@sleep2agi/commhub-server 0.9.0-preview.108 → 0.9.0-preview.110

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.108",
+  "version": "0.9.0-preview.110",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/create-node-unicode-name.test.ts

@@ -0,0 +1,118 @@
+// Board #652 — create_node takes Chinese / Unicode node names (the alias); illegal
+// characters are refused with a reason before any row is written; the in-flight
+// uniqueness check still holds. Driven through the REAL /mcp entry (zod schema +
+// handler) on a private port with a temp DB, then get_create_request as the daemon.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-652-"));
+process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+process.env.HOST = "127.0.0.1";
+
+const { db } = await import("./db.js");
+const { register, createNetworkTokenForNode } = await import("./auth.js");
+
+const PW = "Unicode652Passw0rd!x";
+let BASE = "";
+let hub: any = null;
+let OWNER = "";
+let OWNER_ID = "";
+let NET = "";
+let DAEMON_TOK = "";
+const DAEMON_ID = "node_t652_daemon";
+
+async function rpc(token: string, method: string, params?: unknown): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, ...(params === undefined ? {} : { params }) }),
+  });
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  return lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+}
+async function mcp(token: string, name: string, args: Record<string, unknown>): Promise<any> {
+  const out = await rpc(token, "tools/call", { name, arguments: args });
+  const text = out?.result?.content?.[0]?.text;
+  if (typeof text !== "string") return { _raw: out };
+  try { return JSON.parse(text); } catch { return { _text: text, isError: out.result.isError }; }
+}
+const create = (name: string) => mcp(OWNER, "create_node", {
+  daemon_node_id: DAEMON_ID, network_id: NET,
+  node_spec: { name, runtime: "claude-agent-sdk", model: "claude-sonnet-4-5", flags: {} },
+});
+const rows = (name: string) =>
+  db.get<{ n: number }>("SELECT COUNT(*) AS n FROM node_create_requests WHERE daemon_node_id = ?1 AND child_name = ?2", DAEMON_ID, name)?.n ?? -1;
+
+beforeAll(async () => {
+  const a = register(`t652_owner_${Date.now()}`, PW, undefined, "Owner");
+  if (!a.ok) throw new Error("register failed");
+  OWNER = a.token!; OWNER_ID = a.user!.user_id; NET = a.network_id!;
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const t = createNetworkTokenForNode(OWNER_ID, NET, "t652-daemon", DAEMON_ID);
+  if (!t.ok || !t.token) throw new Error("daemon token failed: " + t.error);
+  DAEMON_TOK = t.token;
+  db.run(
+    `INSERT OR REPLACE INTO nodes (node_id, node_name, alias, runtime, model, config_path, channels, server, hostname, network_id, config_revision, config_snapshot)
+     VALUES (?1, 't652-daemon', 't652-daemon', 'claude-agent-sdk', 'm', '/tmp/cfg.json', '[]', 'h', 'h', ?2, 0, ?3)`,
+    [DAEMON_ID, NET, JSON.stringify({ role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"] } })],
+  );
+});
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  rmSync(DIR, { recursive: true, force: true });
+});
+
+describe("#652 create_node via /mcp — Unicode names", () => {
+  test("「测试」 is accepted; the daemon gets the same alias", async () => {
+    const r = await create("测试");
+    expect(r.ok).toBe(true);
+    expect(String(r.request_id)).toMatch(/^cr_/);
+    expect(rows("测试")).toBe(1);
+    const g = await mcp(DAEMON_TOK, "get_create_request", { request_id: r.request_id });
+    expect(g.ok).toBe(true);
+    expect(g.node_spec.name).toBe("测试");
+  });
+
+  test("upper case / digit-first ASCII and 64 CJK characters pass the zod bound and the rule", async () => {
+    for (const name of ["研发助手A", "Demo2", "9lives", "测".repeat(64)]) {
+      const r = await create(name);
+      expect({ name, ok: r.ok, error: r.error }).toEqual({ name, ok: true, error: undefined });
+    }
+  });
+
+  test("surrounding whitespace is trimmed before it is stored", async () => {
+    const r = await create("  前后空格  ");
+    expect(r.ok).toBe(true);
+    expect(rows("前后空格")).toBe(1);
+    expect(rows("  前后空格  ")).toBe(0);
+  });
+
+  test("illegal characters are refused with reason + char + message, and no row is written", async () => {
+    for (const [name, reason] of [["a/b", "forbidden_char"], ["a\\b", "forbidden_char"], ["a:b", "forbidden_char"],
+      [".hidden", "forbidden_char"], ["..", "forbidden_char"], ["a b", "forbidden_char"], ["a\u0007b", "forbidden_char"],
+      ["-x", "leading_dash"], ["测".repeat(65), "too_long"]] as const) {
+      const r = await create(name);
+      expect({ name, error: r.error, reason: r.reason }).toEqual({ name, error: "node_name_invalid", reason });
+      expect(String(r.message ?? "").length).toBeGreaterThan(0);
+      expect(rows(name)).toBe(0);
+    }
+    const slash = await create("a/b");
+    expect(slash.char).toBe("/");
+    expect(slash.message).toContain("/");
+  });
+
+  test("uniqueness: a second in-flight request for the same Chinese name is a conflict", async () => {
+    const first = await create("重复名字");
+    expect(first.ok).toBe(true);
+    const second = await create("重复名字");
+    expect(second.ok).toBe(false);
+    expect(second.error).toBe("node_name_conflict");
+    expect(rows("重复名字")).toBe(1);
+  });
+});

package/src/create-node-validate.test.ts

@@ -9,17 +9,31 @@ import {
 const okSecret = (k: string, _net: string, key: string) => k === key ? `value-of-${k}` : undefined;
 const allow = (k: string) => new Set<string>([k, "ANTHROPIC_API_KEY", "OPENAI_API_KEY"]);
 
