@sleep2agi/commhub-server 0.9.0-preview.1 → 0.9.0-preview.101

package/src/create-node-validate.ts

@@ -0,0 +1,288 @@
+// RFC-026 v4 §4.2.2 (F2 structured) + §4.4.7 (C1+B1 env_refs) + §4.2.6
+// (B2 fork wrapper) — pure validators + arg builder. No DB access. Used
+// by hub create_node MCP tool (RPC entry) AND by daemon get_create_request
+// (re-check, defense in depth).
+//
+// All validation errors throw ValidationError with a stable `code` field
+// that the MCP tool surface maps to a JSON {ok:false, error: <code>}
+// payload (RFC §4.6).
+
+import { isReservedEnvKey } from "./shared/reserved-env.js";
+
+export class ValidationError extends Error {
+  constructor(public code: string, public detail?: Record<string, unknown>) {
+    super(`${code}${detail ? ` ${JSON.stringify(detail)}` : ""}`);
+    this.name = "ValidationError";
+  }
+}
+
+// §4.2.2 — structural enums.
+// #1298 —— daemon 远程创建允许的 runtime。2026-08-28 从 3 个放开到 7 个。
+//
+// 放开之前挡着的问题是「daemon 建出来的是**无人值守**的后台进程,而三个共存 runtime
+// 的本质是人和 agent 共用一个 TUI 会话 —— 建出来给谁用?」
+//
+// Vincent 2026-08-28 定,理由是**兜底排错**:
+//   「某个节点突然不动了,人可以进去看。在 daemon 还没那么靠谱的情况下,
+//     这非常重要 —— 至少可以跟 Codex 和 Claude Code 对话。」
+// 🔴 关键在于 **attach 是「建好之后」的动作,不是「建的时候」的前提**。
+//
+// 支撑读数(2026-08-28 实测舰队):`通信牛` 跑 codex-app-server(共存 runtime),
+// **764 次成功完成任务**,当天仍在跑 —— 比两个普通 runtime 的节点(61 次 / 3 次)
+// 都多一个量级。⇒ 任务链路不需要人坐在屏幕前。
+//
+// 🔴 这七个名字与 `agent-network/src/normalize-runtime.ts` 的 `RuntimeName` 一致。
+//    那边是 CLI 侧的全集;两边分叉过一次(daemon 侧的 VALID_RUNTIMES 早就是 7 个,
+//    只有这里还是 3 个,而记录此事的 #1298 正文写的是「三道闸都关着」——
+//    **一份快照式的盘点,只在写下的那一刻是真的**)。
+export const RUNTIMES = [
+  "claude-agent-sdk",
+  "claude-code-cli",
+  "codex-sdk",
+  "codex-app-server",
+  "grok-build-acp",
+  "grok-build-cli",
+  "opencode-cli",
+] as const;
+export type Runtime = typeof RUNTIMES[number];
+
+export const FLAG_KEYS = ["permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout"] as const;
+export type FlagKey = typeof FLAG_KEYS[number];
+
+export const PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"] as const;
+
+// §4.4.7 — env_refs limits.
+export const MAX_ENV_KEYS_PER_NODE = 32;
+export const MAX_ENV_VALUE_BYTES = 16 * 1024;
+const ENV_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
+
+// §4.2.2 name + model.
