@sleep2agi/commhub-server 0.9.0-preview.0 → 0.9.0-preview.100

package/src/scheduled-reply-unread-http.test.ts

@@ -0,0 +1,212 @@
+// 定时任务的回复要进建排程那个人的未读(Vincent 2026-09-30「定时任务触发的…那个红点它是不显示的」)。
+//
+// scheduler 派的任务 from_name='scheduler',回复以前按 from_name 落进 inbox(session_name='scheduler'):
+// app 会话里看得到(会话取自 tasks 表),但 unread_by_agent 只数 session_name=用户名 的行 ⇒ 永远没红点。
+// 这里走真 Hub(bootServer)+ 真节点令牌回复路径(send_reply,callerTokenIsNetwork=true)。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { addNetworkMember, createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+import { runDueScheduledTasks } from "./scheduled-tasks.js";
+import { registerTools } from "./tools.js";
+
+const activeDbPath = process.env.COMMHUB_DB ?? (process.env.COMMHUB_TEST_PG_URL ? "postgres" : undefined);
+if (!activeDbPath) throw new Error("scheduled-reply-unread requires COMMHUB_DB (or COMMHUB_TEST_PG_URL) before module import");
+
+let server: any;
+let base = "";
+let ownerToken = "";
+let ownerName = "";
+let memberToken = "";
+let memberName = "";
+let networkId = "";
+let ownerId = "";
+const stamp = Date.now();
+const ALIAS = `sched-reply-node-${stamp}`;
+const nodeId = `n_sched_reply_${stamp}`;
+
+async function api(token: string, path: string, init?: RequestInit) {
+  const res = await fetch(`${base}${path}`, {
+    ...init,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...(init?.headers || {}) },
+  });
+  return { status: res.status, body: await res.json() as any };
+}
+
+/** 节点令牌身份调 send_reply(与真节点的 commhub_reply 同一个 handler、同一组归属校验)。 */
+async function nodeReply(args: Record<string, unknown>): Promise<any> {
+  const mcp = new McpServer({ name: "sched-reply", version: "0" }) as any;
+  const handlers: Record<string, (a: any) => Promise<any>> = {};
+  const original = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, ...rest: any[]) => {
+    const handler = rest.at(-1);
+    if (typeof handler === "function") handlers[name] = handler;
+    return original(name, ...rest);
+  };
+  registerTools(mcp, undefined, networkId, ownerId, ALIAS, true, null);
+  const out = await handlers.send_reply(args);
+  return JSON.parse(out.content[0].text);
+}
+
+async function unreadFor(token: string): Promise<Record<string, number>> {
+  const res = await api(token, "/api/messages?scope=user&limit=50");
+  expect(res.status).toBe(200);
+  return res.body.unread_by_agent ?? {};
+}
+
+async function ackAgent(token: string) {
+  const res = await api(token, "/api/messages/ack", { method: "POST", body: JSON.stringify({ agent: ALIAS }) });
+  expect(res.status).toBe(200);
+  return res.body;
+}
+
+/** 建一个排程、让它立刻到期、跑一次,返回它派出的 task_id。 */
+async function fireSchedule(token: string, name: string): Promise<{ scheduleId: string; taskId: string }> {
+  const created = await api(token, "/api/scheduled-tasks", {
+    method: "POST",
+    body: JSON.stringify({
+      network_id: networkId, name, target_node_id: nodeId, task: `${name} tick`,
+      timezone: "UTC", schedule: { type: "interval", every_seconds: 120 },
+    }),
+  });
+  expect(created.status).toBe(201);
+  const scheduleId = created.body.schedule.schedule_id as string;
+  // 别的排程不许在这次 sweep 里一起跑
+  db.run("UPDATE scheduled_tasks SET next_run_at = ?1 WHERE schedule_id != ?2", [new Date(Date.now() + 24 * 3600_000).toISOString(), scheduleId]);
+  db.run("UPDATE scheduled_tasks SET next_run_at = ?1 WHERE schedule_id = ?2", [new Date(Date.now() - 60_000).toISOString(), scheduleId]);
+  await runDueScheduledTasks();
+  const run = db.get<{ task_id: string | null }>(
+    "SELECT task_id FROM scheduled_task_runs WHERE schedule_id = ?1 ORDER BY scheduled_for DESC LIMIT 1", scheduleId,
