@sleep2agi/commhub-server 0.9.0-preview.103 → 0.9.0-preview.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.103",
+  "version": "0.9.0-preview.105",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/agent-acl-http.test.ts

@@ -321,13 +321,15 @@ describe("granted member sees and messages ONLY what was granted", () => {
     expect((await tool(aliceToken, "send_task", { alias: X.alias, task: "mcp hello X", network_id: NET })).ok).toBe(true);
     expect((await tool(aliceToken, "send_task", { alias: Z.alias, task: "hi", network_id: NET })).error).toBe("agent_not_granted");
   });
-  test("tasks: alice sees her own exchange with X, not admin's", async () => {
+  test("#563 tasks: alice sees X's and Y's whole timeline (incl. admin's history), never Z's", async () => {
     seedTask("t_x_to_alice", X.alias, "acl_alice", "X answers alice");
     const ids = (await get(aliceToken, `/api/tasks?network_id=${NET}`)).body.tasks.map((t: any) => t.content).sort();
-    expect(ids).toEqual(["X answers alice", "hello X", "mcp hello X"].sort());
-    expect((await get(aliceToken, `/api/tasks/t_admin_to_x`)).status).toBe(404);
+    // 与 admin 看同一个节点时看到的一样:admin 发给 X / Y(Y 是只读授权)的历史也在。
+    expect(ids).toEqual(["X answers alice", "hello X", "mcp hello X", "admin secret for X", "admin secret for Y"].sort());
+    expect((await get(aliceToken, `/api/tasks/t_admin_to_x`)).status).toBe(200);
     expect((await get(aliceToken, `/api/tasks/t_x_to_alice`)).status).toBe(200);
-    expect((await tool(aliceToken, "list_tasks", { network_id: NET })).tasks.map((t: any) => t.content)).not.toContain("admin secret for X");
+    expect((await tool(aliceToken, "list_tasks", { network_id: NET })).tasks.map((t: any) => t.content)).toContain("admin secret for X");
+    expect((await tool(aliceToken, "get_task", { task_id: "t_admin_to_x" })).ok).toBe(true);
   });
   test("requirements people now include X and Y nodes but not Z", async () => {
     const nodes = (await get(aliceToken, `/api/requirements/people?network_id=${NET}`)).body.people.filter((p: any) => p.kind === "node").map((p: any) => p.id).sort();
@@ -341,6 +343,142 @@ describe("granted member sees and messages ONLY what was granted", () => {
   });
 });
 
