a2a-exposed 0.7.19 → 0.7.20

package/lib/feedback.mjs

@@ -1,5 +1,6 @@
 // Feedback: post to a hosted control plane when this inbox points at one, otherwise print a GitHub issue link.
 import os from "node:os";
+import readline from "node:readline/promises";
 import { CliError } from "./a2a.mjs";
 import * as C from "./config.mjs";
 
@@ -12,14 +13,42 @@ const TOKEN_RE = /(?:a2aow_|s2a_|a2amcp_|a2amcpr_|a2aot_)[A-Za-z0-9_-]{20,}/g;
 const SETUP_RE = /([?&])t=[A-Za-z0-9_-]{16,}/g;
 const USERINFO_RE = /([a-z][a-z0-9+.-]*:\/\/)[^/?\s]*@/gi;
 const BEARER_RE = /bearer\s+\S{8,200}/gi;
+const PEM_RE = /-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )?PRIVATE KEY-----|$)/g;
+const API_KEY_RE = /(?:(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|\bAKIA[0-9A-Z]{16}\b|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\brk_(?:live|test)_[A-Za-z0-9]{10,}|\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|\bAIza[0-9A-Za-z_-]{35}\b)/g;
 
-/** Same shapes as the Worker's scrubSecretText, plus a Bearer value. */
+/** Same shapes as the Worker's scrubSecretText, plus a Bearer value, a PEM private key, and common API-key prefixes. */
 export function scrubFeedbackText(value) {
 	return String(value ?? "")
 		.replace(TOKEN_RE, "[redacted]")
 		.replace(SETUP_RE, "$1t=[redacted]")
 		.replace(USERINFO_RE, "$1[redacted]@")
-		.replace(BEARER_RE, "Bearer [redacted]");
+		.replace(BEARER_RE, "Bearer [redacted]")
+		.replace(PEM_RE, "[redacted]")
+		.replace(API_KEY_RE, "[redacted]");
+}
+
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+/** The repository that will receive the issue. The prefilled form is ISSUE_REPO. A hosted post uses the control plane's name. */
+export function publicIssueWarning(repo = ISSUE_REPO) {
+	const name = typeof repo === "string" && REPO_RE.test(repo) && repo.length <= 100 && !repo.includes("..") ? repo : ISSUE_REPO;
+	return `This report is filed as a public GitHub issue on ${name}. Do not include confidential information: secrets, tokens, owner or pairing tokens, private URLs or hostnames, message contents, or personal data.`;
+}
+
+export const PUBLIC_ISSUE_WARNING = publicIssueWarning(ISSUE_REPO);
+
+/** Print the public-issue warning. On a terminal, wait for y or yes unless `yes` is set. Off a terminal, `--yes` is required. */
+export async function confirmPublicIssue(yes, input = process.stdin, output = process.stderr, repo = ISSUE_REPO) {
+	output.write(`${publicIssueWarning(repo)}\n`);
+	if (yes) return;
+	if (!input.isTTY) throw new CliError("feedback files a public GitHub issue; pass --yes to send it");
+	const rl = readline.createInterface({ input, output });
+	try {
+		const answer = (await rl.question("File this public issue? [y/N] ")).trim().toLowerCase();
+		if (answer !== "y" && answer !== "yes") throw new CliError("feedback not sent");
+	} finally {
+		rl.close();
+	}
 }
 
 const ENVIRONMENTS = ["local", "cloud VM", "CI", "cloud agent sandbox", "other"];
@@ -163,6 +192,51 @@ async function readJson(response) {
 	try { return await response.json(); } catch { return null; }
 }
 
+function namedRepo(value) {
+	const repo = typeof value === "string" ? value.trim() : "";
+	if (!REPO_RE.test(repo) || repo.length > 100 || repo.includes("..")) return "";
+	return repo;
+}
+
+/**
+ * Repository named in the warning before a report is sent.
+ * No hosted endpoint: the prefilled form on ISSUE_REPO.
+ * Hosted: GET /api/feedback must return `{ repo }`. A missing name does not guess ISSUE_REPO.
+ */
+export async function feedbackPublicRepo(input) {
+	const base = String(input.baseUrl || "").replace(/\/$/, "");
+	const token = String(input.ownerToken || "");
+	const call = input.fetchImpl ?? fetch;
+	if (!base || !token) return ISSUE_REPO;
+	let probe;
+	try {
+		probe = await call(`${base}/owner/feedback`, {
+			headers: { accept: "application/json", authorization: `Bearer ${token}` },
+			redirect: "error",
+			signal: AbortSignal.timeout(5000),
+		});
+	} catch {
+		probe = null;
+	}
+	const info = probe && probe.ok ? await readJson(probe) : null;
+	if (!info || info.hosted !== true || !feedbackUrlOk(info.url)) return ISSUE_REPO;
+	let named;
+	try {
+		named = await call(info.url, {
+			method: "GET",
+			headers: { accept: "application/json" },
+			redirect: "error",
+			signal: AbortSignal.timeout(5000),
+		});
+	} catch {
+		named = null;
+	}
+	const body = named && named.ok ? await readJson(named) : null;
+	const repo = namedRepo(body?.repo);
+	if (!repo) throw new CliError("the control plane did not name the public repository; feedback was not sent");
+	return repo;
+}
+
 /**
  * Post when GET /owner/feedback says this inbox is hosted and names an https /api/feedback URL.
  * A missing inbox, a probe failure, or a 404 prints the prefilled issue URL. 400, 429, and 5xx throw.

