@sleep2agi/commhub-server 0.9.0-preview.0 → 0.9.0-preview.12

package/src/index.ts

@@ -4,6 +4,7 @@ import { z } from "zod/v4";
 import { registerTools } from "./tools.js";
 import { db, logTaskEvent, logAudit } from "./db.js";
 import { createSSEStream, pushEvent, getSSEStats } from "./push.js";
+import { assertNodeActive } from "./lifecycle-guard.js";
 import { register, login, resolveToken, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, renameNetwork, changePassword, issueUserToken, listTokens, createToken, revokeToken, getNetworkMembers, getUserNetworkRole, addNetworkMember, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
 import { abortRename, cleanupCommittedRenameSessions, commitRename, prepareRename, resolveCanonicalAlias } from "./rename.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
@@ -24,6 +25,8 @@ import {
 } from "./uploads.js";
 import { mkdirSync, writeFileSync, readFileSync, existsSync, statSync } from "fs";
 import { dirname as pathDirname } from "path";
+import { startRetentionSweeper } from "./retention.js";
+import { startStaleSessionSweeper } from "./stale-sweeper.js";
 
 const PORT = Number(process.env.PORT) || 9200;
 const HOST = process.env.HOST || "127.0.0.1";
@@ -1066,11 +1069,9 @@ Bun.serve({
 
     // ── REST: all sessions status ──
     if (url.pathname === "/api/status") {
-      const cutoff = new Date(Date.now() - 10 * 60 * 1000).toISOString().replace("T", " ").slice(0, 19);
-      const staleParams: any[] = [cutoff];
-      let staleSql = "UPDATE sessions SET status = 'offline' WHERE updated_at < ?1 AND status != 'offline'";
-      staleSql = addNetworkScope(staleSql, staleParams, restScope);
-      db.run(staleSql, staleParams);
+      // Round-2/4 review ③: stale-marking moved to startStaleSessionSweeper()
+      // (background timer, ~60s cadence). Read paths no longer fire UPDATE.
+      // Per-request UPDATE was a write-amp vector — see stale-sweeper.ts.
       cleanupCommittedRenameSessions(restScope.networkId ? [restScope.networkId] : restScope.networkIds ?? null);
       // `?light=1` returns a narrow projection (alias / status / agent / task /
       // server / updated_at + runtime + network_id) — used by the mobile APP
@@ -1138,12 +1139,7 @@ Bun.serve({
 
     // ── REST: aggregate agents by physical server ──
     if (url.pathname === "/api/servers") {
-      const cutoff = new Date(Date.now() - 10 * 60 * 1000).toISOString().replace("T", " ").slice(0, 19);
-      const staleParams: any[] = [cutoff];
-      let staleSql = "UPDATE sessions SET status = 'offline' WHERE updated_at < ?1 AND status != 'offline'";
-      staleSql = addNetworkScope(staleSql, staleParams, restScope);
-      db.run(staleSql, staleParams);
-
+      // Round-2/4 review ③: stale-marking moved to background sweeper.
       const params: any[] = [];
       let sql = `
         SELECT hostname, ip, cpu_load_1min, cpu_cores, mem_avail_gb, mem_used_gb,
@@ -1220,12 +1216,7 @@ Bun.serve({
       const detailKind = serverDetailMatch[2];
       if (!host) return withCors(req, Response.json({ ok: false, error: "host required" }, { status: 400 }));
 
-      const cutoff = sqliteTime(new Date(Date.now() - 10 * 60 * 1000));
-      const staleParams: any[] = [cutoff];
-      let staleSql = "UPDATE sessions SET status = 'offline' WHERE updated_at < ?1 AND status != 'offline'";
-      staleSql = addNetworkScope(staleSql, staleParams, restScope);
-      db.run(staleSql, staleParams);
-
+      // Round-2/4 review ③: stale-marking moved to background sweeper.
       if (detailKind === "agents") {
         const params: any[] = [host, host];
         let sql = `
@@ -1631,6 +1622,18 @@ Bun.serve({
         return withCors(req, Response.json(payload, { status: 429 }));
       }
 
