@sleep2agi/commhub-server 0.8.6 → 0.8.8-preview.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.8.6",
+  "version": "0.8.8-preview.0",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and 17 MCP tools.",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -168,6 +168,15 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_tasks_from ON tasks(from_name);
   CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
   CREATE INDEX IF NOT EXISTS idx_tasks_created ON tasks(created_at);
+  -- #248 — composite index for the dashboard chat-panel history query
+  -- (/api/tasks?to_name=X&limit=30 ORDER BY created_at DESC). Without it
+  -- SQLite walks every row for the alias via idx_tasks_to and sorts in
+  -- memory; on an active node with thousands of tasks that's O(N log N)
+  -- per panel open. The composite ordered DESC lets the planner stop
+  -- after LIMIT rows — O(log N + LIMIT). Idempotent migration; safe to
+  -- ship — existing single-column idx_tasks_to is kept (other paths
+  -- use it and we don't need the risk of dropping it).
+  CREATE INDEX IF NOT EXISTS idx_tasks_to_created ON tasks(to_name, created_at DESC);
 `);
 
 // nodes table (V2 Sprint 2) — persistent node identity, separate from runtime sessions

package/src/index.ts

@@ -533,6 +533,8 @@ Bun.serve({
       const token = requestToken(req);
       const authCtx = resolveRequestAuth(req);
       const scopedNetId = authCtx?.networkId || url.searchParams.get("network_id");
+
+      // ── Path 1: legacy AUTH_TOKEN (master token) — unchanged ──
       if (!authCtx && isLegacyAuthToken(req)) {
         if (scopedNetId) {
           const session = db.get<any>(
@@ -543,17 +545,74 @@ Bun.serve({
         }
         return createSSEStream(sessionName, scopedNetId);
       }
-      if (!token?.startsWith("ntok_") || !authCtx || !scopedNetId) {
-        return withCors(req, Response.json({ ok: false, error: "network-scoped token required for SSE" }, { status: 403 }));
+
+      // ── Path 2: ntok_ (network-bound agent token) — pre-#247 behavior preserved ──
+      if (token?.startsWith("ntok_")) {
+        if (!authCtx || !scopedNetId) {
+          return withCors(req, Response.json({ ok: false, error: "network-scoped token required for SSE" }, { status: 403 }));
+        }
+        const role = getUserNetworkRole(authCtx.userId, scopedNetId);
+        if (!role) return withCors(req, Response.json({ ok: false, error: "not a member of this network" }, { status: 403 }));
+        const session = db.get<any>(
+          "SELECT 1 FROM sessions WHERE alias = ?1 AND network_id = ?2",
+          sessionName, scopedNetId
+        );
+        if (!session && authCtx.networkId !== scopedNetId) {
+          return withCors(req, Response.json({ ok: false, error: "session not in requested network" }, { status: 403 }));
+        }
+        return createSSEStream(sessionName, scopedNetId);
+      }
+
+      // ── Path 3 (#247): utok_ (user token, dashboard SSE path) — 4 gates ──
+      //
+      // Pre-#247 the only V3 path required `ntok_` and rejected `utok_` outright,
+      // which locked the dashboard out of SSE (the dashboard proxy authenticates
+      // with the user's `utok_`). That broke real-time chat updates — replies
+      // were persisted but never live-pushed to the UI.
+      //
+      // Auth-scoping rules (all four must pass — see #247 design):
+      //   gate 1: token resolves to a valid user context (authCtx non-null)
+      //   gate 2: network scope is explicit — `utok_` has no implicit network,
+      //           so the caller must pass `?network_id=<id>`
+      //   gate 3: user is a member of that network (any role: owner / admin / member)
+      //   gate 4: channel-ownership — one of:
+      //           (a) sessionName === own username (the dashboard's default channel —
+      //               `send_reply` pushes to the original sender's alias which equals
+      //               the dashboard user's username; NO `sessions` row required for
+      //               this branch since the dashboard user is not a registered agent)
+      //           (b) sessionName is an existing agent alias in `scopedNetId`
+      //               (lets members monitor agents within their network)
+      //
+      // Security: rule 4(a) uses strict equality, so a `utok_` user cannot subscribe
+      // to another user's username channel (no cross-user eavesdrop). Rule 4(b) is
+      // scoped to `scopedNetId` + gate 3 membership, so cross-network eavesdrop is
+      // blocked too. There is intentionally NO org-admin bypass — even users with
+      // global `admin` role must be a member of the network they want to listen on.
+      if (!authCtx) {
+        return withCors(req, Response.json({ ok: false, error: "auth required" }, { status: 403 }));
+      }
+      if (!scopedNetId) {
+        return withCors(req, Response.json({
+          ok: false,
+          error: "network_id required (utok has no implicit network; pass ?network_id=<id>)"
+        }, { status: 403 }));
+      }
+      const utokRole = getUserNetworkRole(authCtx.userId, scopedNetId);
+      if (!utokRole) {
+        return withCors(req, Response.json({ ok: false, error: "not a member of this network" }, { status: 403 }));
+      }
+      if (sessionName === authCtx.username) {
+        return createSSEStream(sessionName, scopedNetId);
       }
-      const role = getUserNetworkRole(authCtx.userId, scopedNetId);
-      if (!role) return withCors(req, Response.json({ ok: false, error: "not a member of this network" }, { status: 403 }));
-      const session = db.get<any>(
+      const utokSession = db.get<any>(
         "SELECT 1 FROM sessions WHERE alias = ?1 AND network_id = ?2",
         sessionName, scopedNetId
       );
-      if (!session && authCtx.networkId !== scopedNetId) {
-        return withCors(req, Response.json({ ok: false, error: "session not in requested network" }, { status: 403 }));
+      if (!utokSession) {
+        return withCors(req, Response.json({
+          ok: false,
+          error: "channel not allowed: must be your username or an existing agent in your network"
+        }, { status: 403 }));
       }
       return createSSEStream(sessionName, scopedNetId);
     }
@@ -1904,6 +1963,12 @@ Bun.serve({
       const toName = url.searchParams.get("to_name");
       const fromName = url.searchParams.get("from_name");
       const limit = Math.min(Number(url.searchParams.get("limit")) || 50, 200);
+      // #248 — opt-out of the stats GROUP-BY scan. The dashboard chat panel
+      // never consumes `stats`; it's a global per-status table scan that
+      // dominates the request time on a large DB (270 MB / many tasks).
+      // Existing callers that don't pass `skip_stats=1` get the same
+      // {ok, tasks, count, stats} shape — backwards-compatible.
+      const skipStats = url.searchParams.get("skip_stats") === "1";
 
       let sql = "SELECT * FROM tasks WHERE 1=1";
       const params: any[] = [];
@@ -1916,6 +1981,9 @@ Bun.serve({
       params.push(limit);
 
       const rows = db.all(sql, ...params);
+      if (skipStats) {
+        return withCors(req, Response.json({ ok: true, tasks: rows, count: rows.length }));
+      }
       const statsParams: any[] = [];
       let statsSql = "SELECT status, COUNT(*) as count FROM tasks WHERE 1=1";
       statsSql = addNetworkScope(statsSql, statsParams, restScope);