@sleep2agi/commhub-server 0.9.0-preview.0 → 0.9.0-preview.100

package/src/skillhub-http.test.ts

@@ -0,0 +1,108 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-skillhub-"));
+let server: any;
+let base = "";
+let ownerToken = "";
+let nodeToken = "";
+let foreignToken = "";
+let networkId = "";
+
+async function tool(token: string, name: string, args: Record<string, unknown>) {
+  const res = await fetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  expect(res.status).toBe(200);
+  const raw = await res.text();
+  const dataLines = raw.split("\n").filter(x => x.startsWith("data:"));
+  const payload = dataLines.length
+    ? JSON.parse(dataLines.at(-1)!.slice(5).trim())
+    : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(dir, "hub.db");
+  const owner = register(`skill_owner_${Date.now()}`, "SkillHubOwner123!", undefined, "seed");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!; networkId = owner.network_id!;
+  const ownerId = db.get<{ user_id: string }>("SELECT owner_id AS user_id FROM networks WHERE network_id = ?1", networkId)!.user_id;
+  const node = createNetworkTokenForNode(ownerId, networkId, "skill-writer");
+  expect(node.ok).toBe(true); nodeToken = node.token!;
+  const foreign = register(`skill_foreign_${Date.now()}`, "SkillHubForeign123!", undefined, "seed");
+  expect(foreign.ok).toBe(true); foreignToken = foreign.token!;
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => { try { server?.stop?.(true); } catch {} try { rmSync(dir, { recursive: true, force: true }); } catch {} });
+
+describe("SkillHub real Hub + SQLite", () => {
+  let skillId = "";
+  test("node submit is token-attributed, pending and immutable/idempotent", async () => {
+    const input = { network_id: networkId, slug: "incident-handoff", name: "Incident handoff", version: "1.0.0", description: "handoff", content: "# Incident handoff\n\nVerify facts." };
+    const first = await tool(nodeToken, "submit_skill", { ...input, source_alias: "forged-admin" });
+    expect(first.ok).toBe(true); expect(first.status).toBe("pending"); expect(first.source_alias).toBe("skill-writer"); skillId = first.skill_id;
+    const retry = await tool(nodeToken, "submit_skill", input);
+    expect(retry.idempotent).toBe(true); expect(retry.skill_id).toBe(skillId);
+    const conflict = await tool(nodeToken, "submit_skill", { ...input, content: "changed" });
+    expect(conflict.error).toBe("skill_version_conflict");
+    const raceBase = { ...input, slug: "concurrent-version", version: "2.0.0" };
+    const raced = await Promise.all([
+      tool(nodeToken, "submit_skill", { ...raceBase, content: "winner-a" }),
+      tool(nodeToken, "submit_skill", { ...raceBase, content: "winner-b" }),
+    ]);
+    expect(raced.filter(x => x.ok).length).toBe(1);
+    expect(raced.filter(x => x.error === "skill_version_conflict").length).toBe(1);
+  });
+
+  test("pending is reviewer-only; owner publishes; published becomes visible", async () => {
+    const nodeList = await tool(nodeToken, "list_skills", { network_id: networkId, include_pending: true });
+    expect(nodeList.skills).toHaveLength(0);
+    expect((await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).error).toBe("skill_not_found");
+    const ownerList = await tool(ownerToken, "list_skills", { network_id: networkId, include_pending: true });
+    expect(ownerList.reviewer).toBe(true); expect(ownerList.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    expect((await tool(ownerToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill.content).toContain("Verify facts");
+    const reviewed = await tool(ownerToken, "review_skill", { network_id: networkId, skill_id: skillId, decision: "published" });
+    expect(reviewed.status).toBe("published");
+    const published = await tool(nodeToken, "list_skills", { network_id: networkId });
+    expect(published.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    expect((await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill.skill_id).toBe(skillId);
+    const detail = (await tool(nodeToken, "get_skill", { network_id: networkId, skill_id: skillId })).skill;
+    expect(detail.created_by_user).toBeUndefined(); expect(detail.reviewed_by_user).toBeUndefined(); expect(detail.content_hash).toBeUndefined();
+  });
+
+  test("query matches regardless of letter case (SQLite LIKE semantics, kept on PostgreSQL)", async () => {
+    for (const query of ["incident", "INCIDENT", "Handoff"]) {
+      const found = await tool(nodeToken, "list_skills", { network_id: networkId, query });
+      expect(found.skills.map((x: any) => x.skill_id)).toContain(skillId);
+    }
