@sleep2agi/commhub-server 0.9.0-preview.0 → 0.9.0-preview.12

package/src/list-host-supervisors.test.ts

@@ -0,0 +1,314 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db, hashToken, generateId } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+// RFC-026 §9.2 / #338 PR2 v2 — list_host_supervisors HANDLER tests.
+//
+// PR2 v1 used a mirror-SQL pattern (re-implemented the query in the test
+// itself) → trivially passed but didn't exercise the handler. 通信龙 audit
+// caught: that style misses the SEC-1 scope-derivation bug
+// (`getNetworkId(clientNetId)` returns the unchecked client-supplied
+// network_id for utok_ callers when enforceNetworkId is null, leaking
+// cross-tenant daemons). This rewrite drives the registered MCP tool
+// through registerTools() so the auth context is real.
+//
+// Covers:
+//   SEC-1.1 — cross-tenant utok_ caller with foreign network_id: DENIED
+//   SEC-1.2 — admin caller with own network_id: returns own daemons
+//   SEC-1.3 — caller with no network_id: returns daemons in all member networks
+//   masking — non-admin viewer: host_telemetry IP/cpu/mem stripped, alert_level still surfaces
+//   revoked — DELETEd token row (revokeToken path): daemon excluded
+//   revoked — revoked_at SET token: daemon excluded
+//   self-declare — runtimes_supported/allowed_secret_keys surface from columns
+//   pre-PR2 daemon — empty arrays on NULL columns (back-compat)
+
+const NET_ALPHA = "net_lhs_alpha";
+const NET_BETA = "net_lhs_beta";
+
+interface ToolHandler { (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>; }
+interface Reply { ok?: boolean; error?: string; daemons?: any[]; count?: number; }
+
+function cleanup() {
+  for (const n of [NET_ALPHA, NET_BETA]) {
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [n]); } catch {}
+    try { db.run("DELETE FROM sessions WHERE network_id = ?1", [n]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [n]); } catch {}
+    try { db.run("DELETE FROM network_members WHERE network_id = ?1", [n]); } catch {}
+    try { db.run("DELETE FROM networks WHERE network_id = ?1", [n]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id LIKE 'u_lhs_%'"); } catch {}
+}
+
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seedUser(user_id: string) {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at)
+     VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [user_id, user_id],
+  );
+}
+function seedNetwork(net_id: string, owner_id = "u_lhs_owner") {
+  db.run(
+    `INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at)
+     VALUES (?1, ?2, ?3, datetime('now'))`,
+    [net_id, net_id, owner_id],
+  );
+}
+function seedMembership(user_id: string, net_id: string, role: "owner" | "admin" | "member" | "viewer" = "member") {
+  db.run(
+    `INSERT INTO network_members (user_id, network_id, role, joined_at)
+     VALUES (?1, ?2, ?3, datetime('now'))`,
+    [user_id, net_id, role],
+  );
+}
+function seedDaemon(opts: {
+  network_id: string, alias: string, node_id?: string,
+  role?: string,
+  runtimes?: string[],
+  secrets?: string[],
+  sessionAgeMs?: number,
+  mintToken?: boolean,
+  tokenRevokedAt?: boolean,
+  tokenDeleted?: boolean,
+}) {
+  const node_id = opts.node_id || `node_${opts.network_id}_${opts.alias}`;
+  const snapshot = JSON.stringify({
+    model: "claude-opus", flags: {}, role: opts.role ?? "host_supervisor",
+    runtimes_supported: opts.runtimes ?? ["claude-agent-sdk"],
+    allowed_secret_keys: opts.secrets ?? [],
+  });
+  db.run(
+    `INSERT OR REPLACE INTO nodes (
+      node_id, node_name, alias, network_id,
+      runtimes_supported, allowed_secret_keys,
+      config_snapshot, hostname,
+      created_at, updated_at
+    ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, datetime('now'), datetime('now'))`,
+    [node_id, opts.alias, opts.alias, opts.network_id,
+     JSON.stringify(opts.runtimes ?? ["claude-agent-sdk"]),
+     JSON.stringify(opts.secrets ?? []),
+     snapshot, `host-${opts.alias}`],
+  );
+  if (opts.sessionAgeMs !== undefined) {
+    const ts = new Date(Date.now() - opts.sessionAgeMs).toISOString().replace("T", " ").replace(/\..+/, "");
+    db.run(
+      `INSERT OR REPLACE INTO sessions (resume_id, alias, network_id, last_seen_at, status, cpu_cores, mem_total_gb, ip)
+       VALUES (?1, ?2, ?3, ?4, 'idle', 8, 16, '10.0.0.5')`,
+      [`s_${node_id}`, opts.alias, opts.network_id, ts],
+    );
+  }
+  if (opts.mintToken !== false && !opts.tokenDeleted) {
+    db.run(
+      `INSERT OR REPLACE INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+       VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, ?6)`,
+      [`tok_${node_id}`, `u_seed_${node_id}`, opts.network_id, `node:${opts.alias}`,
+       `hash_${node_id}`,
+       opts.tokenRevokedAt ? new Date().toISOString().replace("T", " ").replace(/\..+/, "") : null],
+    );
+  }
+  return node_id;
+}
+
+/** Build a server with registerTools wired to a specific enforceUserId. */
+function buildToolHandler(enforceUserId: string | null): ToolHandler {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  // Capture the registered tool function. The MCP SDK's server.tool stores
+  // the handler internally; we intercept by overriding before registerTools.