+describe("#563 one node, one timeline: everyone who can see N sees the same history", () => {
+  const contents = async (token: string, q = "") => (await get(token, `/api/tasks?network_id=${NET}${q}`)).body.tasks.map((t: any) => t.content).sort();
+  test("seed: bob's history with X and traffic between X and the invisible Z", () => {
+    seedTask("t563_bob_to_x", "acl_bob", X.alias, "bob asked X earlier");
+    seedTask("t563_z_to_x", Z.alias, X.alias, "Z whispers to X");
+    seedTask("t563_x_to_z", X.alias, Z.alias, "X whispers to Z");
+    seedTask("t563_admin_to_z", "scheduler", Z.alias, "scheduler pokes Z");
+  });
+  test("chat window query (to_name=X): alice sees exactly what admin sees, minus rows from an agent she cannot see", async () => {
+    const adminView = await contents(adminToken, `&to_name=${X.alias}`);
+    const aliceView = await contents(aliceToken, `&to_name=${X.alias}`);
+    expect(adminView).toContain("Z whispers to X");
+    expect(aliceView).toEqual(adminView.filter((c: string) => c !== "Z whispers to X"));
+    expect(aliceView).toContain("admin secret for X");
+    expect(aliceView).toContain("bob asked X earlier");
+  });
+  test("rows between a visible and an invisible agent stay hidden in every direction; Z's timeline stays hidden", async () => {
+    const all = await contents(aliceToken);
+    expect(all).not.toContain("Z whispers to X");
+    expect(all).not.toContain("X whispers to Z");
+    expect(all).not.toContain("scheduler pokes Z");
+    expect((await get(aliceToken, `/api/tasks/t563_z_to_x`)).status).toBe(404);
+    expect((await get(aliceToken, `/api/tasks/t563_x_to_z`)).status).toBe(404);
+    expect((await get(aliceToken, `/api/task_events?task_id=t563_z_to_x`)).body.events).toEqual([]);
+  });
+  test("/api/tasks/:id: another member's task to X is 200 for granted alice, 404 for bob without a grant", async () => {
+    expect((await get(aliceToken, `/api/tasks/t563_bob_to_x`)).status).toBe(200);
+    expect((await get(aliceToken, `/api/tasks/t_admin_to_x`)).body.task.content).toBe("admin secret for X");
+    expect((await get(bobToken, `/api/tasks/t_admin_to_x`)).status).toBe(404);
+    expect((await get(bobToken, `/api/task_events?task_id=t_admin_to_x`)).body.events).toEqual([]);
+    expect(await contents(bobToken)).toEqual([]);
+  });
+  test("network stats count alice's visible timeline", async () => {
+    const r = await get(aliceToken, `/api/networks/${NET}`);
+    const n = r.body.stats.tasks.reduce((sum: number, row: any) => sum + row.count, 0);
+    expect(n).toBe((await contents(aliceToken)).length);
+  });
+  test("group grant: bob granted a group holding Z sees Z's history (incl. the scheduler row), not X's", async () => {
+    const g = await send(adminToken, "POST", `/api/networks/${NET}/agent-groups`, { name: "acl-563-z", node_ids: [Z.node] });
+    expect(g.status).toBe(200);
+    const groupId = g.body.group.group_id;
+    expect((await send(adminToken, "PUT", grantsPath(bobId), { group_grants: [{ group_id: groupId, can_message: false }] })).status).toBe(200);
+    try {
+      const bobView = await contents(bobToken);
+      expect(bobView).toContain("scheduler pokes Z");
+      expect(bobView).not.toContain("admin secret for X");
+      expect(bobView).not.toContain("Z whispers to X");
+      expect((await get(bobToken, `/api/tasks/t563_admin_to_z`)).status).toBe(200);
+    } finally {
+      await send(adminToken, "PUT", grantsPath(bobId), { group_grants: [] });
+      await send(adminToken, "DELETE", `/api/networks/${NET}/agent-groups/${groupId}`);
+    }
+    expect(await contents(bobToken)).toEqual([]);
+  });
+  test("agent_access=all and network admin see every row for X (unchanged); network owner without hub-admin too", async () => {
+    const adminView = await contents(adminToken, `&to_name=${X.alias}`);
+    await send(adminToken, "PUT", grantsPath(bobId), { agent_access: "all" });
+    try {
+      expect(await contents(bobToken, `&to_name=${X.alias}`)).toEqual(adminView);
+    } finally {
+      await send(adminToken, "PUT", grantsPath(bobId), { agent_access: "granted" });
+    }
+    db.run("UPDATE network_members SET role = 'admin' WHERE network_id = ?1 AND user_id = ?2", [NET, bobId]);
+    try {
+      expect(await contents(bobToken, `&to_name=${X.alias}`)).toEqual(adminView);
+    } finally {
+      db.run("UPDATE network_members SET role = 'member' WHERE network_id = ?1 AND user_id = ?2", [NET, bobId]);
+    }
+    db.run("UPDATE users SET role = 'user' WHERE user_id = ?1", [adminId]);
+    try {
+      expect(await contents(adminToken, `&to_name=${X.alias}`)).toEqual(adminView);
+    } finally {
+      db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [adminId]);
+    }
+    expect(await contents(bobToken)).toEqual([]);
+  });
+  test("files: an attachment on admin's message to X opens for alice; on admin's message to Z it does not", async () => {
+    const upload = async () => {
+      const form = new FormData();
+      form.append("file", new Blob([new Uint8Array([5, 6, 3])], { type: "image/png" }), "shot.png");
+      const up = await fetch(`${BASE}/api/upload?network_id=${NET}`, { method: "POST", body: form, headers: auth(adminToken) });
+      expect(up.status).toBe(200);
+      return (await up.json()).file_id as string;
+    };
+    const toX = await upload();
+    const toZ = await upload();
+    const adminName = db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", adminId)!.username;
+    seedTask("t563_img_x", adminName, X.alias, "look at this", { attachments: [{ type: "file", file_id: toX }] });
+    seedTask("t563_img_z", adminName, Z.alias, "look at this", { attachments: [{ type: "file", file_id: toZ }] });
+    try {
+      expect((await fetch(`${BASE}/api/files/${toX}`, { headers: auth(aliceToken) })).status).toBe(200);
+      expect((await fetch(`${BASE}/api/files/${toZ}`, { headers: auth(aliceToken) })).status).toBe(404);
+      expect((await fetch(`${BASE}/api/files/${toX}`, { headers: auth(bobToken) })).status).toBe(404);
+    } finally {
+      for (const id of ["t563_img_x", "t563_img_z"]) {
+        db.run("DELETE FROM tasks WHERE task_id = ?1", [id]);
+        db.run("DELETE FROM inbox WHERE task_id = ?1", [id]);
+      }
+    }
+  });
+  test("SSE: admin's new message to X and X's reply to admin wake alice's stream; Z traffic never does", async () => {
+    const { pushNetworkObserverEvent } = await import("./push.js");
+    const adminName = db.get<{ username: string }>("SELECT username FROM users WHERE user_id = ?1", adminId)!.username;
+    const ctrl = new AbortController();
+    const res = await fetch(`${BASE}/events/network/${NET}`, { headers: auth(aliceToken), signal: ctrl.signal });
+    expect(res.status).toBe(200);
+    const reader = res.body!.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    let pending: ReturnType<typeof reader.read> | null = null;
+    const readFor = async (ms: number) => {
+      const until = Date.now() + ms;
+      while (Date.now() < until) {
+        pending ??= reader.read();
+        const chunk = await Promise.race([pending, new Promise<null>(r => setTimeout(() => r(null), until - Date.now()))]);
+        if (!chunk) break;
+        pending = null;
+        if (chunk.done) break;
+        buf += decoder.decode(chunk.value);
+      }
+    };
+    await readFor(150);
+    expect((await send(adminToken, "POST", "/api/task", { alias: X.alias, task: "admin live to X", network_id: NET })).status).toBe(200);
+    pushNetworkObserverEvent(NET, { type: "new_reply", task_id: "t_admin_to_x", message_id: "m563", from: X.alias, to: adminName, status: "replied" });
+    pushNetworkObserverEvent(NET, { type: "new_task", task_id: "t563_live_zx", from: Z.alias, to: X.alias, status: "delivered" });
+    pushNetworkObserverEvent(NET, { type: "new_reply", task_id: "t563_live_xz", message_id: "m563z", from: X.alias, to: Z.alias, status: "replied" });
+    pushNetworkObserverEvent(NET, { type: "new_task", task_id: "t563_live_az", from: adminName, to: Z.alias, status: "delivered" });
+    await readFor(400);
+    ctrl.abort();
+    const events = buf.split("\n").filter(l => l.startsWith("data:")).map(l => JSON.parse(l.slice(5)));
+    expect(events.some(e => e.type === "new_task" && e.from === adminName && e.to === X.alias)).toBe(true);
+    expect(events.some(e => e.type === "new_reply" && e.from === X.alias && e.to === adminName)).toBe(true);
+    expect(events.some(e => e.from === Z.alias || e.to === Z.alias)).toBe(false);
+  });
+});
+
 describe("requirements: agent references alice cannot see are hidden and protected", () => {
   let reqId = "";
   test("a card owned by Z shows agent_owner=null to alice, Z to admin", async () => {

