@sleep2agi/commhub-server 0.9.0-preview.109 → 0.9.0-preview.111

package/src/server.ts

@@ -3,6 +3,8 @@ import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
 import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { ifNoneMatchHits, memoStatusBody } from "./status-read-cache";
 import { dispatchQueueInfo, queueDepthByNode, queueDepthKey } from "./task-queue-ahead.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { statusAliasResolverRead } from "./status-alias-resolver.js";
 import { readNodeHealth } from "./node-health-store.js";
 import { wantsAllTools } from "./tool-audience.js";
@@ -27,6 +29,7 @@ import { pendingInboxCount } from "./inbox-count.js";
 import { notifyExpiredTasks, type ExpiredTaskRow } from "./task-expiry-notice.js";
 import { expireStaleOpenTasks } from "./task-stale-open.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, addAgentTimelineScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
+import { lifecycleProjections, lifecycleRequestResponse } from "./node-lifecycle-read.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
 import { groupMemberSeesFile, groupUnreadFor, listGroupMessages, listGroupThreads, markGroupRead, memberGroup, sendGroupMessage } from "./group-messages.js";
@@ -792,7 +795,7 @@ function withNetworkNameAlias<T extends { network_name?: unknown }>(row: T): T &
 // ── REST input schema ───────────────────────────────
 const TaskSchema = z.object({
   alias: z.string().min(1).max(200),
-  task: z.string().min(1).max(10000),
+  task: z.string().min(1).max(TASK_CONTENT_MAX),
   priority: z.enum(["high", "normal", "low"]).default("normal"),
   from: z.string().max(200).optional(),
   network_id: z.string().max(200).optional(),
@@ -2455,6 +2458,16 @@ return Bun.serve({
       return withCors(req, Response.json({ ok: false, error: restScope.denied }, { status: 403 }));
     }
 
+    // #629: only actual user credentials gain lifecycle read metadata. Legacy
+    // master/dev-open and network/daemon credentials keep their old surface.
+    const lifecycleAuth = resolveRequestAuth(req, { allowQueryToken: false });
+    const lifecycleUser = !!lifecycleAuth?.userId && !lifecycleAuth.networkId
+      && !requestToken(req, { allowQueryToken: false }).startsWith("ntok_");
+    if (url.pathname === "/api/node-lifecycle-requests" && req.method === "GET") {
+      if (!lifecycleUser) return withCors(req, Response.json({ ok: false, error: "user_token_required" }, { status: 403 }));
+      return withCors(req, lifecycleRequestResponse(url, restScope));
+    }
+
     const sideActor = resolveSideThreadActor(req, resolveRequestAuth(req, { allowQueryToken: false }), isAdmin);
     const nodeCommandActor = sideActor?.kind === "node" && sideActor.boundNodeId && sideActor.boundNetworkId
       ? { tokenId: sideActor.tokenId, networkId: sideActor.boundNetworkId, nodeId: sideActor.boundNodeId }
@@ -3677,8 +3690,8 @@ return Bun.serve({
         // immediately, without waiting for the agent's report_status to
         // arrive. Updating both `task` and `updated_at` is enough — we
         // leave `status` to the agent (idle → working → idle).
-        const touchParams: any[] = [body.task.slice(0, 200), targetAlias];
-        let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
+        const touchParams: any[] = [sessionTaskPreview(body.task), targetAlias];
+        let touchSql = `UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE alias = ?2`;
         if (taskNetId) { touchSql += " AND network_id = ?3"; touchParams.push(taskNetId); }
         db.run(touchSql, touchParams);
       });
@@ -4468,6 +4481,7 @@ return Bun.serve({
           // would silently start dimming every daemon that hasn't
           // upgraded past preview.55.
           let snapCanCreate: boolean | undefined;
+          let snapAdoptCapable: boolean | undefined;
           let snapBlockedReason: string | undefined;
           // #1545 —— 见 report_status schema 里 create_capability_observed_ms_ago 的注释:
           // 上报侧**故意收得宽**(无 int/min/max,免得一个诊断字段能让整份 report 被拒),
@@ -4481,6 +4495,7 @@ return Bun.serve({
               const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
               snapRole = typeof parsed?.role === "string" ? parsed.role : null;
               const caps = parsed?.daemon_capabilities;
+              if (typeof caps?.adopt_capable === "boolean") snapAdoptCapable = caps.adopt_capable;
               if (caps && typeof caps.can_create_nodes === "boolean") {
                 snapCanCreate = caps.can_create_nodes;
               }
@@ -4498,10 +4513,10 @@ return Bun.serve({
             } catch { /* malformed */ }
           }
           return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
-            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness };
+            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness, adoptCapable: snapAdoptCapable };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness, adoptCapable }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -4541,6 +4556,12 @@ return Bun.serve({
             allowed_secret_keys: secrets,
             host_telemetry: telemetry,
           };
+          if (lifecycleUser && typeof adoptCapable === "boolean") {
+            // Do not reveal even the new capability for a node the user cannot read.
+            const visibleParams: any[] = [r.node_id];
+            const visibleSql = addAgentNetworkScope("SELECT node_id FROM nodes WHERE node_id=?1", visibleParams, restScope, { alias: "alias", nodeId: "node_id" });
+            if (db.get(visibleSql, ...visibleParams)) out.adopt_capable = adoptCapable;
+          }
           // #1353 Fix ② — only emit the two capability keys when the
           // daemon actually reported them. Undefined vs. false is a
           // real distinction here (see Fix ② comment above).
@@ -4657,6 +4678,7 @@ return Bun.serve({
         const role = netRoles.get(r.network_id);
         return role === "owner" || role === "admin";
       };
+      const management = lifecycleUser ? lifecycleProjections(restScope) : null;
       const rows = rawRows.map(r => {
         let role: string | null = null;
         const snap = r.config_snapshot;
@@ -4680,6 +4702,7 @@ return Bun.serve({
           role,
           lifecycle_controllable,
           lifecycle_daemon_node_id: controllable.get(r.node_id) ?? null,
+          ...(management ? (management.get(r.node_id) ?? { managed: "none", adoption: null }) : {}),
           viewer_can: { permission_mode: canSetPermissionMode(r) },
         };
       });