+    expect((await tool(nodeToken, "list_skills", { network_id: networkId, query: "no-such-skill" })).skills).toHaveLength(0);
+  });
+
+  test("% and _ in the query are literal characters, not wildcards (#2141)", async () => {
+    const ids = async (query: string) => (await tool(nodeToken, "list_skills", { network_id: networkId, query })).skills.map((x: any) => x.skill_id);
+    expect(await ids("_")).not.toContain(skillId);       // was: matched everything
+    expect(await ids("%")).not.toContain(skillId);
+    expect(await ids("incident_handoff")).not.toContain(skillId); // `_` must not stand for the "-" in the slug
+    expect(await ids("incident-handoff")).toContain(skillId);
+  });
+
+  test("foreign user cannot read or review another network", async () => {
+    expect((await tool(foreignToken, "list_skills", { network_id: networkId })).ok).toBe(false);
+    const review = await tool(foreignToken, "review_skill", { network_id: networkId, skill_id: skillId, decision: "rejected" });
+    expect(review.ok).toBe(false);
+  });
+});

package/src/sqlite-close-checkpoint.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import { copyFileSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SQLiteAdapter } from "./db-adapter";
+
+// #2151 — a cleanly stopped Hub must leave a complete .db: the -wal is absent
+// or empty, and a copy of the .db file alone still has the data.
+const dir = mkdtempSync(join(tmpdir(), "anet-wal-close-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+const walBytes = (db: string) => (existsSync(`${db}-wal`) ? statSync(`${db}-wal`).size : 0);
+
+function copyOnlyDb(db: string): Database {
+  const copy = join(dirname(db), `copy-of-${db.split("/").pop()}`);
+  copyFileSync(db, copy); // deliberately without -wal / -shm
+  return new Database(copy, { readonly: true });
+}
+
+describe("#2151 SQLite WAL is checkpointed on close", () => {
+  test("SQLiteAdapter.close() after >20 distinct statements leaves a complete .db", () => {
+    const path = join(dir, "adapter.db");
+    const raw = new Database(path);
+    raw.exec("PRAGMA journal_mode=WAL");
+    const db = new SQLiteAdapter(raw);
+    db.exec("CREATE TABLE t (x TEXT)");
+    db.run("INSERT INTO t VALUES (?1)", ["kept"]);
+    // bun:sqlite stops being able to close after more than 20 distinct query() strings.
+    for (let i = 0; i < 30; i++) db.get(`SELECT ${i} AS v`);
+    db.close();
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT x FROM t").all()).toEqual([{ x: "kept" }]);
+    copy.close();
+  });
+
+  test("a real Hub that served traffic and got SIGTERM leaves a complete .db", async () => {
+    const bin = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "commhub.ts");
+    const home = join(dir, "home");
+    const path = join(dir, "hub.db");
+    const port = String(27000 + Math.floor(Math.random() * 2000));
+    const base = `http://127.0.0.1:${port}`;
+    const hub = Bun.spawn(["bun", bin, "--port", port, "--host", "127.0.0.1", "--db", path], {
+      env: { PATH: process.env.PATH ?? "", HOME: home }, stdout: "pipe", stderr: "pipe",
+    });
+    try {
+      let up = false;
+      for (let i = 0; i < 150 && !up; i++) {
+        up = await fetch(`${base}/health`).then((r) => r.ok, () => false);
+        if (!up) await Bun.sleep(100);
+      }
+      expect(up).toBe(true);
+      const post = (p: string, body: unknown, token?: string) => fetch(`${base}${p}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+        body: JSON.stringify(body),
+      }).then((r) => r.json() as Promise<any>);
+      const reg = await post("/api/auth/register", { username: "walcheck", password: "StrongPassw0rd" });
+      expect(reg.ok).toBe(true);
+      const login = await post("/api/auth/login", { username: "walcheck", password: "StrongPassw0rd" });
+      const net = await post("/api/networks", { name: "wal-net" }, login.token);
+      expect(net.ok).toBe(true);
+      const ntok = await post("/api/auth/node-token", { network_id: net.network_id, node_name: "wal-agent" }, login.token);
+      expect(ntok.ok).toBe(true);
+      expect(walBytes(path)).toBeGreaterThan(0); // the writes really are in the WAL before the stop
+    } finally {
+      hub.kill("SIGTERM");
+      await hub.exited;
+    }
+    expect(walBytes(path)).toBe(0);
+    const copy = copyOnlyDb(path);
+    expect(copy.query("SELECT COUNT(*) AS n FROM users WHERE username = 'walcheck'").get()).toEqual({ n: 1 });
+    expect(copy.query("SELECT COUNT(*) AS n FROM networks WHERE network_name = 'wal-net'").get()).toEqual({ n: 1 });
+    copy.close();
+  }, 40_000);
+});

package/src/stale-sweeper.test.ts

@@ -0,0 +1,181 @@
+// Round-2/4 review ③ — stale session sweeper tests.