package/src/agent-acl-slice3-http.test.ts

@@ -1,7 +1,7 @@
 // 多用户账号与 Agent 权限 —— slice 3:剩下的面向 Agent 的路径。
 //
 // slice 1(agent-acl-http.test.ts)把默认作用域做成 fail-closed,并对核心路径逐条放行。
-// 这里补:授权后 task_events / messages 的「只看自己往来」、改名广播不外泄 alias、
+// 这里补:授权后 task_events 跟随授权 Agent 的时间线(#563)、messages 的「只看自己往来」、改名广播不外泄 alias、
 // 排程在建的人被收权后不再代派、用户名与后注册的 Agent alias 撞名、以及
 // rules / skills / files / logs 对受限成员(即使授权了)仍然拒绝 —— 这是一个明确的产品决定:
 // 授权 = 能看见、能对话;不等于能管理这个 Agent。
@@ -104,14 +104,14 @@ afterAll(() => {
   try { rmSync(DIR, { recursive: true, force: true }); } catch {}
 });
 
-describe("granted member: task_events and messages are limited to own traffic", () => {
-  test("task_events: own exchange with X visible, admin's task to X not", async () => {
+describe("granted member: task_events follow X's timeline (#563); messages stay own traffic", () => {
+  test("task_events: every task on granted X's timeline is visible, including admin's (#563)", async () => {
     const mine = await get(carolToken, `/api/task_events?task_id=t3_carol_x`);
     expect(mine.body.events.length).toBe(1);
     expect((await get(carolToken, `/api/task_events?task_id=t3_x_carol`)).body.events.length).toBe(1);
-    expect((await get(carolToken, `/api/task_events?task_id=t3_admin_x`)).body.events).toEqual([]);
+    expect((await get(carolToken, `/api/task_events?task_id=t3_admin_x`)).body.events.length).toBe(1);
     const all = await get(carolToken, `/api/task_events?network_id=${NET}`);
-    expect(all.body.events.map((e: any) => e.task_id).sort()).toEqual(["t3_carol_x", "t3_x_carol"]);
+    expect(all.body.events.map((e: any) => e.task_id).sort()).toEqual(["t3_admin_x", "t3_carol_x", "t3_x_carol"]);
   });
   test("messages (alias branch): own inbox rows with X only; admin's never", async () => {
     const r = await get(carolToken, `/api/messages?network_id=${NET}&since=2000-01-01`);