+const NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+// OpenCode 共存的模型带 provider 前缀(`opencode/mimo-v2.5-free`,agent-node parseModelRef 按第一个 `/` 切),
+// 桌面向导 0.2.61 起就发这种形状 —— 允许**恰好一个**斜杠分隔的两段;每段仍是原字符集,且不能是纯点(`..`/`.`)。
+const MODEL_SEGMENT = "[a-zA-Z0-9._:\\-]+";
+const MODEL_RE = new RegExp(`^${MODEL_SEGMENT}(?:/${MODEL_SEGMENT})?$`);
+const MODEL_DOT_ONLY_SEGMENT = /(^|\/)\.+(\/|$)/;
+
+export function validateName(s: unknown): asserts s is string {
+  if (typeof s !== "string" || !NAME_RE.test(s)) {
+    throw new ValidationError("node_name_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+  }
+}
+
+export function validateRuntime(s: unknown): asserts s is Runtime {
+  if (typeof s !== "string" || !(RUNTIMES as readonly string[]).includes(s)) {
+    // 🔴 原来只回一个 `runtime_invalid` + 用户传进来的那个值 —— **不说允许哪些,
+    //    也不说还有没有别的路**。2026-08-28 实测:从 Dashboard 建一个
+    //    `codex-app-server` 节点,用户拿到的就是
+    //      {"ok":false,"error":"runtime_invalid","value":"codex-app-server"}
+    //    而目标机器的 daemon 日志里一行都没有(请求根本没到)。
+    //    用户无从知道:①哪些是允许的 ②这个名字是不是打错了 ③有没有别的办法。
+    //
+    // `allowed` 直接由 RUNTIMES 展开,不是手写的第二份清单 ——
+    // 🔴 手写一份会漂移,而漂移之后报错会**理直气壮地告诉用户一组错的名字**。
+    throw new ValidationError("runtime_invalid", {
+      value: typeof s === "string" ? s.slice(0, 80) : typeof s,
+      allowed: [...RUNTIMES],
+      // 这句提示的前提是查过的:`agent-network/src/normalize-runtime.ts` 的
+      // `RuntimeName` / `SUPPORTED_RUNTIME_NAMES` 是 7 个,包含此处不放行的那几个,
+      // 所以「在目标机器上直接建」确实是一条真实存在的路,不是安慰话。
+      hint: "daemon 远程创建目前只放行以上 runtime；其余 runtime 可以在目标机器上直接 `anet node create --runtime <name>` 创建。",
+    });
+  }
+}
+
+export function validateModel(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string" || s.length === 0 || s.length > 100 || !MODEL_RE.test(s) || MODEL_DOT_ONLY_SEGMENT.test(s)) {
+    throw new ValidationError("model_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+  }
+}
+
+export function validateFlagValue(k: string, v: unknown): void {
+  switch (k) {
+    case "permissionMode":
+      if (typeof v !== "string" || !(PERMISSION_MODES as readonly string[]).includes(v)) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be one of default/acceptEdits/plan/bypassPermissions" });
+      }
+      return;
+    case "dangerouslySkipPermissions":
+      if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
+      return;
+    case "maxTurns":
+      if (!Number.isInteger(v) || (v as number) < 1 || (v as number) > 9999) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be integer 1..9999" });
+      }
+      return;
+    case "budget":
+      if (typeof v !== "number" || !Number.isFinite(v) || (v as number) < 0 || (v as number) > 1000) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be number 0..1000 (decimals OK)" });
+      }
+      return;
+    case "timeout":
+      if (!Number.isInteger(v) || (v as number) < 1 || (v as number) > 86400) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be integer 1..86400" });
+      }
+      return;
+    default:
+      throw new ValidationError("flag_key_unknown", { field: k });
+  }
+}
+
+// §4.4.7 — env_refs 7-step gate. networkSecretsGet is injected so
+// callers can supply either a real DB lookup (hub) or a fixture (tests).
+// The 6th step also reports the resolved value size; we return the
+// resolved-but-not-yet-used map keyed by env-key so the caller can build
+// env_blob without re-querying.
+export interface EnvRefsContext {
+  callerNetworkId: string;
+  daemonAllowList: ReadonlySet<string>;
+  networkSecretsGet: (networkId: string, key: string) => string | undefined;
+}
+export function validateEnvRefs(
+  refs: unknown,
+  ctx: EnvRefsContext,
+): Record<string, string> {
+  if (!Array.isArray(refs)) {
+    if (refs === undefined || refs === null) return {};
+    throw new ValidationError("env_refs_invalid", { reason: "must be array" });
+  }
+  // ① regex
+  for (const k of refs) {
+    if (typeof k !== "string" || !ENV_KEY_RE.test(k)) {
+      throw new ValidationError("env_key_invalid", { key: typeof k === "string" ? k.slice(0, 64) : typeof k });
+    }
+  }
+  // ② reserved denylist (v4 B1)
+  for (const k of refs) {
+    if (isReservedEnvKey(k)) {
+      throw new ValidationError("env_key_reserved", { key: k });
+    }
+  }
+  // ③ duplicate detection (must come before ④ count gate to give a
+  //    truthful error code rather than "too many" for dup-spam).
