a2a-exposed 0.8.40 → 0.8.42

package/worker/test/wake-retry.test.ts

@@ -127,3 +127,45 @@ test("unsigned OpenBot owner test/preview and inbound wake never contact the web
 	assert.equal(message.body.error, undefined, "stored inbox message succeeds without a wake");
 	assert.equal(calls, 0);
 });
+
+
+test("MausBot retries keep their key, later messages and verification tests get new keys", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret",
+		WAKE_PRESET: "mausbot", WAKE_WEBHOOK_URL: "https://hooks.example.com/hooks/wh_test", WAKE_WEBHOOK_KEY: "dummy-secret", WAKE_DEBOUNCE_SECONDS: "0", WAKE_BUSY_SECONDS: "0" };
+	const sent: any[] = [];
+	let answer = 429;
+	const original = globalThis.fetch;
+	globalThis.fetch = (async (_url: any, init: any) => { sent.push(init); return new Response("{}", { status: answer, headers: { "retry-after": "30" } }); }) as typeof fetch;
+	t.after(() => { globalThis.fetch = original; });
+	const call = async (method: string, path: string, body?: any, auth = "Bearer owner-secret") => {
+		const pending: Promise<unknown>[] = [];
+		const response = await worker.fetch(new Request(BASE + path, { method, headers: { authorization: auth, "content-type": "application/json" }, body: body ? JSON.stringify(body) : undefined }) as any,
+			env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		await Promise.allSettled(pending);
+		return { status: response.status, body: await response.json() as any };
+	};
+	const preview = await call("GET", "/owner/wake/preview");
+	assert.equal(preview.status, 200);
+	assert.equal(preview.body.request.headers.authorization, "Bearer ••••");
+	assert.ok(!JSON.stringify(preview.body).includes(env.WAKE_WEBHOOK_KEY));
+	const peer = await call("POST", "/owner/peers", { label: "maus-test" });
+	const msg = (id: string, taskId?: string) => call("POST", "/", { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: id, contextId: "ctx-maus", ...(taskId ? { taskId } : {}), parts: [{ kind: "text", text: "same text" }] } } }, `Bearer ${peer.body.token}`);
+	const first = await msg("m1");
+	assert.equal(sent.length, 1);
+	answer = 202;
+	// Advance only the saved retry deadline, without changing the global clock.
+	await env.DB.prepare("UPDATE wakes SET last_sent_ms = ? WHERE context_id = ?").bind(Date.now() - 1000, "ctx-maus").run();
+	await call("GET", "/health");
+	assert.equal(sent.length, 2);
+	assert.equal(sent[0].headers["idempotency-key"], sent[1].headers["idempotency-key"]);
+	await msg("m2", first.body.result.id);
+	assert.equal(sent.length, 3);
+	assert.notEqual(sent[2].headers["idempotency-key"], sent[1].headers["idempotency-key"]);
+	await call("POST", "/owner/wake/test");
+	await call("POST", "/owner/wake/test");
+	assert.notEqual(sent[3].headers["idempotency-key"], sent[4].headers["idempotency-key"]);
+	delete env.WAKE_WEBHOOK_KEY;
+	assert.equal((await call("GET", "/owner/wake/preview")).status, 400);
+	assert.equal((await call("POST", "/owner/wake/test")).body.status, null);
+	assert.equal(sent.length, 5, "no unsigned request leaves the Worker");
+});

package/worker/test/wake.test.ts

@@ -106,7 +106,7 @@ test("generic: invalid template throws", () => {
 
 test("every preset renders valid JSON", async () => {
 	for (const p of PRESETS) {
-		const r = (await renderWake({ preset: p, url: "https://x/y", key: "k", hmacSecret: "s" }, ev))!;
+		const r = (await renderWake({ preset: p, url: "https://x/hooks/wh_test", key: "k", hmacSecret: "s" }, ev))!;
 		JSON.parse(r.body);
 	}
 });
@@ -151,7 +151,7 @@ const ACCESS = { accessClientId: "abc123.access", accessClientSecret: "s3cr3t-va
 