-describe("validateName (§4.2.2)", () => {
-  test("good names", () => {
-    for (const n of ["a", "demo-bot", "node_1", "z2", "abc-def-ghi"]) {
+describe("validateName (§4.2.2, #652 Unicode names)", () => {
+  test("good names — incl. Chinese, upper case, digits first", () => {
+    for (const n of ["a", "demo-bot", "node_1", "z2", "abc-def-ghi", "测试", "研发助手A", "Demo", "1demo", "测".repeat(64)]) {
       expect(() => validateName(n)).not.toThrow();
     }
   });
-  test("rejects shell-injection-like names", () => {
-    for (const n of [";rm -rf /", "demo bot", "Demo", "1demo", "-demo", "demo;rm", "demo$INJECT", "x".repeat(65)]) {
+  test("returns the trimmed name", () => {
+    expect(validateName("  测试 ")).toBe("测试");
+  });
+  test("rejects shell-injection-like and path-like names with a reason", () => {
+    for (const n of [";rm -rf /", "demo bot", "-demo", "demo;rm", "demo$INJECT", "x".repeat(65), "测".repeat(65),
+      "a/b", "a\\b", "a:b", ".hidden", "..", "a\u0000b", "a`id`", "", "   "]) {
       expect(() => validateName(n)).toThrow(ValidationError);
     }
   });
+  test("error carries reason + offending char + a readable message", () => {
+    try { validateName("a/b"); throw new Error("no throw"); }
+    catch (e: any) {
+      expect(e).toBeInstanceOf(ValidationError);
+      expect(e.code).toBe("node_name_invalid");
+      expect(e.detail.reason).toBe("forbidden_char");
+      expect(e.detail.char).toBe("/");
+      expect(String(e.detail.message)).toContain("/");
+    }
+  });
 });
 
 describe("validateRuntime / validateModel (§4.2.2)", () => {

package/src/create-node-validate.ts

@@ -8,6 +8,7 @@
 // payload (RFC §4.6).
 
 import { isReservedEnvKey } from "./shared/reserved-env.js";
+import { checkNodeName } from "./shared/node-name.js";
 
 export class ValidationError extends Error {
   constructor(public code: string, public detail?: Record<string, unknown>) {
@@ -66,17 +67,26 @@ export const MAX_ENV_VALUE_BYTES = 16 * 1024;
 const ENV_KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
 
 // §4.2.2 name + model.
-const NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+// Board #652 — the name rule lives in ./shared/node-name.ts (byte-identical copy in
+// agent-node/src/shared/, drift-tested). It used to be /^[a-z][a-z0-9_-]{0,63}$/ here.
 // OpenCode 共存的模型带 provider 前缀(`opencode/mimo-v2.5-free`,agent-node parseModelRef 按第一个 `/` 切),
 // 桌面向导 0.2.61 起就发这种形状 —— 允许**恰好一个**斜杠分隔的两段;每段仍是原字符集,且不能是纯点(`..`/`.`)。
 const MODEL_SEGMENT = "[a-zA-Z0-9._:\\-]+";
 const MODEL_RE = new RegExp(`^${MODEL_SEGMENT}(?:/${MODEL_SEGMENT})?$`);
 const MODEL_DOT_ONLY_SEGMENT = /(^|\/)\.+(\/|$)/;
 
-export function validateName(s: unknown): asserts s is string {
-  if (typeof s !== "string" || !NAME_RE.test(s)) {
-    throw new ValidationError("node_name_invalid", { value: typeof s === "string" ? s.slice(0, 80) : typeof s });
+/** Board #652 — returns the normalized (trimmed) name the caller must store and forward. */
+export function validateName(s: unknown): string {
+  const r = checkNodeName(s);
+  if (!r.ok) {
+    throw new ValidationError("node_name_invalid", {
+      value: typeof s === "string" ? s.slice(0, 80) : typeof s,
+      reason: r.error,
+      ...(r.char !== undefined ? { char: r.char } : {}),
+      message: r.message,
+    });
   }
+  return r.name;
 }
 