+  const seen = new Set<string>();
+  for (const k of refs as string[]) {
+    if (seen.has(k)) throw new ValidationError("env_key_duplicate", { key: k });
+    seen.add(k);
+  }
+  // ④ count cap
+  if (seen.size > MAX_ENV_KEYS_PER_NODE) {
+    throw new ValidationError("env_key_too_many", { count: seen.size, max: MAX_ENV_KEYS_PER_NODE });
+  }
+  const out: Record<string, string> = {};
+  // ⑤ vault presence + ⑥ value size cap
+  for (const k of seen) {
+    const v = ctx.networkSecretsGet(ctx.callerNetworkId, k);
+    if (v === undefined) throw new ValidationError("secret_not_in_vault", { key: k });
+    if (Buffer.byteLength(v, "utf8") > MAX_ENV_VALUE_BYTES) {
+      throw new ValidationError("secret_too_large", { key: k, max: MAX_ENV_VALUE_BYTES });
+    }
+    out[k] = v;
+  }
+  // ⑦ daemon allowlist (per-host whitelist of which secrets this
+  //    machine is allowed to receive; declared in daemon config by the
+  //    host operator)
+  for (const k of seen) {
+    if (!ctx.daemonAllowList.has(k)) {
+      throw new ValidationError("secret_not_in_daemon_allowlist", { key: k });
+    }
+  }
+  return out;
+}
+
+// §4.4.7 — safe serializer for .env.local. Dotenv-quoted with escape
+// for backslash / double-quote / newline / carriage-return so that a
+// value containing `\n"evil=KEY2"` cannot pollute the next line.
+export function serializeEnvLocal(env: Record<string, string>): string {
+  return Object.entries(env).map(([k, v]) => {
+    const esc = String(v)
+      .replace(/\\/g, "\\\\")   // 1) backslashes first (or later escapes get un-escaped)
+      .replace(/"/g, '\\"')     // 2) double-quotes
+      .replace(/\n/g, "\\n")    // 3) newline → literal \n
+      .replace(/\r/g, "\\r");   // 4) carriage return → literal \r
+    return `${k}="${esc}"`;
+  }).join("\n") + "\n";
+}
+
+// app「新建节点」工作目录 —— hub 只判**形状**(daemon 才知道那台机器的 $HOME、系统目录、
+// 目录里住没住别的节点,那几条在 agent-node/src/runtime/child-workdir.ts)。
+// 这里挡的是「根本不像一条路径」的输入,让它在派发前就失败,而不是占一个请求行再被 daemon 拒。
+export const MAX_WORKDIR_LEN = 1024;
+export function validateWorkdir(s: unknown): asserts s is string | undefined | null {
+  if (s === undefined || s === null) return;
+  if (typeof s !== "string") throw new ValidationError("workdir_invalid", { reason: "must be string" });
+  const v = s.trim();
+  if (v.length === 0 || v.length > MAX_WORKDIR_LEN) {
+    throw new ValidationError("workdir_invalid", { reason: `length 1..${MAX_WORKDIR_LEN}` });
+  }
+  if (/[\u0000-\u001f\u007f]/.test(v)) throw new ValidationError("workdir_invalid", { reason: "control character" });
+  const shapeOk = v.startsWith("/") || v === "~" || v.startsWith("~/") || /^[A-Za-z]:[\\/]/.test(v);
+  if (!shapeOk) {
+    throw new ValidationError("workdir_invalid", { reason: "must be absolute (/…, ~/…, or C:\\…)", value: v.slice(0, 80) });
+  }
+}
+
+/** daemon 自报的默认工作目录根(`daemon_capabilities.default_workdir_root`),消毒后返回;
+ *  没报 / 形状不对 = null。**非 null 即表示该 daemon 认 `node_spec.workdir`** ——
+ *  create_node 的「老 daemon 不收 workdir」门和 /api/host-supervisors 的透出共用这一个判据。 */
+export function daemonDefaultWorkdirRoot(configSnapshot: unknown): string | null {
+  try {
+    const snap = typeof configSnapshot === "string" ? JSON.parse(configSnapshot) : configSnapshot;
+    const v = (snap as any)?.daemon_capabilities?.default_workdir_root;
+    if (typeof v !== "string" || v.length === 0 || v.length > MAX_WORKDIR_LEN) return null;
+    if (/[\u0000-\u001f\u007f]/.test(v)) return null;
+    if (!(v.startsWith("/") || /^[A-Za-z]:[\\/]/.test(v))) return null;
+    return v;
+  } catch {
+    return null;
+  }
+}
+
+// §4.2.5 — channels fail-closed in P1.