+  );
+  expect(run?.task_id).toBeTruthy();
+  const task = db.get<{ from_name: string }>("SELECT from_name FROM tasks WHERE task_id = ?1", run!.task_id!);
+  expect(task?.from_name).toBe("scheduler");
+  return { scheduleId, taskId: run!.task_id! };
+}
+
+function replyRow(taskId: string) {
+  return db.get<{ session_name: string; from_session: string; acked: number }>(
+    "SELECT session_name, from_session, acked FROM inbox WHERE type = 'reply' AND in_reply_to = ?1", taskId,
+  );
+}
+
+beforeAll(async () => {
+  ownerName = `sched_reply_owner_${stamp}`;
+  const owner = register(ownerName, "SchedReplyOwner123!", undefined, "seed");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!;
+  networkId = owner.network_id!;
+  ownerId = db.get<{ owner_id: string }>("SELECT owner_id FROM networks WHERE network_id = ?1", networkId)!.owner_id;
+
+  memberName = `sched_reply_member_${stamp}`;
+  const member = register(memberName, "SchedReplyMember123!", undefined, "seed");
+  expect(member.ok).toBe(true);
+  memberToken = member.token!;
+  const memberId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", memberName)!.user_id;
+  expect(addNetworkMember(networkId, memberId, "member", ownerId, { agentAccess: "all" }).ok).toBe(true);
+
+  expect(createNetworkTokenForNode(ownerId, networkId, ALIAS).ok).toBe(true);
+  db.run(
+    "INSERT INTO nodes (node_id, node_name, alias, runtime, network_id) VALUES (?1, ?2, ?2, 'claude-code', ?3)",
+    [nodeId, ALIAS, networkId],
+  );
+  db.run(
+    "INSERT INTO sessions (resume_id, alias, status, node_id, network_id) VALUES (?1, ?2, 'idle', ?3, ?4)",
+    [`r_sched_reply_${stamp}`, ALIAS, nodeId, networkId],
+  );
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+});
+
+describe("scheduled-task replies reach the schedule creator's unread", () => {
+  test("a direct reply still lands on the sender and counts once", async () => {
+    await ackAgent(ownerToken);
+    const sent = await api(ownerToken, "/api/task", { method: "POST", body: JSON.stringify({ network_id: networkId, alias: ALIAS, task: "direct hello" }) });
+    expect(sent.status).toBe(200);
+    const taskId = sent.body.task_id as string;
+    const reply = await nodeReply({ in_reply_to: taskId, text: "direct answer", status: "replied" });
+    expect(reply.ok).toBe(true);
+    expect(replyRow(taskId)?.session_name).toBe(ownerName);
+    expect((await unreadFor(ownerToken))[ALIAS]).toBe(1);
+    await ackAgent(ownerToken);
+    expect((await unreadFor(ownerToken))[ALIAS]).toBeUndefined();
+  });
+
+  test("a scheduled-task reply counts for the creator, and ack-by-agent clears it", async () => {
+    await ackAgent(ownerToken);
+    const { taskId } = await fireSchedule(ownerToken, "owner-every-2m");
+    // 节点不带 alias(SDK 运行时)——收件人由 in_reply_to 推出
+    const reply = await nodeReply({ in_reply_to: taskId, text: "tick answer", status: "replied" });
+    expect(reply.ok).toBe(true);
+    expect(replyRow(taskId)).toEqual({ session_name: ownerName, from_session: ALIAS, acked: 0 });
+    expect(db.get<{ status: string; result: string }>("SELECT status, result FROM tasks WHERE task_id = ?1", taskId))
+      .toEqual({ status: "replied", result: "tick answer" });
+    expect((await unreadFor(ownerToken))[ALIAS]).toBe(1);
+
+    const acked = await ackAgent(ownerToken);
+    expect(acked.acked_inbox).toBe(1);
+    expect((await unreadFor(ownerToken))[ALIAS]).toBeUndefined();
+    expect(replyRow(taskId)?.acked).toBe(1);
+  });
+
+  test("a node that names alias='scheduler' explicitly is routed the same way", async () => {
+    await ackAgent(ownerToken);