package/src/network-scope.ts

@@ -177,6 +177,58 @@ export function addOwnTrafficScope(sql: string, params: any[], scope: RestNetwor
   return parts.length ? `${sql} AND (${parts.join(" OR ")})` : `${sql} AND 1=0`;
 }
 
+/**
+ * #563 —— 「不同用户看到同一个节点,消息应该是一样的」。
+ *
+ * tasks 行(聊天窗口的历史 + 回复都在这张表)的作用域:受限网络里,只要成员**看得见** Agent N
+ * (直接授权或经组授权,见 visibleAgents),N 的整条时间线他都看得见 —— 不论是谁发的(包括 owner、
+ * 其他成员),也包括授权之前的历史。时间线 = 一端是看得见的 Agent,另一端是:
+ *   - 另一个看得见的 Agent;或
+ *   - 不是本网络任何 Agent 的名字(人类用户 / scheduler / hub 这类系统发送方)。
+ * 另一端是**看不见**的 Agent 的行一律不放行(不借时间线暴露看不见的节点)。
+ * 没有任何授权的成员什么都看不到(与之前一样);能不能**发**仍由 canMessageAgent 管。
+ * Agent 主动发给某个人的 user_inbox 私信不在这张表里,不受影响。
+ *
+ * 与 addOwnTrafficScope 的区别只在受限网络:那里只放行「自己 ↔ 授权 Agent」。inbox(投递队列)
+ * 仍走 addOwnTrafficScope。用户名与 Agent alias 撞名的网络照旧整网不放行(fail-closed)。
+ */
+export function addAgentTimelineScope(sql: string, params: any[], scope: RestNetworkScope, cols: Required<Pick<TrafficColumns, "from" | "to" | "fromNodeId" | "toNodeId">> & { network?: string }): string {
+  const restriction = scope.agentRestriction;
+  if (!restriction) return addHumanNetworkScope(sql, params, scope, cols.network ?? "network_id");
+  const net = cols.network ?? "network_id";
+  const parts: string[] = [];
+  const allowed = unrestrictedNetworks(scope) ?? [];
+  if (allowed.length) parts.push(`${net} IN (${placeholders(params, allowed)})`);
+  if (restriction.username) {
+    for (const networkId of restriction.networkIds) {
+      if (usernameIsAgentAlias(networkId, restriction.username)) continue;
+      const visible = visibleAgents(restriction.userId, networkId);
+      // 先判空再推参数:推了又不用的绑定参数会让 PG 报错(SQLite 会忽略)。
+      if (visible.aliases.length === 0 && visible.nodeIds.length === 0) continue;
+      const aliasIn = visible.aliases.length ? placeholders(params, visible.aliases) : null;
+      const nodeIn = visible.nodeIds.length ? placeholders(params, visible.nodeIds) : null;
+      const netP = placeholders(params, [networkId]);
+      const isVisible = (aliasCol: string, nodeCol: string): string => {
+        const conds: string[] = [];
+        if (aliasIn) conds.push(`${aliasCol} IN (${aliasIn})`);
+        if (nodeIn) conds.push(`${nodeCol} IN (${nodeIn})`);
+        return `(${conds.join(" OR ")})`;
+      };
+      // 「不是本网络任何 Agent」:没有 node_id,且 alias 不在本网络的 sessions / nodes 里。
+      const notAnAgent = (aliasCol: string, nodeCol: string): string =>
+        `(${nodeCol} IS NULL`
+        + ` AND ${aliasCol} NOT IN (SELECT alias FROM sessions WHERE network_id = ${netP} AND alias IS NOT NULL)`
+        + ` AND ${aliasCol} NOT IN (SELECT alias FROM nodes WHERE network_id = ${netP} AND alias IS NOT NULL))`;
+      const toV = isVisible(cols.to, cols.toNodeId);
+      const fromV = isVisible(cols.from, cols.fromNodeId);
+      const otherFrom = `(${fromV} OR ${notAnAgent(cols.from, cols.fromNodeId)})`;
+      const otherTo = `(${toV} OR ${notAnAgent(cols.to, cols.toNodeId)})`;
+      parts.push(`(${net} = ${netP} AND ((${toV} AND ${otherFrom}) OR (${fromV} AND ${otherTo})))`);
+    }
+  }
+  return parts.length ? `${sql} AND (${parts.join(" OR ")})` : `${sql} AND 1=0`;
+}
+
 export function singleNetworkId(scope: RestNetworkScope): string | null {
   if (scope.networkId) return scope.networkId;
   if (scope.networkIds?.length === 1) return scope.networkIds[0];

