@sleep2agi/commhub-server 0.9.0-preview.110 → 0.9.0-preview.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.110",
+  "version": "0.9.0-preview.111",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -3,6 +3,7 @@
  */
 import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js"; import { deleteDepartmentsForNetwork, groupTx, removeMemberFromChatGroups } from "./departments.js"; // #419: also ensures network_members.department_id exists (same line on purpose: docs pin auth.ts line numbers)
 import { WEAK_PASSWORDS } from "./password-dict.js";
+import { checkNodeTokenClaim, legacyNodeHolder } from "./node-token-ownership.js";
 import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 import { deleteAgentGrants, isAgentRestricted } from "./agent-access.js"; import { deleteTaskGrantsForMember, NEW_MEMBER_TASK_ACCESS, type TaskAccessMode } from "./task-access.js"; // 一行两个 import:文档钉着 auth.ts 的行号
 
@@ -136,7 +137,7 @@ export function register(username: string, password: string, email?: string, dis
   const userToken = generateUserToken();
   const userTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
     [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256)]
   );
 
@@ -144,7 +145,7 @@ export function register(username: string, password: string, email?: string, dis
   const networkToken = generateNetworkToken();
   const networkTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [networkTokenId, hashToken(networkToken), userId, networkId, "default-network", "network"]
   );
 
@@ -216,7 +217,7 @@ export function login(username: string, password: string, client: SessionClientI
   const userToken = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
     [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256)]
   );
 
@@ -246,8 +247,9 @@ export function login(username: string, password: string, client: SessionClientI
  *
  * RFC-036: callers that provide nodeId atomically establish the immutable
  * node-owner binding before the plaintext token is returned. The 3-argument
- * legacy form remains available for old clients, but its token has no bound
- * node id and therefore cannot consume external-schedule edit intents.
+ * name-only form remains available: new identities bind on first registration,
+ * and a verified same-holder refresh binds to the existing unique node. This
+ * does not fill NULL row owners or grant external-schedule ownership.
  */
 export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string, nodeId?: string): { ok: boolean; token?: string; token_id?: string; node_id?: string; error?: string } {
   // Verify user is a member of this network with write access
@@ -262,16 +264,18 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
   const tokenId = generateId("tok");
   try {
     db.transaction(() => {
+      nodeId = checkNodeTokenClaim(userId, networkId, nodeName, nodeId);
       if (nodeId) {
-        const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
-          "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
+        const existing = db.get<{ network_id: string | null; owner_user_id: string | null; alias: string | null }>(
+          "SELECT network_id, owner_user_id, alias FROM nodes WHERE node_id = ?1",
           nodeId,
         );
         if (existing?.network_id && existing.network_id !== networkId) throw new Error("cross_network_node");
+        if (existing?.alias && existing.alias !== nodeName) throw new Error("node_owner_mismatch");
         // Existing pre-RFC-036 rows have no trustworthy owner anchor. A token
         // refresh must not turn knowledge of a legacy node_id into ownership.
-        // They remain read-only until a separately authorized migration.
-        if (existing && !existing.owner_user_id) throw new Error("node_owner_unclaimed");
+        // A same-holder refresh binds the token, without filling the row owner.
+        if (existing && !existing.owner_user_id && !legacyNodeHolder(userId, networkId, nodeName, nodeId)) throw new Error("node_owner_unclaimed");
         if (existing?.owner_user_id && existing.owner_user_id !== userId) throw new Error("node_owner_mismatch");
         db.run(
           `INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, updated_at)
@@ -280,7 +284,7 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
              node_name = COALESCE(nodes.node_name, ?2),
              alias = COALESCE(nodes.alias, ?2),
              network_id = COALESCE(nodes.network_id, ?3),
-             owner_user_id = COALESCE(nodes.owner_user_id, ?4),
+             owner_user_id = nodes.owner_user_id,
              updated_at = datetime('now')`,
           [nodeId, nodeName, networkId, userId],
         );
@@ -293,7 +297,7 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
         }
       }
       db.run(
-        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6)",
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6, 2)",
         [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, nodeId ?? null],
       );
     });
@@ -505,7 +509,7 @@ export function createToken(userId: string, name: string, networkId?: string): {
   const token = generateToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [tokenId, hashToken(token), userId, networkId || null, name, "full"]
   );
   return { ok: true, token, token_id: tokenId };
@@ -520,7 +524,7 @@ export function issueUserToken(userId: string, name = "user-login"): { token: st
   const token = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, NULL, ?4, 'user')",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', 1)",
     [tokenId, hashToken(token), userId, name]
   );
   return { token, token_id: tokenId };
@@ -748,7 +752,7 @@ export function joinByInvite(inviteCode: string, userId: string): { ok: boolean;
   // Auto-create a token for this network
   const token = generateToken();
   const tokenId = generateId("tok");
-  db.run("INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+  db.run("INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [tokenId, hashToken(token), userId, invite.network_id, "auto-join", "full"]);
   return { ok: true, network_id: invite.network_id, role: invite.role };
 }