package/src/session-task-on-dispatch.ts

@@ -0,0 +1,14 @@
+// Board #668. A dispatch preview is what the hub shows before the node
+// reports. Once the session is already working, that text is the task in
+// flight — a newer message waits in the inbox and must not replace it.
+// Idle and every other status still take the preview.
+
+const PLACEHOLDER = /^\?\d+$/;
+
+/** SQL expression for `sessions.task` on dispatch. `placeholder` is a `?N` bind. */
+export function sessionTaskOnDispatch(placeholder: string): string {
+  if (!PLACEHOLDER.test(placeholder)) {
+    throw new Error("sessionTaskOnDispatch placeholder must be a ?N bind");
+  }
+  return `CASE WHEN status = 'working' THEN task ELSE ${placeholder} END`;
+}

package/src/shared/node-name.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  NODE_FOLDER_RE, NODE_NAME_CASES, LEGACY_NODE_NAME_RE,
+  checkNodeName, nodeDirNameFor, nodeFolderSlug, fnv1aHex,
+} from "./node-name.js";
+
+// Board #652 — one name rule for hub + daemon (+ the app's pinned copy).
+
+describe("#652 checkNodeName — shared vectors", () => {
+  for (const c of NODE_NAME_CASES) {
+    test(`${JSON.stringify(c.input).slice(0, 24)} → ${c.ok ? "ok" : c.error}`, () => {
+      const r = checkNodeName(c.input);
+      expect(r.ok).toBe(c.ok);
+      if (!r.ok) {
+        expect(r.error).toBe(c.error!);
+        expect(r.message.length).toBeGreaterThan(0);
+      }
+      if (c.slug !== undefined) expect(nodeFolderSlug(c.input)).toBe(c.slug);
+    });
+  }
+
+  test("the vector table really contains Chinese names that pass (old rule would refuse them)", () => {
+    const cjkOk = NODE_NAME_CASES.filter(c => c.ok && /\p{Script=Han}/u.test(c.input));
+    expect(cjkOk.length).toBeGreaterThan(0);
+    for (const c of cjkOk) expect(LEGACY_NODE_NAME_RE.test(c.input)).toBe(false);
+  });
+});
+
+describe("#652 folder slug", () => {
+  test("every slug — incl. every accepted vector — matches the ASCII folder rule", () => {
+    for (const c of NODE_NAME_CASES.filter(x => x.ok)) {
+      const s = nodeFolderSlug(c.input);
+      expect(NODE_FOLDER_RE.test(s)).toBe(true);
+      expect(/^[\x21-\x7e]+$/.test(s)).toBe(true);
+    }
+  });
+  test("non-ASCII → node-<6 hex>, deterministic", () => {
+    expect(nodeFolderSlug("测试")).toMatch(/^node-[0-9a-f]{6}$/);
+    expect(nodeFolderSlug("测试")).toBe(nodeFolderSlug(" 测试 "));
+    expect(nodeFolderSlug("测试")).not.toBe(nodeFolderSlug("测验"));
+  });
+  test("fnv1a known answers (pins the app reimplementation)", () => {
+    expect(fnv1aHex("")).toBe("811c9dc5");
+    expect(fnv1aHex("a")).toBe("e40c292c");
+    expect(fnv1aHex("foobar")).toBe("bf9cf968");
+  });
+  test("nodeDirNameFor keeps legacy names as-is (existing nodes never move)", () => {
+    for (const n of ["a", "demo-bot", "node_1", "my_agent"]) expect(nodeDirNameFor(n)).toBe(n);
+    expect(nodeDirNameFor("测试")).toBe(nodeFolderSlug("测试"));
+    expect(nodeDirNameFor("MyBot")).toBe("mybot");
+  });
+});
+
+describe("#652 hub/daemon node-name drift guard", () => {
+  test("byte-identical source files", () => {
+    const hub = readFileSync(join(import.meta.dir, "node-name.ts"), "utf-8");
+    const daemon = readFileSync(join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "node-name.ts"), "utf-8");
+    expect(daemon).toBe(hub);
+  });
+});

