@sleep2agi/commhub-server 0.8.8-preview.0 → 0.9.0-preview.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.8.8-preview.0",
-  "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and 17 MCP tools.",
+  "version": "0.9.0-preview.0",
+  "description": "CommHub Server \u2014 AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and 17 MCP tools.",
   "type": "module",
   "main": "src/index.ts",
   "bin": {
@@ -13,7 +13,8 @@
   ],
   "scripts": {
     "start": "bun run src/index.ts",
-    "dev": "bun --watch run src/index.ts"
+    "dev": "bun --watch run src/index.ts",
+    "test": "COMMHUB_DB=/tmp/test-commhub-$$.db bun test src/"
   },
   "keywords": [
     "commhub",

package/src/auth.ts

@@ -19,6 +19,14 @@ export interface AuthResult {
   token?: string;           // user token (utok_)
   network_token?: string;   // network token (ntok_) for default network
   network_id?: string;
+  // #261 P0-2 (2026-06-28): true when the logged-in user still has the
+  // bootstrap-default password. The CLI client uses this to print a
+  // prominent "must change password" warning after login succeeds. NOT
+  // a login-blocker — we don't lock out anyone whose deployment ran on
+  // the old `admin/anethub` default (back-compat per 通信龙 spec). The
+  // field is intentionally absent (rather than `false`) on the normal
+  // case so old clients don't even see it.
+  must_change_password?: boolean;
 }
 
 function validatePasswordStrength(password: string, label = "password"): string | null {
@@ -93,7 +101,7 @@ export function register(username: string, password: string, email?: string, dis
 
 export function login(username: string, password: string): AuthResult {
   const user = db.get<any>(
-    "SELECT user_id, username, password_hash, display_name, email, role FROM users WHERE username = ?1",
+    "SELECT user_id, username, password_hash, display_name, email, role, must_change_password FROM users WHERE username = ?1",
     username);
 
   if (!user) return { ok: false, error: "invalid username or password" };
@@ -123,6 +131,9 @@ export function login(username: string, password: string): AuthResult {
     user: { user_id: user.user_id, username: user.username, display_name: user.display_name, email: user.email, role: user.role },
     token,
     network_id: networkId,
+    // #261 P0-2 — only include field when truthy (back-compat; old clients
+    // don't see this field at all unless their account is flagged).
+    ...(user.must_change_password === 1 ? { must_change_password: true } : {}),
   };
 }
 
@@ -277,11 +288,28 @@ export function changePassword(userId: string, oldPassword: string, newPassword:
   const user = db.get<any>("SELECT password_hash FROM users WHERE user_id = ?1", userId);
   if (!user) return { ok: false, error: "user not found" };
   if (user.password_hash !== hashPassword(oldPassword)) return { ok: false, error: "incorrect current password" };
-  db.run("UPDATE users SET password_hash = ?1, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
+  // #261 P0-2 — clearing must_change_password as a side-effect of a real
+  // password change. If the user changes via `anet passwd`, the bootstrap
+  // nudge goes away on next login. SET to 0 explicitly (rather than skip)
+  // so a future flag flip can't drift the state.
+  db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
   const revoked = revokeOtherUserTokens(userId, currentTokenId);
   return { ok: true, revoked };
 }
 
+/**
+ * #261 P0-2 — mark a user as needing to change their password on first
+ * login. Called by the hub-bootstrap path (`anet hub start`) AFTER it
+ * auto-registers the admin with a random bootstrap password. Idempotent.
+ * Returns true if a row was affected (i.e. the user exists), false
+ * otherwise. NOT exposed via any HTTP endpoint — internal-only, called
+ * via direct module import or a local-process SQLite handle.
+ */
+export function markMustChangePassword(userId: string): boolean {
+  const r = db.run("UPDATE users SET must_change_password = 1 WHERE user_id = ?1", [userId]);
+  return r.changes > 0;
+}
+
 export function resetUserPassword(targetUsername: string, callerIsHubAdmin: boolean): { ok: boolean; error?: string; username?: string; user_id?: string; password?: string; token?: string; token_id?: string; revoked?: number } {
   if (!callerIsHubAdmin) return { ok: false, error: "hub admin required" };
   const user = db.get<any>("SELECT user_id, username FROM users WHERE username = ?1", targetUsername);

