@sleep2agi/commhub-server 0.9.0-preview.105 → 0.9.0-preview.107

package/src/node-daemon-bindings.ts

@@ -0,0 +1,130 @@
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { pushEvent } from "./push.js";
+import { canRestWriteNetwork } from "./network-scope.js";
+import { parseDbTimestampMs } from "./db-timestamp.js";
+
+type Node = { node_id: string; alias: string; network_id: string; owner_user_id: string | null; hostname: string | null; config_snapshot: string | null };
+type Binding = { request_id: string; network_id: string; node_id: string; daemon_node_id: string; workdir: string; requested_by: string; status: string; error: string | null };
+type Human = { userId?: string | null; networkId?: string | null; isNode: boolean; canWrite: (networkId: string) => boolean };
+type Daemon = { ok: true; daemonNodeId: string; networkId: string } | { ok: false; error: string };
+const fail = (error: string) => ({ ok: false as const, error });
+const snapshot = (node: Node) => {
+  try { const value = JSON.parse(node.config_snapshot || "{}"); return value && typeof value === "object" && !Array.isArray(value) ? value : {}; }
+  catch { return {}; }
+};
+
+export function createdDaemon(nodeId: string): string | null {
+  if (!nodeId.startsWith("node_")) return null;
+  return db.get<{ daemon_node_id: string }>("SELECT daemon_node_id FROM node_create_requests WHERE request_id=?1", `cr_${nodeId.slice(5)}`)?.daemon_node_id ?? null;
+}
+export function activeBinding(nodeId: string): Binding | null {
+  return db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status='active'", nodeId);
+}
+export function resolveManagedDaemon(nodeId: string): string | null {
+  return createdDaemon(nodeId) ?? activeBinding(nodeId)?.daemon_node_id ?? null;
+}
+function humanNode(ctx: Human, nodeId: string): Node | null {
+  if (ctx.isNode || !ctx.userId) return null;
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", nodeId);
+  if (!node || (ctx.networkId && ctx.networkId !== node.network_id) || !ctx.canWrite(node.network_id)) return null;
+  const role = getUserNetworkRole(ctx.userId, node.network_id);
+  return node.owner_user_id === ctx.userId || role === "owner" || role === "admin" ? node : null;
+}
+function audit(binding: Binding, action: string, actor: string) {
+  db.run(`INSERT INTO audit_log(user_id,action,target_type,target_id,detail,network_id)
+    VALUES(?1,?2,'node_daemon_binding',?3,?4,?5)`,
+  [actor, action, binding.request_id, JSON.stringify({ node_id: binding.node_id, daemon_node_id: binding.daemon_node_id }), binding.network_id]);
+}
+function daemonReady(daemon: Node | null, node: Node): string | null {
+  if (!daemon || daemon.network_id !== node.network_id) return "daemon_not_found";
+  const snap = snapshot(daemon);
+  if (snap.role !== "host_supervisor" || snap.daemon_capabilities?.adopt_capable !== true) return "daemon_not_adopt_capable";
+  if (!node.hostname || daemon.hostname !== node.hostname) return "hostname_mismatch";
+  const session = db.get<{ last_seen_at: string }>(`SELECT last_seen_at FROM sessions WHERE alias=?1 AND network_id=?2`, daemon.alias, daemon.network_id);
+  const seen = parseDbTimestampMs(session?.last_seen_at ?? "");
+  if (!Number.isFinite(seen) || Date.now() - seen > 300_000) return "daemon_offline";
+  const token = db.get(`SELECT token_id FROM api_tokens WHERE name=?1 AND network_id=?2 AND revoked_at IS NULL`, `node:${daemon.alias}`, daemon.network_id);
+  return token ? null : "daemon_offline";
+}
+
+export function requestAdopt(ctx: Human, args: { node_id: string; daemon_node_id: string; workdir: string }) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, args.node_id);
+  if (!node) return fail("adopt_forbidden");
+  if (snapshot(node).role === "host_supervisor") return fail("cannot_adopt_daemon");
+  if (createdDaemon(node.node_id)) return fail("node_already_managed");
+  if (!args.workdir.trim() || /[\x00-\x1f]/.test(args.workdir)) return fail("invalid_workdir");
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", args.daemon_node_id);
+  const refused = daemonReady(daemon, node);
+  if (refused) return fail(refused);
+  const now = Date.now();