package/lib/main.mjs

@@ -209,16 +209,23 @@ Feedback
   feedback "message" [--kind bug|idea|other] [--contact x]
             [--steps S] [--expected S] [--actual S] [--logs S] [--agent A]
             [--environment local|cloud VM|CI|cloud agent sandbox|other]
-            [--connection webhook|proxy|polling]
+            [--connection webhook|proxy|polling] [--yes]
                                 report a bug or an idea. A bug needs --steps.
+                                The report is a public GitHub issue. The warning names
+                                the repository before it sends. A hosted inbox uses the
+                                control plane's FEEDBACK_REPO. Otherwise the link opens
+                                the form on telegraphic-dev/a2a-exposed. Do not include
+                                confidential information: secrets, tokens, owner or pairing
+                                tokens, private URLs or hostnames, message contents, or
+                                personal data. Prints that warning and asks before sending,
+                                unless --yes is set. Off a terminal, --yes is required.
                                 Posts to the control plane when this inbox is hosted and that
                                 plane accepts feedback. Otherwise prints a link to the bug
                                 report form and does not open a browser. The CLI adds its
                                 version, the inbox Worker version when the inbox reports it,
                                 the OS, the Node version, the connection (webhook, proxy, or
                                 polling), and hosted or self-hosted. --connection overrides
-                                that detection. Don't put tokens, passwords, or keys in the
-                                message. Remove them from --logs too.
+                                that detection. Remove tokens from the message and from --logs.
 
 Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
 Config: ${C.CONFIG_FILE}  (override dir with --config-dir DIR or A2A_CONFIG_DIR; env vars override file values)
@@ -246,7 +253,7 @@ const SPEC = {
 	signup: { "control-url": S, json: B },
 	login: { "control-url": S, json: B },
 	pair: { json: B, web: B, ttl: S, issuer: S, "client-id": S, subjects: S, methods: S, "secret-stdin": B },
-	feedback: { kind: S, contact: S, steps: S, expected: S, actual: S, logs: S, agent: S, environment: S, connection: S },
+	feedback: { kind: S, contact: S, steps: S, expected: S, actual: S, logs: S, agent: S, environment: S, connection: S, yes: B },
 };
 const STATES = ["completed", "input-required", "failed", "rejected", "working"];
 
@@ -336,6 +343,9 @@ export async function main(argv) {
 			const kind = o.kind || "other";
 			if (!fb.KINDS.includes(kind)) throw new CliError("--kind must be bug, idea, or other");
 			if (o.connection && !fb.CONNECTIONS.includes(o.connection)) throw new CliError("--connection must be webhook, proxy, or polling");
+			if (kind === "bug" && !String(o.steps || "").trim()) throw new CliError("a bug report needs reproduction steps (--steps)");
+			const repo = await fb.feedbackPublicRepo({ baseUrl: C.get("A2A_BASE_URL"), ownerToken: C.get("A2A_OWNER_TOKEN") });
+			await fb.confirmPublicIssue(Boolean(o.yes), undefined, undefined, repo);
 			const result = await fb.runFeedback({
 				message, kind, contact: o.contact || "", version: VERSION,
 				steps: o.steps || "", expected: o.expected || "", actual: o.actual || "", logs: o.logs || "",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.19",
+	"version": "0.7.20",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/feedback.ts