package/src/cross-tenant-injection.test.ts

@@ -0,0 +1,225 @@
+// Round-5 F1+F2: cross-tenant write/inject guards.
+//
+// All three guards are exercised against a real in-process SQLite
+// (COMMHUB_DB=/tmp/...) so we're not just unit-testing the SQL string,
+// we're proving the rejection actually happens against persisted rows.
+//
+// Setup: two networks (A, B). Create a task in network A with a known
+// task_id. Then drive the three attack vectors below from a session
+// belonging to network B and assert each is blocked.
+//
+// Run with:
+//   COMMHUB_DB=/tmp/xtenant-test.db bun test src/cross-tenant-injection.test.ts
+
+import { describe, expect, test, beforeEach } from "bun:test";
+import { db, uuidv4, chainReplyToParent } from "./db.js";
+
+function insertTask(opts: {
+  task_id?: string;
+  from_name: string;
+  to_name: string;
+  network_id: string | null;
+  status?: string;
+  parent_task_id?: string | null;
+  result?: string | null;
+}): string {
+  const id = opts.task_id ?? uuidv4();
+  db.run(
+    `INSERT INTO tasks (task_id, from_name, to_name, priority, status, content, requires_response, created_at, network_id, parent_task_id, result)
+     VALUES (?1, ?2, ?3, 'normal', ?4, 'test content', 'reply', datetime('now'), ?5, ?6, ?7)`,
+    [id, opts.from_name, opts.to_name, opts.status ?? "delivered", opts.network_id, opts.parent_task_id ?? null, opts.result ?? null]
+  );
+  return id;
+}
+
+function getTask(taskId: string) {
+  return db.get<{ task_id: string; status: string; result: string | null; network_id: string | null }>(
+    "SELECT task_id, status, result, network_id FROM tasks WHERE task_id = ?1",
+    taskId
+  );
+}
+
+function countInbox(toSession: string): number {
+  const row = db.get<{ cnt: number }>(
+    "SELECT COUNT(*) as cnt FROM inbox WHERE session_name = ?1",
+    toSession
+  );
+  return row?.cnt ?? 0;
+}
+
+beforeEach(() => {
+  // Clean slate per test so prior fixtures don't leak across runs.
+  db.run("DELETE FROM tasks");
+  db.run("DELETE FROM inbox");
+  db.run("DELETE FROM task_events");
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// F2 #3 — chainReplyToParent cross-network rejection
+//
+// The unit-level test of the most direct vector: caller in network B
+// holds a child task whose `parent_task_id` points at a parent in
+// network A. Without the fix, chainReplyToParent walks the link and
+// writes `result` + an inbox notification into network A. With the
+// fix, the function refuses to traverse and writes nothing.
+// ─────────────────────────────────────────────────────────────────────
+
+describe("chainReplyToParent — cross-network rejection (round5 F2 #3)", () => {
+  test("blocks chain when parent.network_id != callerNetId", () => {
+    // Network A: a task that should NEVER receive a foreign reply.
+    const parentA = insertTask({
+      from_name: "admin-a",
+      to_name: "worker-a",
+      network_id: "net-A",
+      status: "delivered",
+    });
+    // Network B: a child task that maliciously names parentA as its
+    // parent (the attack — possible because send_task wrote a row,
+    // and B controls the parent_task_id field of its own dispatch
+    // when the F2 #2 guard isn't in place either).
+    const childB = insertTask({
+      from_name: "attacker-b",
+      to_name: "victim-b",
+      network_id: "net-B",
+      status: "replied",
+      parent_task_id: parentA,
+    });
+
+    // Caller is in network B (effectiveNetId = "net-B"). The chain
+    // walks child → parentA, finds parent.network_id="net-A" !=
+    // caller="net-B", refuses to write.
+    chainReplyToParent(childB, "INJECTED PAYLOAD", "replied", 5, "net-B");
+
+    const after = getTask(parentA);
+    expect(after?.result).toBeNull();        // result NOT polluted
+    expect(after?.status).toBe("delivered"); // status NOT bumped
+    expect(countInbox("admin-a")).toBe(0);   // no rogue inbox row
+  });
+
+  test("legitimate same-network chain still works", () => {
+    const parentB = insertTask({
+      from_name: "admin-b",
+      to_name: "worker-b",
+      network_id: "net-B",
+      status: "delivered",
+    });
+    const childB = insertTask({
+      from_name: "child-b",
+      to_name: "leaf-b",
+      network_id: "net-B",
+      status: "replied",
+      parent_task_id: parentB,
+    });
+
+    chainReplyToParent(childB, "legitimate result", "replied", 5, "net-B");
+
+    const after = getTask(parentB);
+    expect(after?.result).toContain("legitimate result");
+    expect(after?.status).toBe("replied");
+    expect(countInbox("admin-b")).toBe(1);
+  });
+
+  test("default-network (null) caller cannot chain into named network", () => {
+    const parentNamed = insertTask({
+      from_name: "admin-x",
+      to_name: "worker-x",
+      network_id: "net-X",
+      status: "delivered",
+    });
+    const childDefault = insertTask({
+      from_name: "stray",
+      to_name: "leaf",
+      network_id: null,
+      status: "replied",
+      parent_task_id: parentNamed,
+    });
+
+    chainReplyToParent(childDefault, "stray payload", "replied", 5, null);
+
+    expect(getTask(parentNamed)?.result).toBeNull();
+    expect(countInbox("admin-x")).toBe(0);
+  });
+
+  test("named-network caller cannot chain into default-network parent", () => {
+    const parentDefault = insertTask({
+      from_name: "admin-default",
+      to_name: "worker-default",
+      network_id: null,
+      status: "delivered",
+    });
+    const childNamed = insertTask({
+      from_name: "named",
+      to_name: "leaf",
+      network_id: "net-Y",
+      status: "replied",
+      parent_task_id: parentDefault,
+    });
+
+    chainReplyToParent(childNamed, "named payload", "replied", 5, "net-Y");
+
+    expect(getTask(parentDefault)?.result).toBeNull();
+    expect(countInbox("admin-default")).toBe(0);
+  });
+
+  test("recursive chain stops at the first cross-network boundary", () => {
+    // 3-level chain: grandparent (net-A) ← parent (net-B) ← child (net-B)
+    // Caller B replies. F2 #3 should write into parent (same net) but
+    // refuse to recurse into grandparent (foreign net).
+    const grandparent = insertTask({
+      from_name: "gp-admin",
+      to_name: "gp-worker",
+      network_id: "net-A",
+      status: "delivered",
+    });
+    const parent = insertTask({
+      from_name: "p-admin",
+      to_name: "p-worker",
+      network_id: "net-B",
+      status: "delivered",
+      parent_task_id: grandparent,
+    });
+    const child = insertTask({
+      from_name: "c",
+      to_name: "leaf",
+      network_id: "net-B",
+      status: "replied",
+      parent_task_id: parent,
+    });
+
+    chainReplyToParent(child, "result", "replied", 5, "net-B");
+
+    // Parent (same network) — chain wrote.
+    expect(getTask(parent)?.result).toContain("result");
+    expect(getTask(parent)?.status).toBe("replied");
+    // Grandparent (foreign network) — chain refused.
+    expect(getTask(grandparent)?.result).toBeNull();
+    expect(getTask(grandparent)?.status).toBe("delivered");
+    expect(countInbox("gp-admin")).toBe(0);
+  });
+
+  test("undefined callerNetId preserves legacy network-blind behaviour", () => {
+    // Internal/server-only callers that have no tenant context can
+    // still call chainReplyToParent without the enforcement (they
+    // pass undefined). This is the back-compat escape hatch.
+    const parent = insertTask({
+      from_name: "internal-admin",
+      to_name: "internal-worker",
+      network_id: "net-A",
+      status: "delivered",
+    });
+    const child = insertTask({
+      from_name: "child",
+      to_name: "leaf",
+      network_id: "net-B",
+      status: "replied",
+      parent_task_id: parent,
+    });
+
+    chainReplyToParent(child, "legacy result", "replied"); // no callerNetId
+
+    // Legacy behaviour: writes through regardless of network mismatch.
+    // Documents the back-compat surface so a future tightening is a
+    // deliberate decision.
+    expect(getTask(parent)?.result).toContain("legacy result");
+  });
+});