package/src/create-node.ts

@@ -243,8 +243,8 @@ export function resolveCallerDaemonTokenBound(opts: {
   if (!opts.enforceNetworkId) {
     return { ok: false, error: "caller_not_a_daemon" };
   }
-  const tokRow = db.get<{ name: string; network_id: string | null }>(
-    `SELECT name, network_id FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
+  const tokRow = db.get<{ name: string; network_id: string | null; user_id: string | null; bound_node_id: string | null; node_identity_epoch: number }>(
+    `SELECT name, network_id, user_id, bound_node_id, node_identity_epoch FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
     opts.callerTokenId,
   );
   if (!tokRow || !tokRow.name || !tokRow.name.startsWith("node:")) {
@@ -254,13 +254,20 @@ export function resolveCallerDaemonTokenBound(opts: {
     return { ok: false, error: "caller_not_a_daemon" };
   }
   const tokenAlias = tokRow.name.slice(5);
-  const nodeRow = db.get<{ node_id: string; alias: string; network_id: string }>(
-    `SELECT node_id, alias, network_id FROM nodes WHERE alias = ?1 AND network_id = ?2 LIMIT 1`,
-    tokenAlias, tokRow.network_id,
-  );
+  type DaemonRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+  const rows = tokRow.bound_node_id
+    ? db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE node_id = ?1 AND network_id = ?2`, tokRow.bound_node_id, tokRow.network_id)
+    : db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE alias = ?1 AND network_id = ?2`, tokenAlias, tokRow.network_id);
+  const nodeRow = rows.length === 1 ? rows[0] : undefined;
   if (!nodeRow) {
     return { ok: false, error: "caller_not_a_daemon" };
   }
+  // Legacy daemon tokens have no bound_node_id: retain their owner's authority.
+  // A token name is a lookup hint, never proof of authority over that node.
+  const ownsNode = !!tokRow.user_id && tokRow.user_id === nodeRow.owner_user_id;
+  const boundToNode = tokRow.bound_node_id === nodeRow.node_id;
+  const legacyOwnerless = nodeRow.owner_user_id === null && tokRow.node_identity_epoch === 0;
+  if (!ownsNode && !boundToNode && !legacyOwnerless) return { ok: false, error: "caller_not_a_daemon" };
   return {
     ok: true,
     daemonNodeId: nodeRow.node_id,