+  const binding: Binding = { ...args, request_id: `adopt_${uuidv4()}`, network_id: node.network_id, requested_by: ctx.userId, status: "pending", error: null };
+  const inserted = db.transaction(() => {
+    const result = db.run(`INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at)
+      VALUES(?1,?2,?3,?4,?5,?6,'pending',?7,?7) ON CONFLICT DO NOTHING`,
+    [binding.request_id, binding.network_id, node.node_id, args.daemon_node_id, args.workdir, ctx.userId, now]);
+    if (!result.changes) return false;
+    audit(binding, node.owner_user_id === ctx.userId ? "adopt_requested" : "adopt_by_admin", ctx.userId!);
+    return true;
+  });
+  if (!inserted) return fail("node_already_managed");
+  pushEvent(daemon!.alias, { type: "adopt_node", request_id: binding.request_id }, node.network_id);
+  return { ok: true, request_id: binding.request_id, status: "pending" };
+}
+
+function daemonBinding(caller: Daemon, requestId: string): Binding | null {
+  if (!caller.ok) return null;
+  return db.get<Binding>(`SELECT * FROM node_daemon_bindings WHERE request_id=?1 AND daemon_node_id=?2 AND network_id=?3`, requestId, caller.daemonNodeId, caller.networkId);
+}
+export function getAdopt(caller: Daemon, requestId: string) {
+  if (!caller.ok) return fail(caller.error);
+  const binding = daemonBinding(caller, requestId);
+  if (!binding) return fail("request_not_found");
+  if (binding.status !== "pending") return fail("request_not_pending");
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.node_id, binding.network_id);
+  if (!node) return fail("node_not_found");
+  return { ok: true, ...binding, alias: node.alias };
+}
+export function ackAdopt(caller: Daemon, args: { request_id: string; status: "adopted" | "refused"; error?: string }) {
+  if (!caller.ok) return fail(caller.error);
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const binding = daemonBinding(caller, args.request_id);
+  if (!binding) return fail("request_not_found");
+  return db.transaction(() => {
+    // Ownership/membership can change while local verification is in flight.
+    if (args.status === "adopted") {
+      const requester: Human = { userId: binding.requested_by, networkId: binding.network_id, isNode: false,
+        canWrite: networkId => canRestWriteNetwork({ userId: binding.requested_by, networkId: null }, networkId, false) };
+      const node = humanNode(requester, binding.node_id);
+      if (!node || createdDaemon(binding.node_id)) return fail("adopt_forbidden");
+      const refusal = daemonReady(db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", binding.daemon_node_id), node);
+      if (refusal) return fail(refusal);
+    }
+    const changed = db.run(`UPDATE node_daemon_bindings SET status=?1,error=?2,updated_at=?3 WHERE request_id=?4 AND status='pending'`,
+      [args.status === "adopted" ? "active" : "refused", args.error ?? null, Date.now(), args.request_id]);
+    if (!changed.changes) return fail("request_not_pending");
+    audit(binding, `adopt_${args.status}`, caller.daemonNodeId);
+    return { ok: true, status: args.status === "adopted" ? "active" : "refused" };
+  });
+}
+export function unadopt(ctx: Human, nodeId: string) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, nodeId);
+  if (!node) return fail("adopt_forbidden");
+  const binding = db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status IN ('pending','active')", nodeId);
+  if (!binding) return fail("binding_not_found");
+  // Do not reassign authority while a daemon may already be executing a lifecycle command.
+  for (const table of ["node_stop_requests", "node_start_requests"]) {
+    if (db.get(`SELECT request_id FROM ${table} WHERE child_node_id=?1 AND network_id=?2 AND status IN ('pending','delivered')`, nodeId, node.network_id)) return fail("node_lifecycle_in_flight");
+  }
+  db.transaction(() => {
+    db.run("UPDATE node_daemon_bindings SET status='revoked',updated_at=?1 WHERE request_id=?2", [Date.now(), binding.request_id]);
+    audit(binding, "unadopted", ctx.userId!);
+  });
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.daemon_node_id, node.network_id);
+  if (daemon) pushEvent(daemon.alias, { type: "unadopt_node", node_id: nodeId, request_id: binding.request_id }, node.network_id);
+  return { ok: true, status: "revoked" };
+}

