@sleep2agi/commhub-server 0.9.0-preview.1 → 0.9.0-preview.3

package/src/db.ts

@@ -376,6 +376,66 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_tokens_user ON api_tokens(user_id);
 `);
 
+// RFC-026 v4 §4.4.8 C4 — api_tokens metadata so sweeper can revoke
+// orphan child-ntoks without ever touching plaintext tokens. ALTER in
+// try/catch (idempotent for already-migrated DBs).
+//   request_id  — links a child token to the create_node request that
+//                 minted it; sweeper joins on this
+//   revoked_at  — explicit revoke; resolveToken treats non-NULL as
+//                 invalid even before expiry
+for (const ddl of [
+  "ALTER TABLE api_tokens ADD COLUMN request_id TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN revoked_at TEXT",
+  "ALTER TABLE api_tokens ADD COLUMN role TEXT",
+]) {
+  try { db.exec(ddl); }
+  catch (e: any) {
+    if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
+  }
+}
+try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
+catch (e: any) { /* index may already exist */ void e; }
+
+// RFC-026 v4 §2.5 + §4.4 — node_create_requests. Metadata only;
+// env_blob NEVER lives in this table (F1 mint-stream-evict — secret
+// blob is in-memory Map keyed by request_id, drained on daemon get,
+// TTL 60s GC).
+//
+// env_keys is a JSON array of secret KEY NAMES only (for audit). The
+// actual values flow through pendingEnvBlobs Map and never touch
+// disk.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_create_requests (
+    request_id        TEXT PRIMARY KEY,
+    daemon_node_id    TEXT NOT NULL,
+    child_name        TEXT NOT NULL,
+    network_id        TEXT NOT NULL,
+    runtime           TEXT NOT NULL,
+    model             TEXT NOT NULL,
+    flags_json        TEXT NOT NULL,
+    env_keys          TEXT NOT NULL,
+    status            TEXT NOT NULL,
+    error             TEXT,
+    child_token_id    TEXT,
+    created_at        INTEGER NOT NULL,
+    created_by_token  TEXT NOT NULL,
+    delivered_at      INTEGER,
+    acked_at          INTEGER,
+    child_node_id     TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_ncr_daemon_status ON node_create_requests(daemon_node_id, status);
+  CREATE INDEX IF NOT EXISTS idx_ncr_network ON node_create_requests(network_id);
+  CREATE INDEX IF NOT EXISTS idx_ncr_child_name ON node_create_requests(child_name);
+`);
+try {
+  // Single-flight per (daemon, child_name) — prevents racing dashboard
+  // create on same name. Mirrors RFC-024 uniq_ncu_node_inflight.
+  db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_ncr_inflight ON node_create_requests(daemon_node_id, child_name) WHERE status IN ('pending', 'delivered')`);
+} catch (e: any) {
+  console.warn(`[commhub] partial unique index uniq_ncr_inflight skipped: ${e?.message || e}`);
+}
+
 // ── V3: audit_log table ──
 db.exec(`
   CREATE TABLE IF NOT EXISTS audit_log (

package/src/shared/reserved-env-drift.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  RESERVED_ENV_KEYS_EXACT as HUB_EXACT,
+  RESERVED_ENV_PREFIXES as HUB_PREFIXES,
+} from "./reserved-env.js";
+
+// RFC-026 v4 §4.4.7 G9 drift guard — denylist MUST be hub-and-daemon
+// identical, or attacker walks the looser layer. Two enforcement modes:
+//
+//   1. byte-identical source files (this test)
+//   2. runtime set-equality of the imported constants
+//
+// We assert both. If a future contributor edits one side without the
+// other, this test breaks the merge.
+
+const HUB_PATH = join(import.meta.dir, "reserved-env.ts");
+const DAEMON_PATH = join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "reserved-env.ts");
+
+describe("RFC-026 v4 §4.4.7 G9 — hub/daemon reserved-env drift guard", () => {
+  test("byte-identical source files", () => {
+    const hub = readFileSync(HUB_PATH, "utf-8");
+    const daemon = readFileSync(DAEMON_PATH, "utf-8");
+    expect(daemon).toBe(hub);
+  });
+
+  test("imported constants are set-equal at runtime", async () => {
+    // Use a dynamic file import path so this test breaks if the file
+    // moves but still references the daemon copy.
+    const daemonMod = await import(DAEMON_PATH);
+    const daemonExact = daemonMod.RESERVED_ENV_KEYS_EXACT as Set<string>;
+    const daemonPrefixes = daemonMod.RESERVED_ENV_PREFIXES as ReadonlyArray<string>;
+
+    // EXACT set equality
+    expect(daemonExact.size).toBe(HUB_EXACT.size);
+    for (const k of HUB_EXACT) expect(daemonExact.has(k)).toBe(true);
+    for (const k of daemonExact) expect(HUB_EXACT.has(k)).toBe(true);
+
+    // PREFIX array order-independent equality
+    expect(new Set(daemonPrefixes)).toEqual(new Set(HUB_PREFIXES));
+  });
+});