 export function validateRuntime(s: unknown): asserts s is Runtime {

package/src/node-lifecycle-read-http.test.ts

@@ -0,0 +1,202 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const dir = mkdtempSync(join(tmpdir(), "lifecycle-read-"));
+process.env.COMMHUB_DB ||= join(dir, "hub.db");
+process.env.COMMHUB_AUTH_TOKEN ||= "lifecycle-read-master-fixture";
+let hub: ReturnType<typeof Bun.serve>, base: string;
+let db: any, a: any, b: any, limited: any, daemonToken: string;
+const ids = { active: "n_read_active", created: "node_read_created", manual: "node_read_manual", daemon: "n_read_daemon" };
+const get = async (path: string, token = a.token) => {
+  const res = await fetch(base + path, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: res.status, body: await res.json() as any };
+};
+const query = (kind: string, selector: string) => `/api/node-lifecycle-requests?kind=${kind}&${selector}`;
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const suffix = Date.now();
+  a = register(`read_owner_${suffix}`, "ReadFixture-Strong1!");
+  b = register(`read_other_${suffix}`, "ReadFixture-Strong1!");
+  limited = register(`read_limited_${suffix}`, "ReadFixture-Strong1!");
+  expect(a.ok && b.ok && limited.ok).toBe(true);
+  for (const user of [a, b, limited]) db.run("UPDATE users SET role='user' WHERE user_id=?1", [user.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role,agent_access) VALUES(?1,?2,'viewer','granted')", [a.network_id, limited.user.user_id]);
+  for (const [key, id] of Object.entries(ids)) db.run(
+    "INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot) VALUES(?1,?2,?2,?3,?4,'fixture-host',?5)",
+    [id, `read-${key}`, a.network_id, a.user.user_id, key === "daemon" ? JSON.stringify({ role: "host_supervisor", daemon_capabilities: { adopt_capable: true } }) : "{}"]);
+  for (const status of ["active", "pending", "refused", "revoked"]) {
+    const id = status === "active" ? ids.active : `n_read_${status}`;
+    if (status !== "active") db.run("INSERT INTO nodes(node_id,node_name,alias,network_id) VALUES(?1,?1,?2,?3)", [id, `read-${status}`, a.network_id]);
+    db.run(`INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,error,created_at,updated_at)
+      VALUES(?1,?2,?3,?4,'/private/fixture',?5,?6,?7,1,2)`,
+      [`adopt_read_${status}`, a.network_id, id, ids.daemon, a.user.user_id, status, status === "refused" ? "adopt_start_evidence_missing" : null]);
+  }
+  db.run(`INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,flags_json,env_keys,status,created_at,created_by_token)
+    VALUES('cr_read_created',?1,'created',?2,'codex-sdk','{}','[]','succeeded',1,'private-token')`, [ids.daemon, a.network_id]);
+  db.run(`INSERT INTO node_stop_requests(request_id,network_id,daemon_node_id,child_node_id,child_alias,action,created_by_token,status,error,created_at,acked_at)
+    VALUES('stop_read_failed',?1,?2,?3,'read-active','stop','private-token','stop_failed','adopt_explicit_private_socket_required',3,4)`, [a.network_id, ids.daemon, ids.active]);
+  db.run(`INSERT INTO node_start_requests(request_id,network_id,daemon_node_id,child_node_id,child_alias,created_by_token,status,error,created_at,acked_at)
+    VALUES('start_read_failed',?1,?2,?3,'read-active','private-token','start_failed','adopt_start_evidence_missing',5,6)`, [a.network_id, ids.daemon, ids.active]);
+  db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES('read-daemon-session','read-daemon',?1,?2,'idle',datetime('now'))", [ids.daemon, a.network_id]);
+  const { generateNetworkToken, hashToken } = await import("./db.js");
+  daemonToken = generateNetworkToken();
+  db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES('read-daemon-token',?1,?2,'network','node:read-daemon',?3)", [a.user.user_id, a.network_id, hashToken(daemonToken)]);
+  const { bootServer } = await import("./server.js");
+  hub = bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+afterAll(() => hub?.stop(true));
+
+test("public errors redact free text for granted viewers on every projection", async () => {
+  db.run("INSERT INTO network_member_agent_grants(network_id,user_id,node_id,can_message) VALUES(?1,?2,?3,0)", [a.network_id, limited.user.user_id, ids.active]);
+  try {
+    for (const error of [
+      "/private/fixture/secret on fixture-host",
+      "not_my_child: daemon has no local record of fixture-node (fixture-id) — no children-map entry and no config at /private/fixture/fixture-node/config.json; refusing to signal processes by alias.",
+      "bin: ENOENT: /private/fixture/bin/anet on fixture-host",
+      "adopt_unknown_secret", "adopt_start_timeout: /private/fixture", "", "adopt_start_timeout", null,
+    ]) {
+      const expected = error === null || error === "adopt_start_timeout" ? error : "lifecycle_error";
+      for (const [kind, table, request] of [
+        ["adopt", "node_daemon_bindings", "adopt_read_active"],
+        ["start", "node_start_requests", "start_read_failed"],
+        ["stop", "node_stop_requests", "stop_read_failed"],
+      ]) {
+        db.run(`UPDATE ${table} SET error=?1 WHERE request_id=?2`, [error, request]);
+        for (const selector of [`request_id=${request}`, `node_id=${ids.active}`]) {
+          const r = await get(query(kind, selector), limited.token);
+          expect(r.status).toBe(200);
+          expect(r.body.request.error).toBe(expected);
+        }
+      }
+      const nodes = (await get(`/api/nodes?network_id=${a.network_id}`, limited.token)).body.nodes;
+      expect(nodes[0].adoption.error).toBe(expected);
+    }
+  } finally {
+    db.run("DELETE FROM network_member_agent_grants WHERE user_id=?1 AND node_id=?2", [limited.user.user_id, ids.active]);
+    db.run("UPDATE node_daemon_bindings SET error=NULL WHERE request_id='adopt_read_active'");
+    db.run("UPDATE node_start_requests SET error='adopt_start_evidence_missing' WHERE request_id='start_read_failed'");
+    db.run("UPDATE node_stop_requests SET error='adopt_explicit_private_socket_required' WHERE request_id='stop_read_failed'");
+  }
+});
+
+test("created projection prefers recorded child id and only falls back for legacy null", async () => {
+  const read = async () => (await get(`/api/nodes?network_id=${a.network_id}`)).body.nodes;
+  try {
+    expect((await read()).find((n: any) => n.node_id === ids.created).managed).toBe("created");
+    db.run("UPDATE node_create_requests SET child_node_id=?1 WHERE request_id='cr_read_created'", [ids.manual]);
+    let nodes = await read();
+    expect(nodes.find((n: any) => n.node_id === ids.manual).managed).toBe("created");
+    expect(nodes.find((n: any) => n.node_id === ids.created).managed).toBe("none");
+    db.run("UPDATE node_create_requests SET child_node_id='missing-child' WHERE request_id='cr_read_created'");
+    expect((await read()).find((n: any) => n.node_id === ids.created).managed).toBe("none");
+    db.run("UPDATE node_create_requests SET child_node_id=?1,network_id=?2 WHERE request_id='cr_read_created'", [ids.manual, b.network_id]);
+    nodes = await read();
+    expect(nodes.find((n: any) => n.node_id === ids.manual).managed).toBe("none");
+  } finally {
+    db.run("UPDATE node_create_requests SET child_node_id=NULL,network_id=?1 WHERE request_id='cr_read_created'", [a.network_id]);
+  }
+});
+