+//
+// Drives the real sweepStaleSessions against isolated in-process
+// SQLite (COMMHUB_DB=/tmp/...). Pins behaviour the read-path
+// regression (per-request UPDATE) would re-introduce if anyone
+// undoes the fix:
+//
+//   1. fresh sessions stay non-offline regardless of how many
+//      times the sweeper runs;
+//   2. stale sessions get marked offline exactly once (idempotent);
+//   3. global sweep crosses tenant boundaries — a stale agent in
+//      network B is marked offline even when no one in net B is
+//      polling /api/status;
+//   4. env-var cutoff is respected and bad values fall back silently.
+//
+// Run with:
+//   COMMHUB_DB=/tmp/stale-test.db bun test src/stale-sweeper.test.ts
+
+import { describe, expect, test, beforeEach } from "bun:test";
+import { db } from "./db.js";
+import { sweepStaleSessions, staleCutoffMinutes } from "./stale-sweeper.js";
+
+function insertSession(opts: {
+  alias: string;
+  status?: string;
+  minutesAgo: number;
+  network_id?: string;
+}): void {
+  const id = `r_${opts.alias}`;
+  db.run(
+    `INSERT OR REPLACE INTO sessions
+       (resume_id, alias, status, network_id, updated_at, registered_at)
+     VALUES (?1, ?2, ?3, ?4, datetime('now', ?5), datetime('now', ?5))`,
+    [id, opts.alias, opts.status ?? "idle", opts.network_id ?? "default", `-${opts.minutesAgo} minutes`]
+  );
+}
+
+function getStatus(alias: string): string | null {
+  const row = db.get<{ status: string }>(
+    "SELECT status FROM sessions WHERE alias = ?1",
+    alias
+  );
+  return row?.status ?? null;
+}
+
+beforeEach(() => {
+  db.run("DELETE FROM sessions");
+});
+
+describe("sweepStaleSessions — fresh agents not touched", () => {
+  test("agent updated < cutoff stays at its current status", () => {
+    insertSession({ alias: "live-1", status: "idle", minutesAgo: 1 });
+    insertSession({ alias: "live-2", status: "working", minutesAgo: 5 });
+
+    sweepStaleSessions(10);
+
+    expect(getStatus("live-1")).toBe("idle");
+    expect(getStatus("live-2")).toBe("working");
+  });
+
+  test("multiple sweeps on quiet hub are pure no-ops (no write fired)", () => {
+    insertSession({ alias: "live", status: "idle", minutesAgo: 1 });
+
+    const r1 = sweepStaleSessions(10);
+    const r2 = sweepStaleSessions(10);
+    const r3 = sweepStaleSessions(10);
+
+    expect(r1.markedOffline).toBe(0);
+    expect(r2.markedOffline).toBe(0);
+    expect(r3.markedOffline).toBe(0);
+    expect(getStatus("live")).toBe("idle");
+  });
+});
+
+describe("sweepStaleSessions — stale agents marked offline", () => {
+  test("agent updated > cutoff gets marked offline exactly once", () => {
+    insertSession({ alias: "stale", status: "idle", minutesAgo: 30 });
+
+    const r1 = sweepStaleSessions(10);
+    expect(r1.markedOffline).toBe(1);
+    expect(getStatus("stale")).toBe("offline");
+
+    // Second sweep does nothing because the row is already offline
+    // (the predicate is `status != 'offline'`).