+    const { taskId } = await fireSchedule(ownerToken, "owner-explicit-alias");
+    const reply = await nodeReply({ alias: "scheduler", in_reply_to: taskId, text: "explicit answer", status: "replied" });
+    expect(reply.ok).toBe(true);
+    expect(replyRow(taskId)?.session_name).toBe(ownerName);
+    expect((await unreadFor(ownerToken))[ALIAS]).toBe(1);
+    await ackAgent(ownerToken);
+  });
+
+  test("another member of the network does not get the owner's scheduled reply, and gets their own", async () => {
+    await ackAgent(ownerToken);
+    await ackAgent(memberToken);
+    const ownerRun = await fireSchedule(ownerToken, "owner-only");
+    expect((await nodeReply({ in_reply_to: ownerRun.taskId, text: "for owner", status: "replied" })).ok).toBe(true);
+    expect((await unreadFor(memberToken))[ALIAS]).toBeUndefined();
+    expect((await unreadFor(ownerToken))[ALIAS]).toBe(1);
+
+    const memberRun = await fireSchedule(memberToken, "member-only");
+    expect((await nodeReply({ in_reply_to: memberRun.taskId, text: "for member", status: "replied" })).ok).toBe(true);
+    expect(replyRow(memberRun.taskId)?.session_name).toBe(memberName);
+    expect((await unreadFor(memberToken))[ALIAS]).toBe(1);
+    expect((await unreadFor(ownerToken))[ALIAS]).toBe(1);
+    await ackAgent(ownerToken);
+    await ackAgent(memberToken);
+  });
+
+  test("a schedule with no creator falls back to 'scheduler'", async () => {
+    await ackAgent(ownerToken);
+    const { scheduleId, taskId } = await fireSchedule(ownerToken, "creatorless");
+    db.run("UPDATE scheduled_tasks SET created_by = NULL WHERE schedule_id = ?1", [scheduleId]);
+    expect((await nodeReply({ in_reply_to: taskId, text: "nobody's", status: "replied" })).ok).toBe(true);
+    expect(replyRow(taskId)?.session_name).toBe("scheduler");
+    expect((await unreadFor(ownerToken))[ALIAS]).toBeUndefined();
+  });
+
+  test("a creator whose username is also a node alias falls back to 'scheduler' (the collision guard)", async () => {
+    await ackAgent(ownerToken);
+    const { taskId } = await fireSchedule(ownerToken, "colliding-creator");
+    const clashNodeId = `n_clash_${stamp}`;
+    db.run(
+      "INSERT INTO nodes (node_id, node_name, alias, runtime, network_id) VALUES (?1, ?2, ?2, 'claude-code', ?3)",
+      [clashNodeId, ownerName, networkId],
+    );
+    try {
+      expect((await nodeReply({ in_reply_to: taskId, text: "not a todo", status: "replied" })).ok).toBe(true);
+      // 那个同名节点收不到这条(它不是节点的待办),用户名也拿不到(inbox 半边整体跳过)
+      expect(replyRow(taskId)?.session_name).toBe("scheduler");
+      expect(db.get<{ n: number }>(
+        "SELECT COUNT(*) AS n FROM inbox WHERE session_name = ?1 AND in_reply_to = ?2", ownerName, taskId,
+      )?.n).toBe(0);
+    } finally {
+      db.run("DELETE FROM nodes WHERE node_id = ?1", [clashNodeId]);
+    }
+  });
+});

package/src/scheduled-run-terminal.test.ts

@@ -0,0 +1,268 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db, chainReplyToParent } from "./db.js";
+import { dispatchScheduledOccurrence } from "./scheduled-tasks.js";
+import { registerTools } from "./tools.js";
+import { patrolExpiredTasks } from "./server.js";
+
+const NET = "net_690_scheduler_terminal";
+const USER = "u_690_owner";
+const NODE = "n_690_grok";
+const ALIAS = "A站GrokTUI-690";
+
+type Handler = (args: any, extra?: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup(): void {
+  for (const table of ["task_events", "inbox", "scheduled_task_runs", "scheduled_tasks", "tasks", "sessions", "nodes", "network_members", "networks", "users"]) {
+    try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+function seedIdentity(): void {
