@sleep2agi/commhub-server 0.9.0-preview.1 → 0.9.0-preview.101

package/src/ack-create-request.test.ts

@@ -0,0 +1,331 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+// RFC-026 §9.3 D2 / #338 PR3 — ack_create_request HANDLER tests.
+//
+// 通信龙 pre-review caught B1 + B2: my first cut of PR3 added a new daemon
+// ack status `runtime_capability_check_failed` to create-node-daemon.ts but
+// the hub's zod enum only accepted ["started", "failed", "rejected"] — the
+// new status was silently zod-rejected on the hub side and the daemon's
+// `.catch(()=>{})` swallowed the rejection. The PR body also claimed
+// `daemon_capability_lied` audit was written when in fact the action wasn't
+// in the audit enum and no insert ran.
+//
+// This handler-driven suite captures and invokes the registered callback
+// directly. It validates handler branches and DB effects, but deliberately
+// does NOT claim to exercise the MCP SDK's zod transport gate. The
+// complementary in-process transport coverage lives in
+// ack-create-request-transport.test.ts (#344).
+
+const NET = "net_ack_t";
+const DAEMON_NODE_ID = "node_ack_daemon";
+const DAEMON_ALIAS = "ack-daemon";
+const DAEMON_USER = "u_ack_owner";
+const DAEMON_TOKEN_ID = "tok_ack_daemon";
+const DAEMON_TOKEN_HASH = "hash_ack_daemon";
+
+interface ToolHandler { (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>; }
+interface AckReply { ok?: boolean; error?: string; status?: string; }
+
+function cleanup() {
+  try { db.run("DELETE FROM audit_log WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM node_create_requests WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM nodes WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM api_tokens WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [DAEMON_USER]); } catch {}
+}
+
+beforeEach(cleanup);
+afterAll(cleanup);
+
+function seedDaemonWorld() {
+  db.run(
+    `INSERT INTO users (user_id, username, password_hash, role, created_at)
+     VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+    [DAEMON_USER, DAEMON_USER],
+  );
+  db.run(
+    `INSERT OR REPLACE INTO networks (network_id, network_name, owner_id, created_at)
+     VALUES (?1, ?2, ?3, datetime('now'))`,
+    [NET, NET, DAEMON_USER],
+  );
+  db.run(
+    `INSERT INTO network_members (user_id, network_id, role, joined_at)
+     VALUES (?1, ?2, 'owner', datetime('now'))`,
+    [DAEMON_USER, NET],
+  );
+  // daemon node — must exist for resolveCallerDaemonTokenBound to bind.
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at)
+     VALUES (?1, ?2, ?3, ?4, datetime('now'), datetime('now'))`,
+    [DAEMON_NODE_ID, DAEMON_ALIAS, DAEMON_ALIAS, NET],
+  );
+  // daemon ntok — bound to the daemon node via name='node:<alias>'.
+  db.run(
+    `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+     VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+    [DAEMON_TOKEN_ID, DAEMON_USER, NET, `node:${DAEMON_ALIAS}`, DAEMON_TOKEN_HASH],
+  );
+}
+
+function seedCreateRequest(opts: {
+  request_id: string,
+  child_token_id?: string,
+  status?: "pending" | "delivered" | "succeeded" | "failed",
+  child_name?: string,
+  runtime?: string,
+}) {
+  const childName = opts.child_name ?? `child_${opts.request_id}`;
+  if (opts.child_token_id) {
+    db.run(
+      `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+       VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+      [opts.child_token_id, DAEMON_USER, NET, `node:${childName}`, `hash_${opts.child_token_id}`],
+    );
+  }
+  db.run(
+    `INSERT INTO node_create_requests
+       (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
+     VALUES (?1, ?2, ?3, ?4, ?5, 'x', '{}', '[]', ?6, ?7, ?8, ?9)`,
+    [
+      opts.request_id, DAEMON_NODE_ID, childName, NET,
+      opts.runtime ?? "claude-agent-sdk",
+      opts.status ?? "delivered",
+      opts.child_token_id ?? null,
+      Date.now(),
+      DAEMON_TOKEN_ID,
+    ],
+  );
+}
+
+/** Build a server with registerTools wired as if the daemon's ntok bound. */