package/src/db-adapter.ts

@@ -216,6 +216,25 @@ export class PgAdapter implements DbAdapter {
  * Create the appropriate adapter based on environment.
  * - DATABASE_URL starts with "postgres://" → PgAdapter
  * - Otherwise → SQLiteAdapter with COMMHUB_DB or default path
+ *
+ * Test-default-prod GUARD: when `NODE_ENV === "test"` (set automatically by
+ * `bun test`) AND `COMMHUB_DB` is unset, we REFUSE to fall through to the
+ * default `~/.commhub/commhub.db` path. Several modules (notably
+ * `server/src/auth.ts register()`) write into the configured database at
+ * import-time-side-effect granularity; running their tests against the
+ * production hub DB silently created spurious users / networks / tokens
+ * on 2026-06-23 (4u / 4net / 8tok by one `bun -e` probe + an unknown
+ * pre-existing history of test pollution in the same DB). The guard makes
+ * the failure mode loud + actionable instead of silent + destructive.
+ *
+ * The guard does NOT fire when:
+ *   - COMMHUB_DB is set (the test runner's documented contract); or
+ *   - NODE_ENV is unset (production server) or any non-"test" value.
+ *
+ * Operators who run `bun -e` snippets that touch the DB are expected to
+ * `COMMHUB_DB=/tmp/...` themselves — `bun -e` doesn't set NODE_ENV, so the
+ * guard can't catch that case. The rule (never read or write the
+ * production hub database) is documented in CLAUDE.md.
  */
 export function createAdapter(): DbAdapter {
   const dbUrl = process.env.DATABASE_URL;
@@ -226,6 +245,18 @@ export function createAdapter(): DbAdapter {
   // Default: SQLite
   const { mkdirSync } = require("fs");
   const { dirname } = require("path");
+
+  // Test-default-prod GUARD (see docblock above).
+  if (process.env.NODE_ENV === "test" && !process.env.COMMHUB_DB) {
+    throw new Error(
+      "[commhub] REFUSING to open the default SQLite database under NODE_ENV=test.\n" +
+      "  Tests must explicitly set COMMHUB_DB to a throwaway path so they don't\n" +
+      "  pollute the production hub DB. Run tests via:\n" +
+      "    COMMHUB_DB=/tmp/test-$$.db bun test src/\n" +
+      "  (or use the `npm run test` script which sets this for you)."
+    );
+  }
+
   const dbPath = process.env.COMMHUB_DB || `${process.env.HOME}/.commhub/commhub.db`;
   mkdirSync(dirname(dbPath), { recursive: true });
   console.log(`[commhub] database: ${dbPath}`);