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))", [USER, USER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [NET, USER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [USER, NET]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, runtime, network_id, lifecycle_state)
+     VALUES (?1, ?2, ?2, 'grok-build-acp', ?3, 'active')`,
+    [NODE, ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES ('r_690', ?1, 'idle', ?2, ?3, datetime('now'), datetime('now'))`,
+    [ALIAS, NODE, NET],
+  );
+}
+
+function handlers(): Record<string, Handler> {
+  const server = new McpServer({ name: "test690", version: "0" }) as any;
+  const result: Record<string, Handler> = {};
+  const original = server.tool.bind(server);
+  server.tool = (name: string, ...args: any[]) => {
+    const handler = args.at(-1);
+    if (typeof handler === "function") result[name] = handler;
+    return original(name, ...args);
+  };
+  registerTools(server, undefined, NET, USER, USER, false, null);
+  return result;
+}
+
+async function call(handler: Handler, args: any): Promise<any> {
+  const reply = await handler(args);
+  return JSON.parse(reply.content[0].text);
+}
+
+function seedScheduledTask(status = "delivered", suffix = crypto.randomUUID()): { taskId: string; runId: string; scheduleId: string } {
+  const taskId = `task_${suffix}`;
+  const runId = `srun_${suffix}`;
+  const scheduleId = `sched_${suffix}`;
+  const meta = JSON.stringify({ scheduled_task_id: scheduleId, scheduled_run_id: runId, auth_origin: "hub_scheduler" });
+  db.run(
+    `INSERT INTO scheduled_tasks
+       (schedule_id, network_id, name, target_node_id, target_alias, task_content, priority,
+        schedule_type, schedule_json, timezone, status, next_run_at)
+     VALUES (?1, ?2, 'test690', ?3, ?4, 'test690 task', 'normal', 'interval',
+             '{"type":"interval","every_seconds":3600}', 'UTC', 'active', datetime('now', '+1 hour'))`,
+    [scheduleId, NET, NODE, ALIAS],
+  );
+  db.run(
+    `INSERT INTO tasks
+       (task_id, from_name, to_node_id, to_name, priority, status, content, requires_response,
+        created_at, delivered_at, expires_at, network_id, meta_json)
+     VALUES (?1, 'scheduler', ?2, ?3, 'normal', ?4, 'test690 task', 'reply',
+             datetime('now'), datetime('now'), datetime('now', '+1 hour'), ?5, ?6)`,
+    [taskId, NODE, ALIAS, status, NET, meta],
+  );
+  db.run(
+    `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id, meta_json)
+     VALUES (?1, ?1, ?2, ?3, 'task', 'normal', 'test690 task', 'scheduler', 'reply', ?4, ?5)`,
+    [taskId, ALIAS, NODE, NET, meta],
+  );
+  db.run(
+    `INSERT INTO scheduled_task_runs (run_id, schedule_id, network_id, scheduled_for, task_id, status, completed_at)
+     VALUES (?1, ?2, ?3, datetime('now'), ?4, ?5, datetime('now'))`,
+    [runId, scheduleId, NET, taskId, status],
+  );
+  return { taskId, runId, scheduleId };
+}
+
+const readRun = (runId: string) => db.get<any>(
+  "SELECT run_id, task_id, network_id, status, error_code, completed_at FROM scheduled_task_runs WHERE run_id = ?1",
+  runId,
+);
+
+beforeEach(() => { cleanup(); seedIdentity(); });
+afterAll(cleanup);
+
+describe("#690 scheduled run follows the real task lifecycle", () => {
+  test("dispatch is open until the task reaches a terminal state", () => {
+    const scheduleId = `sched_dispatch_${crypto.randomUUID()}`;
+    const row: any = {
+      schedule_id: scheduleId,
+      network_id: NET,
+      name: "dispatch open",
+      target_node_id: NODE,
+      target_alias: ALIAS,
+      task_content: "dispatch open",
+      priority: "normal",