+test("authenticated port-0 HTTP projects actual authority, never an id prefix", async () => {
+  const { status, body } = await get(`/api/nodes?network_id=${a.network_id}`);
+  expect(status).toBe(200);
+  const rows = body.nodes;
+  expect(rows.find((r: any) => r.node_id === ids.created)).toMatchObject({ managed: "created", adoption: null, lifecycle_controllable: true });
+  expect(rows.find((r: any) => r.node_id === ids.manual)).toMatchObject({ managed: "none", adoption: null, lifecycle_controllable: false });
+  expect(rows.find((r: any) => r.node_id === ids.active)).toMatchObject({ managed: "adopted", adoption: { status: "active", request_id: "adopt_read_active" }, lifecycle_controllable: true });
+  for (const status of ["pending", "refused", "revoked"]) expect(rows.find((r: any) => r.node_id === `n_read_${status}`)).toMatchObject({ managed: "none", adoption: { status } });
+});
+test("adopt query preserves all persisted states, request id and bounded projection", async () => {
+  for (const status of ["pending", "active", "refused", "revoked"]) {
+    const r = await get(query("adopt", `request_id=adopt_read_${status}`));
+    expect(r.status).toBe(200);
+    expect(r.body.request).toMatchObject({ kind: "adopt", status, request_id: `adopt_read_${status}` });
+    expect(r.body.request.workdir).toBeUndefined();
+    expect(r.body.request.requested_by).toBeUndefined();
+  }
+});
+test("start/stop returns daemon failure codes; node selector returns latest, not success fiction", async () => {
+  for (const [kind, error] of [["start", "adopt_start_evidence_missing"], ["stop", "adopt_explicit_private_socket_required"]]) {
+    const r = await get(query(kind, `node_id=${ids.active}`));
+    expect(r.status).toBe(200);
+    expect(r.body.request).toMatchObject({ status: `${kind}_failed`, error, node_id: ids.active });
+    expect(r.body.request.created_by_token).toBeUndefined();
+  }
+  expect((await get(query("start", `node_id=${ids.manual}`))).body.request).toBeNull();
+});
+test("cross-network request and node guesses do not disclose data", async () => {
+  for (const kind of ["adopt", "start", "stop"]) {
+    const id = kind === "adopt" ? "adopt_read_active" : `${kind}_read_failed`;
+    const denied = await get(query(kind, `request_id=${id}`), b.token);
+    expect(denied.status).toBe(404);
+    expect(denied.body).toEqual((await get(query(kind, "request_id=nonexistent"), b.token)).body);
+    expect((await get(query(kind, `node_id=${ids.active}`), b.token)).status).toBe(404);
+    expect((await get(query(kind, `request_id=${id}&network_id=${a.network_id}`), b.token)).status).toBe(403);
+  }
+});
+test("same-network restricted viewer without node grants cannot read requests", async () => {
+  for (const kind of ["adopt", "start", "stop"]) {
+    expect((await get(query(kind, `node_id=${ids.active}&network_id=${a.network_id}`), limited.token)).status).toBe(404);
+    const id = kind === "adopt" ? "adopt_read_active" : `${kind}_read_failed`;
+    expect((await get(query(kind, `request_id=${id}&network_id=${a.network_id}`), limited.token)).status).toBe(404);
+  }
+  expect((await get(`/api/nodes?network_id=${a.network_id}`, limited.token)).body.nodes).toEqual([]);
+});
+test("current node grant allows reads; revocation immediately closes them", async () => {
+  db.run("INSERT INTO network_member_agent_grants(network_id,user_id,node_id,can_message) VALUES(?1,?2,?3,0)", [a.network_id, limited.user.user_id, ids.active]);
+  try {
+    expect((await get(query("adopt", "request_id=adopt_read_active"), limited.token)).status).toBe(200);
+    const nodes = (await get(`/api/nodes?network_id=${a.network_id}`, limited.token)).body.nodes;
+    expect(nodes).toHaveLength(1);
+    expect(nodes[0].managed).toBe("adopted");
+  } finally { db.run("DELETE FROM network_member_agent_grants WHERE user_id=?1 AND node_id=?2", [limited.user.user_id, ids.active]); }
+  expect((await get(query("adopt", "request_id=adopt_read_active"), limited.token)).status).toBe(404);
+});
+test("daemon and legacy master do not gain the new user read surface", async () => {
+  for (const token of [daemonToken, process.env.COMMHUB_AUTH_TOKEN!]) {
+    expect((await get(query("adopt", "request_id=adopt_read_active"), token)).status).toBe(403);
+    const nodes = (await get(`/api/nodes?network_id=${a.network_id}`, token)).body.nodes;
+    expect(nodes.length).toBeGreaterThan(0);
+    expect(nodes.every((n: any) => !("managed" in n) && !("adoption" in n))).toBe(true);
+  }
+  expect((await get(query("adopt", "request_id=adopt_read_active"), "invalid")).status).toBe(401);
+  const queryOnly = await fetch(base + query("adopt", `request_id=adopt_read_active&token=${encodeURIComponent(a.token)}`));
+  expect([401, 403]).toContain(queryOnly.status);
+});
+test("host-supervisors capability respects user token and node visibility; absent stays absent", async () => {
+  const path = `/api/host-supervisors?network_id=${a.network_id}`;
+  expect((await get(path)).body.daemons.find((d: any) => d.daemon_node_id === ids.daemon).adopt_capable).toBe(true);
+  for (const token of [limited.token, daemonToken]) {
+    const r = await get(path, token);
+    expect((r.body.daemons ?? []).every((d: any) => !("adopt_capable" in d))).toBe(true);
+  }
+  db.run("UPDATE nodes SET config_snapshot=?1 WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor", daemon_capabilities: { adopt_capable: false } }), ids.daemon]);
+  expect((await get(path)).body.daemons[0].adopt_capable).toBe(false);
+  db.run("UPDATE nodes SET config_snapshot=?1 WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor" }), ids.daemon]);
+  expect((await get(path)).body.daemons[0].adopt_capable).toBeUndefined();
+});
+test("invalid selectors rejected rather than listing every lifecycle request", async () => {
+  for (const suffix of ["", "kind=adopt", "kind=other&node_id=x", "kind=start&request_id=x&node_id=y", "kind=stop&node_id=x&node_id=y", "kind=start&request_id=x&node_id=", "kind=adopt&node_id=%20"])
+    expect((await get(`/api/node-lifecycle-requests?${suffix}`)).status).toBe(400);
+});
+test("request state refresh exposes pending, completion and binding-missing failure without caching", async () => {
+  for (const [kind, statuses] of [["start", ["pending", "delivered", "started", "start_failed", "timeout"]], ["stop", ["pending", "delivered", "stopped", "stop_failed", "noop_not_my_child"]]] as const) {
+    for (const status of statuses) {
+      const error = status.endsWith("failed") ? "adopt_active_binding_required" : null;
+      db.run(`UPDATE node_${kind}_requests SET status=?1,error=?2 WHERE request_id=?3`, [status, error, `${kind}_read_failed`]);
+      expect((await get(query(kind, `request_id=${kind}_read_failed`))).body.request).toMatchObject({ status, error });
+    }
+  }
+});
+test("join refuses a request whose stored network disagrees with its target node", async () => {
+  db.run("UPDATE node_start_requests SET network_id=?1 WHERE request_id='start_read_failed'", [b.network_id]);
+  try {
+    expect((await get(query("start", "request_id=start_read_failed"))).status).toBe(404);
+    expect((await get(query("start", "request_id=start_read_failed"), b.token)).status).toBe(404);
+  } finally { db.run("UPDATE node_start_requests SET network_id=?1 WHERE request_id='start_read_failed'", [a.network_id]); }
+});