@@ -6,10 +6,49 @@ import type { TenantContext } from "./tenancy.ts";
 import { VERSION } from "./version.ts";
 
 export const ISSUE_REPO = "telegraphic-dev/a2a-exposed";
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+/** Name the repository that receives the issue. The prefilled form uses ISSUE_REPO. A filed issue uses the repository in its URL. */
+export function publicIssueNote(repo: string): string {
+	const name = REPO_RE.test(repo) && !repo.includes("..") ? repo : ISSUE_REPO;
+	return `This report is filed as a public GitHub issue on ${name}. Do not include confidential information: secrets, tokens, owner or pairing tokens, private URLs or hostnames, message contents, or personal data.`;
+}
+
+export const PUBLIC_ISSUE_NOTE = publicIssueNote(ISSUE_REPO);
+
+/** Owner/name from a GitHub issue URL or the prefilled new-issue URL. Empty when the URL is not that shape. */
+export function repoFromIssueUrl(value: string): string {
+	try {
+		const url = new URL(value);
+		const match = url.pathname.match(/^\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/issues(?:\/|$)/);
+		if (url.protocol !== "https:" || url.hostname !== "github.com" || url.username || url.password || !match) return "";
+		const repo = `${match[1]}/${match[2]}`;
+		return REPO_RE.test(repo) && !repo.includes("..") ? repo : "";
+	} catch {
+		return "";
+	}
+}
+
+export function feedbackResultText(result: { filed: boolean; issue_url: string }): string {
+	const note = publicIssueNote(repoFromIssueUrl(result.issue_url));
+	return result.filed
+		? `${note}\nFeedback filed: ${result.issue_url}`
+		: `${note}\nFeedback was not filed from here. Open this link to create the issue:\n${result.issue_url}`;
+}
+
+/** Tool description. A repository is named only when this call already knows it. A hosted inbox learns the name from the issue URL in the result. */
+export function feedbackToolDescription(repo: string): string {
+	const note = REPO_RE.test(repo) && !repo.includes("..")
+		? publicIssueNote(repo)
+		: "This report is filed as a public GitHub issue on this deployment's configured feedback repository. The result names that repository. Do not include confidential information: secrets, tokens, owner or pairing tokens, private URLs or hostnames, message contents, or personal data.";
+	return `${note} Redact before sending. Report a bug or an idea about this inbox to its developers. A bug requires reproduction steps. Include exact commands, error output with tokens and secrets removed, which agent you are, and where you run (local, cloud VM, CI, cloud agent sandbox, or other). Version, connection (webhook, proxy, or polling), and deployment (hosted or self-hosted) are filled by the inbox when you omit them. When this deployment does not file the report, the result is a link to the bug report form. You do not open a browser.`;
+}
 /** Inbox build. The same value as `version` in cli/package.json. */
 export const WORKER_VERSION = VERSION;
 const TIMEOUT_MS = 5000;
 const BEARER_RE = /bearer\s+\S{8,200}/gi;
+const PEM_RE = /-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )?PRIVATE KEY-----|$)/g;
+const API_KEY_RE = /(?:(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|\bAKIA[0-9A-Z]{16}\b|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\brk_(?:live|test)_[A-Za-z0-9]{10,}|\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|\bAIza[0-9A-Za-z_-]{35}\b)/g;
 const KINDS = ["bug", "idea", "other"] as const;
 const CONNECTIONS = ["webhook", "proxy", "polling"] as const;
 const ENVIRONMENTS = ["local", "cloud VM", "CI", "cloud agent sandbox", "other"] as const;
@@ -36,9 +75,12 @@ export interface FeedbackNote {
 	logs?: string;
 }
 
-/** scrubSecretText, then a Bearer value. The rest of the text stays. */
+/** scrubSecretText, then a Bearer value, a PEM private key, and common API-key prefixes. The rest of the text stays. */
 export function scrubFeedbackText(value: string): string {
-	return scrubSecretText(value).replace(BEARER_RE, "Bearer [redacted]");
+	return scrubSecretText(value)
+		.replace(BEARER_RE, "Bearer [redacted]")
+		.replace(PEM_RE, "[redacted]")
+		.replace(API_KEY_RE, "[redacted]");
 }
 
 /**

package/worker/src/index.ts

@@ -2414,9 +2414,7 @@ async function runTool(ctx: TenantContext, ectx: ExecutionContext, name: string,
 				connection: argStr(a, "connection", false),
 				deployment: argStr(a, "deployment", false),
 			});
-			return result.filed
-				? `Feedback filed: ${result.issue_url}`
-				: `Feedback was not filed from here. Open this link to create the issue:\n${result.issue_url}`;
+			return Fb.feedbackResultText(result);
 		}
 	}
 	throw new ToolError(`unknown tool ${name}`);
@@ -2430,6 +2428,12 @@ const mcpInstructions = `This is your A2A inbox: other agents send you tasks her
 const unsupportedVersion = (id: Json, requested: string) =>
 	rpcError(id, M.ERR.UNSUPPORTED_VERSION, "Unsupported protocol version", 400, { supported: M.PROTOCOL_VERSIONS, requested });
 