+      schedule_type: "interval",
+      schedule_json: JSON.stringify({ type: "interval", every_seconds: 3600 }),
+      timezone: "UTC",
+      overlap_policy: "skip",
+      misfire_policy: "catch_up_once",
+      status: "active",
+      next_run_at: new Date(Date.now() + 3600_000).toISOString(),
+      last_run_at: null,
+      revision: 1,
+    };
+    db.run(
+      `INSERT INTO scheduled_tasks
+         (schedule_id, network_id, name, target_node_id, target_alias, task_content, priority,
+          schedule_type, schedule_json, timezone, overlap_policy, misfire_policy, status, next_run_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14)`,
+      [scheduleId, NET, row.name, NODE, ALIAS, row.task_content, row.priority, row.schedule_type,
+       row.schedule_json, row.timezone, row.overlap_policy, row.misfire_policy, row.status, row.next_run_at],
+    );
+    const dispatched = dispatchScheduledOccurrence(row, new Date().toISOString(), false);
+    const run = readRun(dispatched.runId);
+    expect(["delivered", "queued"]).toContain(run.status);
+    expect(run.completed_at).toBeNull();
+  });
+
+  test("send_reply terminalizes the exact bound run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const reply = await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "verified",
+      in_reply_to: taskId,
+      status: "replied",
+      network_id: NET,
+      attachments: [{ type: "file", file_id: "file_690_reply", name: "evidence.json", size: 12, mime: "application/json" }],
+    });
+    expect(reply.ok).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+    expect(readRun(runId).completed_at).toBeTruthy();
+  });
+
+  test("task and run terminal transition roll back together on an injected run-write failure", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    db.exec(
+      `CREATE TRIGGER test690_fail_run_terminal
+         BEFORE UPDATE OF status ON scheduled_task_runs
+         WHEN NEW.run_id = '${runId}' AND NEW.status = 'replied'
+       BEGIN
+         SELECT RAISE(ABORT, 'test690_injected_run_failure');
+       END`,
+    );
+    let threw = false;
+    try {
+      await call(handlers().send_reply, {
+        alias: ALIAS,
+        text: "must roll back",
+        in_reply_to: taskId,
+        status: "replied",
+        network_id: NET,
+      });
+    } catch (error: any) {
+      threw = /test690_injected_run_failure/.test(String(error?.message || error));
+    } finally {
+      db.exec("DROP TRIGGER IF EXISTS test690_fail_run_terminal");
+    }
+    expect(threw).toBe(true);
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", taskId)?.status).toBe("delivered");
+    expect(readRun(runId).status).toBe("delivered");
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM inbox WHERE in_reply_to = ?1", taskId)?.count).toBe(0);
+  });
+
+  test("cancel terminalizes, retry reopens, and the retry result closes the same run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const tools = handlers();
+    expect((await call(tools.cancel_task, { task_id: taskId, reason: "operator", network_id: NET })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("cancelled");
+    expect(readRun(runId).completed_at).toBeTruthy();
+
+    expect((await call(tools.retry_task, { task_id: taskId, network_id: NET })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("delivered");
+    expect(readRun(runId).completed_at).toBeNull();
+
+    expect((await call(tools.send_reply, {
+      alias: ALIAS,
+      text: "runtime failed",
+      in_reply_to: taskId,
+      status: "failed",
+      network_id: NET,
+    })).ok).toBe(true);
+    expect(readRun(runId).status).toBe("failed");