+function buildAckHandler(): ToolHandler {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, _schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    return origTool(name, _desc, _schema, handler);
+  };
+  const origRegisterTool = server.registerTool?.bind(server);
+  if (origRegisterTool) {
+    server.registerTool = (name: string, _cfg: any, handler: ToolHandler) => {
+      tools[name] = handler;
+      return origRegisterTool(name, _cfg, handler);
+    };
+  }
+  registerTools(
+    server,
+    /* clientIP */ undefined,
+    /* enforceNetworkId */ NET,
+    /* enforceUserId */ DAEMON_USER,
+    /* callerAlias */ DAEMON_ALIAS,
+    /* callerTokenIsNetwork */ true,
+    /* callerTokenId */ DAEMON_TOKEN_ID,
+  );
+  const h = tools["ack_create_request"];
+  if (!h) throw new Error("ack_create_request tool not registered");
+  return h;
+}
+
+async function callAck(handler: ToolHandler, args: any): Promise<AckReply> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text) as AckReply;
+}
+
+function readRequest(request_id: string) {
+  return db.get<{ status: string; error: string | null; acked_at: number | null }>(
+    `SELECT status, error, acked_at FROM node_create_requests WHERE request_id = ?1`,
+    request_id,
+  );
+}
+
+function readToken(token_id: string) {
+  return db.get<{ revoked_at: string | null }>(
+    `SELECT revoked_at FROM api_tokens WHERE token_id = ?1`,
+    token_id,
+  );
+}
+
+function readAuditRows(action: string, target_id: string) {
+  return db.all<{ action: string; network_id: string; target_id: string; detail: string }>(
+    `SELECT action, network_id, target_id, detail FROM audit_log
+     WHERE action = ?1 AND target_id = ?2 ORDER BY id DESC`,
+    [action, target_id],
+  );
+}
+
+describe("ack_create_request HANDLER — B1 schema accepts runtime_capability_check_failed", () => {
+  test("schema accepts runtime_capability_check_failed + runtime field (no zod reject)", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b1_accept";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    const reply = await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      error: "child died within 5000ms post-spawn",
+      runtime: "codex-sdk",
+    });
+    // PR3 v1 BUG: hub zod enum rejected this status → reply.ok=false /
+    // tool would even throw before getting here. Now must accept.
+    expect(reply.ok).toBe(true);
+    expect(reply.status).toBe("runtime_capability_check_failed");
+  });
+
+  test("request flips to terminal runtime_capability_check_failed status", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b1_terminal";
+    seedCreateRequest({ request_id: reqId, status: "delivered" });
+    const handler = buildAckHandler();
+    await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      error: "boom",
+      runtime: "codex-sdk",
+    });
+    const row = readRequest(reqId);
+    expect(row?.status).toBe("runtime_capability_check_failed");
+    expect(row?.error).toBe("boom");
+    expect(row?.acked_at).toBeGreaterThan(0);
+  });
+
+  test("child ntok is revoked on capability-check-failed (same teardown as 'failed')", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b1_revoke";
+    const childTok = "tok_ack_child_b1";
+    seedCreateRequest({ request_id: reqId, child_token_id: childTok });
+    expect(readToken(childTok)?.revoked_at).toBeNull();
+    const handler = buildAckHandler();
+    await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      runtime: "codex-sdk",
+    });
+    expect(readToken(childTok)?.revoked_at).not.toBeNull();
+  });
+});
+
+describe("ack_create_request HANDLER — B2 audit_log daemon_capability_lied", () => {
+  test("writes daemon_capability_lied audit row with runtime + daemon + error in detail", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b2_audit";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      error: "OPENAI_API_KEY unset",
+      runtime: "codex-sdk",
+    });
+    const rows = readAuditRows("daemon_capability_lied", reqId);
+    // PR3 v1 BUG: action wasn't in auditCreateNode enum → 0 rows + no
+    // surface for ops to spot lying daemons. Now must write exactly 1.
