it onto a live inbox/);
+	assert.equal(sql.includes(pasted), false);
+	assert.equal(sql.includes("oauth_codes"), false);
+	assert.equal(sql.includes("oidc_txns"), false);
+	assert.equal(sql.includes(issued.token ?? ""), false);
+	const badFormat = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export", query: { format: "json" } });
+	assert.equal(badFormat.status, 400);
+	const logged = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/log" });
+	assert.equal(logged.status, 200);
+	const loggedText = JSON.stringify(logged.body);
+	assert.match(loggedText, /note \[redacted\] end/);
+	assert.equal(loggedText.includes(pasted), false);
+	assert.equal(loggedText.includes("data_json"), false);
 	const oddQuery = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/inbox", query: { format: "sql" } });
 	assert.equal(oddQuery.status, 400);
 	const pairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });

package/worker/test/owner-rpc.test.ts

@@ -29,13 +29,19 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(ok("GET", "/owner/wake/preview")?.name, "GET /owner/wake/preview");
 	assert.equal(ok("POST", "/owner/wake/test")?.name, "POST /owner/wake/test");
 	assert.equal(ok("GET", "/owner/contexts")?.name, "GET /owner/contexts");
+	assert.equal(ok("GET", "/owner/log")?.name, "GET /owner/log");
+	assert.equal(ok("GET", "/owner/export")?.name, "GET /owner/export");
+	assert.equal(ok("GET", "/owner/export", { format: "sql" })?.search, "?format=sql");
 
 	const refused = (method: string, path: string, query?: Record<string, string>) => matchOwnerRpc(method, path, query);
 	assert.deepEqual(refused("POST", "/owner/peers"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/pairing/password-link"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("PUT", "/owner/pairing/password"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("PUT", "/owner/outbound-peers/ada"), { ok: false, reason: "path" });
-	assert.deepEqual(refused("GET", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/export", { format: "json" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/export", { format: "sql", n: "1" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("POST", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/log", { n: "10" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
@@ -54,6 +60,7 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 
 test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	const token = "a2aow_" + "a".repeat(43);
+	assert.equal(ownerResponseLeaks("a2aot_" + "Q".repeat(43)), true);
 	assert.equal(ownerResponseLeaks({ label: "ada", revoked_at: null }), false);
 	assert.equal(ownerResponseLeaks([{ text: "hello" }]), false);
 	assert.equal(ownerResponseLeaks({ token }), true);

package/worker/test/pairing.test.ts

@@ -722,3 +722,35 @@ test("owner summary counts tasks and pending pairing requests without their text
 	assert.equal(text.includes(taskId), false);
 	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
 });
+
+test("owner log lists history without data_json and does not clear a pending wake", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const issued = await s.owner("POST", "/owner/peers", { label: "ada" });
+	assert.match(issued.data.token, /^a2aow_/);
+	const pasted = "a2aow_" + "b".repeat(20);
+	const owner = "a2aot_" + "Q".repeat(43);
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m-log", parts: [{ kind: "text", text: "hello from ada" }] } } },
+		headers: { authorization: `Bearer ${issued.data.token}` },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const taskId = sent.data.result.id;
+	const pending = JSON.stringify({ taskIds: [taskId] });
+	const now = Date.now();
+	s.DB.db.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES (?, ?, ?, ?)").run("ctx-keep", now, pending, now);
+	const secret = JSON.stringify({ token: pasted, messageId: "m-log" });
+	s.DB.db.prepare("UPDATE history SET text = ?, data_json = ? WHERE dir = 'in'").run(`hello ${pasted} and ${owner} there`, secret);
+	const log = await s.owner("GET", "/owner/log");
+	assert.equal(log.status, 200);
+	const text = JSON.stringify(log.data);
+	assert.match(text, /hello \[redacted\] and \[redacted\] there/);
+	assert.equal(text.includes(pasted), false);
+	assert.equal(text.includes(owner), false);
+	assert.equal(text.includes(secret), false);
+	assert.equal(text.includes("data_json"), false);
+	assert.equal(text.includes('"data"'), false);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, pending);
+	const inbox = await s.owner("GET", "/owner/inbox");
+	assert.equal(inbox.status, 200);
+	assert.equal(s.DB.db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").get("ctx-keep")?.pending_json, null);
+});