package/src/daemon-token-owner-http.test.ts

@@ -0,0 +1,226 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { nodeTokenReissueError } from "../../agent-network/src/cli-errors";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync("/tmp/owner678-")}/hub.db`;
+let db: any, hub: ReturnType<typeof Bun.serve>, base: string;
+let owner: any, member: any, outsider: any, legacy: string, mismatched: string, bound: string;
+let wrongBound: string, ownerless: string, revoked: string, crossNetwork: string, requestId: string;
+const daemon = "n_owner_fixture_daemon", child = "n_owner_fixture_child";
+
+async function call(token: string, name: string, args: Record<string, unknown> = {}) {
+  const response = await fetch(`${base}/mcp`, {
+    method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  expect(response.status).toBe(200);
+  const raw = await response.text(), lines = raw.split("\n").filter(line => line.startsWith("data:"));
+  const message = JSON.parse(lines.length ? lines.at(-1)!.slice(5) : raw);
+  expect(message.error).toBeUndefined();
+  return JSON.parse(message.result.content[0].text);
+}
+async function mint(token: string, network: string, name: string, nodeId?: string) {
+  const response = await fetch(`${base}/api/auth/node-token`, { method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ network_id: network, node_name: name, ...(nodeId ? { node_id: nodeId } : {}) }),
+  });
+  return { status: response.status, body: await response.json() as any };
+}
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const { generateNetworkToken, hashToken } = await import("./db.js");
+  owner = register("owner678", "Fixture-Strong1!");
+  member = register("member678", "Fixture-Strong1!");
+  outsider = register("outside678", "Fixture-Strong1!");
+  db.run("UPDATE users SET role='user' WHERE user_id IN (?1,?2)", [member.user.user_id, outsider.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role) VALUES(?1,?2,'member')", [owner.network_id, member.user.user_id]);
+  for (const id of [daemon, child, "n_ownerless_fixture"]) {
+    db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state)
+      VALUES(?1,?1,?1,?2,?3,'fixture-host',?4,'active')`, [id, owner.network_id,
+      id === "n_ownerless_fixture" ? null : owner.user.user_id,
+      JSON.stringify(id === daemon ? { role: "host_supervisor", daemon_capabilities: { adopt_capable: true } } : {})]);
+  }
+  db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES(?1,?1,?1,?2,'idle',datetime('now'))", [daemon, owner.network_id]);
+  function credential(label: string, user: string, node: string | null = null, alias = daemon, network = owner.network_id) {
+    const token = generateNetworkToken();
+    db.run(`INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash,bound_node_id)
+      VALUES(?1,?2,?3,'network',?4,?5,?6)`, [label, user, network, `node:${alias}`, hashToken(token), node]);
+    return token;
+  }
+  legacy = credential("owner678_legacy", owner.user.user_id);
+  mismatched = credential("owner678_mismatch", member.user.user_id);
+  bound = credential("owner678_bound", member.user.user_id, daemon);
+  wrongBound = credential("owner678_wrong_bound", member.user.user_id, "n_absent_bound");
+  ownerless = credential("owner678_ownerless", member.user.user_id, null, "n_ownerless_fixture");
+  db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'");
+  revoked = credential("owner678_revoked", owner.user.user_id);
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id='owner678_revoked'");
+  crossNetwork = credential("owner678_cross", outsider.user.user_id, daemon, daemon, outsider.network_id);
+  const { bootServer } = await import("./server.js");
+  hub = bootServer({ port: 0, hostname: "127.0.0.1" }); base = `http://127.0.0.1:${hub.port}`;
+  const request = await call(owner.token, "request_adopt_node", { node_id: child, daemon_node_id: daemon, workdir: "/fixture/project" });
+  expect(request.ok).toBe(true); requestId = request.request_id;
+}, 60000);
+afterAll(() => hub?.stop(true));
+
+test("name-only issuance checks existing ownership atomically", async () => {
+  const count = () => db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  const before = count();
+  expect(await mint(member.token, owner.network_id, daemon)).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(await mint(owner.token, owner.network_id, "n_ownerless_fixture")).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(count()).toBe(before);
+  // Legacy owner refresh and a new node name remain supported.
+  const refresh = await mint(owner.token, owner.network_id, daemon);
+  expect(refresh.status).toBe(200);
+  expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  expect((await mint(member.token, owner.network_id, "fresh678")).status).toBe(200);
+  expect((await mint(member.token, owner.network_id, daemon, daemon)).body.error).toBe("node_owner_mismatch");
+});
+
+// Every daemon-facing handler must fail at the shared identity boundary,
+// not incidentally at request lookup or argument validation.
+const endpoints: [string, Record<string, unknown>][] = [
+  ["list_my_pending_create_requests", {}], ["list_my_pending_lifecycle_requests", {}],
+  ["get_create_request", { request_id: "cr_fixture_absent" }],
+  ["ack_create_request", { request_id: "cr_fixture_absent", status: "started" }],
+  ["get_stop_request", { request_id: "sr_fixture_absent" }],
+  ["ack_stop_request", { request_id: "sr_fixture_absent", status: "stopped" }],
+  ["get_start_request", { request_id: "start_fixture_absent" }],
+  ["ack_start_request", { request_id: "start_fixture_absent", status: "started" }],
+  ["list_my_children", {}], ["get_adopt_request", {}], ["ack_adopt_request", { status: "adopted" }],
+  ["get_probe_request", { probe_id: "probe_fixture_absent" }],
+  ["ack_probe_request", { probe_id: "probe_fixture_absent", status: "ok", latency_ms: 1 }],
+];
+for (const [name, arguments_] of endpoints) {
+  test(`daemon identity boundary: ${name}`, async () => {
+    const args = name.includes("adopt_request") ? { ...arguments_, request_id: requestId } : arguments_;
+    for (const token of [mismatched, wrongBound, ownerless, owner.token, member.token]) {
+      expect(await call(token, name, args)).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+    }
+    expect(db.get("SELECT status FROM node_daemon_bindings WHERE request_id=?1", requestId).status).toBe("pending");
+  });
+}
+
+test("legacy owner and exact bound identity remain supported", async () => {
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id='owner678_legacy'").bound_node_id).toBeNull();
+  for (const token of [legacy, bound]) {
+    expect((await call(token, "list_my_children")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_create_requests")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_lifecycle_requests")).ok).toBe(true);
+    expect((await call(token, "get_adopt_request", { request_id: requestId })).ok).toBe(true);
+  }
+  // An explicit binding does not bypass the network or revocation boundaries.
+  expect(await call(crossNetwork, "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  const denied = await fetch(`${base}/mcp`, { method: "POST", headers: { Authorization: `Bearer ${revoked}` } });