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, _schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    return origTool(name, _desc, _schema, handler);
+  };
+  // Some tools use registerTool; intercept that too
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, _cfg: any, handler: ToolHandler) => {
+      tools[name] = handler;
+      return origRegisterTool(name, _cfg, handler);
+    };
+  }
+  registerTools(
+    server,
+    /* clientIP */ undefined,
+    /* enforceNetworkId */ null,
+    /* enforceUserId */ enforceUserId,
+    /* callerAlias */ null,
+    /* callerTokenIsNetwork */ false,
+    /* callerTokenId */ null,
+  );
+  const h = tools["list_host_supervisors"];
+  if (!h) throw new Error("list_host_supervisors tool not registered");
+  return h;
+}
+
+async function callList(handler: ToolHandler, args: any = {}): Promise<Reply> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text) as Reply;
+}
+
+describe("list_host_supervisors HANDLER tests (RFC-026 §9.2, PR2 v2)", () => {
+  test("SEC-1.1: cross-tenant utok_ caller with foreign network_id → DENIED", async () => {
+    const userA = "u_lhs_alice"; // belongs to NET_ALPHA only
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedNetwork(NET_BETA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_BETA, alias: "secret-beta-daemon" });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_BETA });
+    // PR2 v1 BUG: this returned ok:true with secret-beta-daemon in the list.
+    expect(reply.ok).toBe(false);
+    expect(reply.error).toMatch(/access denied|not a member/i);
+    // Belt: hostname not in error payload
+    expect(JSON.stringify(reply)).not.toContain("secret-beta-daemon");
+    expect(JSON.stringify(reply)).not.toContain("host-secret-beta-daemon");
+  });
+
+  test("SEC-1.2: admin caller with own network_id returns own daemons", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_ALPHA, alias: "alpha-daemon-1" });
+    seedDaemon({ network_id: NET_ALPHA, alias: "alpha-daemon-2" });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    expect(reply.ok).toBe(true);
+    const aliases = (reply.daemons ?? []).map(d => d.alias).sort();
+    expect(aliases).toEqual(["alpha-daemon-1", "alpha-daemon-2"]);
+  });
+
+  test("SEC-1.3: caller without network_id arg → returns daemons across member networks only", async () => {
+    const userA = "u_lhs_alice"; // member of NET_ALPHA only
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedNetwork(NET_BETA);
+    seedMembership(userA, NET_ALPHA, "member");
+    seedDaemon({ network_id: NET_ALPHA, alias: "ok-daemon" });
+    seedDaemon({ network_id: NET_BETA, alias: "forbidden-daemon" });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler);
+    expect(reply.ok).toBe(true);
+    const aliases = (reply.daemons ?? []).map(d => d.alias);
+    expect(aliases).toContain("ok-daemon");
+    expect(aliases).not.toContain("forbidden-daemon");
+  });
+
+  test("masking: member caller gets host_telemetry without IP/cpu/mem; admin gets full", async () => {
+    const userMember = "u_lhs_bob_member";
+    const userAdmin = "u_lhs_carol_admin";
+    seedUser(userMember);
+    seedUser(userAdmin);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userMember, NET_ALPHA, "member");
+    seedMembership(userAdmin, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_ALPHA, alias: "telemetry-daemon", sessionAgeMs: 5_000 });
+
+    const memberHandler = buildToolHandler(userMember);
+    const memberReply = await callList(memberHandler, { network_id: NET_ALPHA });
+    expect(memberReply.daemons?.[0].host_telemetry.alert_level).toBeDefined();
+    expect(memberReply.daemons?.[0].host_telemetry).not.toHaveProperty("cpu_cores");
+    expect(memberReply.daemons?.[0].host_telemetry).not.toHaveProperty("mem_gb");