package/src/shared/node-name.ts

@@ -0,0 +1,161 @@
+// Board #652 — node name (= network alias) rules and the ASCII folder slug derived from it.
+//
+// Single source of truth for hub + daemon. This file is byte-identical in
+// server/src/shared/node-name.ts and agent-node/src/shared/node-name.ts
+// (node-name-drift.test.ts fails the build on any difference), and the app
+// (sleep2agi/agent-network-app) keeps a copy pinned to NODE_NAME_CASES below.
+//
+// Before #652 the name had to match /^[a-z][a-z0-9_-]{0,63}$/, so the app
+// wizard refused 「测试」 while the real fleet runs Chinese aliases started by
+// hand. House rule: the alias may be Chinese, the working directory may not.
+// So the name is now any Unicode letters/digits, and every directory derived
+// from it uses nodeFolderSlug() (or the legacy name, for names the old rule
+// already accepted — see nodeDirNameFor).
+
+/** The old rule. Every name it accepts keeps its old directory (nodeDirNameFor). */
+export const LEGACY_NODE_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+
+/** Folder / slug rule: what a working directory or `.anet/nodes/<dir>` may be called. */
+export const NODE_FOLDER_RE = /^[a-z][a-z0-9-]{0,63}$/;
+
+export const NODE_NAME_MAX_CHARS = 64;
+
+// First char: a letter, a digit or `_` (never `-`: `anet node start -x` reads as a flag;
+// never `.`: hidden files, `..`). Rest: letters, digits, combining marks (Devanagari,
+// Thai… need them), `_`, `-`. Nothing else — no whitespace, `/ \ :`, `.`, quotes,
+// `$`, backticks, control characters: the name ends up in argv, tmux session names
+// (tmux rewrites `.` and `:`), JSON, logs and file names in the trash directory.
+const NODE_NAME_RE = /^[\p{L}\p{N}_][\p{L}\p{M}\p{N}_-]*$/u;
+
+export type NodeNameError =
+  | "empty"
+  | "too_long"
+  | "leading_dash"
+  | "forbidden_char"
+  | "not_nfc";
+
+export type NodeNameCheck =
+  | { ok: true; name: string }
+  | { ok: false; error: NodeNameError; char?: string; message: string };
+
+/** Trim + NFC. Callers store the returned `name`, not the raw input. */
+export function normalizeNodeName(raw: string): string {
+  return raw.trim().normalize("NFC");
+}
+
+function describeChar(ch: string): string {
+  const cp = ch.codePointAt(0) ?? 0;
+  if (cp < 0x20 || cp === 0x7f) return `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`;
+  if (/\s/u.test(ch)) return "空格";
+  return ch;
+}
+
+/**
+ * Check a node name. `raw` is trimmed first; the trimmed, NFC form must be
+ * 1..64 characters (code points) of letters / digits / `_` / `-`, not starting with `-`.
+ */
+export function checkNodeName(raw: unknown): NodeNameCheck {
+  if (typeof raw !== "string") return { ok: false, error: "empty", message: "名字不能为空" };
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return { ok: false, error: "empty", message: "名字不能为空" };
+  const chars = [...trimmed];
+  if (chars.length > NODE_NAME_MAX_CHARS) {
+    return { ok: false, error: "too_long", message: `名字最多 ${NODE_NAME_MAX_CHARS} 个字符` };
+  }
+  if (trimmed !== trimmed.normalize("NFC")) {
+    return { ok: false, error: "not_nfc", message: "名字需要是 Unicode NFC 规范形式" };
+  }
+  if (chars[0] === "-") {
+    return { ok: false, error: "leading_dash", char: "-", message: "名字不能以 - 开头" };
+  }
+  if (!NODE_NAME_RE.test(trimmed)) {
+    const bad = chars.find((ch, i) => !(i === 0 ? /^[\p{L}\p{N}_]$/u : /^[\p{L}\p{M}\p{N}_-]$/u).test(ch)) ?? chars[0]!;
+    return {
+      ok: false,
+      error: "forbidden_char",
+      char: bad,
+      message: `名字里不能有「${describeChar(bad)}」：只能用文字、字母、数字、_ 和 -`,
+    };
+  }
+  return { ok: true, name: trimmed };
+}
+