+  expect(denied.status).toBe(401);
+  expect(await call(legacy, "ack_adopt_request", { request_id: requestId, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
+  expect((await call(legacy, "list_my_children")).children).toContainEqual({ child_node_id: child, alias: child, lifecycle_state: "active", managed: "adopted" });
+  const stop = await call(owner.token, "stop_node", { node_id: child, network_id: owner.network_id });
+  expect(stop.ok).toBe(true);
+  expect((await call(legacy, "get_stop_request", { request_id: stop.request_id })).ok).toBe(true);
+  expect((await call(legacy, "ack_stop_request", { request_id: stop.request_id, status: "stopped" })).ok).toBe(true);
+  const start = await call(owner.token, "start_node", { node_id: child, network_id: owner.network_id });
+  expect(start.ok).toBe(true);
+  expect((await call(legacy, "get_start_request", { request_id: start.request_id })).ok).toBe(true);
+  expect(await call(legacy, "ack_start_request", { request_id: start.request_id, status: "started", child_pid: 4321 })).toMatchObject({ ok: true, status: "started" });
+});
+
+test("ownerless legacy daemon remains supported without rewriting its owner", async () => {
+  db.run("UPDATE api_tokens SET node_identity_epoch=0 WHERE token_id='owner678_ownerless'");
+  try {
+    expect((await call(ownerless, "list_my_children")).ok).toBe(true);
+    const refresh = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_ownerless_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+    const withId = await mint(member.token, owner.network_id, "n_ownerless_fixture", "n_ownerless_fixture");
+    expect(withId.status).toBe(200);
+    expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_ownerless_fixture'").owner_user_id).toBeNull();
+    expect((await mint(owner.token, owner.network_id, "n_ownerless_fixture")).status).toBe(400);
+  } finally { db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'"); }
+});
+
+test("new name-only registration binds once and its holder can refresh with either shape", async () => {
+  const first = await mint(member.token, owner.network_id, "refresh_fixture");
+  expect(first.status).toBe(200);
+  expect(db.get("SELECT node_identity_epoch FROM api_tokens WHERE token_id=?1", first.body.token_id).node_identity_epoch).toBe(2);
+  const result = await call(first.body.token, "report_status", {
+    resume_id: "refresh-fixture-session", alias: "refresh_fixture", status: "idle", node_id: "n_refresh_fixture",
+  });
+  expect(result.ok).toBe(true);
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", first.body.token_id).bound_node_id).toBe("n_refresh_fixture");
+  expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_refresh_fixture'").owner_user_id).toBeNull();
+  for (const id of [undefined, "n_refresh_fixture"]) {
+    const refresh = await mint(member.token, owner.network_id, "refresh_fixture", id);
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_refresh_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  }
+  expect((await mint(owner.token, owner.network_id, "refresh_fixture")).status).toBe(400);
+});
+
+test("fresh ID cannot mint another node alias", async () => {
+  const before = db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  expect((await mint(member.token, owner.network_id, daemon, "n_fresh_impostor")).status).toBe(400);
+  expect(db.get("SELECT node_id FROM nodes WHERE node_id='n_fresh_impostor'")).toBeNull();
+  expect(db.get("SELECT COUNT(*) AS n FROM api_tokens").n).toBe(before);
+  expect((await call(legacy, "list_my_children")).ok).toBe(true);
+});
+
+test("duplicate legacy aliases use bound IDs and unbound ambiguity fails closed", async () => {
+  // Historical duplicate rows: the member's row was inserted first. Neither
+  // lookup order nor alias can redirect the later owner's exact-bound token.
+  const { hashToken, generateNetworkToken } = await import("./db.js");
+  const tokens: string[] = [];
+  for (const [id, user] of [["n_duplicate_first", member.user.user_id], ["n_duplicate_owner", owner.user.user_id]]) {
+    db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id) VALUES(?1,'duplicate_fixture','duplicate_fixture',?2,?3)", [id, owner.network_id, user]);
+    const token = generateNetworkToken(); tokens.push(token);
+    db.run("INSERT INTO api_tokens(token_id,token_hash,user_id,network_id,name,scope,bound_node_id) VALUES(?1,?2,?3,?4,'node:duplicate_fixture','network',?1)", [id, hashToken(token), user, owner.network_id]);
+    db.run("INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES(?1,?2,?1,?1,'/fixture',?3,'pending',1,1)", [id, owner.network_id, user]);
+  }
+  for (let i = 0; i < tokens.length; i++) {
+    const result = await call(tokens[i], "list_my_children");
+    expect(result.ok).toBe(true);
+    const ownId = i === 0 ? "n_duplicate_first" : "n_duplicate_owner";
+    expect((await call(tokens[i], "get_adopt_request", { request_id: ownId })).ok).toBe(true);
+    expect((await call(tokens[i], "get_adopt_request", { request_id: i === 0 ? "n_duplicate_owner" : "n_duplicate_first" })).ok).toBe(false);
+  }
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_owner'");
+  expect(await call(tokens[1], "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_first'");
+  expect(await call(tokens[0], "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  expect((await mint(owner.token, owner.network_id, "duplicate_fixture", "n_third_duplicate")).status).toBe(400);
+});
+
+test("all production token issuers explicitly mark the rollout epoch", () => {
+  const root = `${import.meta.dir}/../..`;
+  function sources(dir: string): string[] {
+    return readdirSync(dir, { withFileTypes: true }).flatMap(entry => {
+      const path = `${dir}/${entry.name}`;
+      return entry.isDirectory() ? sources(path) : entry.name.endsWith(".ts") && !entry.name.endsWith(".test.ts") ? [path] : [];
+    });
+  }
+  const sourceFiles = ["server/src", "agent-network/src", "agent-network/bin", "agent-node/src"].flatMap(dir => sources(`${root}/${dir}`));
+  let count = 0;
+  for (const file of sourceFiles) {
+    const source = readFileSync(file, "utf8");
+    for (const match of source.matchAll(/INSERT\s+INTO\s+api_tokens\s*\(([^)]+)\)/gi)) {
+      expect(match[1]).toContain("node_identity_epoch"); count++;
+    }
+  }
+  expect(count).toBe(9);
+  expect(readFileSync(`${root}/agent-network/bin/cli.ts`, "utf8")).toContain("'admin-reset', 'user', 1)");
+});
+
+test("revoked ownerless credential cannot be reclaimed by doctor and gives actionable guidance", async () => {
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE name='node:n_ownerless_fixture'");
+  const result = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+  expect(result.status).toBe(400);
+  expect(result.body.error).toBe("node_owner_mismatch");
+  expect(nodeTokenReissueError(result.body)).toContain("这个节点没有归属，请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "node_owner_unclaimed" })).toContain("请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "network_not_found" })).toBe("network_not_found");
+  expect(readFileSync(`${import.meta.dir}/../../agent-network/bin/cli.ts`, "utf8")).toContain("body ? nodeTokenReissueError(body) : r.status");
+});