+    expect(memberReply.daemons?.[0].host_telemetry).not.toHaveProperty("ip_internal");
+
+    const adminHandler = buildToolHandler(userAdmin);
+    const adminReply = await callList(adminHandler, { network_id: NET_ALPHA });
+    expect(adminReply.daemons?.[0].host_telemetry.cpu_cores).toBe(8);
+    expect(adminReply.daemons?.[0].host_telemetry.mem_gb).toBe(16);
+    expect(adminReply.daemons?.[0].host_telemetry.ip_internal).toBe("10.0.0.5");
+  });
+
+  test("revoked: DELETEd token row (revokeToken path) excludes daemon", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_ALPHA, alias: "alive-daemon" });
+    seedDaemon({ network_id: NET_ALPHA, alias: "deleted-token-daemon", tokenDeleted: true });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    const aliases = (reply.daemons ?? []).map(d => d.alias).sort();
+    expect(aliases).toContain("alive-daemon");
+    expect(aliases).not.toContain("deleted-token-daemon");
+  });
+
+  test("revoked: token with revoked_at SET also excludes daemon", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_ALPHA, alias: "alive-daemon" });
+    seedDaemon({ network_id: NET_ALPHA, alias: "revoked-at-daemon", tokenRevokedAt: true });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    const aliases = (reply.daemons ?? []).map(d => d.alias).sort();
+    expect(aliases).toContain("alive-daemon");
+    expect(aliases).not.toContain("revoked-at-daemon");
+  });
+
+  test("role filter: regular member nodes (role=member) excluded after extraction", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({ network_id: NET_ALPHA, alias: "real-daemon", role: "host_supervisor" });
+    seedDaemon({ network_id: NET_ALPHA, alias: "regular-node", role: "member" });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    const aliases = (reply.daemons ?? []).map(d => d.alias).sort();
+    expect(aliases).toEqual(["real-daemon"]);
+  });
+
+  test("self-declare: runtimes_supported + allowed_secret_keys surface from columns", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    seedDaemon({
+      network_id: NET_ALPHA, alias: "rich-daemon",
+      runtimes: ["claude-agent-sdk", "codex-sdk", "grok-build-acp"],
+      secrets: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+    });
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    const d = reply.daemons?.[0];
+    expect(d.runtimes_supported).toEqual(["claude-agent-sdk", "codex-sdk", "grok-build-acp"]);
+    expect(d.allowed_secret_keys).toEqual(["ANTHROPIC_API_KEY", "OPENAI_API_KEY"]);
+  });
+
+  test("pre-PR2 daemon (NULL columns) extracts to empty arrays back-compat", async () => {
+    const userA = "u_lhs_alice";
+    seedUser(userA);
+    seedNetwork(NET_ALPHA);
+    seedMembership(userA, NET_ALPHA, "admin");
+    db.run(
+      `INSERT INTO nodes (node_id, node_name, alias, network_id, config_snapshot, runtimes_supported, allowed_secret_keys, created_at, updated_at)
+       VALUES (?1, 'legacy', 'legacy', ?2, ?3, NULL, NULL, datetime('now'), datetime('now'))`,
+      ["node_legacy_alpha", NET_ALPHA, JSON.stringify({ role: "host_supervisor" })],
+    );
+    // Seed active token so the EXISTS guard lets it through
+    db.run(
+      `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash)
+       VALUES ('tok_legacy', 'u_seed_legacy', ?1, 'network', 'node:legacy', 'hash_legacy')`,
+      [NET_ALPHA],
+    );
+
+    const handler = buildToolHandler(userA);
+    const reply = await callList(handler, { network_id: NET_ALPHA });
+    const d = reply.daemons?.find(d => d.alias === "legacy");
+    expect(d).toBeTruthy();
+    expect(d.runtimes_supported).toEqual([]);
+    expect(d.allowed_secret_keys).toEqual([]);
+  });
+});

package/src/probe-validate.test.ts

@@ -0,0 +1,221 @@
+// RFC-028 P1 §4.4 probe-validate tests — pure unit, no I/O.