+/** Hosted feedback is filed on FEEDBACK_REPO, which this inbox does not know until the issue URL comes back. Do not name the prefilled-form repository in that description. */
+function mcpTools(ctx: TenantContext) {
+	if (!Fb.feedbackEndpoint(ctx)) return M.TOOLS;
+	return M.TOOLS.map((tool) => tool.name === "send_feedback" ? { ...tool, description: Fb.feedbackToolDescription("") } : tool);
+}
+
 /** One tools/call, shared by both eras. */
 async function callTool(ctx: TenantContext, ectx: ExecutionContext, grant: Json, params: Json): Promise<{ error?: [number, string]; result?: Json }> {
 	const name = String(params.name || "");
@@ -2501,7 +2505,7 @@ async function handleMcp(req: Request, ctx: TenantContext, ectx: ExecutionContex
 			case "server/discover":
 				return done({ supportedVersions: M.PROTOCOL_VERSIONS, capabilities: { tools: {} }, instructions: mcpInstructions, ttlMs: M.LIST_TTL_MS, cacheScope: "private" });
 			case "tools/list":
-				return done({ tools: M.TOOLS, ttlMs: M.LIST_TTL_MS, cacheScope: "private" });
+				return done({ tools: mcpTools(ctx), ttlMs: M.LIST_TTL_MS, cacheScope: "private" });
 			case "tools/call": {
 				const r = await callTool(ctx, ectx, grant, params);
 				return r.error ? rpcError(id, r.error[0], r.error[1]) : done(r.result);
@@ -2530,7 +2534,7 @@ async function handleMcp(req: Request, ctx: TenantContext, ectx: ExecutionContex
 				capabilities: { tools: { listChanged: false } }, serverInfo: serverInfo(ctx), instructions: mcpInstructions });
 		}
 		case "ping": return rpcResult(id, {});
-		case "tools/list": return rpcResult(id, { tools: M.TOOLS });
+		case "tools/list": return rpcResult(id, { tools: mcpTools(ctx) });
 		case "tools/call": {
 			const r = await callTool(ctx, ectx, grant, params);
 			return r.error ? rpcError(id, r.error[0], r.error[1]) : rpcResult(id, r.result);

package/worker/src/mcp.ts

@@ -3,6 +3,7 @@
 // metadata. Pure helpers live here; the routes (D1, approval password, owner API) are in index.ts.
 import { esc } from "./pairing.ts";
 import { isPrivateHost } from "./a2a.ts";
+import { feedbackToolDescription, ISSUE_REPO } from "./feedback.ts";
 import { derivePeerKey } from "./tenancy.ts";
 
 export const SCOPE = "inbox";
@@ -286,7 +287,7 @@ export const TOOLS: { name: string; title: string; description: string; inputSch
 		description: "Agents asking to connect to this inbox (read-only). Show your human who is asking, the code and the link; NEVER approve or deny on your own: your human decides on the /device link with their approval password. The names and card URLs are claimed by the requester (untrusted).",
 		inputSchema: { type: "object", properties: {}, additionalProperties: false } },
 	{ name: "send_feedback", title: "Send feedback", annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-		description: "Report a bug or an idea about this inbox to its developers. A bug requires reproduction steps. Include exact commands, error output with tokens and secrets removed, which agent you are, and where you run (local, cloud VM, CI, cloud agent sandbox, or other). Version, connection (webhook, proxy, or polling), and deployment (hosted or self-hosted) are filled by the inbox when you omit them. Do not include tokens, passwords, or keys. When this deployment does not file the report, the result is a link to the bug report form. You do not open a browser.",
+		description: feedbackToolDescription(ISSUE_REPO),
 		inputSchema: { type: "object", properties: {
 			message: str("What happened, at most 4000 characters. Include the exact commands you ran."),
 			kind: str("bug, idea, or other. A bug requires steps.", { enum: ["bug", "idea", "other"] }),