package/src/db.ts

@@ -640,6 +640,9 @@ for (const ddl of [
   "ALTER TABLE api_tokens ADD COLUMN revoked_at TEXT",
   "ALTER TABLE api_tokens ADD COLUMN role TEXT",
   "ALTER TABLE api_tokens ADD COLUMN bound_node_id TEXT",
+  // Existing tokens retain epoch 0. Every production issuer writes 1 (general)
+  // or 2 (ownership-checked node token); 0 is a rollout boundary, not a clock.
+  "ALTER TABLE api_tokens ADD COLUMN node_identity_epoch INTEGER NOT NULL DEFAULT 0",
   // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
   "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
   "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",

package/src/node-lifecycle-read-http.test.ts

@@ -59,8 +59,9 @@ test("public errors redact free text for granted viewers on every projection", a
       "not_my_child: daemon has no local record of fixture-node (fixture-id) — no children-map entry and no config at /private/fixture/fixture-node/config.json; refusing to signal processes by alias.",
       "bin: ENOENT: /private/fixture/bin/anet on fixture-host",
       "adopt_unknown_secret", "adopt_start_timeout: /private/fixture", "", "adopt_start_timeout", null,
+      "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed",
     ]) {
-      const expected = error === null || error === "adopt_start_timeout" ? error : "lifecycle_error";
+      const expected = error === null || ["adopt_start_timeout", "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed"].includes(error) ? error : "lifecycle_error";
       for (const [kind, table, request] of [
         ["adopt", "node_daemon_bindings", "adopt_read_active"],
         ["start", "node_start_requests", "start_read_failed"],

package/src/node-lifecycle-read.ts

@@ -3,6 +3,7 @@ import { addAgentNetworkScope, type RestNetworkScope } from "./network-scope.js"
 
 // Exact public codes only; daemon exception text must never reach node viewers.
 const publicLifecycleErrors = new Set([
+  "adopted_node_delete_unsupported", "adopt_codex_readopt_required", "adopt_stop_receipt_changed",
   "adopt_active_binding_required", "adopt_binding_unavailable",
   "adopt_binding_revoked_during_start", "adopt_explicit_private_socket_required",
   "adopt_start_evidence_missing", "adopt_stop_evidence_missing",

package/src/node-token-ownership.ts

@@ -0,0 +1,36 @@
+import { db } from "./db.js";
+
+// Call inside the caller's transaction. Serialize registration and issuance for
+// this alias on PG; SQLite already serializes writes on its single connection.
+export function lockNodeAlias(network: string, alias: string, nodeId?: string): void {
+  if (db.dialect !== "postgres") return;
+  db.get("SELECT pg_advisory_xact_lock(hashtext(?1))", JSON.stringify([network, "alias", alias]));
+  if (nodeId) db.get("SELECT pg_advisory_xact_lock(hashtext(?1))", JSON.stringify([network, "id", nodeId]));
+}
+
+export function legacyNodeHolder(user: string, network: string, alias: string, nodeId: string): boolean {
+  return !!db.get(`SELECT token_id FROM api_tokens WHERE user_id=?1 AND network_id=?2
+    AND name=?3 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > datetime('now'))
+    AND (bound_node_id=?4 OR (bound_node_id IS NULL AND node_identity_epoch=0)) LIMIT 1`,
+    user, network, `node:${alias}`, nodeId);
+}
+
+/** Resolve a name-only refresh to the existing identity, never claim its owner. */
+export function checkNodeTokenClaim(user: string, network: string, alias: string, nodeId?: string): string | undefined {
+  lockNodeAlias(network, alias, nodeId);
+  const rows = db.all<{node_id: string; owner_user_id: string | null}>(
+    "SELECT node_id, owner_user_id FROM nodes WHERE network_id=?1 AND alias=?2", network, alias);
+  if (rows.length > 1 || rows.some(row => nodeId && row.node_id !== nodeId)) throw Error("node_owner_mismatch");
+  const row = rows[0];
+  // Explicit-ID ownerless claims retain auth.ts's node_owner_unclaimed error;
+  // name-only requests need holder evidence before resolving to that ID.
+  if (row && (row.owner_user_id ? row.owner_user_id !== user : !nodeId && !legacyNodeHolder(user, network, alias, row.node_id))) {
+    throw Error("node_owner_mismatch");
+  }
+  if (!row && db.get(`SELECT token_id FROM api_tokens WHERE network_id=?1 AND name=?2
+    AND user_id<>?3 AND node_identity_epoch=2 AND revoked_at IS NULL
+    AND (expires_at IS NULL OR expires_at > datetime('now')) LIMIT 1`, network, `node:${alias}`, user)) {
+    throw Error("node_owner_mismatch");
+  }
+  return nodeId ?? row?.node_id;
+}