+
+import { describe, expect, test } from "bun:test";
+import {
+  validateBaseUrl, isForbiddenIp, isLoopbackHost, assertSecureTlsEnv,
+  ProbeAckPayloadSchema, deriveErrorLabel, rejectIfSecretLeaked,
+  VENDOR_HOST_ALLOWLIST, SUPPORTED_VENDORS, ProbeValidationError,
+} from "./probe-validate.js";
+
+describe("validateBaseUrl (§4.4.1 vendor host allowlist)", () => {
+  test("anthropic + api.anthropic.com → ok", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.anthropic.com/v1")).not.toThrow();
+  });
+  test("anthropic + api.openai.com → probe_target_forbidden", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.openai.com/v1")).toThrow(/probe_target_forbidden/);
+  });
+  test("anthropic + 169.254.169.254 (metadata) → probe_target_forbidden (host不在 allowlist)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://169.254.169.254/v1")).toThrow(/probe_target_forbidden/);
+  });
+  test("unsupported vendor → vendor_not_supported", () => {
+    expect(() => validateBaseUrl("openai", "https://api.openai.com/v1")).toThrow(/vendor_not_supported/);
+  });
+  test("non-https → probe_base_url_invalid", () => {
+    expect(() => validateBaseUrl("anthropic", "http://api.anthropic.com/v1")).toThrow(/probe_base_url_invalid/);
+  });
+  test("http+loopback OK with allowLoopback opt-in", () => {
+    expect(() => validateBaseUrl("anthropic", "http://localhost:8080/v1", { allowLoopback: true }))
+      .toThrow(/probe_target_forbidden/);   // 但 host 还是不在 allowlist, allowLoopback 只放过 protocol
+  });
+  test("malformed URL → probe_base_url_invalid", () => {
+    expect(() => validateBaseUrl("anthropic", "not a url")).toThrow(/probe_base_url_invalid/);
+  });
+  test("P1 SUPPORTED_VENDORS only contains anthropic", () => {
+    expect(SUPPORTED_VENDORS).toEqual(["anthropic"]);
+  });
+
+  // ── RFC-028 P1.5+ — Anthropic-compatible 3rd-party hosts on `anthropic` vendor.
+  // Whitelist semantics preserved; new entries require PR + security review.
+  // Host allowlist passes here; IP-level guard still fires at fetch time
+  // (covered by safelyFetchProbe + docker scenarios qa-rfc028 F + M.ssrf).
+  test("anthropic + api.deepseek.com → ok (Anthropic-compatible /v1/messages)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.deepseek.com/v1")).not.toThrow();
+  });
+  test("anthropic + api.minimax.chat → ok (MiniMax legacy domain)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.minimax.chat/v1")).not.toThrow();
+  });
+  test("anthropic + api.minimax.io → ok (MiniMax new domain, Vincent live)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.minimax.io/v1")).not.toThrow();
+  });
+  test("subdomain of allowed host NOT accepted (regex anchored)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://attacker.api.deepseek.com/v1")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl("anthropic", "https://api.minimax.io.attacker.example/v1")).toThrow(/probe_target_forbidden/);
+  });
+  test("homograph / look-alike host rejected (regex anchored)", () => {
+    expect(() => validateBaseUrl("anthropic", "https://api.deepseek.com.attacker/v1")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl("anthropic", "https://api-deepseek.com/v1")).toThrow(/probe_target_forbidden/);
+  });
+  test("VENDOR_HOST_ALLOWLIST.anthropic curated list = exactly 4 entries", () => {
+    // Lock the curated set — adding a 5th host MUST go through a PR
+    // bump this assertion (forces conscious security review).