+    expect(rows.length).toBe(1);
+    expect(rows[0].network_id).toBe(NET);
+    const detail = JSON.parse(rows[0].detail);
+    expect(detail.runtime).toBe("codex-sdk");
+    expect(detail.daemon_node_id).toBe(DAEMON_NODE_ID);
+    expect(detail.error).toBe("OPENAI_API_KEY unset");
+    expect(typeof detail.acked_at).toBe("number");
+  });
+
+  test("does NOT write daemon_capability_lied on generic 'failed' ack (status discriminates)", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b2_no_audit_on_failed";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    await callAck(handler, {
+      request_id: reqId,
+      status: "failed",
+      error: "child died immediately after spawn",
+    });
+    const rows = readAuditRows("daemon_capability_lied", reqId);
+    expect(rows.length).toBe(0);
+  });
+
+  test("does NOT write daemon_capability_lied on 'started' (happy path silence)", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b2_no_audit_on_started";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    await callAck(handler, { request_id: reqId, status: "started", child_pid: 12345 });
+    const rows = readAuditRows("daemon_capability_lied", reqId);
+    expect(rows.length).toBe(0);
+  });
+
+  test("runtime field nullable if daemon omitted it (older daemon back-compat)", async () => {
+    // Older daemon (preview.10 and earlier) wouldn't send `runtime`.
+    // The hub must still accept + audit, just with runtime=null.
+    seedDaemonWorld();
+    const reqId = "cr_ack_b2_nullable_runtime";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    const reply = await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      error: "child died",
+    });
+    expect(reply.ok).toBe(true);
+    const rows = readAuditRows("daemon_capability_lied", reqId);
+    expect(rows.length).toBe(1);
+    const detail = JSON.parse(rows[0].detail);
+    expect(detail.runtime).toBeNull();
+  });
+
+  test("error string is truncated to 500 chars in audit detail (defense vs giant payload)", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_b2_trunc";
+    seedCreateRequest({ request_id: reqId });
+    const handler = buildAckHandler();
+    const giant = "x".repeat(900);
+    await callAck(handler, {
+      request_id: reqId,
+      status: "runtime_capability_check_failed",
+      error: giant,
+      runtime: "codex-sdk",
+    });
+    const rows = readAuditRows("daemon_capability_lied", reqId);
+    expect(rows.length).toBe(1);
+    const detail = JSON.parse(rows[0].detail);
+    expect(detail.error.length).toBe(500);
+  });
+});
+
+describe("ack_create_request HANDLER — pre-existing happy-path stays green (regression)", () => {
+  test("status='started' still flips acked_at without terminal teardown", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_started_regression";
+    const childTok = "tok_ack_child_started";
+    seedCreateRequest({ request_id: reqId, child_token_id: childTok });
+    const handler = buildAckHandler();
+    const reply = await callAck(handler, { request_id: reqId, status: "started", child_pid: 7777 });
+    expect(reply.ok).toBe(true);
+    expect(reply.status).toBe("awaiting_register");
+    const row = readRequest(reqId);
+    // 'started' doesn't flip to terminal; status stays 'delivered'.
+    expect(row?.status).toBe("delivered");
+    expect(row?.acked_at).toBeGreaterThan(0);
+    // child ntok is NOT revoked on 'started'.
+    expect(readToken(childTok)?.revoked_at).toBeNull();
+  });
+
+  test("status='failed' still revokes child + flips to failed (no audit_log daemon_capability_lied)", async () => {
+    seedDaemonWorld();
+    const reqId = "cr_ack_failed_regression";
+    const childTok = "tok_ack_child_failed";
+    seedCreateRequest({ request_id: reqId, child_token_id: childTok });
+    const handler = buildAckHandler();
+    const reply = await callAck(handler, { request_id: reqId, status: "failed", error: "fork failed" });
+    expect(reply.ok).toBe(true);
+    const row = readRequest(reqId);
+    expect(row?.status).toBe("failed");
+    expect(row?.error).toBe("fork failed");
+    expect(readToken(childTok)?.revoked_at).not.toBeNull();
+    expect(readAuditRows("daemon_capability_lied", reqId).length).toBe(0);
+  });
+});

package/src/admin-delete-network-http.test.ts

@@ -0,0 +1,228 @@
+// Hub 管理员删别人的**空**网络(清理旧测试账号留下的个人网络)。
+// 真 HTTP:走 DELETE /api/networks/:id,库和上传目录都是本文件私有的临时目录。
+//   bun test server/src/admin-delete-network-http.test.ts