package/src/db.ts

@@ -231,6 +231,21 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
 `);
 
+// #261 P0-2 (2026-06-28): must_change_password flag. Added via ALTER
+// (not in the CREATE block above) so it's a no-op on fresh DBs that
+// already get the column via the CREATE path's full definition AND a
+// pure additive migration on existing prod DBs — column defaults 0
+// for every existing row, so old `admin/anethub` deployments are NOT
+// locked or nudged on upgrade (back-compat per 通信龙 spec). Wrapped
+// in try/catch because SQLite throws "duplicate column" if the column
+// already exists on subsequent restarts (no IF NOT EXISTS syntax for
+// ALTER ADD COLUMN until SQLite 3.35+, can't assume that everywhere).
+try {
+  db.exec(`ALTER TABLE users ADD COLUMN must_change_password INTEGER DEFAULT 0`);
+} catch (e: any) {
+  if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+}
+
 // ── V3: networks table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS networks (
@@ -734,10 +749,37 @@ export function logAudit(userId: string | null, username: string | null, action:
 // 'replied' if it's still open, and post an inbox notification to the parent's
 // originator (so an upstream agent or the dashboard sees the chained answer).
 // Recurse up the chain (in case of N hops).
-export function chainReplyToParent(childTaskId: string, replyText: string, replyStatus: "replied" | "failed" | "cancelled" = "replied", maxDepth = 5): void {
+/**
+ * Auto-chain a sub-task reply up to the parent task lineage.
+ *
+ * `callerNetId` (round5 F2 fix): the network the *caller* (send_reply
+ * / report_completion) is operating in. When supplied, the chain
+ * refuses to traverse into a parent whose `network_id` doesn't match —
+ * blocks cross-tenant write where network B replies to a task they've
+ * named as parent but which actually lives in network A.
+ *
+ * Callers that legitimately need the legacy network-blind behavior
+ * (e.g. server-internal bookkeeping that doesn't have a tenant
+ * context) can omit `callerNetId`, but every MCP tool path MUST
+ * supply it.
+ */
+export function chainReplyToParent(
+  childTaskId: string,
+  replyText: string,
+  replyStatus: "replied" | "failed" | "cancelled" = "replied",
+  maxDepth = 5,
+  callerNetId?: string | null,
+): void {
   let currentChildId: string | null = childTaskId;
   let currentReply = replyText;
   let depth = 0;
+  // Normalize so undefined ("don't enforce") stays distinct from
+  // null ("explicit default network"). Caller passes undefined to
+  // opt out of the cross-tenant check; null to require the parent
+  // also live in the default (null) network.
+  const enforce = callerNetId !== undefined;
+  const callerNorm = callerNetId ?? null;
+
   while (currentChildId && depth < maxDepth) {
     depth++;
     type ChildRow = { parent_task_id: string | null; to_name: string; from_name: string; content: string };
@@ -753,6 +795,18 @@ export function chainReplyToParent(childTaskId: string, replyText: string, reply
     );
     if (!parent) return;
 
+    // round5 F2 fix: refuse to write into a parent that lives in a
+    // different network than the caller. Stops chain-reply being a
+    // cross-tenant write primitive. Logs once per attempt so ops can
+    // see the rejection in the access log.
+    if (enforce) {
+      const parentNet = parent.network_id ?? null;
+      if (parentNet !== callerNorm) {
+        console.log(`[commhub] 🚫 chainReplyToParent cross-network blocked: parent=${parent.task_id.slice(0, 8)} parent-net=${parentNet ?? "null"} caller-net=${callerNorm ?? "null"}`);
+        return;
+      }
+    }
+
     const childAlias = child.to_name;
     const marker = `\n\n[via ${childAlias} 子任务结果]\n${currentReply}`;
     const newResult = parent.result ? parent.result + marker : `[via ${childAlias} 子任务结果]\n${currentReply}`;