+export function validateChannelsP1(channels: unknown): void {
+  if (channels === undefined || channels === null) return;
+  if (!Array.isArray(channels)) {
+    throw new ValidationError("channels_not_supported_in_p1", { reason: "expected array or omitted" });
+  }
+  if (channels.length > 0) {
+    throw new ValidationError("channels_not_supported_in_p1", { received: channels.length, p3_tracker: "RFC-026 §5 P3" });
+  }
+}
+
+// §4.2.2 — fully validated NodeSpec, ready to feed into buildAnetArgs.
+export interface NodeSpec {
+  name: string;
+  runtime: Runtime;
+  model?: string | null;
+  flags?: Record<string, unknown>;
+  channels?: unknown;
+}
+
+// kebab-case helper for flag names. permissionMode → permission-mode.
+function kebab(k: string): string {
+  return k.replace(/([A-Z])/g, "-$1").toLowerCase();
+}
+
+// §4.2.2 — build the argv that gets fed verbatim to execFile (no
+// shell, no string concat). Each value has already passed type/enum
+// validation, so String() coercion is safe.
+export function buildAnetArgs(spec: NodeSpec): string[] {
+  validateName(spec.name);
+  validateRuntime(spec.runtime);
+  validateModel(spec.model);
+  validateChannelsP1(spec.channels);
+
+  const args: string[] = ["node", "create", spec.name, "--runtime", spec.runtime];
+  if (spec.model) args.push("--model", spec.model);
+  if (spec.flags && typeof spec.flags === "object") {
+    for (const [k, v] of Object.entries(spec.flags)) {
+      if (!(FLAG_KEYS as readonly string[]).includes(k)) {
+        throw new ValidationError("flag_key_unknown", { field: k });
+      }
+      validateFlagValue(k, v);
+      args.push(`--${kebab(k)}`, String(v));
+    }
+  }
+  return args;
+}

package/src/create-node-workdir.test.ts

@@ -0,0 +1,255 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import "./require-explicit-test-db.js";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+import { daemonDefaultWorkdirRoot, validateWorkdir, ValidationError } from "./create-node-validate.js";
+import { addNetworkMember, login, register } from "./auth.js";
+
+// app「新建节点」工作目录 —— hub 这一层管三件事:
+//   ① node_spec.workdir 的**形状**(绝对 / ~/… / C:\…),派发前就拒
+//   ② daemon 没自报 default_workdir_root(= 老 daemon,会静默忽略 workdir)⇒ 拒,不派
+//   ③ 请求行存下 workdir,get_create_request 原样交给 daemon;不带就**不出现**这个键
+// 以及 /api/host-supervisors 只给 admin/owner 透出默认根(它是那台机器的家目录路径)。
+
+const NET = "net_workdir_gate";
+const USER_ID = "u_workdir_admin";
+const DAEMON_ID = "node_workdir_daemon";
+const DAEMON_ALIAS = "workdir-daemon";
+const DAEMON_TOK = "tok_workdir_daemon";
+const ROOT = "/home/user";
+
+interface ToolHandler { (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>; }
+interface Reply { ok?: boolean; error?: string; request_id?: string; node_spec?: any; [k: string]: unknown; }
+
+function cleanup() {
+  for (const t of ["node_create_requests", "audit_log", "nodes", "sessions", "api_tokens", "network_members"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER_ID]); } catch {}
+}
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seed(caps: Record<string, unknown>) {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'user', datetime('now'))`, [USER_ID]);
+  db.run(`INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET, USER_ID]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'admin', datetime('now'))`, [USER_ID, NET]);
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, config_snapshot, hostname, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, ?4, 'host-x', datetime('now'), datetime('now'), 'active')`,
+    [DAEMON_ID, DAEMON_ALIAS, NET, JSON.stringify({ role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"], ...caps } })],
+  );
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOK, USER_ID, NET, `node:${DAEMON_ALIAS}`, `hash_${DAEMON_TOK}`],
+  );
+}
+
+function tools(callerTokenId: string | null = null): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const out: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, d: string, schema: any, handler: ToolHandler) => { out[name] = handler; return origTool(name, d, schema, handler); };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, cfg: any, handler: ToolHandler) => { out[name] = handler; return origRegisterTool(name, cfg, handler); };
+  }
+  registerTools(server, undefined, NET, USER_ID, null, true, callerTokenId);