package/src/node-health-codex-login.test.ts

@@ -0,0 +1,120 @@
+// #594 step 1 — report_status.health.codex_login (non-secret codex login fingerprint +
+// "shared with N other nodes on this host"). Additive on the #448 health channel.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/node-health-codex-login.db bun test src/node-health-codex-login.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { clearNodeHealthStore, readNodeHealth } from "./node-health-store.js";
+import { degradedLayers } from "./node-health-guard.js";
+
+const NET = "net_health_codex_login_t";
+const OWNER = "u_hcl_owner";
+const NODE_A = "hcl-node-a";
+const NODE_B = "hcl-node-b";
+const NODE_A_ID = "node_hcl_a";
+const NODE_B_ID = "node_hcl_b";
+const T_A = "tok_hcl_node_a";
+const T_B = "tok_hcl_node_b";
+
+function cleanup() {
+  for (const t of ["sessions", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [OWNER]); } catch {}
+  clearNodeHealthStore();
+}
+function seed() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [OWNER, OWNER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET, NET, OWNER]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [OWNER, NET]);
+  for (const [id, alias, tok] of [[NODE_A_ID, NODE_A, T_A], [NODE_B_ID, NODE_B, T_B]]) {
+    db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'))`, [id, alias, alias, NET, OWNER]);
+    db.run(`INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`, [tok, OWNER, NET, `node:${alias}`, `hash_${tok}`, id]);
+  }
+}
+
+async function connectAs(alias: string, tokenId: string) {
+  const server = new McpServer({ name: "health-test", version: "1" });
+  registerTools(server, undefined, NET, OWNER, alias, true, tokenId);
+  const client = new Client({ name: "health-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name: "report_status", arguments: args });
+    return { isError: r.isError === true, body: JSON.parse(r.content?.[0]?.text ?? "null") };
+  };
+  return { call, close: async () => { await client.close(); await server.close(); } };
+}
+
+const LOGIN = { fingerprint: "1a2b3c4d", shared_with: 2, shared_home_with: 1, codex_home: "/srv/ws/.anet/nodes/a/codex-home" };
+
+beforeEach(() => { cleanup(); seed(); });
+afterAll(cleanup);
+
+describe("#594 report_status.health.codex_login passthrough", () => {
+  test("well-formed codex_login is kept next to the #448 layers and readable", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { bridge: "ok", model_auth: "ok", codex_login: LOGIN } });
+      expect(r.isError).toBe(false);
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual(LOGIN);
+  });
+
+  test("codex_login alone (codex-sdk runtime, no #448 monitor) is accepted", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: { fingerprint: "deadbeef", shared_with: 0 } } });
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual({ fingerprint: "deadbeef", shared_with: 0 });
+  });
+
+  test("🔴 a shared login is NOT a degraded layer — dispatch must not refuse because of it", () => {
+    expect(degradedLayers({ bridge: "ok", model_auth: "ok", codex_login: LOGIN } as any)).toEqual([]);
+  });
+
+  test("🔴 anything that is not an 8-hex fingerprint is dropped (a token pasted there never gets stored), report still accepted", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    const bads = [
+      { fingerprint: "FAKE-REFRESH-TOKEN-should-never-be-stored", shared_with: 1 },
+      { fingerprint: "a".repeat(64), shared_with: 1 },
+      { fingerprint: "1A2B3C4D", shared_with: 1 },
+      { fingerprint: "1a2b3c4d", shared_with: -1 },
+      { fingerprint: "1a2b3c4d", shared_with: 1.5 },
+      { fingerprint: "1a2b3c4d" },
+      "1a2b3c4d",
+    ];
+    try {
+      for (const bad of bads) {
+        const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { bridge: "ok", model_auth: "ok", codex_login: bad } });
+        expect(r.isError).toBe(false);
+        const h = readNodeHealth(NET, NODE_A)?.health;
+        expect(h?.model_auth).toBe("ok");
+        expect(h?.codex_login).toBeUndefined();
+        expect(JSON.stringify(h)).not.toContain("FAKE-REFRESH-TOKEN");
+      }
+    } finally { await a.close(); }
+    expect(db.get<{ s: string }>("SELECT status AS s FROM sessions WHERE alias = ?1 AND network_id = ?2", NODE_A, NET)?.s).toBe("idle");
+  });
+
+  test("bad optional sub-fields degrade alone: control characters in codex_home are dropped, the rest kept", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: { fingerprint: "1a2b3c4d", shared_with: 1, shared_home_with: "x", codex_home: "/x\n; rm -rf /" } } });
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual({ fingerprint: "1a2b3c4d", shared_with: 1 });
+  });
+
+  test("another node's token cannot set this node's codex_login", async () => {
+    const b = await connectAs(NODE_B, T_B);
+    try {
+      await b.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: LOGIN } });
+    } finally { await b.close(); }
+    expect(readNodeHealth(NET, NODE_A)).toBeNull();
+  });
+});