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.2a REST site
+      // 1/2 — paired with the 6 MCP sites guarded in tools.ts at PR1.1).
+      // Dashboard's "Dispatch" button hits this endpoint, so without
+      // the guard a stopping/stopped/deleting node still got tasks
+      // routed through REST. Returns 409 with the same structured
+      // payload the MCP handlers use.
+      {
+        const lc = assertNodeActive(targetAlias, taskNetId ?? null);
+        if (!lc.ok) {
+          return withCors(req, Response.json(lc, { status: 409 }));
+        }
+      }
       // Mirror send_task MCP: write inbox + tasks rows in a single
       // transaction so the dispatch is visible to dashboard's Tasks page
       // and the parent_task_id lineage chain. Previously this endpoint
@@ -1711,6 +1714,12 @@ Bun.serve({
       const targets = db.all<{ alias: string; node_id: string | null; network_id: string | null }>(sql, ...params);
       const ids: string[] = [];
       for (const t of targets) {
+        // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.2a REST site
+        // 2/2). Broadcast skips non-active recipients silently per its
+        // best-effort semantics — mirrors the MCP broadcast handler
+        // in tools.ts (PR1.1 site 6/6).
+        const lc = assertNodeActive(t.alias, t.network_id ?? null);
+        if (!lc.ok) continue;
         const id = crypto.randomUUID();
         db.run(
           `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, network_id)
@@ -1927,17 +1936,195 @@ Bun.serve({
       }));
     }
 