+    const r2 = sweepStaleSessions(10);
+    expect(r2.markedOffline).toBe(0);
+    expect(getStatus("stale")).toBe("offline");
+  });
+
+  test("already-offline stale row not re-marked (write avoided)", () => {
+    insertSession({ alias: "old-offline", status: "offline", minutesAgo: 60 });
+
+    const r = sweepStaleSessions(10);
+
+    expect(r.markedOffline).toBe(0);
+    expect(getStatus("old-offline")).toBe("offline");
+  });
+});
+
+describe("sweepStaleSessions — global across tenants (the read-path fix)", () => {
+  test("stale row in network B is marked offline even with no net-B polling", () => {
+    // Pre-fix: GET /api/status from net-A would only UPDATE rows in
+    // net-A's scope. A stale agent in net-B would stay non-offline
+    // until someone polled net-B. After the fix, the global sweeper
+    // is tenant-blind on the maintenance write.
+    insertSession({ alias: "stale-a", status: "idle", minutesAgo: 30, network_id: "net-A" });
+    insertSession({ alias: "stale-b", status: "idle", minutesAgo: 30, network_id: "net-B" });
+    insertSession({ alias: "stale-c", status: "idle", minutesAgo: 30, network_id: null as any });
+
+    const r = sweepStaleSessions(10);
+
+    expect(r.markedOffline).toBe(3);
+    expect(getStatus("stale-a")).toBe("offline");
+    expect(getStatus("stale-b")).toBe("offline");
+    expect(getStatus("stale-c")).toBe("offline");
+  });
+});
+
+describe("sweepStaleSessions — cutoff boundary + env", () => {
+  test("exactly-at-cutoff agent treated as stale (< strict, not <=)", () => {
+    // Just past the cutoff window.
+    insertSession({ alias: "just-stale", status: "idle", minutesAgo: 11 });
+    sweepStaleSessions(10);
+    expect(getStatus("just-stale")).toBe("offline");
+  });
+
+  test("just-under-cutoff agent treated as live", () => {
+    insertSession({ alias: "just-live", status: "working", minutesAgo: 9 });
+    sweepStaleSessions(10);
+    expect(getStatus("just-live")).toBe("working");
+  });
+
+  test("env COMMHUB_STALE_CUTOFF_MINUTES overrides default", () => {
+    process.env.COMMHUB_STALE_CUTOFF_MINUTES = "3";
+    expect(staleCutoffMinutes()).toBe(3);
+    delete process.env.COMMHUB_STALE_CUTOFF_MINUTES;
+  });
+
+  test("env invalid value falls back to default 10 (no operator footgun)", () => {
+    process.env.COMMHUB_STALE_CUTOFF_MINUTES = "not-a-number";
+    expect(staleCutoffMinutes()).toBe(10);
+    delete process.env.COMMHUB_STALE_CUTOFF_MINUTES;
+
+    process.env.COMMHUB_STALE_CUTOFF_MINUTES = "0";
+    expect(staleCutoffMinutes()).toBe(10);
+    delete process.env.COMMHUB_STALE_CUTOFF_MINUTES;
+
+    process.env.COMMHUB_STALE_CUTOFF_MINUTES = "-5";
+    expect(staleCutoffMinutes()).toBe(10);
+    delete process.env.COMMHUB_STALE_CUTOFF_MINUTES;
+  });
+});
+
+describe("sweepStaleSessions — read-path regression guard (pin the fix)", () => {
+  // This is the load-bearing pin: if anyone adds back a per-request
+  // UPDATE in /api/status / /api/servers / /api/server-detail-* /
+  // get_all_status, this test plus the absence of those UPDATEs in
+  // the source should make the regression visible. Since this is a
+  // unit-level test of the sweeper itself, the regression-prevention
+  // role is mostly social — the comments in this file + the comments
+  // in index.ts and tools.ts at the former UPDATE sites tell future
+  // editors "do not put the UPDATE back; use the sweeper."