package/src/node-health-store.ts

@@ -27,9 +27,35 @@ export const nodeHealthSchema = z.object({
     reason: z.string().max(40),
   }).optional().catch(undefined),
   model_auth: z.enum(["ok", "revoked", "expired", "unknown"]).optional().catch(undefined),
+  // #594 —— codex 节点的登录指纹 + 本机另有几台节点持有同一份登录(见下方 codexLoginSchema)。
+  // 🔴 线上 schema 故意是 unknown:report_status 的 JSON schema 每个节点每次 tools/list 都要下发,
+  //    #476 给它定了字节上限(tool-audience-http.test.ts)。严格校验在 recordNodeHealth 里做,效果相同:
+  //    不合规 → 这一格当没报,整份 report 照收。
+  codex_login: z.unknown().optional(),
 }).optional().catch(undefined);
 
-export type NodeHealth = NonNullable<z.infer<typeof nodeHealthSchema>>;
+// #594 —— health.codex_login 的严格形状。纯展示/提示,**不是** degraded 层:共用登录今天还能跑,
+// 只是迟早互相顶掉(#1918);派发不因它拒绝。fingerprint 必须是 8 位小写 hex(sha256(refresh_token)
+// 截断,不是凭据)—— 节点误把 token 塞进来也存不下;计数是小的非负整数;codex_home 是节点自己的路径
+// (给客户端拼 `CODEX_HOME=<codex_home> codex login --device-auth`),拒控制字符。
+// 可选格各自降级;必需格(fingerprint / shared_with)不合规 → 整格丢弃。
+export const codexLoginSchema = z.object({
+  fingerprint: z.string().regex(/^[0-9a-f]{8}$/),
+  shared_with: z.number().int().min(0).max(100_000),
+  shared_home_with: z.number().int().min(0).max(100_000).optional().catch(undefined),
+  codex_home: z.string().max(1024).regex(/^[^\u0000-\u001f\u007f]*$/).optional().catch(undefined),
+});
+export type CodexLoginHealth = z.infer<typeof codexLoginSchema>;
+
+export type NodeHealth = Omit<NonNullable<z.infer<typeof nodeHealthSchema>>, "codex_login"> & { codex_login?: CodexLoginHealth };
+
+/** 线上收到的 health → 存的那份:codex_login 按严格形状过一遍,不合规就去掉这一格。 */
+export function normalizeNodeHealth(raw: NonNullable<z.infer<typeof nodeHealthSchema>>): NodeHealth {
+  const { codex_login: rawLogin, ...rest } = raw;
+  if (rawLogin === undefined) return rest;
+  const parsed = codexLoginSchema.safeParse(rawLogin);
+  return parsed.success ? { ...rest, codex_login: parsed.data } : rest;
+}
 
 const store = new Map<string, { health: NodeHealth; at: number }>();
 const keyOf = (networkId: string | null | undefined, alias: string) => `${networkId ?? "default"}\0${alias}`;
@@ -48,9 +74,12 @@ export function nodeHealthNextExpiryAt(now = Date.now()): number {
   return next;
 }
 
-export function recordNodeHealth(networkId: string | null | undefined, alias: string, health: NodeHealth, now = Date.now()): void {
+export function recordNodeHealth(
+  networkId: string | null | undefined, alias: string,
+  health: NodeHealth | NonNullable<z.infer<typeof nodeHealthSchema>>, now = Date.now(),
+): void {
   version++;
-  store.set(keyOf(networkId, alias), { health, at: now });
+  store.set(keyOf(networkId, alias), { health: normalizeNodeHealth(health), at: now });
   // 有界:按 TTL 顺手清掉过期的,别让改过名/删掉的节点在内存里攒着。
   if (store.size > 256) {
     for (const [k, v] of store) if (now - v.at > NODE_HEALTH_TTL_MS) store.delete(k);