package/src/node-lifecycle-read.ts

@@ -0,0 +1,98 @@
+import { db } from "./db.js";
+import { addAgentNetworkScope, type RestNetworkScope } from "./network-scope.js";
+
+// Exact public codes only; daemon exception text must never reach node viewers.
+const publicLifecycleErrors = new Set([
+  "adopt_active_binding_required", "adopt_binding_unavailable",
+  "adopt_binding_revoked_during_start", "adopt_explicit_private_socket_required",
+  "adopt_start_evidence_missing", "adopt_stop_evidence_missing",
+  "adopt_launch_mode_mismatch", "adopt_lifecycle_verification_failed",
+  "adopt_process_generation_changed", "adopt_process_still_running",
+  "adopt_process_stop_timeout", "adopt_process_tree_unstable",
+  "adopt_registry_identity_mismatch", "adopt_self_process_refused",
+  "adopt_start_timeout", "adopt_tmux_session_still_exists",
+  "adopt_local_verification_failed", "adopt_roots_not_configured",
+  "adopt_workdir_outside_roots", "adopt_workdir_not_absolute",
+  "adopt_alias_invalid", "adopt_alias_mismatch", "adopt_config_invalid",
+  "adopt_config_network_mismatch", "adopt_network_mismatch",
+  "adopt_hub_invalid", "adopt_hub_missing", "adopt_hub_mismatch",
+  "adopt_identity_ambiguous", "adopt_identity_not_found", "adopt_identity_changed",
+  "adopt_path_not_regular", "adopt_path_owner_mismatch", "adopt_path_writable_by_others",
+  "adopt_process_argv_mismatch", "adopt_process_home_mismatch",
+  "adopt_process_identity_mismatch", "adopt_process_changed",
+  "adopt_tmux_socket_mismatch", "adopt_pane_invalid", "adopt_pane_unverified",
+  "adopt_pane_process_mismatch", "adopt_socket_directory_unsafe", "adopt_socket_unsafe",
+  "adopt_pid_changed", "adopt_pid_invalid", "adopt_pidfile_unsafe",
+  "adopt_proc_invalid", "adopt_proc_unreadable", "adopt_platform_unsupported",
+  "adopt_registry_conflict", "adopt_registry_entry_invalid", "adopt_registry_invalid",
+  "adopt_registry_unsafe", "adopt_config_env_invalid", "adopt_env_file_invalid",
+  "adopt_env_file_unsafe", "adopt_request_mismatch", "adopt_ack_rejected",
+]);
+function publicLifecycleError(error: unknown): string | null {
+  return error == null ? null
+    : typeof error === "string" && publicLifecycleErrors.has(error) ? error : "lifecycle_error";
+}
+
+type Adoption = { request_id: string; daemon_node_id: string; status: string; error: string | null };
+export type LifecycleProjection = { managed: "created" | "adopted" | "none"; adoption: Adoption | null };
+const scopeNodes = (sql: string, params: any[], scope: RestNetworkScope) =>
+  addAgentNetworkScope(sql, params, scope, { network: "n.network_id", nodeId: "n.node_id", alias: "n.alias" });
+
+/** Called only for authenticated human readers. Same visibility as /api/nodes;
+ * constant query count, no id-prefix or host-name inference of authority. */
+export function lifecycleProjections(scope: RestNetworkScope): Map<string, LifecycleProjection> {
+  const result = new Map<string, LifecycleProjection>();
+  const bp: any[] = [];
+  const bindings = db.all<Adoption & { node_id: string }>(scopeNodes(
+    `SELECT b.node_id,b.request_id,b.daemon_node_id,b.status,b.error
+       FROM node_daemon_bindings b JOIN nodes n ON n.node_id=b.node_id AND n.network_id=b.network_id
+      WHERE 1=1`, bp, scope) + " ORDER BY b.created_at DESC,b.request_id DESC", ...bp);
+  for (const b of bindings) {
+    let projection = result.get(b.node_id);
+    if (!projection) {
+      projection = { managed: "none", adoption: { request_id: b.request_id, daemon_node_id: b.daemon_node_id, status: b.status, error: publicLifecycleError(b.error) } };
+      result.set(b.node_id, projection);
+    }
+    if (b.status === "active") projection.managed = "adopted";
+  }
+  const cp: any[] = [];
+  const created = db.all<{ node_id: string }>(scopeNodes(
+    `SELECT n.node_id FROM node_create_requests c JOIN nodes n
+       ON n.node_id=COALESCE(c.child_node_id, CASE WHEN substr(c.request_id,1,3)='cr_'
+         THEN 'node_' || substr(c.request_id,4) END) AND n.network_id=c.network_id
+      WHERE 1=1`, cp, scope), ...cp);
+  for (const n of created) result.set(n.node_id, { managed: "created", adoption: result.get(n.node_id)?.adoption ?? null });
+  return result;
+}
+
+/** Read-only, selector-bound lookup. Join the live node in the SAME network,
+ * then apply its current visibility (including restricted member grants).
+ * Result fields exclude credentials, PID and config; error values separately
+ * use the exact public-code allowlist (daemon text may contain workdir paths). */
+export function lifecycleRequestResponse(url: URL, scope: RestNetworkScope): Response {
+  const kind = url.searchParams.get("kind");
+  const requestId = url.searchParams.get("request_id"), nodeId = url.searchParams.get("node_id");
+  const fail = (error: string, status: number) => Response.json({ ok: false, error }, { status });
+  if (!["adopt", "start", "stop"].includes(kind ?? "")
+      || url.searchParams.has("request_id") === url.searchParams.has("node_id")
+      || !(requestId ?? nodeId ?? "").trim()
+      || ["kind", "request_id", "node_id"].some(k => url.searchParams.getAll(k).length > 1)
+      || (requestId ?? nodeId ?? "").length > 200) return fail("invalid_lifecycle_query", 400);
+  // The table and column names below come only from this closed enum.
+  const table = kind === "adopt" ? "node_daemon_bindings" : kind === "start" ? "node_start_requests" : "node_stop_requests";
+  const nodeColumn = kind === "adopt" ? "node_id" : "child_node_id";
+  // A node lookup with no request must distinguish 'no requests' from 'not visible'.
+  if (nodeId) {
+    const params: any[] = [nodeId];
+    if (!db.get(scopeNodes("SELECT n.node_id FROM nodes n WHERE n.node_id=?1", params, scope), ...params))
+      return fail("node_not_found", 404);
+  }
+  const params: any[] = [requestId ?? nodeId];
+  const sql = scopeNodes(`SELECT r.request_id,r.${nodeColumn} AS node_id,r.network_id,r.daemon_node_id,
+      r.status,r.error,r.created_at,${kind === "adopt" ? "r.updated_at" : "r.acked_at,r.delivered_at"}
+    FROM ${table} r JOIN nodes n ON n.node_id=r.${nodeColumn} AND n.network_id=r.network_id
+    WHERE r.${requestId ? "request_id" : nodeColumn}=?1${kind === "stop" ? " AND r.action='stop'" : ""}`, params, scope);
+  const row = db.get<Record<string, unknown>>(sql + " ORDER BY r.created_at DESC,r.request_id DESC LIMIT 1", ...params);
+  if (!row && requestId) return fail("request_not_found", 404);
+  return Response.json({ ok: true, request: row ? { kind, ...row, error: publicLifecycleError(row.error) } : null });
+}