package/src/restricted-files.ts

@@ -3,14 +3,17 @@
 // 也不能把自己看不见的 file_id 塞进发给授权 Agent 的任务(那等于借 Agent 的网络令牌去读)。
 import { existsSync, readFileSync } from "fs";
 import { db } from "./db.js";
-import { addOwnTrafficScope, type RestNetworkScope } from "./network-scope.js";
+import { addAgentTimelineScope, addOwnTrafficScope, type RestNetworkScope } from "./network-scope.js";
 import { FILE_ID_REGEX, indexEntryPath, validateIndexEntry } from "./uploads.js";
 
 /**
  * 受限成员能不能看见这个文件:只认**对方(授权 Agent / 给他发私信的人)放进来**的附件 ——
  *   user_inbox 里发给自己的私信附件;
- *   授权 Agent 发给自己的任务 / inbox 行的 attachments;
- *   自己发给授权 Agent 的任务上,Agent 回复写进的 reply_attachments。
+ *   授权 Agent 时间线上(#563,与 /api/tasks 同一判据 addAgentTimelineScope)**别人**发出的任务的
+ *   attachments —— 时间线上看得见那条消息,就得看得见它带的图;发送方是受限成员时发送路径已校验过
+ *   他看得见这些文件,不受限的发送方本来就看得见全网文件;
+ *   时间线上任务的 reply_attachments(Agent 回复写进的);
+ *   授权 Agent 发给自己的 inbox 行的 attachments。
  * 自己随任务带出去的 attachments **不算**:否则把任意 file_id 塞进自己的任务就能「解锁」别人的文件。
  */
 export function restrictedMemberSeesFile(userId: string, username: string, networkId: string, fileId: string): boolean {
@@ -32,10 +35,10 @@ export function restrictedMemberSeesFile(userId: string, username: string, netwo
   }
   const scope: RestNetworkScope = { networkId, networkIds: null, agentRestriction: { userId, username, networkIds: [networkId] } };
   const taskParams: unknown[] = [needle];
-  const taskSql = addOwnTrafficScope("SELECT from_name, to_name, meta_json FROM tasks WHERE meta_json LIKE ?1 ESCAPE '\\'", taskParams, scope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+  const taskSql = addAgentTimelineScope("SELECT from_name, to_name, meta_json FROM tasks WHERE meta_json LIKE ?1 ESCAPE '\\'", taskParams, scope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
   for (const row of db.all<{ from_name: string; to_name: string; meta_json: string | null }>(taskSql + " LIMIT 50", ...taskParams)) {
-    if (row.to_name === username && listed(row.meta_json, "attachments")) return true;
-    if (row.from_name === username && listed(row.meta_json, "reply_attachments")) return true;
+    if (row.from_name !== username && listed(row.meta_json, "attachments")) return true;
+    if (listed(row.meta_json, "reply_attachments")) return true;
   }
   const inboxParams: unknown[] = [needle];
   const inboxSql = addOwnTrafficScope("SELECT session_name, meta_json FROM inbox WHERE meta_json LIKE ?1 ESCAPE '\\'", inboxParams, scope, { from: "from_session", to: "session_name" });