package/src/node-id-alias.test.ts

@@ -168,7 +168,9 @@ describe("app#196 —— 「解析不到 daemon」的两种情况必须给不同
     const r = await call("stop_node", { node_id: DAEMON_CHILD });
     expect(r.ok).toBe(false);
     expect(r.error).toBe("daemon_not_resolvable");
-    expect(r.message).toContain("pass daemon_node_id explicitly");
+    // Board #625: an explicit daemon id no longer substitutes for authority.
+    expect(r.message).not.toContain("pass daemon_node_id explicitly");
+    expect(r.message).toContain("adopt this node");
   });
 
   test("delete_node 走同一条判别(两个调用点不能只改一个)", async () => {

package/src/node-lifecycle-controllable.ts

@@ -24,8 +24,10 @@ export function childNodeIdForCreateRequest(requestId: unknown): string | null {
 /** 由创建记录建出「child node_id → daemon node_id」的映射。 */
 export function buildControllableMap(
   createRequests: Array<{ request_id?: unknown; daemon_node_id?: unknown }>,
+  bindings: Array<{ node_id: string; daemon_node_id: string }> = [],
 ): Map<string, string> {
   const m = new Map<string, string>();
+  for (const binding of bindings) m.set(binding.node_id, binding.daemon_node_id);
   for (const cr of createRequests) {
     const child = childNodeIdForCreateRequest(cr?.request_id);
     if (!child) continue;

package/src/node-permissions.ts

@@ -220,6 +220,8 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   get_create_request: "always", ack_create_request: "always", get_stop_request: "always", ack_stop_request: "always",
   get_start_request: "always", ack_start_request: "always", get_probe_request: "always", ack_probe_request: "always",
   list_my_pending_create_requests: "always", list_my_pending_lifecycle_requests: "always", list_my_children: "always",
+  request_adopt_node: "human_only", unadopt_node: "human_only",
+  get_adopt_request: "always", ack_adopt_request: "always",
   send_desktop_message: "always", // 发给人的私信,不是派活
   // 读
   get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read",

package/src/runtime-readiness.ts

@@ -0,0 +1,83 @@
+// #622 —— daemon 逐 runtime 自检结果(`config_snapshot.daemon_capabilities.runtime_readiness`)。
+//
+// 上报侧:agent-node/src/runtime/runtime-readiness.ts。这里两件事:
+//   1. report_status 的 zod 形状 —— **收得宽**:任何一格坏都只丢这一格(或整个
+//      runtime_readiness),绝不拒掉整份 report(同 create_capability_observed_ms_ago
+//      的教训:zod 对象里一个已知字段验证失败 = 整份被拒 = 节点在 hub 上失联)。
+//   2. /api/host-supervisors 读取时再消毒一次(库里可能存着任何旧形状)。
+//
+// 向后兼容:旧 daemon 不报 ⇒ 响应里**没有**这个键(不是 {}、不是 null)。
+
+import { z } from "zod/v4";
+
+export const READINESS_STATES = ["ready", "missing_cli", "not_logged_in", "no_network", "unknown"] as const;
+export type ReadinessState = typeof READINESS_STATES[number];
+
+const MAX_RUNTIMES = 16;
+const MAX_REASON = 600;
+
+const MAX_JSON_BYTES = 16 * 1024;
+
+/** report_status 里 `daemon_capabilities.runtime_readiness` 的 schema。永不拒整份 report。
+ *
+ *  🔴 故意只验外形(对象、键数、总字节),逐格消毒放在读取侧 `sanitizeRuntimeReadiness`:
+ *     这份 schema 会进每个节点的 `tools/list`(#476 按角色的字节天花板),逐字段声明
+ *     一遍要多花 ~500 B;而读取侧本来就必须再消毒一次(库里可能存着任何旧形状)。
+ *     总字节上限挡住一个异常 daemon 往库里塞大对象。 */
+export const runtimeReadinessSchema = z
+  .record(z.string().max(64), z.record(z.string(), z.unknown()))
+  .refine((r) => Object.keys(r).length <= MAX_RUNTIMES && JSON.stringify(r).length <= MAX_JSON_BYTES)
+  .optional()
+  .catch(undefined);
+
+export interface RuntimeReadinessOut {
+  ok: boolean;
+  state: ReadinessState;
+  reason: string;
+  version?: string;
+  checked_at?: string;
+  cli?: string;
+  auth?: string;
+  network?: string;
+  shared_login_count?: number;
+}
+
+const ENUMS: Record<string, readonly string[]> = {
+  cli: ["found", "missing", "bundled", "unknown"],
+  auth: ["present", "absent", "not_required", "unknown"],
+  network: ["reachable", "unreachable", "skipped"],
+};
+
+/** 读取侧消毒。返回 undefined 表示「daemon 没报」—— 调用方据此**不输出**这个键。 */
+export function sanitizeRuntimeReadiness(raw: unknown): Record<string, RuntimeReadinessOut> | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const out: Record<string, RuntimeReadinessOut> = {};
+  let n = 0;
+  for (const [rt, v] of Object.entries(raw as Record<string, unknown>)) {
+    if (n >= MAX_RUNTIMES) break;
+    if (typeof rt !== "string" || rt.length === 0 || rt.length > 64) continue;
+    if (!v || typeof v !== "object" || Array.isArray(v)) continue;
+    const e = v as Record<string, unknown>;
+    const state: ReadinessState = (READINESS_STATES as readonly string[]).includes(e.state as string)
+      ? e.state as ReadinessState
+      : "unknown";
+    const entry: RuntimeReadinessOut = {
+      // ok 只在 state=ready 时可能为真:不让一个自相矛盾的上报朝「没问题」方向错。
+      ok: e.ok === true && state === "ready",
+      state,
+      reason: typeof e.reason === "string" ? e.reason.slice(0, MAX_REASON) : "",
+    };
+    if (typeof e.version === "string" && e.version.length > 0) entry.version = e.version.slice(0, 64);
+    if (typeof e.checked_at === "string" && e.checked_at.length > 0) entry.checked_at = e.checked_at.slice(0, 40);
+    for (const k of ["cli", "auth", "network"] as const) {
+      if (typeof e[k] === "string" && ENUMS[k].includes(e[k] as string)) entry[k] = e[k] as string;
+    }
+    if (typeof e.shared_login_count === "number" && Number.isInteger(e.shared_login_count)
+        && e.shared_login_count >= 0 && e.shared_login_count <= 100_000) {
+      entry.shared_login_count = e.shared_login_count;
+    }
+    out[rt] = entry;
+    n++;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}