+export function isValidNodeName(raw: unknown): boolean {
+  return checkNodeName(raw).ok;
+}
+
+/** FNV-1a 32-bit over the UTF-8 bytes, 8 hex digits. Tiny, dependency-free, and the
+ *  app reimplements it byte for byte (no crypto module needed in the browser / RN). */
+export function fnv1aHex(s: string): string {
+  const bytes = new TextEncoder().encode(s);
+  let h = 0x811c9dc5;
+  for (const b of bytes) {
+    h ^= b;
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+
+/**
+ * ASCII folder name for a node name. Pure-ASCII names are transliterated
+ * (lowercase, runs of anything outside [a-z0-9] become one `-`, trimmed, `node-`
+ * prefixed when they do not start with a letter); anything else — and anything the
+ * transliteration empties — becomes `node-<first 6 hex of fnv1a(name)>`.
+ * The result always matches NODE_FOLDER_RE.
+ */
+export function nodeFolderSlug(raw: string): string {
+  const name = normalizeNodeName(raw);
+  // eslint-disable-next-line no-control-regex
+  if (/^[\x00-\x7f]*$/.test(name)) {
+    let s = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    if (s && !/^[a-z]/.test(s)) s = `node-${s}`;
+    s = s.slice(0, NODE_NAME_MAX_CHARS).replace(/-+$/, "");
+    if (NODE_FOLDER_RE.test(s)) return s;
+  }
+  return `node-${fnv1aHex(name).slice(0, 6)}`;
+}
+
+/**
+ * The directory under `.anet/nodes/` a daemon-created node lives in.
+ * Names the old rule accepted keep their old directory (= the name) so nothing that
+ * worked before #652 moves; every other name gets nodeFolderSlug(name).
+ */
+export function nodeDirNameFor(name: string): string {
+  return LEGACY_NODE_NAME_RE.test(name) ? name : nodeFolderSlug(name);
+}
+
+/** Shared test vectors — the app's copy must produce the same verdicts and slugs. */
+export const NODE_NAME_CASES: ReadonlyArray<{ input: string; ok: boolean; error?: NodeNameError; slug?: string }> = [
+  { input: "测试", ok: true, slug: "node-f78149" },
+  { input: "研发助手A", ok: true, slug: "node-1d348f" },
+  { input: "AB测试牛", ok: true, slug: "node-048250" },
+  { input: "my-bot", ok: true, slug: "my-bot" },
+  { input: "MyBot_2", ok: true, slug: "mybot-2" },
+  { input: "  spaced  ", ok: true, slug: "spaced" },
+  { input: "123", ok: true, slug: "node-123" },
+  { input: "_x", ok: true, slug: "x" },
+  { input: "Ünïcödé", ok: true, slug: "node-030667" },
+  { input: "a".repeat(64), ok: true, slug: "a".repeat(64) },
+  { input: "测".repeat(64), ok: true, slug: "node-50c3fb" },
+  { input: "", ok: false, error: "empty" },
+  { input: "   ", ok: false, error: "empty" },
+  { input: "a".repeat(65), ok: false, error: "too_long" },
+  { input: "测".repeat(65), ok: false, error: "too_long" },
+  { input: "-x", ok: false, error: "leading_dash" },
+  { input: "e\u0301", ok: false, error: "not_nfc" },
+  { input: ".hidden", ok: false, error: "forbidden_char" },
+  { input: "..", ok: false, error: "forbidden_char" },
+  { input: "a/b", ok: false, error: "forbidden_char" },
+  { input: "a\\b", ok: false, error: "forbidden_char" },
+  { input: "a:b", ok: false, error: "forbidden_char" },
+  { input: "a.b", ok: false, error: "forbidden_char" },
+  { input: "a b", ok: false, error: "forbidden_char" },
+  { input: "a\u0000b", ok: false, error: "forbidden_char" },
+  { input: "a\nb", ok: false, error: "forbidden_char" },
+  { input: "a$b", ok: false, error: "forbidden_char" },
+  { input: "a`b", ok: false, error: "forbidden_char" },
+  { input: "a'b", ok: false, error: "forbidden_char" },
+  { input: "a\"b", ok: false, error: "forbidden_char" },
+  { input: "a;b", ok: false, error: "forbidden_char" },
+  { input: "a*b", ok: false, error: "forbidden_char" },
+];