package/src/shared/reserved-env.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { RESERVED_ENV_KEYS_EXACT, RESERVED_ENV_PREFIXES, isReservedEnvKey } from "./reserved-env.js";
+
+describe("RFC-026 v4 §4.4.7 reserved env denylist (B1)", () => {
+  test("exact PATH/HOME/LANG/NODE_OPTIONS blocked", () => {
+    for (const k of ["PATH", "HOME", "LANG", "LC_ALL", "SHELL", "USER", "LOGNAME", "NODE_OPTIONS", "IFS", "TMPDIR"]) {
+      expect(isReservedEnvKey(k)).toBe(true);
+    }
+  });
+  test("LD_ prefix family blocked (Linux dynamic loader)", () => {
+    for (const k of ["LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT", "LD_"]) {
+      expect(isReservedEnvKey(k)).toBe(true);
+    }
+  });
+  test("DYLD_ prefix blocked (macOS)", () => {
+    expect(isReservedEnvKey("DYLD_INSERT_LIBRARIES")).toBe(true);
+    expect(isReservedEnvKey("DYLD_LIBRARY_PATH")).toBe(true);
+  });
+  test("BUN_/NPM_/NPM_CONFIG_/NODE_ prefix blocked", () => {
+    expect(isReservedEnvKey("BUN_INSTALL")).toBe(true);
+    expect(isReservedEnvKey("NPM_TOKEN")).toBe(true);
+    expect(isReservedEnvKey("NPM_CONFIG_REGISTRY")).toBe(true);
+    expect(isReservedEnvKey("NODE_PATH")).toBe(true);
+    expect(isReservedEnvKey("NODE_TLS_REJECT_UNAUTHORIZED")).toBe(true);
+  });
+  test("legitimate API key style is NOT blocked", () => {
+    for (const k of ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "TELEGRAM_BOT_TOKEN", "DEEPSEEK_API_KEY", "MY_APP_CONFIG"]) {
+      expect(isReservedEnvKey(k)).toBe(false);
+    }
+  });
+  test("set shape sanity — both EXACT and PREFIX non-empty + frozen-ish", () => {
+    expect(RESERVED_ENV_KEYS_EXACT.size).toBeGreaterThan(10);
+    expect(RESERVED_ENV_PREFIXES.length).toBeGreaterThan(3);
+  });
+});

package/src/shared/reserved-env.ts

@@ -0,0 +1,31 @@
+// RFC-026 v4 §4.4.7 B1 — reserved env-key denylist (single source of
+// truth for hub + daemon).
+//
+// Scope: env_refs naming a system/process-model sensitive key (PATH /
+// LD_PRELOAD / NODE_OPTIONS / BUN_* / NPM_* / ...) MUST be rejected
+// before the secret value ever reaches fork(), because such a key in
+// the child env is effectively arbitrary code execution.
+//
+// G9 (drift guard): this module is the ONE source. Daemon-side runtime
+// imports the same constants. A divergence between hub and daemon would
+// let attacker target the looser layer; CI test asserts set equality.
+
+export const RESERVED_ENV_KEYS_EXACT = new Set<string>([
+  "PATH", "HOME", "LANG", "LC_ALL", "SHELL", "USER", "LOGNAME",
+  "NODE_OPTIONS", "IFS", "PS1", "PS4", "ENV", "BASH_ENV",
+  "CDPATH", "PROMPT_COMMAND", "TMPDIR",
+]);
+
+// Prefix-match denied. Order matters only for clarity (LD_ catches
+// LD_PRELOAD / LD_LIBRARY_PATH / LD_AUDIT; DYLD_ catches DYLD_INSERT_
+// LIBRARIES; BUN_ / NPM_ / NPM_CONFIG_ / NODE_ catch ecosystem-level
+// runtime config).
+export const RESERVED_ENV_PREFIXES: ReadonlyArray<string> = [
+  "LD_", "DYLD_", "BUN_", "NPM_", "NPM_CONFIG_", "NODE_",
+];
+
+export function isReservedEnvKey(k: string): boolean {
+  if (RESERVED_ENV_KEYS_EXACT.has(k)) return true;
+  for (const p of RESERVED_ENV_PREFIXES) if (k.startsWith(p)) return true;
+  return false;
+}