package/src/server.ts

@@ -1,4 +1,5 @@
 import { buildServeErrorResponse } from "./serve-error.js";
+import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
 import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { ifNoneMatchHits, memoStatusBody } from "./status-read-cache";
 import { dispatchQueueInfo, queueDepthByNode, queueDepthKey } from "./task-queue-ahead.js";
@@ -4474,6 +4475,7 @@ return Bun.serve({
           // 🔴 不是 clamp 成边界值:clamp 会把一个坏值变成一个**看起来正常的年龄**,
           //    而这一格存在的全部意义就是让人分辨新鲜和陈旧。
           let snapObservedMsAgo: number | undefined;
+          let snapReadiness: ReturnType<typeof sanitizeRuntimeReadiness>;
           if (r.config_snapshot) {
             try {
               const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
@@ -4491,13 +4493,15 @@ return Bun.serve({
                   && rawAge >= 0 && rawAge <= 365 * 24 * 60 * 60 * 1000) {
                 snapObservedMsAgo = rawAge;
               }
+              // #622 —— 逐 runtime 就绪度;旧 daemon 不报 ⇒ undefined ⇒ 响应里没有这个键。
+              snapReadiness = sanitizeRuntimeReadiness(caps?.runtime_readiness);
             } catch { /* malformed */ }
           }
           return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
-            observedMsAgo: snapObservedMsAgo };
+            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason, observedMsAgo }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -4562,6 +4566,10 @@ return Bun.serve({
               out.create_capability_observed_ms_ago = observedMsAgo;
             }
           }
+          // #622 —— 逐 runtime 实测就绪度(CLI / 登录存在性 / 网络 / codex 共享登录数)。
+          // 只在 daemon 真的报了时出现;**不影响** can_create_nodes(旧 app 依赖它的语义)。
+          // 内容不含路径与凭据(上报侧只发存在性 + 版本号 + 通用修法),所以不按角色脱敏。
+          if (readiness) out.runtime_readiness = readiness;
           // app「新建节点」确认页的默认工作目录根。出现即表示该 daemon 认 node_spec.workdir;
           // 缺席(老 daemon / 老 hub 的 zod 剥掉了它)时 app 藏起那一行、不发 workdir。
           // 🔴 它是那台机器的家目录路径 —— 与 ip_internal 同级,只给 admin/owner。
@@ -4628,7 +4636,10 @@ return Bun.serve({
           const crParams: any[] = [];
           let crSql = "SELECT request_id, daemon_node_id FROM node_create_requests WHERE 1=1";
           crSql = addNetworkScope(crSql, crParams, restScope);
-          return buildControllableMap(db.all<Record<string, any>>(crSql, ...crParams));
+          const bindingParams: any[] = [];
+          const bindingSql = addNetworkScope("SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE status='active'", bindingParams, restScope);
+          return buildControllableMap(db.all<Record<string, any>>(crSql, ...crParams),
+            db.all<{ node_id: string; daemon_node_id: string }>(bindingSql, ...bindingParams));
         } catch {
           // 表不存在/查询失败 ⇒ 全部按不可控处理,不让这一格拖垮整个列表
           return new Map<string, string>();