package/src/project-dir-warn-clear-http.test.ts

@@ -0,0 +1,132 @@
+// #667 — a restart from the right directory must clear the cwd warning the
+// previous process left on the same resume_id. Hub stores
+// `task = COALESCE(?11, sessions.task)`, so omitting task keeps the warning.
+// Register sends task: "" once. Later idle reports omit task, so the
+// description of a finished task stays. This boots a throwaway hub on
+// port 0 (never 9200).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { reportedTask } from "../../agent-node/src/project-dir-mismatch.ts";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-667-clear-"));
+process.env.COMMHUB_DB = join(DIR, "hub.db");
+process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+process.env.HOST = "127.0.0.1";
+
+const PW = "ProjectDirWarn123!x";
+const stamp = Date.now();
+const ROOT = "/work";
+const NODE_DIR = "/work/.anet/nodes/demo-node";
+const CONFIG = `${NODE_DIR}/config.json`;
+
+let db: { get: (sql: string, ...params: unknown[]) => { task: string | null } | null };
+let hub: { port: number; stop: (close?: boolean) => void } | null = null;
+let BASE = "";
+let NET = "";
+let node: { alias: string; nodeId: string; token: string };
+
+async function tool(token: string, name: string, args: Record<string, unknown>) {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream",
+      "MCP-Protocol-Version": "2025-03-26",
+    },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  const raw = await res.text();
+  const data = raw.split("\n").filter((line) => line.startsWith("data:"));
+  const payload = data.length ? JSON.parse(data.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+
+function sessionTask(): string | null {
+  return db.get("SELECT task FROM sessions WHERE resume_id = ?1", `sdk-${node.nodeId}`)?.task ?? null;
+}
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { createNetworkTokenForNode, register } = await import("./auth.js");
+  const boss = register(`cwd_boss_${stamp}`, PW);
+  expect(boss.ok).toBe(true);
+  NET = boss.network_id!;
+  const alias = `demo-node-${stamp}`;
+  const nodeId = `n_cwd_${stamp}`;
+  const minted = createNetworkTokenForNode(boss.user!.user_id, NET, alias, nodeId);
+  expect(minted.ok).toBe(true);
+  node = { alias, nodeId, token: minted.token! };
+  const mod = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  expect(hub.port).not.toBe(9200);
+  expect(hub.port).toBeGreaterThan(0);
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop(true); } catch { /* already stopped */ }
+  try { rmSync(DIR, { recursive: true, force: true }); } catch { /* temp dir */ }
+});
+
+describe("#667 restart from the workspace root clears the cwd warning", () => {
+  test("wrong directory writes the warning; the right directory sends \"\" and the hub row is empty", async () => {
+    const resume = `sdk-${node.nodeId}`;
+    const wrong = reportedTask({ configPath: CONFIG, cwd: NODE_DIR, inFlight: 0, status: "idle" });
+    expect(wrong).toContain("目录不一致");
+    const started = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "idle", node_id: node.nodeId, network_id: NET, task: wrong,
+    });
+    expect(started.ok).toBe(true);
+    expect(sessionTask()).toBe(wrong);
+
+    const kept = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "idle", node_id: node.nodeId, network_id: NET,
+    });
+    expect(kept.ok).toBe(true);
+    expect(sessionTask()).toBe(wrong);
+
+    const idle = reportedTask({ configPath: CONFIG, cwd: ROOT, inFlight: 0, status: "idle" });
+    expect(idle).toBeUndefined();
+    const cleared = idle ?? "";
+    expect(cleared).toBe("");
+    const fixed = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "idle", node_id: node.nodeId, network_id: NET, task: cleared,
+    });
+    expect(fixed.ok).toBe(true);
+    expect(sessionTask()).toBe("");
+  });
+
+  test("after startup, a finished task's description stays on the hub", async () => {
+    const resume = `sdk-${node.nodeId}`;
+    const description = "BOARD667-FINISHED-TASK";
+    const startup = reportedTask({ configPath: CONFIG, cwd: ROOT, inFlight: 0, status: "idle" }) ?? "";
+    expect(startup).toBe("");
+    const registered = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "idle", node_id: node.nodeId, network_id: NET, task: startup,
+    });
+    expect(registered.ok).toBe(true);
+    expect(sessionTask()).toBe("");
+
+    const working = reportedTask({
+      configPath: CONFIG, cwd: ROOT, inFlight: 1, status: "working", task: description,
+    });
+    expect(working).toBe(description);
+    const ran = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "working", node_id: node.nodeId, network_id: NET, task: working,
+    });
+    expect(ran.ok).toBe(true);
+    expect(sessionTask()).toBe(description);
+
+    const finished = reportedTask({ configPath: CONFIG, cwd: ROOT, inFlight: 0, status: "idle" });
+    expect(finished).toBeUndefined();
+    const done = await tool(node.token, "report_status", {
+      resume_id: resume, alias: node.alias, status: "idle", node_id: node.nodeId, network_id: NET,
+    });
+    expect(done.ok).toBe(true);
+    expect(sessionTask()).toBe(description);
+  });
+});

package/src/requirement-events-http.test.ts

@@ -73,10 +73,21 @@ beforeAll(async () => {
   // 看全部任务,但一个 Agent 都没授权:所有节点对他隐去
   db.run("UPDATE network_members SET task_access = 'all', agent_access = 'granted' WHERE network_id = ?1 AND user_id = ?2", [NET, restricted.id]);
   NODE = `n_ev_${stamp}`;
-  db.run("INSERT INTO nodes (node_id, node_name, alias, network_id) VALUES (?1, ?2, ?3, ?4)", [NODE, "ev-node", "ev-node", NET]);
   const ntok = createNetworkTokenForNode(admin.id, NET, "ev-node");
   expect(ntok.ok).toBe(true);
   nodeToken = ntok.token!;
+  // Real legacy-client order: mint by name, then register; never fill owner.
+  const registration = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${nodeToken}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "report_status", arguments: {
+      resume_id: `ev-session-${stamp}`, alias: "ev-node", status: "idle", node_id: NODE,
+    } } }),
+  });
+  expect(registration.status).toBe(200);
+  await registration.text();
+  expect(db.get<{owner_user_id: string | null}>("SELECT owner_user_id FROM nodes WHERE node_id=?1", NODE)?.owner_user_id).toBeNull();
+  expect(db.get<{bound_node_id: string | null}>("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", ntok.token_id!)?.bound_node_id).toBe(NODE);
 }, 30_000);
 