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DIR = mkdtempSync(join(tmpdir(), "anet-admin-delete-network-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DIR, "hub.db");
+process.env.COMMHUB_UPLOADS_DIR = join(PRIVATE_DIR, "uploads");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let db: typeof import("./db.js").db;
+let auth: typeof import("./auth.js");
+let adminToken = "";
+let adminUserId = "";
+let adminNetworkId = "";
+let memberToken = "";
+let memberUserId = "";
+let memberNodeToken = "";
+const stamp = Date.now();
+
+function del(networkId: string, token: string) {
+  return fetch(`${base}/api/networks/${networkId}`, { method: "DELETE", headers: { Authorization: `Bearer ${token}` } });
+}
+
+function memberNetwork(name: string): string {
+  const created = auth.createNetwork(memberUserId, `${name}-${stamp}`);
+  expect(created.ok).toBe(true);
+  return created.network_id!;
+}
+
+function rowCount(table: string, networkId: string): number {
+  return db.get<{ cnt: number }>(`SELECT COUNT(*) AS cnt FROM ${table} WHERE network_id = ?1`, networkId)!.cnt;
+}
+
+// 同 admin-networks-http.test.ts:register() 跑 KDF + bootServer,给 30s 而不是 bun 默认 5s。
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  auth = await import("./auth.js");
+
+  // 第一个注册的是 Hub 管理员;第二个是普通用户,不在管理员的网络里。
+  const admin = auth.register(`admin_delnet_${stamp}`, "AdminDelNet-Strong-1!", undefined, "admin");
+  expect(admin.ok).toBe(true);
+  adminToken = admin.token!;
+  adminNetworkId = admin.network_id!;
+  adminUserId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `admin_delnet_${stamp}`)!.user_id;
+
+  const member = auth.register(`member_delnet_${stamp}`, "MemberDelNet-Strong-1!", undefined, "member");
+  expect(member.ok).toBe(true);
+  memberToken = member.token!;
+  memberUserId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `member_delnet_${stamp}`)!.user_id;
+  expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", adminUserId)!.role).toBe("admin");
+  expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", memberUserId)!.role).not.toBe("admin");
+  // free 档只能拥有 2 个网络;本文件要给它建七八个。plan 只影响配额,不影响任何权限判定。
+  db.run("UPDATE users SET plan = 'pro' WHERE user_id = ?1", [memberUserId]);
+
+  const minted = auth.createNetworkTokenForNode(memberUserId, member.network_id!, "delnet-node");
+  expect(minted.ok).toBe(true);
+  memberNodeToken = minted.token!;
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("DELETE /api/networks/:id — hub admin override for empty foreign networks", () => {
+  test("admin deletes an empty foreign network: 200, network + members + scoped tokens gone, audit has admin_override", async () => {
+    const netId = memberNetwork("empty");
+    const minted = auth.createNetworkTokenForNode(memberUserId, netId, "leftover-node");
+    expect(minted.ok).toBe(true);
+    expect(rowCount("network_members", netId)).toBe(1);
+    expect(rowCount("api_tokens", netId)).toBe(1);
+
+    const res = await del(netId, adminToken);
+    const body = await res.json() as any;
+    expect(res.status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.admin_override).toBe(true);
+
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeFalsy();
+    expect(rowCount("network_members", netId)).toBe(0);
+    expect(rowCount("api_tokens", netId)).toBe(0);
+    // 被删网络的节点令牌不再能解析。
+    expect(auth.resolveToken(minted.token!)).toBeFalsy();
+
+    const audit = db.get<{ user_id: string; detail: string; network_id: string }>(
+      "SELECT user_id, detail, network_id FROM audit_log WHERE action = 'network_deleted' AND target_id = ?1", netId);
+    expect(audit).toBeTruthy();
+    expect(audit!.user_id).toBe(adminUserId);
+    const detail = JSON.parse(audit!.detail);
+    expect(detail.admin_override).toBe(true);
+    expect(detail.owner_id).toBe(memberUserId);
+  });
+
+  test("admin is refused with 409 and counts when the network has a node and a session", async () => {
+    const netId = memberNetwork("busy");
+    db.run("INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'))",
+      [`node-${stamp}`, `busy-node-${stamp}`, netId]);
+    db.run("INSERT INTO sessions (resume_id, alias, network_id) VALUES (?1, ?2, ?3)", [`resume-${stamp}`, `busy-node-${stamp}`, netId]);
+
+    const res = await del(netId, adminToken);
+    const body = await res.json() as any;
+    expect(res.status).toBe(409);
+    expect(body.ok).toBe(false);
+    expect(body.counts).toEqual({ nodes: 1, sessions: 1 });
+    expect(body.error).toContain("nodes=1");
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeTruthy();