+  return out;
+}
+
+async function call(h: ToolHandler, args: any): Promise<Reply> {
+  return JSON.parse((await h(args)).content[0].text) as Reply;
+}
+
+const baseSpec = { name: "wd-child", runtime: "claude-agent-sdk", model: "claude-sonnet-4-5", flags: {} };
+
+function rowCount(): number {
+  return db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_create_requests WHERE daemon_node_id = ?1", DAEMON_ID)?.n ?? -1;
+}
+
+describe("validateWorkdir — shape only", () => {
+  const ok = ["/home/user/proj", "/srv/x", "~", "~/proj", "C:\\Users\\alice\\proj", "D:/work", "  /padded  "];
+  for (const v of ok) test(`accepts ${JSON.stringify(v)}`, () => { expect(() => validateWorkdir(v)).not.toThrow(); });
+  test("accepts undefined / null (field omitted)", () => {
+    expect(() => validateWorkdir(undefined)).not.toThrow();
+    expect(() => validateWorkdir(null)).not.toThrow();
+  });
+  const bad: unknown[] = ["", "   ", "proj", "./proj", "../x", "~alice/x", "C:proj", "/a\nb", "/a\u0000b", "x".repeat(10) + "/", "/" + "a".repeat(1024), 42, {}];
+  for (const v of bad) {
+    test(`rejects ${JSON.stringify(v)?.slice(0, 40)}`, () => {
+      let code = "";
+      try { validateWorkdir(v); } catch (e) { code = (e as ValidationError).code; }
+      expect(code).toBe("workdir_invalid");
+    });
+  }
+});
+
+describe("daemonDefaultWorkdirRoot — sanitize the self-report", () => {
+  const snap = (v: unknown) => JSON.stringify({ daemon_capabilities: { default_workdir_root: v } });
+  test("absolute posix root passes through", () => { expect(daemonDefaultWorkdirRoot(snap(ROOT))).toBe(ROOT); });
+  test("windows root passes through", () => { expect(daemonDefaultWorkdirRoot(snap("C:\\Users\\alice"))).toBe("C:\\Users\\alice"); });
+  test("object snapshot (not string) also accepted", () => {
+    expect(daemonDefaultWorkdirRoot({ daemon_capabilities: { default_workdir_root: ROOT } })).toBe(ROOT);
+  });
+  for (const v of [undefined, null, "", "relative", "~/x", 7, "/a\nb", "/" + "a".repeat(1100)]) {
+    test(`not reported / malformed ${JSON.stringify(v)?.slice(0, 30)} → null`, () => {
+      expect(daemonDefaultWorkdirRoot(snap(v))).toBeNull();
+    });
+  }
+  test("null / garbage snapshot → null", () => {
+    expect(daemonDefaultWorkdirRoot(null)).toBeNull();
+    expect(daemonDefaultWorkdirRoot("{not json")).toBeNull();
+  });
+});
+
+describe("create_node + workdir", () => {
+  test("🔴 old daemon (no default_workdir_root) + workdir → workdir_not_supported_by_daemon, NO row", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `${ROOT}/wd-child` } });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("workdir_not_supported_by_daemon");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("old daemon WITHOUT workdir still dispatches (no regression for existing callers)", async () => {
+    seed({});
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBeNull();
+  });
+
+  test("bad shape rejected before dispatch → workdir_invalid, NO row", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: "relative/dir" } });
+    expect(r.error).toBe("workdir_invalid");
+    expect(rowCount()).toBe(0);
+  });
+
+  test("new daemon + workdir → row stores it and get_create_request hands it to the daemon", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe(wd);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect(g.node_spec.workdir).toBe(wd);
+    expect(g.node_spec.name).toBe(baseSpec.name);
+  });
+
+  test("workdir is trimmed before storage", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: `  ~/wd-child  ` } });
+    expect(r.ok).toBe(true);
+    const row = db.get<{ workdir: string | null }>("SELECT workdir FROM node_create_requests WHERE request_id = ?1", r.request_id);
+    expect(row?.workdir).toBe("~/wd-child");
+  });
+
+  test("new daemon WITHOUT workdir → get_create_request node_spec has NO workdir key (daemon keeps legacy layout)", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: baseSpec });
+    expect(r.ok).toBe(true);
+    const g = await call(tools(DAEMON_TOK).get_create_request, { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect("workdir" in g.node_spec).toBe(false);
+  });
+
+  test("audit detail records the requested workdir", async () => {
+    seed({ default_workdir_root: ROOT });
+    const wd = `${ROOT}/wd-child`;