 afterAll(() => {

package/src/requirements-last-event-http.test.ts

@@ -92,10 +92,15 @@ beforeAll(async () => {
   // 看全部任务,但一个 Agent 都没授权:所有节点对他隐去
   db.run("UPDATE network_members SET task_access = 'all', agent_access = 'granted' WHERE network_id = ?1 AND user_id = ?2", [NET, restricted.id]);
   NODE = `n_le_${stamp}`;
-  db.run("INSERT INTO nodes (node_id, node_name, alias, network_id) VALUES (?1, ?2, ?3, ?4)", [NODE, "le-node", "le-node", NET]);
   const ntok = createNetworkTokenForNode(admin.id, NET, "le-node");
   expect(ntok.ok).toBe(true);
   nodeToken = ntok.token!;
+  // Real legacy-client order, with no owner backfill or administrator claim.
+  expect((await mcp(nodeToken, "report_status", {
+    resume_id: `le-session-${stamp}`, alias: "le-node", status: "idle", node_id: NODE,
+  })).data.ok).toBe(true);
+  expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id=?1", NODE).owner_user_id).toBeNull();
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", ntok.token_id).bound_node_id).toBe(NODE);
 }, 30_000);
 
 afterAll(() => {

package/src/scheduled-tasks.ts

@@ -1,4 +1,6 @@
 import { db, logTaskEvent } from "./db.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { assertNodeHealthy } from "./node-health-guard.js";
 import { addNetworkScope, canRestWriteNetwork, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
@@ -366,7 +368,7 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
     // Dispatch is not completion. Keep the run open until the exact bound
     // task reaches replied/failed/cancelled/expired; db.ts owns that mirror.
     db.run("UPDATE scheduled_task_runs SET task_id = ?1, status = ?2, completed_at = NULL WHERE run_id = ?3", [taskId, deliveryState, runId]);
-    db.run("UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE node_id = ?2 AND network_id = ?3", [row.task_content.slice(0, 200), node.node_id, row.network_id]);
+    db.run(`UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE node_id = ?2 AND network_id = ?3`, [sessionTaskPreview(row.task_content), node.node_id, row.network_id]);
     db.run("UPDATE scheduled_tasks SET target_alias = ?1, last_run_at = ?2, updated_at = datetime('now') WHERE schedule_id = ?3", [node.alias, scheduledFor, row.schedule_id]);
     if (advanceSchedule) advance({ ...row, target_alias: node.alias }, scheduledFor, advanceAfter);
     createdTaskId = taskId;
@@ -517,7 +519,7 @@ export async function handleScheduledTaskRequest(ctx: ScheduledRequestContext):
       const name = typeof body.name === "string" ? body.name.trim() : "";
       const content = typeof body.task === "string" ? body.task.trim() : "";
       if (!name || name.length > 120) throw new Error("invalid_name");
-      if (!content || content.length > 10_000) throw new Error("invalid_task");
+      if (!content || content.length > TASK_CONTENT_MAX) throw new Error("invalid_task");
       const priority = typeof body.priority === "string" ? body.priority : "normal";
       if (!PRIORITIES.has(priority)) throw new Error("invalid_priority");
       const misfirePolicy = parseMisfirePolicy(body.misfire_policy);
@@ -604,7 +606,7 @@ export async function handleScheduledTaskRequest(ctx: ScheduledRequestContext):
       const content = body.task === undefined ? row.task_content : String(body.task).trim();
       const priority = body.priority === undefined ? row.priority : String(body.priority);
       if (!name || name.length > 120) throw new Error("invalid_name");
-      if (!content || content.length > 10_000) throw new Error("invalid_task");
+      if (!content || content.length > TASK_CONTENT_MAX) throw new Error("invalid_task");
       if (!PRIORITIES.has(priority)) throw new Error("invalid_priority");
       const target = body.target_node_id === undefined ? { node_id: row.target_node_id, alias: row.target_alias } : validateTarget(row.network_id, body.target_node_id);
       const parsed = body.schedule === undefined

package/src/server.ts

@@ -3,6 +3,8 @@ import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
 import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { ifNoneMatchHits, memoStatusBody } from "./status-read-cache";
 import { dispatchQueueInfo, queueDepthByNode, queueDepthKey } from "./task-queue-ahead.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { statusAliasResolverRead } from "./status-alias-resolver.js";
 import { readNodeHealth } from "./node-health-store.js";
 import { wantsAllTools } from "./tool-audience.js";
@@ -793,7 +795,7 @@ function withNetworkNameAlias<T extends { network_name?: unknown }>(row: T): T &
 // ── REST input schema ───────────────────────────────
 const TaskSchema = z.object({
   alias: z.string().min(1).max(200),
-  task: z.string().min(1).max(10000),
+  task: z.string().min(1).max(TASK_CONTENT_MAX),
   priority: z.enum(["high", "normal", "low"]).default("normal"),
   from: z.string().max(200).optional(),
   network_id: z.string().max(200).optional(),
@@ -3688,8 +3690,8 @@ return Bun.serve({
         // immediately, without waiting for the agent's report_status to
         // arrive. Updating both `task` and `updated_at` is enough — we
         // leave `status` to the agent (idle → working → idle).
-        const touchParams: any[] = [body.task.slice(0, 200), targetAlias];
-        let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
+        const touchParams: any[] = [sessionTaskPreview(body.task), targetAlias];
+        let touchSql = `UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE alias = ?2`;
         if (taskNetId) { touchSql += " AND network_id = ?3"; touchParams.push(taskNetId); }
         db.run(touchSql, touchParams);
       });