+    expect(rowCount("network_members", netId)).toBe(1);
+  });
+
+  test("admin is refused when the only content left is an uploaded file (disk index, not the DB)", async () => {
+    const netId = memberNetwork("files");
+    const indexDir = join(process.env.COMMHUB_UPLOADS_DIR!, ".index");
+    mkdirSync(indexDir, { recursive: true });
+    writeFileSync(join(indexDir, `f${stamp}.json`), JSON.stringify({ file_id: `f${stamp}`, network_id: netId }));
+
+    const res = await del(netId, adminToken);
+    const body = await res.json() as any;
+    expect(res.status).toBe(409);
+    expect(body.counts).toEqual({ files: 1 });
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeTruthy();
+  });
+
+  test("admin cannot delete the 'default' network even when it is empty", async () => {
+    db.run("INSERT INTO networks (network_id, network_name, owner_id) VALUES ('default', ?1, ?2)", [`legacy-default-${stamp}`, memberUserId]);
+    const res = await del("default", adminToken);
+    expect(res.status).toBe(409);
+    expect(((await res.json()) as any).error).toContain("default");
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = 'default'")).toBeTruthy();
+  });
+
+  test("a non-admin user cannot delete someone else's network", async () => {
+    const res = await del(adminNetworkId, memberToken);
+    expect(res.status).toBe(400);
+    expect(((await res.json()) as any).error).toBe("not your network");
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", adminNetworkId)).toBeTruthy();
+  });
+
+  test("a node token is refused with user_token_required", async () => {
+    const netId = memberNetwork("ntok");
+    const res = await del(netId, memberNodeToken);
+    expect(res.status).toBe(403);
+    expect(((await res.json()) as any).error).toBe("user_token_required");
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeTruthy();
+  });
+
+  test("owner path is unchanged: owner deletes own network (even with a node row), sessions still block it", async () => {
+    const withNode = memberNetwork("owner-node");
+    db.run("INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at) VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'))",
+      [`owner-node-${stamp}`, `owner-node-${stamp}`, withNode]);
+    const ok = await del(withNode, memberToken);
+    expect(ok.status).toBe(200);
+    expect(await ok.json()).toEqual({ ok: true });
+
+    const withSession = memberNetwork("owner-session");
+    db.run("INSERT INTO sessions (resume_id, alias, network_id) VALUES (?1, ?2, ?3)", [`owner-resume-${stamp}`, `owner-s-${stamp}`, withSession]);
+    const blocked = await del(withSession, memberToken);
+    expect(blocked.status).toBe(400);
+    expect(((await blocked.json()) as any).error).toContain("active session");
+  });
+
+  test("admin deleting its OWN network goes through the owner path (no admin_override)", async () => {
+    const created = auth.createNetwork(adminUserId, `admin-own-${stamp}`);
+    expect(created.ok).toBe(true);
+    const res = await del(created.network_id!, adminToken);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+
+  // #2144 —— Agent 分组(#2131)的三张表。
+  function addGroup(netId: string, tag: string): string {
+    const groupId = `grp-${tag}-${stamp}`;
+    db.run("INSERT INTO agent_groups (group_id, network_id, name) VALUES (?1, ?2, ?3)", [groupId, netId, `g-${tag}`]);
+    db.run("INSERT INTO agent_group_members (group_id, node_id) VALUES (?1, ?2)", [groupId, `node-${tag}-${stamp}`]);
+    db.run("INSERT INTO network_member_group_grants (network_id, user_id, group_id) VALUES (?1, ?2, ?3)", [netId, memberUserId, groupId]);
+    return groupId;
+  }
+  function groupRows(netId: string, groupId: string) {
+    return {
+      agent_groups: rowCount("agent_groups", netId),
+      agent_group_members: db.get<{ cnt: number }>("SELECT COUNT(*) AS cnt FROM agent_group_members WHERE group_id = ?1", groupId)!.cnt,
+      network_member_group_grants: rowCount("network_member_group_grants", netId),
+    };
+  }
+
+  test("#2144 admin is refused with 409 counts.agent_groups when the network has an agent group", async () => {
+    const netId = memberNetwork("grouped");
+    const groupId = addGroup(netId, "admin-blocked");
+    const res = await del(netId, adminToken);
+    const body = await res.json() as any;
+    expect(res.status).toBe(409);
+    expect(body.counts).toEqual({ agent_groups: 1 });
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeTruthy();