+    expect(VENDOR_HOST_ALLOWLIST.anthropic.length).toBe(4);
+    const sources = VENDOR_HOST_ALLOWLIST.anthropic.map(r => r.source).sort();
+    expect(sources).toEqual([
+      "^api\\.anthropic\\.com$",
+      "^api\\.deepseek\\.com$",
+      "^api\\.minimax\\.chat$",
+      "^api\\.minimax\\.io$",
+    ]);
+  });
+});
+
+describe("isForbiddenIp (§4.4.2 private/reserved IP block — anti SSRF)", () => {
+  test("blocks IPv4 private + metadata + CGNAT", () => {
+    for (const ip of [
+      "10.0.0.1", "10.255.255.255",
+      "172.16.0.1", "172.31.255.255",
+      "192.168.1.1",
+      "127.0.0.1", "127.255.255.255",
+      "169.254.169.254",      // cloud metadata
+      "169.254.0.0",
+      "100.64.0.1", "100.127.255.254",   // CGNAT
+      "0.0.0.0",
+      "224.0.0.1",            // multicast
+      "240.0.0.1", "255.255.255.255",   // experimental/broadcast
+    ]) {
+      expect(isForbiddenIp(ip)).toBe(true);
+    }
+  });
+  test("allows public IPv4", () => {
+    for (const ip of ["1.1.1.1", "8.8.8.8", "104.16.0.1", "172.32.0.1", "172.15.255.254"]) {
+      expect(isForbiddenIp(ip)).toBe(false);
+    }
+  });
+  test("blocks IPv6 loopback + link-local + ULA", () => {
+    for (const ip of ["::1", "::", "fe80::1", "fc00::1", "fd00::1"]) {
+      expect(isForbiddenIp(ip)).toBe(true);
+    }
+  });
+  test("blocks IPv4-mapped IPv6 (anti绕)", () => {
+    expect(isForbiddenIp("::ffff:10.0.0.1")).toBe(true);
+    expect(isForbiddenIp("::ffff:169.254.169.254")).toBe(true);
+    expect(isForbiddenIp("::FFFF:127.0.0.1")).toBe(true);
+  });
+  test("allows public IPv6", () => {
+    expect(isForbiddenIp("2606:4700:4700::1111")).toBe(false);
+    expect(isForbiddenIp("2001:4860:4860::8888")).toBe(false);
+  });
+});
+
+describe("isLoopbackHost", () => {
+  test("recognizes localhost/127.0.0.1/::1", () => {
+    expect(isLoopbackHost("localhost")).toBe(true);
+    expect(isLoopbackHost("127.0.0.1")).toBe(true);
+    expect(isLoopbackHost("::1")).toBe(true);
+    expect(isLoopbackHost("api.example.com")).toBe(false);
+  });
+});
+
+describe("assertSecureTlsEnv (§4.4 boot guard)", () => {
+  test("clean env passes", () => {
+    expect(() => assertSecureTlsEnv({})).not.toThrow();
+  });
+  test("NODE_TLS_REJECT_UNAUTHORIZED=0 throws probe_tls_insecure_disabled", () => {
+    expect(() => assertSecureTlsEnv({ NODE_TLS_REJECT_UNAUTHORIZED: "0" }))
+      .toThrow(/probe_tls_insecure_disabled/);
+  });
+  test("NODE_TLS_REJECT_UNAUTHORIZED=1 passes (default safe)", () => {
+    expect(() => assertSecureTlsEnv({ NODE_TLS_REJECT_UNAUTHORIZED: "1" })).not.toThrow();
+  });
+});
+
+describe("ProbeAckPayloadSchema (§4.4.4 v3 R3 strict whitelist)", () => {
+  test("minimal valid payload parses", () => {
+    const ok = { probe_id: "p_1", status: "ok", latency_ms: 180 };
+    expect(ProbeAckPayloadSchema.parse(ok)).toEqual(ok);
+  });
+  test("with raw_status_code parses", () => {
+    const r = ProbeAckPayloadSchema.parse({ probe_id: "p_2", status: "auth_fail", raw_status_code: 401, latency_ms: 50 });
+    expect(r.raw_status_code).toBe(401);
+  });
+  test("REJECTS extra error_message field (zod .strict, v3 R3 attacker daemon catch)", () => {
+    expect(() => ProbeAckPayloadSchema.parse({
+      probe_id: "p_3", status: "auth_fail", latency_ms: 50,
+      error_message: "Invalid API key: sk-ant-abc",   // ← attacker smuggling
+    })).toThrow();
+  });
+  test("REJECTS extra response_body / response_headers / url / vendor_text", () => {
+    for (const extra of [
+      { response_body: "..." },