 test("Access service-token headers are added for every preset, next to the preset's own auth", async () => {
 	for (const preset of PRESETS) {
-		const r = (await renderWake({ preset, url: "https://wake-x.example.com/hooks/wake", key: "k1", hmacSecret: "h1", ...ACCESS }, ev))!;
+		const r = (await renderWake({ preset, url: "https://wake-x.example.com/hooks/wh_test", key: "k1", hmacSecret: "h1", ...ACCESS }, ev))!;
 		assert.equal(r.headers["CF-Access-Client-Id"], "abc123.access", preset);
 		assert.equal(r.headers["CF-Access-Client-Secret"], "s3cr3t-value-0123456789", preset);
 		if (preset === "hermes") assert.ok(r.headers["X-Webhook-Signature-V2"], "hermes keeps its HMAC");
@@ -227,3 +227,36 @@ test("OpenBot assigns a fresh delivery ID to every rendered attempt", async () =
 	const second = (await renderWake(cfg, ev))!;
 	assert.notEqual(first.headers["x-openbot-delivery-id"], second.headers["x-openbot-delivery-id"]);
 });
+
+
+test("mausbot: Bearer JSON, bounded peer preview, stable delivery identity and masked credentials", async () => {
+	const cfg = { preset: "mausbot", url: "https://hooks.example.com/hooks/wh_example", key: "dummy-mausbot-secret" };
+	const event = { ...ev, preview: '雪 "quoted"\n'.repeat(100), deliveryId: "wake-1" };
+	const first = (await renderWake(cfg, event, { requestId: "attempt-1" }))!;
+	const retry = (await renderWake(cfg, event, { requestId: "attempt-2" }))!;
+	assert.equal(first.headers.authorization, "Bearer dummy-mausbot-secret");
+	assert.equal(first.headers["content-type"], "application/json");
+	assert.equal(first.headers["idempotency-key"], "t-2:wake-1");
+	assert.equal(retry.headers["idempotency-key"], first.headers["idempotency-key"]);
+	assert.deepEqual(JSON.parse(first.body), wakePayload(event, "npx -y a2a-exposed@latest"));
+	assert.equal(JSON.parse(first.body).preview.length, 300);
+	assert.equal(JSON.parse(first.body).deliveryId, undefined);
+	assert.equal(redact(first).headers.authorization, "Bearer ••••");
+	assert.ok(!JSON.stringify(redact(first)).includes(cfg.key));
+	const update = (await renderWake(cfg, { ...event, kind: "outbound_update", deliveryId: "wake-2" }))!;
+	assert.notEqual(update.headers["idempotency-key"], first.headers["idempotency-key"]);
+	assert.match(JSON.parse(update.body).hint, /history ctx-1 --from peer-a/);
+	const test1 = (await renderWake(cfg, { ...ev, kind: "test", taskId: "none" }))!;
+	const test2 = (await renderWake(cfg, { ...ev, kind: "test", taskId: "none" }))!;
+	assert.notEqual(test1.headers["idempotency-key"], test2.headers["idempotency-key"], "verification test must not suppress the enabled test");
+});
+
+test("mausbot: rejects unsafe URLs, capability credentials and missing Bearer auth without echoing input", async () => {
+	for (const url of ["http://example.com/hooks/wh_test", "https://user:secret@example.com/hooks/wh_test", "https://example.com/hooks/wh_test/capability-secret", "https://example.com/hooks/wh_test?secret=dummy", "https://example.com/hooks/wh_test#dummy", "not-a-url", "https://example.com/api"]) {
+		await assert.rejects(renderWake({ preset: "mausbot", url, key: "dummy" }, ev), error => error instanceof Error && /MausBot requires an HTTPS/.test(error.message) && !error.message.includes(url));
+	}
+	for (const key of [undefined, "", "   ", "line\nbreak"]) {
+		await assert.rejects(renderWake({ preset: "mausbot", url: "https://example.com/hooks/wh_test", key, hmacSecret: "cannot-replace-bearer" }, ev), /MausBot requires WAKE_WEBHOOK_KEY/);
+	}
+	assert.equal(await renderWake({ preset: "mausbot" }, ev), null);
+});