package/src/shared/task-content-limit-drift.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { SESSION_TASK_PREVIEW_MAX, TASK_CONTENT_MAX, sessionTaskPreview } from "./task-content-limit.js";
+
+// Board #668 — the node reports the whole task so the hub can match it
+// against tasks.content. Both sides must agree on the cap.
+const HUB_PATH = join(import.meta.dir, "task-content-limit.ts");
+const NODE_PATH = join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "task-content-limit.ts");
+
+describe("#668 — hub/node task-content-limit drift guard", () => {
+  test("byte-identical source files", () => {
+    expect(readFileSync(NODE_PATH, "utf-8")).toBe(readFileSync(HUB_PATH, "utf-8"));
+  });
+
+  test("constants equal at runtime", async () => {
+    const node = await import(NODE_PATH);
+    expect(node.TASK_CONTENT_MAX).toBe(TASK_CONTENT_MAX);
+    expect(node.SESSION_TASK_PREVIEW_MAX).toBe(SESSION_TASK_PREVIEW_MAX);
+  });
+
+  test("preview is the first 200 chars", () => {
+    expect(SESSION_TASK_PREVIEW_MAX).toBe(200);
+    const long = "字".repeat(TASK_CONTENT_MAX);
+    expect(sessionTaskPreview(long)).toBe(long.slice(0, 200));
+    expect(sessionTaskPreview("short")).toBe("short");
+  });
+});

package/src/shared/task-content-limit.ts

@@ -0,0 +1,25 @@
+// Board #668 — task text limits shared by hub and node.
+//
+// This file is byte-identical in server/src/shared/task-content-limit.ts and
+// agent-node/src/shared/task-content-limit.ts (task-content-limit-drift.test.ts
+// fails the build on any difference).
+//
+// TASK_CONTENT_MAX is the cap every dispatch entry (send_task, REST /api/task,
+// scheduled tasks) and report_status.task accept. The node reports the whole
+// task text so the hub can match it against tasks.content and write
+// started_at. If the dispatch cap grew without the node and report_status
+// following, long tasks would silently stop matching again.
+//
+// SESSION_TASK_PREVIEW_MAX is what the hub keeps in sessions.task. That column
+// is readable by get_all_status, the full /api/status and members who may see
+// the agent but not its conversations, so only a short preview is stored —
+// the full text is used for matching, never persisted on the session row.
+
+export const TASK_CONTENT_MAX = 10_000;
+
+export const SESSION_TASK_PREVIEW_MAX = 200;
+
+/** The preview stored in sessions.task — same cut as the dispatch preview. */
+export function sessionTaskPreview(task: string): string {
+  return task.slice(0, SESSION_TASK_PREVIEW_MAX);
+}