+  test("after sweep, sessions row has the offline status persisted (single source of truth)", () => {
+    insertSession({ alias: "x", status: "working", minutesAgo: 30 });
+    const before = sweepStaleSessions(10);
+    expect(before.markedOffline).toBe(1);
+
+    // Re-read directly — no extra UPDATE needed by a caller.
+    const status = getStatus("x");
+    expect(status).toBe("offline");
+
+    // 100 simulated read-path lookups don't fire any maintenance writes.
+    for (let i = 0; i < 100; i++) {
+      const row = db.get<{ status: string }>(
+        "SELECT status FROM sessions WHERE alias = ?1",
+        "x"
+      );
+      expect(row?.status).toBe("offline");
+    }
+  });
+});

package/src/stale-sweeper.ts

@@ -0,0 +1,114 @@
+// Round-2/4 review ③ — read-path write amplification fix.
+//
+// Before this module: GET /api/status, GET /api/servers, GET
+// /api/server-health/:host, and the MCP `get_all_status` tool each
+// fired:
+//
+//   UPDATE sessions SET status = 'offline'
+//   WHERE updated_at < ?1 AND status != 'offline'
+//
+// on every call. With the dashboard polling /api/status every few
+// seconds × N tabs × M users, that's a high-frequency WRITE on a
+// heavily-read table just to maintain a derived field. Wait events
+// stack up (WAL fsync, page locks) and the writes are 99% no-ops.
+//
+// Fix: move the stale-marking off the read path into a single
+// background timer. Reads now SELECT only; the timer runs every 60s
+// and applies the same UPDATE GLOBALLY (no per-network scope — stale
+// is stale regardless of which tenant is asking). Worst-case delay
+// between an agent crashing and going `offline` in the dashboard:
+//
+//   10min stale cutoff + 60s sweep = up to ~11min
+//
+// (unchanged from before the fix for any reader that wasn't actively
+// polling).
+//
+// Same pattern as `src/retention.ts` for shutdown (clearInterval in
+// the graceful shutdown handler).
+
+import { db } from "./db.js";
+
+export type StaleSweepResult = {
+  startedAt: string;
+  durationMs: number;
+  markedOffline: number;
+  staleCutoffMinutes: number;
+};
+
+// Stale window: an agent that hasn't reported in this many minutes is
+// considered offline. Matches the pre-fix per-request cutoff so the
+// observable behaviour from the dashboard's perspective is unchanged.
+const DEFAULT_STALE_MINUTES = 10;
+const DEFAULT_SWEEP_MS = 60 * 1000;
+
+export function staleCutoffMinutes(): number {
+  const raw = process.env.COMMHUB_STALE_CUTOFF_MINUTES;
+  if (raw === undefined || raw === "") return DEFAULT_STALE_MINUTES;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_STALE_MINUTES;
+  return n;
+}
+
+function sqliteCutoff(minutes: number): string {
+  return new Date(Date.now() - minutes * 60 * 1000)
+    .toISOString()
+    .replace("T", " ")
+    .slice(0, 19);
+}
+
+// Single GLOBAL UPDATE — no per-network filtering. The pre-fix per-
+// request stale marker WAS scoped (each REST call only saw its own
+// network's stale rows), but the semantics of "this row hasn't been
+// heard from in 10min" is global. A network that no one's looking at
+// still wants its agents marked offline so an admin scanning all
+// networks gets consistent state.
+export function sweepStaleSessions(cutoffMinutes = staleCutoffMinutes()): StaleSweepResult {
+  const startedAt = new Date().toISOString();
+  const t0 = Date.now();
+  let markedOffline = 0;
+  try {
+    const cutoff = sqliteCutoff(cutoffMinutes);
+    const res = db.run(
+      "UPDATE sessions SET status = 'offline' WHERE updated_at < ?1 AND status != 'offline'",
+      [cutoff],
+    );
+    markedOffline = res.changes ?? 0;
+  } catch (e: any) {
+    console.log(`[commhub stale-sweep] failed: ${e?.message ?? e}`);
+  }
+  return {
+    startedAt,
+    durationMs: Date.now() - t0,
+    markedOffline,
+    staleCutoffMinutes: cutoffMinutes,
+  };
+}
+
+export function startStaleSessionSweeper(
+  intervalMs?: number,
+): ReturnType<typeof setInterval> {
+  const env = process.env.COMMHUB_STALE_SWEEP_SECONDS;
+  const envMs = env && Number.isFinite(Number(env)) && Number(env) > 0
+    ? Number(env) * 1000
+    : undefined;
+  const ms = intervalMs ?? envMs ?? DEFAULT_SWEEP_MS;
+  const sweep = () => {
+    try {
+      const r = sweepStaleSessions();
+      // Log only when something actually changed — quiet hubs stay quiet.