+    expect(readRun(runId).error_code).toBe("task_failed");
+  });
+
+  test("report_completion terminalizes a scheduler run", async () => {
+    const { taskId, runId } = seedScheduledTask();
+    const reply = await call(handlers().report_completion, {
+      alias: ALIAS,
+      task: taskId,
+      result: "done",
+      network_id: NET,
+    });
+    expect(reply.ok).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+  });
+
+  test("expiration patrol closes the exact run in the same lifecycle pass", () => {
+    const { taskId, runId } = seedScheduledTask();
+    db.run("UPDATE tasks SET expires_at = datetime('now', '-1 minute') WHERE task_id = ?1", [taskId]);
+    patrolExpiredTasks();
+    expect(db.get<{ status: string }>("SELECT status FROM tasks WHERE task_id = ?1", taskId)?.status).toBe("expired");
+    expect(readRun(runId).status).toBe("expired");
+    expect(readRun(runId).error_code).toBe("task_expired");
+    expect(readRun(runId).completed_at).toBeTruthy();
+  });
+
+  test("child auto-chain terminalizes a scheduled parent", () => {
+    const { taskId: parentId, runId } = seedScheduledTask();
+    const childId = `child_${crypto.randomUUID()}`;
+    db.run(
+      `INSERT INTO tasks
+         (task_id, parent_task_id, from_name, to_name, priority, status, content, requires_response, created_at, network_id)
+       VALUES (?1, ?2, ?3, 'A站负责人', 'normal', 'replied', 'verify candidate', 'reply', datetime('now'), ?4)`,
+      [childId, parentId, ALIAS, NET],
+    );
+    const result = chainReplyToParent(childId, "news_id=14519", "replied", 5, NET);
+    expect(result.chained).toBe(true);
+    expect(readRun(runId).status).toBe("replied");
+  });
+
+  test("forged metadata cannot cross-bind another task or network run", async () => {
+    const victim = seedScheduledTask("delivered", "victim");
+    const attackerTaskId = "task_attacker";
+    const forgedMeta = JSON.stringify({ scheduled_task_id: victim.scheduleId, scheduled_run_id: victim.runId, auth_origin: "hub_scheduler" });
+    db.run(
+      `INSERT INTO tasks
+         (task_id, from_name, to_node_id, to_name, priority, status, content, requires_response, created_at, network_id, meta_json)
+       VALUES (?1, 'scheduler', ?2, ?3, 'normal', 'delivered', 'forged', 'reply', datetime('now'), ?4, ?5)`,
+      [attackerTaskId, NODE, ALIAS, NET, forgedMeta],
+    );
+    await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "forged close",
+      in_reply_to: attackerTaskId,
+      status: "replied",
+      network_id: NET,
+    });
+    expect(readRun(victim.runId).status).toBe("delivered");
+  });
+
+  test("a task cannot close a run whose persisted network binding differs", async () => {
+    const victim = seedScheduledTask("delivered", "foreign_network");
+    db.run("UPDATE scheduled_task_runs SET network_id = 'net_690_foreign' WHERE run_id = ?1", [victim.runId]);
+    await call(handlers().send_reply, {
+      alias: ALIAS,
+      text: "must not cross network",
+      in_reply_to: victim.taskId,
+      status: "replied",
+      network_id: NET,
+    });
+    expect(readRun(victim.runId).status).toBe("delivered");
+  });
+});

package/src/scheduled-skip-blocking-task.test.ts

@@ -0,0 +1,120 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { dispatchScheduledOccurrence, handleScheduledTaskRequest } from "./scheduled-tasks.js";
+
+// A skip used to record only error_code=previous_run_active. The owner saw
+// dozens of identical 「已跳过」 rows while the node sat idle, because the
+// open task had never reached it. The skip record now names the blocking task
+// and whether the node had picked it up.