package/src/server.ts

@@ -25,12 +25,12 @@ import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { notifyExpiredTasks, type ExpiredTaskRow } from "./task-expiry-notice.js";
 import { expireStaleOpenTasks } from "./task-stale-open.js";
-import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
+import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, addAgentTimelineScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
 import { groupMemberSeesFile, groupUnreadFor, listGroupMessages, listGroupThreads, markGroupRead, memberGroup, sendGroupMessage } from "./group-messages.js";
 import { getTaskAccessMode, isTaskScoped, listProjectGrants, replaceTaskGrants, NEW_MEMBER_TASK_ACCESS } from "./task-access.js";
-import { canMessageAgent, isAgentRestricted, listAgentGrants, listGroupGrants, getAgentAccessMode, replaceAgentGrants, restrictedNetworkIds, usernameIsAgentAlias, listAgentGroups, createAgentGroup, updateAgentGroup, replaceAgentGroupMembers, deleteAgentGroup, usersGrantedGroup } from "./agent-access.js";
+import { canMessageAgent, isAgentRestricted, visibleAgents, listAgentGrants, listGroupGrants, getAgentAccessMode, replaceAgentGrants, restrictedNetworkIds, usernameIsAgentAlias, listAgentGroups, createAgentGroup, updateAgentGroup, replaceAgentGroupMembers, deleteAgentGroup, usersGrantedGroup } from "./agent-access.js";
 import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_PERMISSION_MODES, nodeDecide, nodeIdentity, nodePermissionDeniedBody, nodePermissionsFlag, streamVerdict, writeVerdict, type NodeIdentity, type NodePermissionMode, type Verdict } from "./node-permissions.js";
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
@@ -1097,13 +1097,38 @@ return Bun.serve({
       }
       const streamDenied = restNodeDenied(req, authCtx, "SSE /events/network/:id", (id) => streamVerdict(id, "network"));
       if (streamDenied) return streamDenied;
-      // 多用户 Agent 权限:受限成员只收到自己是一端的路由事件(自己发的 / 发给自己的),
-      // 看不到网络里别人和各个 Agent 之间的流量。
+      // 多用户 Agent 权限:受限成员收到自己是一端的路由事件,以及授权 Agent 时间线上的事件
+      // (#563:与 /api/tasks 的 addAgentTimelineScope 同一判据 —— 一端是看得见的 Agent,另一端是
+      // 看得见的 Agent 或不是本网络任何 Agent;另一端是看不见的 Agent 的事件不推)。
       if (isAgentRestricted(authCtx.userId, observedNetId)) {
         const me = authCtx.username;
+        const userId = authCtx.userId;
+        const collides = usernameIsAgentAlias(observedNetId, me);
+        // 授权与 Agent 名单每条事件都现查太贵;缓存 5 秒(授权撤销最多晚 5 秒对推送生效)。
+        let cache: { at: number; visible: Set<string>; agents: Set<string> } | null = null;
+        const sets = () => {
+          if (!cache || Date.now() - cache.at > 5_000) {
+            const visible = new Set(visibleAgents(userId, observedNetId).aliases);
+            const agents = new Set(db.all<{ alias: string }>(
+              "SELECT alias FROM sessions WHERE network_id = ?1 AND alias IS NOT NULL UNION SELECT alias FROM nodes WHERE network_id = ?1 AND alias IS NOT NULL",
+              observedNetId,
+            ).map((r) => r.alias));
+            cache = { at: Date.now(), visible, agents };
+          }
+          return cache;
+        };
         return createNetworkObserverStream(observedNetId, {
           subscriberUserId: authCtx.userId,
-          eventFilter: (event) => event.from === me || event.to === me,
+          eventFilter: (event) => {
+            if (event.from === me || event.to === me) return true;
+            if (collides) return false;
+            const { visible, agents } = sets();
+            const from = typeof event.from === "string" ? event.from : null;
+            const to = typeof event.to === "string" ? event.to : null;
+            const vis = (a: string | null) => !!a && visible.has(a);
+            const otherOk = (a: string | null) => vis(a) || (!!a && !agents.has(a));
+            return (vis(to) && otherOk(from)) || (vis(from) && otherOk(to));
+          },
         });
       }
       return createNetworkObserverStream(observedNetId, { subscriberUserId: authCtx.userId });
@@ -2225,7 +2250,7 @@ return Bun.serve({
       if (!viewerRole && !isHubAdminCredential(resolved)) {
         return withCors(req, Response.json({ ok: false, error: "access denied" }, { status: 403 }));
       }
-      // Get network stats —— 受限成员只数得到授权给他的 Agent 与自己的往来。
+      // Get network stats —— 受限成员只数得到授权给他的 Agent 的时间线(#563)。
       const detailScope: RestNetworkScope = resolved.user.role === "admin" || resolved.networkId
         ? { networkId, networkIds: null }
         : resolveRestNetworkScope(networkId, { userId: resolved.user.user_id, networkId: null, username: resolved.user.username }, false);
@@ -2234,7 +2259,7 @@ return Bun.serve({
       const sessionParams: unknown[] = [];
       const sessionCount = db.get<{ cnt: number }>(addAgentNetworkScope("SELECT COUNT(*) as cnt FROM sessions WHERE 1=1", sessionParams, detailScope, { alias: "alias", nodeId: "node_id" }), ...sessionParams);
       const taskParams: unknown[] = [];
-      const taskStats = db.all<any>(addOwnTrafficScope("SELECT status, COUNT(*) as count FROM tasks WHERE 1=1", taskParams, detailScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" }) + " GROUP BY status", ...taskParams);
+      const taskStats = db.all<any>(addAgentTimelineScope("SELECT status, COUNT(*) as count FROM tasks WHERE 1=1", taskParams, detailScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" }) + " GROUP BY status", ...taskParams);
       return withCors(req, Response.json({
         ok: true, network,
         stats: { nodes: nodeCount?.cnt || 0, sessions: sessionCount?.cnt || 0, tasks: taskStats },
@@ -4061,9 +4086,9 @@ return Bun.serve({
       let sql = `SELECT ${TASK_EVENT_REST_SELECT} FROM task_events WHERE 1=1`;
       const params: any[] = [];
       if (restScope.agentRestriction) {
-        // 受限成员:只看得到自己与授权 Agent 往来的那些任务的事件。
+        // 受限成员:只看得到授权 Agent 时间线上那些任务的事件(#563,与 /api/tasks 同一判据)。
         sql += " AND task_id IN (SELECT task_id FROM tasks WHERE 1=1";
-        sql = addOwnTrafficScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" }) + ")";
+        sql = addAgentTimelineScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" }) + ")";
       } else {
         sql = addNetworkScope(sql, params, restScope);
       }
@@ -4656,7 +4681,7 @@ return Bun.serve({
       const taskId = decodeURIComponent(taskPathMatch[1] ?? "");
       const params: any[] = [taskId];
       let sql = `SELECT ${TASK_REST_SELECT} FROM tasks WHERE task_id = ?1`;
-      sql = addOwnTrafficScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      sql = addAgentTimelineScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       sql += " LIMIT 1";
       const task = db.get(sql, ...params);
       if (!task) {
@@ -4745,7 +4770,7 @@ return Bun.serve({
 