+      if (r.markedOffline > 0) {
+        console.log(
+          `[commhub stale-sweep] marked ${r.markedOffline} session(s) offline in ${r.durationMs}ms ` +
+            `(cutoff=${r.staleCutoffMinutes}min)`,
+        );
+      }
+    } catch (e: any) {
+      console.log(`[commhub stale-sweep] top-level failed: ${e?.message ?? e}`);
+    }
+  };
+  // Fire once at boot via setImmediate so the very-first /api/status
+  // after server start gets fresh stale state without blocking
+  // startup.
+  setImmediate(sweep);
+  return setInterval(sweep, ms);
+}

package/src/start-node.test.ts

@@ -0,0 +1,109 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+
+const NET = "net_start_node"; const USER = "u_start_node";
+const DAEMON = "node_start_daemon"; const DAEMON_ALIAS = "start-daemon";
+const CHILD = "node_start_child"; const CHILD_ALIAS = "start-child";
+
+function cleanup() {
+  for (const table of ["node_start_requests", "node_create_requests", "audit_log", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${table} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id=?1", USER); } catch {}
+}
+beforeEach(() => { cleanup();
+  db.run(`INSERT INTO users(user_id,username,password_hash,role,created_at) VALUES(?1,?1,'x','user',datetime('now'))`, USER);
+  db.run(`INSERT INTO networks(network_id,network_name,owner_id,created_at) VALUES(?1,?1,?2,datetime('now'))`, [NET, USER]);
+  db.run(`INSERT INTO network_members(user_id,network_id,role,joined_at) VALUES(?1,?2,'owner',datetime('now'))`, [USER, NET]);
+  db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,config_snapshot,hostname,created_at,updated_at,lifecycle_state) VALUES(?1,?2,?2,?3,'{}','h',datetime('now'),datetime('now'),'active')`, [DAEMON, DAEMON_ALIAS, NET]);
+  db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,config_snapshot,hostname,created_at,updated_at,lifecycle_state) VALUES(?1,?2,?2,?3,'{}','h',datetime('now'),datetime('now'),'stopped')`, [CHILD, CHILD_ALIAS, NET]);
+  db.run(`INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES('tok_start_daemon',?1,?2,'network',?3,'h')`, [USER, NET, `node:${DAEMON_ALIAS}`]);
+  db.run(`INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id) VALUES('cr_start_child',?1,?2,?3,'codex-sdk','x','{}','[]','succeeded',1,'t',?4)`, [DAEMON, CHILD_ALIAS, NET, CHILD]);
+});
+afterAll(cleanup);
+
+function handlers(user: string | null, daemon = false) {
+  const s = new McpServer({ name: "t", version: "0" }) as any; const out: any = {};
+  const orig = s.tool.bind(s); s.tool = (n: string, d: string, schema: any, h: any) => { out[n] = h; return orig(n,d,schema,h); };
+  registerTools(s, undefined, daemon ? NET : null, user, null, daemon, daemon ? "tok_start_daemon" : null); return out;
+}
+async function call(h: any, args: any) { return JSON.parse((await h(args)).content[0].text); }
+
+describe("start_node Hub -> daemon lifecycle", () => {
+  test("dispatch, authenticated pull, ack transitions stopped -> starting -> active", async () => {
+    const u = handlers(USER); const dispatch = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(dispatch.ok).toBe(true); expect(dispatch.lifecycle_state).toBe("starting");
+    const d = handlers(null, true); const pulled = await call(d.get_start_request, { request_id: dispatch.request_id });
+    expect(pulled).toMatchObject({ ok: true, child_node_id: CHILD, child_alias: CHILD_ALIAS });
+    const ack = await call(d.ack_start_request, { request_id: dispatch.request_id, status: "started", child_pid: 4321 });
+    expect(ack.ok).toBe(true);