package/src/server.ts

@@ -27,6 +27,7 @@ import { pendingInboxCount } from "./inbox-count.js";
 import { notifyExpiredTasks, type ExpiredTaskRow } from "./task-expiry-notice.js";
 import { expireStaleOpenTasks } from "./task-stale-open.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, addAgentTimelineScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
+import { lifecycleProjections, lifecycleRequestResponse } from "./node-lifecycle-read.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
 import { groupMemberSeesFile, groupUnreadFor, listGroupMessages, listGroupThreads, markGroupRead, memberGroup, sendGroupMessage } from "./group-messages.js";
@@ -2455,6 +2456,16 @@ return Bun.serve({
       return withCors(req, Response.json({ ok: false, error: restScope.denied }, { status: 403 }));
     }
 
+    // #629: only actual user credentials gain lifecycle read metadata. Legacy
+    // master/dev-open and network/daemon credentials keep their old surface.
+    const lifecycleAuth = resolveRequestAuth(req, { allowQueryToken: false });
+    const lifecycleUser = !!lifecycleAuth?.userId && !lifecycleAuth.networkId
+      && !requestToken(req, { allowQueryToken: false }).startsWith("ntok_");
+    if (url.pathname === "/api/node-lifecycle-requests" && req.method === "GET") {
+      if (!lifecycleUser) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
+      return withCors(req, lifecycleRequestResponse(url, restScope));
+    }
+
     const sideActor = resolveSideThreadActor(req, resolveRequestAuth(req, { allowQueryToken: false }), isAdmin);
     const nodeCommandActor = sideActor?.kind === "node" && sideActor.boundNodeId && sideActor.boundNetworkId
       ? { tokenId: sideActor.tokenId, networkId: sideActor.boundNetworkId, nodeId: sideActor.boundNodeId }
@@ -4468,6 +4479,7 @@ return Bun.serve({
           // would silently start dimming every daemon that hasn't
           // upgraded past preview.55.
           let snapCanCreate: boolean | undefined;
+          let snapAdoptCapable: boolean | undefined;
           let snapBlockedReason: string | undefined;
           // #1545 —— 见 report_status schema 里 create_capability_observed_ms_ago 的注释:
           // 上报侧**故意收得宽**(无 int/min/max,免得一个诊断字段能让整份 report 被拒),
@@ -4481,6 +4493,7 @@ return Bun.serve({
               const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
               snapRole = typeof parsed?.role === "string" ? parsed.role : null;
               const caps = parsed?.daemon_capabilities;
+              if (typeof caps?.adopt_capable === "boolean") snapAdoptCapable = caps.adopt_capable;
               if (caps && typeof caps.can_create_nodes === "boolean") {
                 snapCanCreate = caps.can_create_nodes;
               }
@@ -4498,10 +4511,10 @@ return Bun.serve({
             } catch { /* malformed */ }
           }
           return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
-            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness };
+            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness, adoptCapable: snapAdoptCapable };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness, adoptCapable }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -4541,6 +4554,12 @@ return Bun.serve({
             allowed_secret_keys: secrets,
             host_telemetry: telemetry,
           };
+          if (lifecycleUser && typeof adoptCapable === "boolean") {
+            // Do not reveal even the new capability for a node the user cannot read.
+            const visibleParams: any[] = [r.node_id];
+            const visibleSql = addAgentNetworkScope("SELECT node_id FROM nodes WHERE node_id=?1", visibleParams, restScope, { alias: "alias", nodeId: "node_id" });
+            if (db.get(visibleSql, ...visibleParams)) out.adopt_capable = adoptCapable;
+          }
           // #1353 Fix ② — only emit the two capability keys when the
           // daemon actually reported them. Undefined vs. false is a
           // real distinction here (see Fix ② comment above).
@@ -4657,6 +4676,7 @@ return Bun.serve({
         const role = netRoles.get(r.network_id);
         return role === "owner" || role === "admin";
       };
+      const management = lifecycleUser ? lifecycleProjections(restScope) : null;
       const rows = rawRows.map(r => {
         let role: string | null = null;
         const snap = r.config_snapshot;
@@ -4680,6 +4700,7 @@ return Bun.serve({
           role,
           lifecycle_controllable,
           lifecycle_daemon_node_id: controllable.get(r.node_id) ?? null,
+          ...(management ? (management.get(r.node_id) ?? { managed: "none", adoption: null }) : {}),
           viewer_can: { permission_mode: canSetPermissionMode(r) },
         };
       });