       let sql = `SELECT ${TASK_REST_SELECT} FROM tasks WHERE 1=1`;
       const params: any[] = [];
-      sql = addOwnTrafficScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      sql = addAgentTimelineScope(sql, params, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       if (taskId) { sql += ` AND task_id = ?${params.length + 1}`; params.push(taskId); }
       if (status) { sql += ` AND status = ?${params.length + 1}`; params.push(status); }
       if (toName) { sql += ` AND to_name = ?${params.length + 1}`; params.push(toName); }
@@ -4768,7 +4793,7 @@ return Bun.serve({
       }
       const statsParams: any[] = [];
       let statsSql = "SELECT status, COUNT(*) as count FROM tasks WHERE 1=1";
-      statsSql = addOwnTrafficScope(statsSql, statsParams, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      statsSql = addAgentTimelineScope(statsSql, statsParams, restScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       statsSql += " GROUP BY status";
       const stats = db.all<any>(statsSql, ...statsParams);
       return withCors(req, Response.json({ ok: true, tasks: rows, count: rows.length, stats }));

package/src/stop-delete-node.test.ts

@@ -435,6 +435,34 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A })).ok).toBe(true);
   });
 
+  // #571 — 手工起的节点(id `n_…`)没有任何 daemon 链接。改前:authority==null 时
+  // 放行调用方点名的任意同网 daemon → 门铃发过去,那台 daemon 本地无记录,按 alias
+  // 全机 pgrep+SIGTERM,误杀同 alias 的别的 agent-node。改后:不论传没传 daemon 一律拒。
+  test("#571: stop/delete of a hand-started node refuse even with an explicit same-network daemon", async () => {
+    setupAlphaNetwork();
+    const HAND_ID = "n_571abcde";
+    const HAND_ALIAS = "sd-hand-571";
+    seedChild(NET_A, HAND_ID, HAND_ALIAS, USER_A_ID, "tok_sd_hand_571");
+    const u = buildHandlers(USER_A_ID);
+    const s = await call(u.stop_node, { child_node_id: HAND_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A });
+    expect(s.ok).toBe(false);
+    expect(s.error).toBe("not_daemon_managed");
+    expect(String(s.message)).toContain("anet node stop");
+    const d = await call(u.delete_node, { child_node_id: HAND_ID, daemon_node_id: DAEMON_A_ID, confirm_alias: HAND_ALIAS, network_id: NET_A });
+    expect(d.error).toBe("not_daemon_managed");
+    // 没有任何副作用:状态没动、没写 stop 请求行
+    expect(readNode(HAND_ID)?.lifecycle_state).toBe("active");
+    const rows = db.get<{ n: number }>(`SELECT COUNT(*) AS n FROM node_stop_requests WHERE child_node_id = ?1`, HAND_ID);
+    expect(Number(rows?.n ?? 0)).toBe(0);
+    // 回归钉:daemon 建的 child(有 create 记录)照常可停
+    db.run(
+      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
+       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
+      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
+    );
+    expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, network_id: NET_A })).ok).toBe(true);
+  });
+
   // #1448 finding-5 — delete 完成时按派发时定住的 token_id 精确撤 ntok,而非按
   // name='node:<alias>' 广撤。改前:同 alias 在 delete 未收敛窗口内被重建、拿到同名新
   // token,ack 会把新 token 一并误撤(下面 REBUILT_TOK 断言 not revoked 会红)。