+    expect(db.get<any>(`SELECT lifecycle_state FROM nodes WHERE node_id=?1`, CHILD)?.lifecycle_state).toBe("active");
+    expect(db.all<any>(`SELECT action FROM audit_log WHERE target_id=?1 ORDER BY id`, dispatch.request_id).map((x:any)=>x.action)).toEqual(["start_node_dispatched", "start_node_completed"]);
+  });
+  test("active child and caller-supplied wrong daemon fail closed", async () => {
+    const u = handlers(USER);
+    db.run(`UPDATE nodes SET lifecycle_state='active' WHERE node_id=?1`, CHILD);
+    expect((await call(u.start_node, { child_node_id: CHILD, network_id: NET })).error).toBe("node_not_stopped");
+    db.run(`UPDATE nodes SET lifecycle_state='stopped' WHERE node_id=?1`, CHILD);
+    expect((await call(u.start_node, { child_node_id: CHILD, daemon_node_id: "node_wrong", network_id: NET })).error).toBe("daemon_child_mismatch");
+  });
+});
+
+// #1448 finding-2 — stale-starting reaper（对齐 update_node_config/restart_node 的 60s
+// single-flight stale-supersede）。start 只受理 stopped;卡在 starting 的节点(门铃丢 /
+// daemon 在 UPDATE starting 后死)改前永远 start 不了(gate 返 node_not_stopped)、也无
+// reaper 拉回 → 永久卡死。改后:in-flight start 请求晾过 60s ⇒ 标 timeout 超越 + 放行
+// 重派;未过阈值 ⇒ 拒 node_already_starting。
+describe("start_node — stale-starting reaper (#1448 finding-2)", () => {
+  function seedStartReq(reqId: string, status: string, ageMs: number) {
+    db.run(
+      `INSERT INTO node_start_requests(request_id,network_id,daemon_node_id,child_node_id,child_alias,created_by_token,status,created_at)
+       VALUES(?1,?2,?3,?4,?5,'t',?6,?7)`,
+      [reqId, NET, DAEMON, CHILD, CHILD_ALIAS, status, Date.now() - ageMs],
+    );
+  }
+
+  test("starting + FRESH in-flight start (< 60s) → refused node_already_starting (not superseded)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_fresh", "delivered", 5_000);   // 5s old — within threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_already_starting");
+    expect(r.existing_request_id).toBe("str_fresh");
+    expect(typeof r.age_ms).toBe("number");
+    // old request untouched, no new dispatch
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_fresh'`)?.status).toBe("delivered");
+  });
+
+  // witnessed-red：改前 gate 直接 `!== 'stopped' → node_not_stopped`，一个 stale 的
+  // 'starting' 节点返回 node_not_stopped、永远卡死。改后应超越重派(ok:true)。
+  test("starting + STALE in-flight start (> 60s) → supersede old + re-dispatch (converges)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_stale", "delivered", 61_000);   // 61s old — past 60s threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+    expect(typeof r.request_id).toBe("string");
+    expect(r.request_id).not.toBe("str_stale");                       // fresh request
+    // old stale request superseded → terminal, unblocks the child-inflight unique index
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_stale'`)?.status).toBe("timeout");
+    // exactly one non-terminal start request now (the new one)
+    const live = db.all<any>(`SELECT request_id FROM node_start_requests WHERE child_node_id=?1 AND status IN ('pending','delivered')`, CHILD);
+    expect(live.map((x:any)=>x.request_id)).toEqual([r.request_id]);
+    // audit records the real prior state
+    const aud = db.get<any>(`SELECT detail FROM audit_log WHERE target_id=?1`, r.request_id);
+    expect(JSON.parse(aud.detail).lifecycle_state_before).toBe("starting");
+  });
+
+  test("starting + NO in-flight row (orphaned state) → self-heals by re-dispatching", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+  });
+});