+    const r = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { ...baseSpec, workdir: wd } });
+    const a = db.get<{ detail: string }>(
+      "SELECT detail FROM audit_log WHERE target_id = ?1 AND action = 'create_node_dispatch_attempted'", r.request_id,
+    );
+    expect(JSON.parse(a?.detail || "{}").workdir).toBe(wd);
+  });
+
+  test("list_host_supervisors (MCP) surfaces default_workdir_root for admin", async () => {
+    seed({ default_workdir_root: ROOT });
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d.default_workdir_root).toBe(ROOT);
+  });
+
+  test("list_host_supervisors (MCP) omits the key for an old daemon", async () => {
+    seed({});
+    const r = await call(tools().list_host_supervisors, {});
+    const d = (r as any).daemons.find((x: any) => x.daemon_node_id === DAEMON_ID);
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});
+
+// ── REST /api/host-supervisors: admin sees the root, member does not ──────────
+let BASE = "";
+let server: any = null;
+let ownerTok = "", memberTok = "", restNet = "", ownerId = "";
+describe("/api/host-supervisors — default_workdir_root visibility", () => {
+  beforeAll(async () => {
+    process.env.HOST = "127.0.0.1";
+    const sfx = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+    const pw = "BootstrapPw123Aa!";
+    const s = register(`wd_seed_${sfx}`, pw, undefined, "seed");
+    if (!s.ok) throw new Error("seed failed");
+    db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`wd_seed_${sfx}`]);
+    const o = register(`wd_owner_${sfx}`, pw, undefined, "seed");
+    if (!o.ok || !o.token) throw new Error("owner register failed");
+    ownerTok = o.token; restNet = o.network_id ?? "";
+    ownerId = login(`wd_owner_${sfx}`, pw).user!.user_id;
+    const m = register(`wd_member_${sfx}`, pw, undefined, "seed");
+    if (!m.ok || !m.token) throw new Error("member register failed");
+    memberTok = m.token;
+    const memberId = login(`wd_member_${sfx}`, pw).user!.user_id;
+    // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+    const add = addNetworkMember(restNet, memberId, "member", undefined, { agentAccess: "all" });
+    if (!add.ok) throw new Error("add member failed: " + add.error);
+    const { bootServer } = await import("./server.js");
+    server = bootServer({ port: 0, hostname: "127.0.0.1" });
+    BASE = `http://127.0.0.1:${server.port}`;
+    for (const [alias, caps] of [["wd-new", { default_workdir_root: ROOT }], ["wd-old", {}]] as const) {
+      db.run(
+        `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, runtime, model, config_path, channels, server, hostname, network_id, config_revision, config_snapshot)
+         VALUES (?1, ?2, ?2, 'claude-agent-sdk', 'm', '/tmp/cfg.json', '[]', 'h', 'h', ?3, 0, ?4)`,
+        [`wd_n_${alias}`, alias, restNet, JSON.stringify({ role: "host_supervisor", daemon_capabilities: caps })],
+      );
+      db.run(
+        `INSERT OR REPLACE INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, 'network')`,
+        [`wd_t_${alias}`, `hash_wd_${alias}`, ownerId, restNet, `node:${alias}`],
+      );
+    }
+  });
+  afterAll(() => {
+    try { server?.stop?.(true); } catch {}
+    try { db.run("DELETE FROM nodes WHERE network_id = ?1", [restNet]); } catch {}
+    try { db.run("DELETE FROM api_tokens WHERE network_id = ?1 AND name LIKE 'node:%'", [restNet]); } catch {}
+  });
+
+  async function list(tok: string): Promise<any[]> {
+    const res = await fetch(`${BASE}/api/host-supervisors?network_id=${encodeURIComponent(restNet)}`, { headers: { Authorization: `Bearer ${tok}` } });
+    const b = await res.json();
+    if (!b.ok) throw new Error("list failed: " + JSON.stringify(b));
+    return b.daemons;
+  }
+
+  test("owner sees default_workdir_root on the new daemon", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-new");
+    expect(d?.default_workdir_root).toBe(ROOT);
+  });
+  test("old daemon row has NO default_workdir_root key (app hides the row)", async () => {
+    const d = (await list(ownerTok)).find(x => x.alias === "wd-old");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+  test("🔴 member does NOT see the host's home path", async () => {
+    const rows = await list(memberTok);
+    const d = rows.find(x => x.alias === "wd-new");
+    expect(d).toBeDefined();
+    expect("default_workdir_root" in d).toBe(false);
+  });
+});