+      { response_headers: { foo: "bar" } },
+      { url: "https://leak" },
+      { vendor_text: "leak" },
+      { error: "leak" },
+      { detail: "leak" },
+    ]) {
+      expect(() => ProbeAckPayloadSchema.parse({
+        probe_id: "p", status: "ok", latency_ms: 1,
+        ...extra,
+      })).toThrow();
+    }
+  });
+  test("REJECTS bad enum status", () => {
+    expect(() => ProbeAckPayloadSchema.parse({ probe_id: "p", status: "bogus", latency_ms: 1 })).toThrow();
+  });
+  test("REJECTS latency_ms > 60_000 or negative", () => {
+    expect(() => ProbeAckPayloadSchema.parse({ probe_id: "p", status: "ok", latency_ms: 60_001 })).toThrow();
+    expect(() => ProbeAckPayloadSchema.parse({ probe_id: "p", status: "ok", latency_ms: -1 })).toThrow();
+  });
+});
+
+describe("deriveErrorLabel (hub-only, daemon CANNOT submit)", () => {
+  test("ok → null", () => {
+    expect(deriveErrorLabel({ probe_id: "p", status: "ok", latency_ms: 10 })).toBeNull();
+  });
+  test("auth_fail with code → label includes HTTP code", () => {
+    expect(deriveErrorLabel({ probe_id: "p", status: "auth_fail", raw_status_code: 401, latency_ms: 10 }))
+      .toContain("401");
+  });
+  test("every enum has a label or null", () => {
+    for (const status of ["ok", "auth_fail", "quota", "rate_limit", "network_error", "timeout", "redirect_forbidden", "vendor_5xx", "other_4xx", "tls_error"] as const) {
+      const r = deriveErrorLabel({ probe_id: "p", status, latency_ms: 1 });
+      expect(typeof r === "string" || r === null).toBe(true);
+    }
+  });
+});
+
+describe("rejectIfSecretLeaked (§4.4.4 belt-and-suspenders)", () => {
+  test("clean ack passes", () => {
+    expect(() => rejectIfSecretLeaked(
+      JSON.stringify({ probe_id: "p", status: "ok" }),
+      ["sk-very-long-secret-1234567890"],
+    )).not.toThrow();
+  });
+  test("ack containing raw secret → ack_secret_leak (plain)", () => {
+    expect(() => rejectIfSecretLeaked(
+      JSON.stringify({ probe_id: "p", status: "fail", x: "sk-very-long-secret-1234567890" }),
+      ["sk-very-long-secret-1234567890"],
+    )).toThrow(/ack_secret_leak/);
+  });
+  test("ack containing URL-encoded secret → ack_secret_leak (url_encoded)", () => {
+    const secret = "sk/with+special=chars/here-long-enough";
+    const enc = encodeURIComponent(secret);
+    expect(() => rejectIfSecretLeaked(
+      JSON.stringify({ probe_id: "p", url: `https://x/?key=${enc}` }),
+      [secret],
+    )).toThrow(/ack_secret_leak/);
+  });
+  test("ack containing 12-char substring of long secret → ack_secret_leak (substring_12)", () => {
+    const secret = "sk-ant-api03-very-long-key-1234567890-abcdef";
+    expect(() => rejectIfSecretLeaked(
+      JSON.stringify({ probe_id: "p", x: "leak prefix sk-ant-api03 here" }),
+      [secret],
+    )).toThrow(/ack_secret_leak/);
+  });
+  test("short secret (<8) not checked (avoid false positive on tiny tokens)", () => {
+    expect(() => rejectIfSecretLeaked(
+      JSON.stringify({ probe_id: "p", x: "test" }),
+      ["test"],
+    )).not.toThrow();
+  });
+});

package/src/probe-validate.ts

@@ -0,0 +1,104 @@
+// RFC-028 P1 §4.4 — probe path validators (pure, no I/O).
+// Host allowlist + IP block + validateBaseUrl extracted into
+// shared/probe-host-allowlist.ts (mirror of agent-node/src/shared/, G9
+// drift guard enforces byte-identical). This module re-exports them so
+// existing hub call sites keep working, and adds hub-only bits:
+// PROBE_STATUS_ENUM + ProbeAckPayloadSchema + deriveErrorLabel +
+// rejectIfSecretLeaked + assertSecureTlsEnv.