package/src/shared/node-name.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  NODE_FOLDER_RE, NODE_NAME_CASES, LEGACY_NODE_NAME_RE,
+  checkNodeName, nodeDirNameFor, nodeFolderSlug, fnv1aHex,
+} from "./node-name.js";
+
+// Board #652 — one name rule for hub + daemon (+ the app's pinned copy).
+
+describe("#652 checkNodeName — shared vectors", () => {
+  for (const c of NODE_NAME_CASES) {
+    test(`${JSON.stringify(c.input).slice(0, 24)} → ${c.ok ? "ok" : c.error}`, () => {
+      const r = checkNodeName(c.input);
+      expect(r.ok).toBe(c.ok);
+      if (!r.ok) {
+        expect(r.error).toBe(c.error!);
+        expect(r.message.length).toBeGreaterThan(0);
+      }
+      if (c.slug !== undefined) expect(nodeFolderSlug(c.input)).toBe(c.slug);
+    });
+  }
+
+  test("the vector table really contains Chinese names that pass (old rule would refuse them)", () => {
+    const cjkOk = NODE_NAME_CASES.filter(c => c.ok && /\p{Script=Han}/u.test(c.input));
+    expect(cjkOk.length).toBeGreaterThan(0);
+    for (const c of cjkOk) expect(LEGACY_NODE_NAME_RE.test(c.input)).toBe(false);
+  });
+});
+
+describe("#652 folder slug", () => {
+  test("every slug — incl. every accepted vector — matches the ASCII folder rule", () => {
+    for (const c of NODE_NAME_CASES.filter(x => x.ok)) {
+      const s = nodeFolderSlug(c.input);
+      expect(NODE_FOLDER_RE.test(s)).toBe(true);
+      expect(/^[\x21-\x7e]+$/.test(s)).toBe(true);
+    }
+  });
+  test("non-ASCII → node-<6 hex>, deterministic", () => {
+    expect(nodeFolderSlug("测试")).toMatch(/^node-[0-9a-f]{6}$/);
+    expect(nodeFolderSlug("测试")).toBe(nodeFolderSlug(" 测试 "));
+    expect(nodeFolderSlug("测试")).not.toBe(nodeFolderSlug("测验"));
+  });
+  test("fnv1a known answers (pins the app reimplementation)", () => {
+    expect(fnv1aHex("")).toBe("811c9dc5");
+    expect(fnv1aHex("a")).toBe("e40c292c");
+    expect(fnv1aHex("foobar")).toBe("bf9cf968");
+  });
+  test("nodeDirNameFor keeps legacy names as-is (existing nodes never move)", () => {
+    for (const n of ["a", "demo-bot", "node_1", "my_agent"]) expect(nodeDirNameFor(n)).toBe(n);
+    expect(nodeDirNameFor("测试")).toBe(nodeFolderSlug("测试"));
+    expect(nodeDirNameFor("MyBot")).toBe("mybot");
+  });
+});
+
+describe("#652 hub/daemon node-name drift guard", () => {
+  test("byte-identical source files", () => {
+    const hub = readFileSync(join(import.meta.dir, "node-name.ts"), "utf-8");
+    const daemon = readFileSync(join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "node-name.ts"), "utf-8");
+    expect(daemon).toBe(hub);
+  });
+});