package/src/tools.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
+import { lockNodeAlias } from "./node-token-ownership.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
 import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
@@ -9,6 +10,8 @@ import { noteModelAuthHealth } from "./model-auth-notify.js";
 import { numberedAliasInClause, parseAliasFilter } from "./alias-filter.js";
 import { createHash } from "node:crypto";
 import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
 import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
@@ -680,7 +683,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       resume_id: z.string().min(1).max(200).describe("Claude Code session UUID (unique per session)"),
       alias: z.string().min(1).max(200).describe("Human-readable session name for dispatching (e.g. 指挥室/知识哥)"),
       status: z.enum(["working", "idle", "blocked", "error", "waiting_input", "offline"]),
-      task: z.string().max(10000).optional().describe("Current task description"),
+      task: z.string().max(TASK_CONTENT_MAX).optional().describe("Current task description (the hub stores only the first 200 chars on the session row; the full text is matched against tasks.content)"),
       output: z.string().max(50000).optional().describe("Recent output (max 4000 chars stored)"),
       score: z.number().min(0).max(10).optional().describe("Self-score 1-10"),
       progress: z.number().min(0).max(100).optional().describe("Progress 0-100"),
@@ -1048,6 +1051,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         ) ?? null;
         const keep = <T,>(fresh: T | null | undefined, column: string): T | null =>
           (fresh ?? (handover?.[column] as T | null | undefined) ?? null);
+        // #668 — the node reports the whole task so the tasks UPDATE below can match
+        // tasks.content. sessions.task is readable far wider than the task row
+        // (get_all_status, full /api/status, members who see the agent but not its
+        // conversations), so only the dispatch-sized preview is stored here.
+        const sessionTask = task == null ? null : sessionTaskPreview(task); // board668-session-preview
         db.run("DELETE FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3", [effectiveAlias, resume_id, sessionNetId]);
         db.run(
           `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, external_schedules, peer_reply_inbox_capable, last_seen_at, updated_at)
@@ -1079,7 +1087,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              external_schedules = COALESCE(?34, sessions.external_schedules),
              peer_reply_inbox_capable = ?35,
              last_seen_at = datetime('now'), updated_at = datetime('now')`,
-          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
+          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, sessionTask, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
         );
         if (handover) {
           // 换 resume_id 那条路径上 ON CONFLICT 不会触发;INSERT 完再把没上报(仍为 NULL)的
@@ -1739,7 +1747,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "Dispatch a task to a session's inbox (by alias). The reply carries queue_ahead (open tasks already on the target), target_busy, est_wait_minutes (rough, null = no history) and, when the queue is long, a warning: queued, never refused — consider an idle node.",
     {
       alias: z.string().min(1).max(200).describe("Target session alias"),
-      task: z.string().min(1).max(10000).describe("Task content"),
+      task: z.string().min(1).max(TASK_CONTENT_MAX).describe("Task content"),
       priority: z.enum(["high", "normal", "low"]).optional().default("normal"),
       context: z.string().max(10000).optional(),
       from_session: z.string().max(200).optional(),
@@ -1771,8 +1779,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
 
       // Resolve parent_task_id: explicit > inferred (caller's most recent
-      // delivered/started inbox task that's still open). Inference is the
-      // safety net for when the LLM forgets to pass parent_task_id.
+      // delivered inbox task). Inference is the safety net for when the LLM
+      // forgets to pass parent_task_id.
+      //
+      // #668 — only 'delivered'. 'started' was never a tasks status. A task
+      // the caller has acked or is running is NOT inferred: an unrelated
+      // dispatch without parent_task_id would hang under it, the child's
+      // reply would close it early (chainReplyToParent), and the node's own
+      // reply would then be refused as reply_task_terminal.
       //
       // round5 F1 fix: the inference SELECT MUST be network-scoped. Without
       // it, a caller in network B can pick up the parent_task_id of a
@@ -1782,7 +1796,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
         try {
           const recentParams: any[] = [from_session];
-          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered','started')";
+          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered')"; // board668-parent-delivered-only
           recentSql = addScope(recentSql, recentParams, effectiveNetId);
           recentSql += " ORDER BY created_at DESC LIMIT 1";
           const recent = db.get<{ task_id: string }>(recentSql, ...recentParams);
@@ -1930,8 +1944,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
            VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'delivered', ?7, 'reply', datetime('now'), datetime('now'), datetime('now', ?8), ?9, ?10, ?11)`,
           [id, fromNodeId, from_session, targetNodeId, targetAlias, priority, task, `+${ttl_seconds || 3600} seconds`, effectiveNetId ?? null, parentTaskId, metaJson]
         );
-        const touchParams: any[] = [task.slice(0, 200), targetAlias];
-        let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
+        const touchParams: any[] = [sessionTaskPreview(task), targetAlias];
+        let touchSql = `UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE alias = ?2`;
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
         // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
@@ -4108,7 +4122,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     {
       daemon_node_id: z.string().min(1).max(200),
       node_spec: z.object({
-        name: z.string().min(1).max(64),
+        // #652 — 64 *code points* after trim is enforced by validateChildName (shared/node-name.ts);
+        // zod's max counts UTF-16 units and surrounding whitespace, so it is only a coarse bound here.
+        name: z.string().min(1).max(256),
         runtime: z.string().min(1).max(64),
         model: z.string().min(1).max(100).optional().nullable(),
         flags: z.record(z.string(), z.unknown()).optional(),
@@ -4257,7 +4273,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // flag injection at the hub edge). Daemon repeats this; double
       // layer per RFC §4.2.2.
       try {
-        validateChildName(node_spec.name);
+        // #652 — store/forward the trimmed name the validator returns.
+        node_spec.name = validateChildName(node_spec.name);
         validateRuntime(node_spec.runtime);
         validateModel(node_spec.model);
         validateChannelsP1((node_spec as any).channels);
@@ -4350,7 +4367,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "auth_required" }) }] };
       }
       db.run(
-        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)`,
+        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 2)`,
         [childTokenId, hashToken(childToken), enforceUserId, networkIdForChild, `node:${node_spec.name}`, "network", "child", requestId]
       );
 