+
+import { z } from "zod/v4";
+export {
+  VENDOR_HOST_ALLOWLIST,
+  SUPPORTED_VENDORS,
+  ProbeValidationError,
+  validateBaseUrl,
+  isLoopbackHost,
+  isForbiddenIp,
+} from "./shared/probe-host-allowlist.js";
+import { ProbeValidationError } from "./shared/probe-host-allowlist.js";
+
+// ── §4.4.5 boot-time TLS env guard (assert before any probe runs) ──
+
+export function assertSecureTlsEnv(env: NodeJS.ProcessEnv = process.env): void {
+  if (env.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
+    throw new ProbeValidationError("probe_tls_insecure_disabled", {
+      reason: "NODE_TLS_REJECT_UNAUTHORIZED=0 forbidden — TLS cert validation must be ON for SSRF defense",
+    });
+  }
+}
+
+// ── §4.4.4 ProbeAckPayload — STRICT whitelist (v3 R3) ─────────────
+// Daemon ack returns ONLY these fields. Any extra string is dropped
+// at the zod parse boundary. Hub additionally runs rejectIfSecretLeaked
+// (defense in depth).
+
+export const PROBE_STATUS_ENUM = [
+  "ok",
+  "auth_fail",
+  "quota",
+  "rate_limit",
+  "network_error",
+  "timeout",
+  "redirect_forbidden",
+  "vendor_5xx",
+  "other_4xx",
+  "tls_error",
+  // SSRF guards surface their own statuses so dashboard can show the
+  // exact reason; deriveErrorLabel maps to UI text.
+  "probe_resolve_unsafe_ip",
+  "probe_target_forbidden",
+] as const;
+export type ProbeStatus = typeof PROBE_STATUS_ENUM[number];
+
+export const ProbeAckPayloadSchema = z.object({
+  probe_id: z.string().min(1).max(200),
+  status: z.enum(PROBE_STATUS_ENUM),
+  raw_status_code: z.number().int().min(100).max(599).optional(),
+  latency_ms: z.number().int().min(0).max(60_000),
+}).strict();   // .strict() rejects ANY extra field — error_message / response_body / etc smuggled by attacker daemon
+export type ProbeAckPayload = z.infer<typeof ProbeAckPayloadSchema>;
+
+/** Hub-side: map (status, raw_status_code) → human label.
+ *  daemon NEVER submits this; hub computes from enum + numeric. */
+export function deriveErrorLabel(ack: ProbeAckPayload): string | null {
+  switch (ack.status) {
+    case "ok":                   return null;
+    case "auth_fail":            return `API key 校验失败 (HTTP ${ack.raw_status_code ?? "?"})`;
+    case "quota":                return "API 额度用尽 (429)";
+    case "rate_limit":           return "我方 rate limit (60req/min/provider) 触发";
+    case "network_error":        return "网络不可达 (connect/DNS fail)";
+    case "timeout":              return "连通性测试超时 (>30s)";
+    case "redirect_forbidden":   return "vendor 返回 30x redirect, P1 一律拒";
+    case "vendor_5xx":           return `vendor 服务端错 (HTTP ${ack.raw_status_code ?? "5xx"})`;
+    case "other_4xx":            return `vendor 客户端错 (HTTP ${ack.raw_status_code ?? "4xx"})`;
+    case "tls_error":            return "TLS 证书校验失败";
+    case "probe_resolve_unsafe_ip": return "SSRF 拒: base_url 解析到禁用 IP 段 (私网/metadata)";
+    case "probe_target_forbidden":  return "SSRF 拒: base_url host 不在 vendor allowlist";
+  }
+}
+
+// ── §4.4.4 hub-side belt: reject if daemon ack contains a secret ──
+// Even though daemon ack schema (zod .strict()) blocks string fields,
+// this guard catches a daemon impl bug that smuggles secrets via
+// some other means (e.g. probe_id stuffed with key value).
+// Checks plaintext + URL-encoded + 12-char sliding window substring.
+
+export function rejectIfSecretLeaked(ackJson: string, knownSecrets: ReadonlyArray<string>): void {
+  for (const s of knownSecrets) {
+    if (!s || s.length < 8) continue;  // avoid false positive on tiny tokens
+    if (ackJson.includes(s)) {
+      throw new ProbeValidationError("ack_secret_leak", { reason: "plain", len: s.length });
+    }
+    const enc = encodeURIComponent(s);
+    if (enc !== s && ackJson.includes(enc)) {
+      throw new ProbeValidationError("ack_secret_leak", { reason: "url_encoded", len: s.length });
+    }
+    if (s.length >= 16) {
+      for (let i = 0; i <= s.length - 12; i++) {
+        if (ackJson.includes(s.slice(i, i + 12))) {
+          throw new ProbeValidationError("ack_secret_leak", { reason: "substring_12", offset: i });
+        }
+      }
+    }
+  }
+}