+    expect(groupRows(netId, groupId)).toEqual({ agent_groups: 1, agent_group_members: 1, network_member_group_grants: 1 });
+  });
+
+  test("#2144 admin delete of an otherwise-empty network cleans orphan group grants", async () => {
+    const netId = memberNetwork("orphan-grant");
+    db.run("INSERT INTO network_member_group_grants (network_id, user_id, group_id) VALUES (?1, ?2, ?3)", [netId, memberUserId, `grp-gone-${stamp}`]);
+    const res = await del(netId, adminToken);
+    const body = await res.json() as any;
+    expect(res.status).toBe(200);
+    expect(body.cleaned.network_member_group_grants).toBe(1);
+    expect(rowCount("network_member_group_grants", netId)).toBe(0);
+  });
+
+  test("#2144 owner delete removes the network's groups, group members and group grants, and leaves other networks' groups", async () => {
+    const netId = memberNetwork("owner-grouped");
+    const groupId = addGroup(netId, "owner");
+    const otherNet = memberNetwork("owner-grouped-other");
+    const otherGroup = addGroup(otherNet, "other");
+
+    const res = await del(netId, memberToken);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+    expect(db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)).toBeFalsy();
+    expect(groupRows(netId, groupId)).toEqual({ agent_groups: 0, agent_group_members: 0, network_member_group_grants: 0 });
+    expect(groupRows(otherNet, otherGroup)).toEqual({ agent_groups: 1, agent_group_members: 1, network_member_group_grants: 1 });
+  });
+});

package/src/admin-networks-http.test.ts

@@ -0,0 +1,88 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { NETWORK_REST_COLUMNS } from "./rest-projections.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-admin-networks-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let adminToken = "";
+let memberToken = "";
+let nodeToken = "";
+let adminNetworkId = "";
+let memberNetworkId = "";
+
+async function listNetworks(token: string): Promise<any[]> {
+  const response = await fetch(`${base}/api/networks`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  expect(response.status).toBe(200);
+  const body = await response.json() as any;
+  expect(body.ok).toBe(true);
+  return body.networks;
+}
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  const { db } = await import("./db.js");
+  const { createNetworkTokenForNode, register } = await import("./auth.js");
+
+  // The first registered user is the global Hub admin. The second user owns a
+  // separate network and is intentionally not a member of the admin's network.
+  const admin = register(`admin_networks_${Date.now()}`, "AdminNetworks-Strong-1!", undefined, "admin");
+  expect(admin.ok).toBe(true);
+  adminToken = admin.token!;
+  adminNetworkId = admin.network_id!;
+
+  const member = register(`member_networks_${Date.now()}`, "MemberNetworks-Strong-1!", undefined, "member");
+  expect(member.ok).toBe(true);
+  memberToken = member.token!;
+  memberNetworkId = member.network_id!;
+
+  const memberUserId = db.get<{ user_id: string }>(
+    "SELECT user_id FROM users WHERE username LIKE 'member_networks_%' ORDER BY created_at DESC LIMIT 1",
+  )!.user_id;
+  const minted = createNetworkTokenForNode(memberUserId, memberNetworkId, "admin-networks-node");
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("GET /api/networks global-admin visibility (#94)", () => {
+  test("global admin utok sees every network without losing public shape", async () => {
+    const rows = await listNetworks(adminToken);
+    expect(new Set(rows.map((row) => row.network_id))).toEqual(new Set([adminNetworkId, memberNetworkId]));
+
+    const own = rows.find((row) => row.network_id === adminNetworkId);
+    const foreign = rows.find((row) => row.network_id === memberNetworkId);
+    expect(own.member_role).toBe("owner");
+    expect(foreign.member_role).toBe("admin");
+    expect(Object.keys(foreign).sort()).toEqual([...NETWORK_REST_COLUMNS, "member_role", "name"].sort());
+  });
+
+  test("ordinary utok remains limited to member networks", async () => {
+    const rows = await listNetworks(memberToken);
+    expect(rows.map((row) => row.network_id)).toEqual([memberNetworkId]);
+    expect(rows.some((row) => row.network_id === adminNetworkId)).toBe(false);
+  });
+
+  test("network token remains limited to its bound network", async () => {
+    const rows = await listNetworks(nodeToken);
+    expect(rows.map((row) => row.network_id)).toEqual([memberNetworkId]);
+    expect(rows.some((row) => row.network_id === adminNetworkId)).toBe(false);
+  });
+});