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.7.19";
+export const VERSION = "0.7.20";

package/worker/test/feedback.test.ts

@@ -3,7 +3,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import worker, { dispatch } from "../src/index.ts";
 import { sha256 } from "../src/a2a.ts";
-import { connectionOf, feedbackEndpoint, feedbackIssueUrl, scrubFeedbackText, sendFeedback, WORKER_VERSION } from "../src/feedback.ts";
+import { connectionOf, feedbackEndpoint, feedbackIssueUrl, feedbackResultText, feedbackToolDescription, scrubFeedbackText, sendFeedback, WORKER_VERSION } from "../src/feedback.ts";
 import { readFileSync } from "node:fs";
 import { hostedTenantContext, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
@@ -38,9 +38,12 @@ async function call(env: WorkerBindings, path: string, headers: Record<string, s
 
 test("scrubFeedbackText removes token shapes and Bearer values", () => {
 	const token = "a2aow_" + "b".repeat(24);
-	const text = scrubFeedbackText(`token ${token} and Bearer supersecretvalue stay out`);
+	const pem = "-----BEGIN RSA PRIVATE KEY-----\nSECRETKEYMATERIAL\n-----END RSA PRIVATE KEY-----";
+	const text = scrubFeedbackText(`token ${token} and Bearer supersecretvalue stay out ${pem} AKIAIOSFODNN7EXAMPLE`);
 	assert.equal(text.includes(token), false);
 	assert.equal(text.includes("supersecretvalue"), false);
+	assert.equal(text.includes("SECRETKEYMATERIAL"), false);
+	assert.equal(text.includes("AKIAIOSFODNN7EXAMPLE"), false);
 	assert.match(text, /\[redacted\]/);
 	assert.match(text, /Bearer \[redacted\]/);
 });
@@ -88,6 +91,18 @@ test("GET /owner/feedback is hosted only for a hosted tenant", async () => {
 	assert.deepEqual(await res.json(), { hosted: true, url: "https://control.example.com/api/feedback", version: WORKER_VERSION, connection: "polling" });
 });
 
+test("the public-issue note names the repository in the issue URL", () => {
+	const filed = feedbackResultText({ filed: true, issue_url: "https://github.com/example-org/example-repo/issues/4" });
+	assert.match(filed, /public GitHub issue on example-org\/example-repo/);
+	assert.equal(filed.includes("telegraphic-dev/a2a-exposed"), false);
+	assert.match(filed, /Feedback filed: https:\/\/github.com\/example-org\/example-repo\/issues\/4/);
+	const form = feedbackResultText({ filed: false, issue_url: feedbackIssueUrl({ title: "hi" }) });
+	assert.match(form, /public GitHub issue on telegraphic-dev\/a2a-exposed/);
+	assert.match(feedbackToolDescription(""), /configured feedback repository/);
+	assert.equal(feedbackToolDescription("").includes("telegraphic-dev/a2a-exposed"), false);
+	assert.match(feedbackToolDescription("example-org/example-repo"), /public GitHub issue on example-org\/example-repo/);
+});
+
 test("sendFeedback does not call out from a self-hosted inbox", async () => {
 	const ctx = resolveTenant(selfEnv({ FEEDBACK_URL: "https://control.example.com" }));
 	const result = await sendFeedback(ctx, { message: "hello", kind: "other", contact: "", version: "" }, () => {

package/worker/test/mcp.test.ts

@@ -342,6 +342,8 @@ test("send_feedback returns a GitHub issue link and strips tokens", async (t) =>
 		message: `dropped a task ${token}`, kind: "bug", steps: `ran ${token}`, agent: "Claude Code", environment: "cloud agent sandbox",
 	});
 	assert.equal(r.isError, false);
+	assert.match(r.content[0].text, /public GitHub issue on telegraphic-dev\/a2a-exposed/);
+	assert.match(r.content[0].text, /confidential information/);
 	const link = r.content[0].text.split("\n").pop() ?? "";
 	const url = new URL(link);
 	assert.equal(`${url.origin}${url.pathname}`, "https://github.com/telegraphic-dev/a2a-exposed/issues/new");
@@ -357,6 +359,8 @@ test("send_feedback returns a GitHub issue link and strips tokens", async (t) =>
 	assert.equal(url.searchParams.get("version"), `worker ${WORKER_VERSION}`);
 	assert.equal((url.searchParams.get("message") ?? "").includes("hook.example.net"), false);
 	const listed = (await s.mcp(a.access_token, "tools/list")).data.result.tools.find((tool: { name: string }) => tool.name === "send_feedback");
+	assert.match(listed.description, /public GitHub issue on telegraphic-dev\/a2a-exposed/);
+	assert.match(listed.description, /Redact before sending/);
 	assert.match(listed.description, /exact commands/);
 	assert.match(listed.description, /filled by the inbox/);
 	assert.match(listed.inputSchema.properties.steps.description, /Remove tokens and secrets/);