+    // ── REST: single node config snapshot (RFC-024 B5) ──
+    // Dashboard calls this for the snapshot path. Returns the masked
+    // {model, flags, config_revision} the node last posted via
+    // report_status (B6). NEVER reads per-node files. Network-scoped
+    // via addNetworkScope so a netA viewer can't read a netB node.
+    const nodeConfigMatch = url.pathname.match(/^\/api\/nodes\/([^/]+)\/config$/);
+    if (nodeConfigMatch && req.method === "GET") {
+      const nodeId = decodeURIComponent(nodeConfigMatch[1] ?? "");
+      const params: any[] = [nodeId];
+      let sql = "SELECT node_id, alias, network_id, config_revision, config_snapshot FROM nodes WHERE node_id = ?1";
+      sql = addNetworkScope(sql, params, restScope);
+      sql += " LIMIT 1";
+      const node = db.get<any>(sql, ...params);
+      if (!node) {
+        return withCors(req, Response.json({ ok: false, error: "node_not_found", node_id: nodeId }, { status: 404 }));
+      }
+      let snapshot: any = {};
+      if (node.config_snapshot) {
+        try { snapshot = JSON.parse(node.config_snapshot); } catch { snapshot = {}; }
+      }
+      return withCors(req, Response.json({
+        ok: true,
+        node_id: node.node_id,
+        alias: node.alias,
+        network_id: node.network_id,
+        config_revision: node.config_revision || 0,
+        model: snapshot.model ?? null,
+        flags: snapshot.flags ?? {},
+        config_update_capable: snapshot.config_update_capable ?? false,
+      }));
+    }
+
     // ── REST: nodes table (V2 Sprint 2) ──
+    // Explicit column list — NOT `SELECT *`. Two reasons:
+    //   1. `SELECT *` silently broadcasts any column added later to the
+    //      response (RFC-024 added config_revision/config_snapshot which
+    //      the dashboard's GET /api/nodes/:id/config endpoint owns;
+    //      RFC-028 will add more vault-flavored columns). Tests asserting
+    //      response shape break on every ALTER; integrations that key
+    //      off Object.keys() can pick up internals.
+    //   2. The list endpoint and the per-node config snapshot endpoint
+    //      have different consumer contracts; this list should be the
+    //      stable, dashboard-facing fields only.
+    // Add a new column to this list explicitly when a real client needs
+    // it; do NOT switch back to SELECT *.
+    // ── REST: list host_supervisor daemons (RFC-026 §9.2.2 / #338 PR2) ──
+    // Mirror of the `list_host_supervisors` MCP tool for non-MCP callers.
+    // Same SQL + role-extract + member-脱敏 logic; SEC-1 scoped via REST
+    // auth pipeline (restScope). Returns {ok, daemons:[...], count}.
+    if (url.pathname === "/api/host-supervisors") {
+      const netParam = url.searchParams.get("network_id");
+      const effectiveNetId = restScope.networkId ?? netParam ?? null;
+      if (!effectiveNetId) {
+        return withCors(req, Response.json({ ok: false, error: "missing_network_id" }, { status: 400 }));
+      }
+      // Role for member-脱敏 (admin/owner = full host_telemetry, others = masked)
+      let isPrivileged = false;
+      if (restAuth?.userId) {
+        const role = getUserNetworkRole(restAuth.userId, effectiveNetId);
+        isPrivileged = role === "admin" || role === "owner";
+      } else {
+        // Network-token caller (no user) — treat as privileged within its network
+        isPrivileged = true;
+      }
+
+      // EXISTS subquery handles BOTH revoked_at SET and DELETEd token
+      // rows (revokeToken DELETEs the row in production — PR2 v1
+      // SHOULD-FIX per 通信龙 audit). EXISTS naturally dedupes daemons
+      // with rotated tokens.
+      const sqlRows = db.all<Record<string, any>>(`
+        SELECT
+          n.node_id, n.alias, n.hostname, n.network_id,
+          n.runtimes_supported, n.allowed_secret_keys,
+          n.created_at, n.updated_at,
+          s.last_seen_at AS session_last_seen,
+          s.cpu_cores AS session_cpu_cores,
+          s.mem_total_gb AS session_mem_total_gb,
+          s.ip AS session_ip,
+          n.config_snapshot
+        FROM nodes n
+        LEFT JOIN sessions s ON s.alias = n.alias AND (s.network_id = n.network_id OR s.network_id IS NULL)
+        WHERE n.network_id = ?1
+          AND EXISTS (
+            SELECT 1 FROM api_tokens t
+            WHERE t.network_id = n.network_id
+              AND t.name = 'node:' || n.alias
+              AND t.revoked_at IS NULL
+          )
+        ORDER BY n.updated_at DESC
+      `, effectiveNetId);
+
+      const nowMs = Date.now();
+      const ONLINE_MS = 60_000;
+      const daemons = sqlRows
+        .map(r => {