@@ -6266,6 +6283,13 @@ export function trustedConfigSnapshotForNode(
 }
 
 export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
+  return db.transaction(() => {
+    if (input.callerNetworkId && input.alias) lockNodeAlias(input.callerNetworkId, input.alias, input.node_id ?? undefined);
+    return upsertNodeIdentity(input);
+  });
+}
+
+function upsertNodeIdentity(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
   if (!input.node_id) return { result: "skipped", reason: "missing_node_id" };
   const existing = db.get<{ network_id: string | null; owner_user_id: string | null; alias: string | null; config_path: string | null }>(
     "SELECT network_id, owner_user_id, alias, config_path FROM nodes WHERE node_id = ?1",
@@ -6277,8 +6301,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
   // report only that exact node. Legacy unbound ntok rows remain compatible,
   // but they can never consume owner-gated schedule intents.
   if (input.callerTokenId) {
-    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null }>(
-      "SELECT bound_node_id, user_id, network_id FROM api_tokens WHERE token_id = ?1",
+    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null; node_identity_epoch: number; name: string }>(
+      "SELECT bound_node_id, user_id, network_id, node_identity_epoch, name FROM api_tokens WHERE token_id = ?1",
       input.callerTokenId,
     );
     if (token?.bound_node_id && token.bound_node_id !== input.node_id) {
@@ -6287,6 +6311,16 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     if (token?.network_id && _norm(token.network_id) !== _norm(callerNet)) {
       return { result: "refused", reason: "cross_network", existingNet: existing?.network_id ?? null, callerNet };
     }
+    // New name-only node tokens bind once, at their first registration. General
+    // tokens renamed by report_status are deliberately NOT upgraded to epoch 2.
+    if (token?.node_identity_epoch === 2 && !token.bound_node_id) {
+      const conflict = db.get("SELECT node_id FROM nodes WHERE network_id=?1 AND alias=?2 AND node_id<>?3 LIMIT 1",
+        callerNet, input.alias ?? "", input.node_id);
+      if (conflict || token.name !== `node:${input.alias}` || token.user_id !== input.callerUserId || existing) {
+        console.warn(`[commhub] 🚫 report_status node upsert refused (identity_mismatch): node_id=${input.node_id} first-binding conflict`);
+        return { result: "refused", reason: "identity_mismatch", existingNet: existing?.network_id ?? null, callerNet };
+      }
+    }
   }
   if (existing?.owner_user_id && input.callerUserId !== existing.owner_user_id) {
     return { result: "refused", reason: "owner_mismatch", existingNet: existing.network_id, callerNet };
@@ -6351,6 +6385,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       callerNet ?? null,
     ],
   );
+  if (input.callerTokenId) db.run(`UPDATE api_tokens SET bound_node_id=?1
+    WHERE token_id=?2 AND node_identity_epoch=2 AND bound_node_id IS NULL`, [input.node_id, input.callerTokenId]);
   const trustedSnapshot = trustedConfigSnapshotForNode(
     input.config_snapshot,
     input.callerTokenId,