package/src/stop-delete-node.test.ts

@@ -184,6 +184,12 @@ function setupAlphaNetwork() {
   seedMembership(USER_A_ID, NET_A, "admin");
   seedDaemon(NET_A, DAEMON_A_ID, DAEMON_A_ALIAS, USER_A_ID, DAEMON_A_TOK);
   seedChild(NET_A, CHILD_A_ID, CHILD_A_ALIAS, USER_A_ID, CHILD_TOK_A_ID);
+  // Board #625: happy paths must carry actual creation authority, not merely a node_ id.
+  db.run(
+    `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
+     VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
+    [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
+  );
 }
 
 // ── stop_node ──────────────────────────────────────────────────────
@@ -418,12 +424,7 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
   // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。
   test("#1448 finding-4: stop/delete reject a wrong same-network daemon_node_id (daemon_child_mismatch)", async () => {
     setupAlphaNetwork();
-    // authority: CHILD_A 由 DAEMON_A 创建(resolveDaemonForChild 读 node_create_requests)
-    db.run(
-      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
-       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
-      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
-    );
+    // setupAlphaNetwork carries the creation authority.
     // 一个同网、存在、但没创建 CHILD_A 的 daemon
     const DAEMON_B = "node_sd_daemon_b";
     seedDaemon(NET_A, DAEMON_B, "sd-daemon-b", USER_A_ID, "tok_sd_daemon_b");
@@ -454,12 +455,7 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(readNode(HAND_ID)?.lifecycle_state).toBe("active");
     const rows = db.get<{ n: number }>(`SELECT COUNT(*) AS n FROM node_stop_requests WHERE child_node_id = ?1`, HAND_ID);
     expect(Number(rows?.n ?? 0)).toBe(0);
-    // 回归钉:daemon 建的 child(有 create 记录)照常可停
-    db.run(
-      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
-       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
-      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
-    );
+    // 回归钉:setupAlphaNetwork 中有 create 记录的 child 照常可停。
     expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, network_id: NET_A })).ok).toBe(true);
   });
 

package/src/tool-audience-http.test.ts

@@ -182,7 +182,9 @@ describe("what each caller sees", () => {
 describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // 全部工具(= 改动前每个调用者拿到的)71–72 KB;改动后按角色。改数字时在 PR 里写为什么。
   // 量出来(#478 合入时):全部 74 个工具 71,559 B;节点 52 个 57,632 B(−19%);人 56 个 54,780 B(−23%)。留 ~1.5 KB 余量。
-  const CEILINGS = { node: 59_000, user: 56_500, all: 72_500 } as const;
+  // Board #625 adds 2 human tools + 2 hidden daemon protocol tools. Measured:
+  // all 78 / 73,969 B; user 58 / 56,615 B; node remains 52 / 58,320 B.
+  const CEILINGS = { node: 59_000, user: 57_500, all: 75_000 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -23,6 +23,8 @@ import { NODE_TOOL_CLASS, nodeIdentity, nodePermissionsFlag, broadcastVerdict, h
 export type ToolAudience = "both" | "node" | "protocol" | "user";
 
 export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
+  request_adopt_node: "user", unadopt_node: "user",
+  get_adopt_request: "protocol", ack_adopt_request: "protocol",
   // ── 节点:用户令牌一律 network_token_required ──
   report_status: "node",
   // ── 协议:用户令牌一律 network_token_required / node_token_required / caller_not_a_daemon ──