+
+const NET = "net_sched_skip_blocking";
+const NODE = "n_sched_skip_blocking";
+const ALIAS = "sched-skip-blocking";
+
+function cleanup(): void {
+  for (const table of ["task_events", "inbox", "scheduled_task_runs", "scheduled_tasks", "tasks", "sessions", "nodes"]) {
+    try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+}
+
+function seedSchedule(): any {
+  const scheduleId = `sched_${crypto.randomUUID()}`;
+  db.run(
+    `INSERT INTO scheduled_tasks
+       (schedule_id, network_id, name, target_node_id, target_alias, task_content, priority,
+        schedule_type, schedule_json, timezone, status, next_run_at)
+     VALUES (?1, ?2, 'skip detail', ?3, ?4, 'scheduled task', 'normal', 'interval',
+             '{"type":"interval","every_seconds":60}', 'UTC', 'active', datetime('now', '+1 minute'))`,
+    [scheduleId, NET, NODE, ALIAS],
+  );
+  return db.get("SELECT * FROM scheduled_tasks WHERE schedule_id = ?1", scheduleId);
+}
+
+function run(runId: string): any {
+  return db.get(
+    "SELECT status, error_code, error_message, blocked_by_task_id, blocked_by_state FROM scheduled_task_runs WHERE run_id = ?1",
+    runId,
+  );
+}
+
+beforeEach(() => {
+  cleanup();
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, runtime, network_id, lifecycle_state)
+     VALUES (?1, ?2, ?2, 'codex-sdk', ?3, 'active')`,
+    [NODE, ALIAS, NET],
+  );
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`r_${crypto.randomUUID()}`, ALIAS, NODE, NET],
+  );
+});
+
+afterAll(cleanup);
+
+describe("skipped run names the task that blocked it", () => {
+  test("open task still unacked in the inbox → not_received", () => {
+    const schedule = seedSchedule();
+    const first = dispatchScheduledOccurrence(schedule, "2026-09-29T08:00:00.000Z", false);
+    expect(first.status).toBe("delivered");
+
+    const second = dispatchScheduledOccurrence(schedule, "2026-09-29T08:01:00.000Z", false);
+    expect(second.status).toBe("skipped");
+    const row = run(second.runId);
+    expect(row.error_code).toBe("previous_run_active");
+    expect(row.blocked_by_task_id).toBe(first.taskId);
+    expect(row.blocked_by_state).toBe("not_received");
+    expect(row.error_message).toContain(first.taskId!);
+    expect(row.error_message).toContain("not been received");
+  });
+
+  test("open task whose inbox row the node acked → in_progress", () => {
+    const schedule = seedSchedule();
+    const first = dispatchScheduledOccurrence(schedule, "2026-09-29T09:00:00.000Z", false);
+    db.run("UPDATE inbox SET acked = 1 WHERE task_id = ?1", [first.taskId]);
+
+    const second = dispatchScheduledOccurrence(schedule, "2026-09-29T09:01:00.000Z", false);
+    expect(second.status).toBe("skipped");
+    const row = run(second.runId);
+    expect(row.blocked_by_task_id).toBe(first.taskId);
+    expect(row.blocked_by_state).toBe("in_progress");
+    expect(row.error_message).toContain("still in progress");
+  });
+
+  test("task status running counts as received even without an acked inbox row", () => {
+    const schedule = seedSchedule();
+    const first = dispatchScheduledOccurrence(schedule, "2026-09-29T10:00:00.000Z", false);
+    db.run("UPDATE tasks SET status = 'running' WHERE task_id = ?1", [first.taskId]);
+
+    const second = dispatchScheduledOccurrence(schedule, "2026-09-29T10:01:00.000Z", false);
+    expect(run(second.runId).blocked_by_state).toBe("in_progress");
+  });
+
+  test("GET /runs exposes the blocking task and state", async () => {
+    const schedule = seedSchedule();
+    const first = dispatchScheduledOccurrence(schedule, "2026-09-29T12:00:00.000Z", false);
+    const second = dispatchScheduledOccurrence(schedule, "2026-09-29T12:01:00.000Z", false);
+    const url = new URL(`http://hub.test/api/scheduled-tasks/${schedule.schedule_id}/runs`);
+    const res = await handleScheduledTaskRequest({
+      req: new Request(url, { method: "GET" }),
+      url,
+      auth: { userId: "u_skip_detail", networkId: NET, username: "skip-detail" },
+      isAdmin: false,
+      isNodeToken: false,
+      scope: { networkId: NET, networkIds: [NET] },
+    });
+    const body = await res!.json() as any;
+    const skipped = body.runs.find((r: any) => r.run_id === second.runId);
+    expect(skipped.blocked_by_task_id).toBe(first.taskId);
+    expect(skipped.blocked_by_state).toBe("not_received");
+  });
+
+  test("a delivered run carries no blocking fields", () => {
+    const schedule = seedSchedule();
+    const first = dispatchScheduledOccurrence(schedule, "2026-09-29T11:00:00.000Z", false);
+    const row = run(first.runId);
+    expect(row.blocked_by_task_id).toBeNull();
+    expect(row.blocked_by_state).toBeNull();
+  });
+});