package/src/tools.ts

@@ -12,7 +12,7 @@ import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js"
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
-import { addAgentNetworkScope, addNetworkScope, addOwnTrafficScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
+import { addAgentNetworkScope, addAgentTimelineScope, addNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS, type AgentRef } from "./agent-access.js";
 import { listedToolFilter, scopeToolsList, type ToolCaller } from "./tool-audience.js";
 import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_TOOL_CLASS, nodeDecide, nodeIdentity, nodePermissionDeniedBody, writeVerdict, type NodeIdentity, type Verdict } from "./node-permissions.js";
@@ -2530,7 +2530,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
       const params: any[] = [task_id];
       let sql = "SELECT * FROM tasks WHERE task_id = ?1";
-      sql = addOwnTrafficScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      sql = addAgentTimelineScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       const task = db.get<any>(sql, ...params);
       return {
         content: [{
@@ -2599,7 +2599,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       let sql = "SELECT task_id, from_node_id, from_name, to_node_id, to_name, priority, status, content, result, created_at, runtime_submitted_at, consumed_at, thread_id, turn_id, completed_at FROM tasks WHERE 1=1";
       const params: any[] = [];
-      sql = addOwnTrafficScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      sql = addAgentTimelineScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       if (alias) { sql += ` AND to_name = ?${params.length + 1}`; params.push(alias); }
       if (status) { sql += ` AND status = ?${params.length + 1}`; params.push(status); }
       if (from_name) { sql += ` AND from_name = ?${params.length + 1}`; params.push(from_name); }
@@ -2615,7 +2615,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Stats
       const statsParams: any[] = [];
       let statsSql = "SELECT status, COUNT(*) as count FROM tasks WHERE 1=1";
-      statsSql = addOwnTrafficScope(statsSql, statsParams, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
+      statsSql = addAgentTimelineScope(statsSql, statsParams, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       statsSql += " GROUP BY status";
       const stats = db.all(statsSql, ...statsParams);
 
@@ -4698,7 +4698,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           ok: false, error: "not_daemon_managed",
           message:
             `node ${child_node_id} was not created by a daemon (it was started by hand with ` +
-            `\`anet node start\` on some machine), so no daemon on the Hub can stop it. ` +
+            `\`anet node start\` on some machine), so no daemon on the Hub can stop it ` +
+            `(naming a daemon_node_id does not change that). ` +
             `Run \`anet node stop <alias>\` on that machine instead. ` +
             `Daemon-created children have ids beginning with \`node_\`; this one does not.`,
         };
@@ -4826,6 +4827,16 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     // authority==null(create 记录被裁剪的旧 child)加拒,避免给它们的 stop/delete 引入
     // 新失败面——handler 的 daemon_node_id??resolveDaemonForChild 已兜住无法解析的情形。
     const authoritativeDaemonId = resolveDaemonForChild(args.child_node_id);
+    // #571 — 手工起的节点(id 不以 `node_` 开头)**没有**任何 daemon 链接。此前
+    // authority==null 时放行调用方点名的任意同网 daemon → 门铃发给那台 daemon,
+    // 它本地没这个 child 的记录,会走「按 alias 全机 pgrep + SIGTERM」的收敛分支,
+    // 杀掉那台机器上所有同 alias 的 agent-node(不分工作目录/HOME/网络)。
+    // 对 hand-started 节点这条路在概念上就不成立(见 explainUnresolvableDaemon ①),
+    // 所以不管调用方传没传 daemon_node_id 一律拒。`node_` 开头但缺 create 记录的
+    // (②,显式传 daemon 是文档化的出路)保持原行为。
+    if (!authoritativeDaemonId && !args.child_node_id.startsWith("node_")) {
+      return explainUnresolvableDaemon(args.child_node_id);
+    }
     if (authoritativeDaemonId && authoritativeDaemonId !== args.daemon_node_id) {
       return { ok: false, error: "daemon_child_mismatch", message: "daemon_node_id is not this child's authoritative creator daemon" };
     }