package/src/shared/node-name.ts

@@ -0,0 +1,161 @@
+// Board #652 — node name (= network alias) rules and the ASCII folder slug derived from it.
+//
+// Single source of truth for hub + daemon. This file is byte-identical in
+// server/src/shared/node-name.ts and agent-node/src/shared/node-name.ts
+// (node-name-drift.test.ts fails the build on any difference), and the app
+// (sleep2agi/agent-network-app) keeps a copy pinned to NODE_NAME_CASES below.
+//
+// Before #652 the name had to match /^[a-z][a-z0-9_-]{0,63}$/, so the app
+// wizard refused 「测试」 while the real fleet runs Chinese aliases started by
+// hand. House rule: the alias may be Chinese, the working directory may not.
+// So the name is now any Unicode letters/digits, and every directory derived
+// from it uses nodeFolderSlug() (or the legacy name, for names the old rule
+// already accepted — see nodeDirNameFor).
+
+/** The old rule. Every name it accepts keeps its old directory (nodeDirNameFor). */
+export const LEGACY_NODE_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+
+/** Folder / slug rule: what a working directory or `.anet/nodes/<dir>` may be called. */
+export const NODE_FOLDER_RE = /^[a-z][a-z0-9-]{0,63}$/;
+
+export const NODE_NAME_MAX_CHARS = 64;
+
+// First char: a letter, a digit or `_` (never `-`: `anet node start -x` reads as a flag;
+// never `.`: hidden files, `..`). Rest: letters, digits, combining marks (Devanagari,
+// Thai… need them), `_`, `-`. Nothing else — no whitespace, `/ \ :`, `.`, quotes,
+// `$`, backticks, control characters: the name ends up in argv, tmux session names
+// (tmux rewrites `.` and `:`), JSON, logs and file names in the trash directory.
+const NODE_NAME_RE = /^[\p{L}\p{N}_][\p{L}\p{M}\p{N}_-]*$/u;
+
+export type NodeNameError =
+  | "empty"
+  | "too_long"
+  | "leading_dash"
+  | "forbidden_char"
+  | "not_nfc";
+
+export type NodeNameCheck =
+  | { ok: true; name: string }
+  | { ok: false; error: NodeNameError; char?: string; message: string };
+
+/** Trim + NFC. Callers store the returned `name`, not the raw input. */
+export function normalizeNodeName(raw: string): string {
+  return raw.trim().normalize("NFC");
+}
+
+function describeChar(ch: string): string {
+  const cp = ch.codePointAt(0) ?? 0;
+  if (cp < 0x20 || cp === 0x7f) return `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`;
+  if (/\s/u.test(ch)) return "空格";
+  return ch;
+}
+
+/**
+ * Check a node name. `raw` is trimmed first; the trimmed, NFC form must be
+ * 1..64 characters (code points) of letters / digits / `_` / `-`, not starting with `-`.
+ */
+export function checkNodeName(raw: unknown): NodeNameCheck {
+  if (typeof raw !== "string") return { ok: false, error: "empty", message: "名字不能为空" };
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return { ok: false, error: "empty", message: "名字不能为空" };
+  const chars = [...trimmed];
+  if (chars.length > NODE_NAME_MAX_CHARS) {
+    return { ok: false, error: "too_long", message: `名字最多 ${NODE_NAME_MAX_CHARS} 个字符` };
+  }
+  if (trimmed !== trimmed.normalize("NFC")) {
+    return { ok: false, error: "not_nfc", message: "名字需要是 Unicode NFC 规范形式" };
+  }
+  if (chars[0] === "-") {
+    return { ok: false, error: "leading_dash", char: "-", message: "名字不能以 - 开头" };
+  }
+  if (!NODE_NAME_RE.test(trimmed)) {
+    const bad = chars.find((ch, i) => !(i === 0 ? /^[\p{L}\p{N}_]$/u : /^[\p{L}\p{M}\p{N}_-]$/u).test(ch)) ?? chars[0]!;
+    return {
+      ok: false,
+      error: "forbidden_char",
+      char: bad,
+      message: `名字里不能有「${describeChar(bad)}」：只能用文字、字母、数字、_ 和 -`,
+    };
+  }
+  return { ok: true, name: trimmed };
+}
+
+export function isValidNodeName(raw: unknown): boolean {
+  return checkNodeName(raw).ok;
+}
+
+/** FNV-1a 32-bit over the UTF-8 bytes, 8 hex digits. Tiny, dependency-free, and the
+ *  app reimplements it byte for byte (no crypto module needed in the browser / RN). */
+export function fnv1aHex(s: string): string {
+  const bytes = new TextEncoder().encode(s);
+  let h = 0x811c9dc5;
+  for (const b of bytes) {
+    h ^= b;
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+
+/**
+ * ASCII folder name for a node name. Pure-ASCII names are transliterated
+ * (lowercase, runs of anything outside [a-z0-9] become one `-`, trimmed, `node-`
+ * prefixed when they do not start with a letter); anything else — and anything the
+ * transliteration empties — becomes `node-<first 6 hex of fnv1a(name)>`.
+ * The result always matches NODE_FOLDER_RE.
+ */
+export function nodeFolderSlug(raw: string): string {
+  const name = normalizeNodeName(raw);
+  // eslint-disable-next-line no-control-regex
+  if (/^[\x00-\x7f]*$/.test(name)) {
+    let s = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    if (s && !/^[a-z]/.test(s)) s = `node-${s}`;
+    s = s.slice(0, NODE_NAME_MAX_CHARS).replace(/-+$/, "");
+    if (NODE_FOLDER_RE.test(s)) return s;
+  }
+  return `node-${fnv1aHex(name).slice(0, 6)}`;
+}
+
+/**
+ * The directory under `.anet/nodes/` a daemon-created node lives in.
+ * Names the old rule accepted keep their old directory (= the name) so nothing that
+ * worked before #652 moves; every other name gets nodeFolderSlug(name).
+ */
+export function nodeDirNameFor(name: string): string {
+  return LEGACY_NODE_NAME_RE.test(name) ? name : nodeFolderSlug(name);
+}
+
+/** Shared test vectors — the app's copy must produce the same verdicts and slugs. */
+export const NODE_NAME_CASES: ReadonlyArray<{ input: string; ok: boolean; error?: NodeNameError; slug?: string }> = [
+  { input: "测试", ok: true, slug: "node-f78149" },
+  { input: "研发助手A", ok: true, slug: "node-1d348f" },
+  { input: "AB测试牛", ok: true, slug: "node-048250" },
+  { input: "my-bot", ok: true, slug: "my-bot" },
+  { input: "MyBot_2", ok: true, slug: "mybot-2" },
+  { input: "  spaced  ", ok: true, slug: "spaced" },
+  { input: "123", ok: true, slug: "node-123" },
+  { input: "_x", ok: true, slug: "x" },
+  { input: "Ünïcödé", ok: true, slug: "node-030667" },
+  { input: "a".repeat(64), ok: true, slug: "a".repeat(64) },
+  { input: "测".repeat(64), ok: true, slug: "node-50c3fb" },
+  { input: "", ok: false, error: "empty" },
+  { input: "   ", ok: false, error: "empty" },
+  { input: "a".repeat(65), ok: false, error: "too_long" },
+  { input: "测".repeat(65), ok: false, error: "too_long" },
+  { input: "-x", ok: false, error: "leading_dash" },
+  { input: "e\u0301", ok: false, error: "not_nfc" },
+  { input: ".hidden", ok: false, error: "forbidden_char" },
+  { input: "..", ok: false, error: "forbidden_char" },
+  { input: "a/b", ok: false, error: "forbidden_char" },
+  { input: "a\\b", ok: false, error: "forbidden_char" },
+  { input: "a:b", ok: false, error: "forbidden_char" },
+  { input: "a.b", ok: false, error: "forbidden_char" },
+  { input: "a b", ok: false, error: "forbidden_char" },
+  { input: "a\u0000b", ok: false, error: "forbidden_char" },
+  { input: "a\nb", ok: false, error: "forbidden_char" },
+  { input: "a$b", ok: false, error: "forbidden_char" },
+  { input: "a`b", ok: false, error: "forbidden_char" },
+  { input: "a'b", ok: false, error: "forbidden_char" },
+  { input: "a\"b", ok: false, error: "forbidden_char" },
+  { input: "a;b", ok: false, error: "forbidden_char" },
+  { input: "a*b", ok: false, error: "forbidden_char" },
+];

package/src/tools.ts

@@ -3879,6 +3879,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!sec1Ok) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_node" }) }] };
       }
+      // board #627: a binding proves stop/start authority, not an exit-75
+      // supervisor. No verified adopted-wrapper capability exists in this
+      // protocol; a self-reported config_update_capable flag is not proof.
+      // Created authority retains its existing restart behavior unchanged.
+      if (!createdDaemon(nodeId) && activeBinding(nodeId)) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false,
+          error: "adopted_restart_requires_daemon", message: "Use Stop, then Start for this adopted node." }) }] };
+      }
       // F-B reaper: same stale-supersede semantics as update_node_config,
       // with same acked_at-anchored liveness clock (see update_node_config
       // for the 通信龙 polish reasoning).
@@ -4100,7 +4108,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     {
       daemon_node_id: z.string().min(1).max(200),
       node_spec: z.object({
-        name: z.string().min(1).max(64),
+        // #652 — 64 *code points* after trim is enforced by validateChildName (shared/node-name.ts);
+        // zod's max counts UTF-16 units and surrounding whitespace, so it is only a coarse bound here.
+        name: z.string().min(1).max(256),
         runtime: z.string().min(1).max(64),
         model: z.string().min(1).max(100).optional().nullable(),
         flags: z.record(z.string(), z.unknown()).optional(),
@@ -4249,7 +4259,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // flag injection at the hub edge). Daemon repeats this; double
       // layer per RFC §4.2.2.
       try {
-        validateChildName(node_spec.name);
+        // #652 — store/forward the trimmed name the validator returns.
+        node_spec.name = validateChildName(node_spec.name);
         validateRuntime(node_spec.runtime);
         validateModel(node_spec.model);
         validateChannelsP1((node_spec as any).channels);