+          let snapRole: string | null = null;
+          if (r.config_snapshot) {
+            try {
+              const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
+              snapRole = typeof parsed?.role === "string" ? parsed.role : null;
+            } catch { /* malformed */ }
+          }
+          return { row: r, role: snapRole };
+        })
+        .filter(({ role }) => role === "host_supervisor")
+        .map(({ row: r }) => {
+          let online = false;
+          let lastSeenAt: string | null = null;
+          if (r.session_last_seen) {
+            lastSeenAt = r.session_last_seen;
+            const t = Date.parse(r.session_last_seen);
+            if (!isNaN(t)) online = (nowMs - t) <= ONLINE_MS;
+          }
+          let runtimes: string[] = [];
+          let secrets: string[] = [];
+          try {
+            if (r.runtimes_supported) {
+              const parsed = JSON.parse(r.runtimes_supported);
+              runtimes = Array.isArray(parsed) ? parsed.filter((s: unknown) => typeof s === "string") : [];
+            }
+          } catch {}
+          try {
+            if (r.allowed_secret_keys) {
+              const parsed = JSON.parse(r.allowed_secret_keys);
+              secrets = Array.isArray(parsed) ? parsed.filter((s: unknown) => typeof s === "string") : [];
+            }
+          } catch {}
+          const telemetry: Record<string, unknown> = {
+            alert_level: online ? "green" : "gray",
+          };
+          if (isPrivileged) {
+            telemetry.cpu_cores = r.session_cpu_cores ?? null;
+            telemetry.mem_gb = r.session_mem_total_gb ?? null;
+            telemetry.ip_internal = r.session_ip ?? null;
+          }
+          return {
+            daemon_node_id: r.node_id,
+            alias: r.alias,
+            hostname: r.hostname,
+            online,
+            last_seen_at: lastSeenAt,
+            runtimes_supported: runtimes,
+            allowed_secret_keys: secrets,
+            host_telemetry: telemetry,
+          };
+        });
+      return withCors(req, Response.json({ ok: true, daemons, count: daemons.length }));
+    }
+
     if (url.pathname === "/api/nodes") {
       const nodeId = url.searchParams.get("node_id");
       const alias = url.searchParams.get("alias");
-      let sql = "SELECT * FROM nodes WHERE 1=1";
+      // `config_snapshot` SELECTed ONLY to extract the daemon `role` field
+      // for dashboard discovery — full snapshot is NOT broadcast (would
+      // re-introduce the #312 SELECT * fragility). Mapping step pulls
+      // `role` out then drops `config_snapshot` from the response row.
+      // RFC-027 PR2 dashboard prereq: lifecycle_state is needed
+      // client-side to drive the ⋮ menu (active → "停止/删除";
+      // stopped → "重启/删除"). Hub schema gained the column at PR1
+      // (#345) but /api/nodes never SELECTed it. Following #312
+      // "explicit SELECT" discipline — extend the projection here,
+      // do NOT switch to SELECT *.
+      let sql = `SELECT node_id, node_name, alias, runtime, model,
+                        config_path, channels, server, hostname,
+                        network_id, created_at, updated_at,
+                        config_snapshot, lifecycle_state
+                 FROM nodes WHERE 1=1`;
       const params: any[] = [];
       sql = addNetworkScope(sql, params, restScope);
       if (nodeId) { sql += ` AND node_id = ?${params.length + 1}`; params.push(nodeId); }
       if (alias) { sql += ` AND alias = ?${params.length + 1}`; params.push(alias); }
       sql += " ORDER BY updated_at DESC";
-      const rows = db.all(sql, ...params);
+      const rawRows = db.all<Record<string, any>>(sql, ...params);
+      // Add a single new field `role: string | null` per row, extracted from
+      // config_snapshot JSON. Daemon nodes that posted role='host_supervisor'
+      // via report_status surface here; dashboard uses this for daemon
+      // discovery (replacing the prior `node_daemon_` prefix heuristic).
+      // RFC-026 P1 P2 §9 will supersede this REST proxy with the
+      // `list_host_supervisors` MCP tool.
+      const rows = rawRows.map(r => {
+        let role: string | null = null;
+        const snap = r.config_snapshot;
+        if (snap) {
+          try { role = (typeof snap === "string" ? JSON.parse(snap) : snap)?.role ?? null; }
+          catch { /* malformed snapshot — leave role null */ }
+        }
+        const { config_snapshot, ...rest } = r;
+        return { ...rest, role };
+      });
       return withCors(req, Response.json({ ok: true, nodes: rows, count: rows.length }));
     }
 
@@ -2105,9 +2292,31 @@ Security: ${SECURITY_LABEL}
   },
 });
 
+// Round-2/4 review ② — periodic retention sweep + incremental VACUUM.
+// Sweeps every hour by default. Operators can disable any single table
+// by setting COMMHUB_RETENTION_*_DAYS to a negative value, or shorten
+// the sweep window via COMMHUB_RETENTION_SWEEP_MINUTES.
+const sweepIntervalMinutes = Number(process.env.COMMHUB_RETENTION_SWEEP_MINUTES);
+const sweepIntervalMs = Number.isFinite(sweepIntervalMinutes) && sweepIntervalMinutes > 0
+  ? sweepIntervalMinutes * 60 * 1000
+  : 60 * 60 * 1000;
+const retentionSweeperTimer = startRetentionSweeper(sweepIntervalMs);
+
+// Round-2/4 review ③ — stale session sweeper (coexists with the
+// retention sweeper above; different concerns + different cadences).
+// Replaces the per-request UPDATE in GET /api/status (+ /api/servers,
+// /api/server-detail/*, MCP get_all_status). Each of those endpoints
+// used to run UPDATE on the sessions table just to maintain the
+// derived `offline` status; with the dashboard polling fast that was
+// 99% no-op write-amp under hot read paths. Now done globally once
+// every COMMHUB_STALE_SWEEP_SECONDS (default 60s).
+const staleSweeperTimer = startStaleSessionSweeper();
+
 // ── Graceful shutdown ───────────────────────────────
 function shutdown() {
   console.log("[commhub] shutting down...");
+  clearInterval(retentionSweeperTimer);
+  clearInterval(staleSweeperTimer);
   db.close();
   process.exit(0);
 }
@@ -2126,3 +2335,22 @@ console.log(`
 ║   Health: http://${HOST}:${PORT}/health               ║
 ╚══════════════════════════════════════════════════╝
 `);
+
+// RFC-028 P1 boot banner — vault key configuration status.
+// F2 invariant: hub MUST boot regardless of vault state. This is
+// banner-only (informational); errors are raised lazily at vault op
+// time. needsKeyToOp=true means the operator should set
+// ANET_HUB_SECRET_VAULT_KEY before vault/provider features will work.
+try {
+  const { vaultStatusForBoot } = await import("./vault.js");
+  const s = vaultStatusForBoot();
+  if (s.needsKeyToOp) {
+    console.warn("[rfc-028 vault] ⚠️  network_secrets/providers have data BUT ANET_HUB_SECRET_VAULT_KEY is unset — vault ops will throw vault_master_key_missing until you set the env. Generate one: `openssl rand -hex 32` (must match the key used at write time).");
+  } else if (s.configured) {
+    console.log(`[rfc-028 vault] master key configured (tables_have_data=${s.tablesHaveData})`);
+  } else {
+    console.log("[rfc-028 vault] master key not set + no vault rows — vault gating is lazy; boot OK. Set ANET_HUB_SECRET_VAULT_KEY when enabling provider/secret features.");
+  }
+} catch (e: any) {
+  console.warn(`[rfc-028 vault] boot banner skipped (${e?.message || e})`);
+}

package/src/lifecycle-guard.ts

@@ -0,0 +1,50 @@
+// RFC-027 §2.3 race-free invariant — shared helper for the inbox-
+// enqueue lifecycle guard.
+//
+// PR1.1 (#346) added an `assertNodeActive` helper inside the
+// registerTools() closure and applied it at the 6 INSERT INTO inbox
+// sites in server/src/tools.ts. PR1.1 review (通信龙 #346 ack) caught
+// that the closure scope made the helper unreachable from REST
+// handlers in server/src/index.ts — POST /api/task (:1631) and
+// POST /api/broadcast (:1706) are dashboard's "Dispatch" entry
+// points and bypassed the guard, leaving the §2.3 race open on the
+// REST path.
+//
+// PR1.2a (#346 follow-up) extracts the helper to this module so both
+// the MCP tools and the REST handlers can import the same code path,
+// per [[feedback_grep_all_sites_before_apply_guard]]: any SQL-level
+// guard's helper lives at module scope so every write site
+// (MCP + REST + internal db.ts helpers) can use it.
+//
+// Behaviour:
+//   - no nodes row for the alias → ok:true (brand-new alias allowed;
+//     could be the first INSERT for a child about to register)
+//   - lifecycle_state = 'active' OR NULL (pre-RFC-027 row) → ok:true
+//   - anything else (stopping / stopped / stop_failed / deleting) →
+//     ok:false + structured `node_not_active` reply
+//
+// COALESCE on the WHERE keeps NULL-network inbox rows / legacy nodes
+// rows correctly scoped (PR1 SF-5 lineage).
+
+import { db } from "./db.js";
+
+export type LifecycleGuardResult =
+  | { ok: true }
+  | { ok: false; error: "node_not_active"; lifecycle_state: string; alias: string };
+
+export function assertNodeActive(
+  sessionAlias: string,
+  networkId: string | null,
+): LifecycleGuardResult {
+  if (!sessionAlias) return { ok: true };
+  const row = db.get<{ lifecycle_state: string | null }>(
+    networkId
+      ? `SELECT lifecycle_state FROM nodes WHERE alias = ?1 AND COALESCE(network_id, ?2) = ?2 LIMIT 1`
+      : `SELECT lifecycle_state FROM nodes WHERE alias = ?1 LIMIT 1`,
+    ...(networkId ? [sessionAlias, networkId] : [sessionAlias]),
+  );
+  if (!row) return { ok: true };
+  const st = row.lifecycle_state ?? "active";
+  if (st === "active") return { ok: true };
+  return { ok: false, error: "node_not_active", lifecycle_state: st, alias: sessionAlias };
+}