package/src/session-task-on-dispatch.ts

@@ -0,0 +1,14 @@
+// Board #668. A dispatch preview is what the hub shows before the node
+// reports. Once the session is already working, that text is the task in
+// flight — a newer message waits in the inbox and must not replace it.
+// Idle and every other status still take the preview.
+
+const PLACEHOLDER = /^\?\d+$/;
+
+/** SQL expression for `sessions.task` on dispatch. `placeholder` is a `?N` bind. */
+export function sessionTaskOnDispatch(placeholder: string): string {
+  if (!PLACEHOLDER.test(placeholder)) {
+    throw new Error("sessionTaskOnDispatch placeholder must be a ?N bind");
+  }
+  return `CASE WHEN status = 'working' THEN task ELSE ${placeholder} END`;
+}

package/src/shared/task-content-limit-drift.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { SESSION_TASK_PREVIEW_MAX, TASK_CONTENT_MAX, sessionTaskPreview } from "./task-content-limit.js";
+
+// Board #668 — the node reports the whole task so the hub can match it
+// against tasks.content. Both sides must agree on the cap.
+const HUB_PATH = join(import.meta.dir, "task-content-limit.ts");
+const NODE_PATH = join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "task-content-limit.ts");
+
+describe("#668 — hub/node task-content-limit drift guard", () => {
+  test("byte-identical source files", () => {
+    expect(readFileSync(NODE_PATH, "utf-8")).toBe(readFileSync(HUB_PATH, "utf-8"));
+  });
+
+  test("constants equal at runtime", async () => {
+    const node = await import(NODE_PATH);
+    expect(node.TASK_CONTENT_MAX).toBe(TASK_CONTENT_MAX);
+    expect(node.SESSION_TASK_PREVIEW_MAX).toBe(SESSION_TASK_PREVIEW_MAX);
+  });
+
+  test("preview is the first 200 chars", () => {
+    expect(SESSION_TASK_PREVIEW_MAX).toBe(200);
+    const long = "字".repeat(TASK_CONTENT_MAX);
+    expect(sessionTaskPreview(long)).toBe(long.slice(0, 200));
+    expect(sessionTaskPreview("short")).toBe("short");
+  });
+});

package/src/shared/task-content-limit.ts

@@ -0,0 +1,25 @@
+// Board #668 — task text limits shared by hub and node.
+//
+// This file is byte-identical in server/src/shared/task-content-limit.ts and
+// agent-node/src/shared/task-content-limit.ts (task-content-limit-drift.test.ts
+// fails the build on any difference).
+//
+// TASK_CONTENT_MAX is the cap every dispatch entry (send_task, REST /api/task,
+// scheduled tasks) and report_status.task accept. The node reports the whole
+// task text so the hub can match it against tasks.content and write
+// started_at. If the dispatch cap grew without the node and report_status
+// following, long tasks would silently stop matching again.
+//
+// SESSION_TASK_PREVIEW_MAX is what the hub keeps in sessions.task. That column
+// is readable by get_all_status, the full /api/status and members who may see
+// the agent but not its conversations, so only a short preview is stored —
+// the full text is used for matching, never persisted on the session row.
+
+export const TASK_CONTENT_MAX = 10_000;
+
+export const SESSION_TASK_PREVIEW_MAX = 200;
+
+/** The preview stored in sessions.task — same cut as the dispatch preview. */
+export function sessionTaskPreview(task: string): string {
+  return task.slice(0, SESSION_TASK_PREVIEW_MAX);
+}

package/src/tools.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
+import { lockNodeAlias } from "./node-token-ownership.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
 import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
@@ -9,6 +10,8 @@ import { noteModelAuthHealth } from "./model-auth-notify.js";
 import { numberedAliasInClause, parseAliasFilter } from "./alias-filter.js";
 import { createHash } from "node:crypto";
 import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
 import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
@@ -680,7 +683,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       resume_id: z.string().min(1).max(200).describe("Claude Code session UUID (unique per session)"),
       alias: z.string().min(1).max(200).describe("Human-readable session name for dispatching (e.g. 指挥室/知识哥)"),
       status: z.enum(["working", "idle", "blocked", "error", "waiting_input", "offline"]),
-      task: z.string().max(10000).optional().describe("Current task description"),
+      task: z.string().max(TASK_CONTENT_MAX).optional().describe("Current task description (the hub stores only the first 200 chars on the session row; the full text is matched against tasks.content)"),
       output: z.string().max(50000).optional().describe("Recent output (max 4000 chars stored)"),
       score: z.number().min(0).max(10).optional().describe("Self-score 1-10"),
       progress: z.number().min(0).max(100).optional().describe("Progress 0-100"),
@@ -1048,6 +1051,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         ) ?? null;
         const keep = <T,>(fresh: T | null | undefined, column: string): T | null =>
           (fresh ?? (handover?.[column] as T | null | undefined) ?? null);
+        // #668 — the node reports the whole task so the tasks UPDATE below can match
+        // tasks.content. sessions.task is readable far wider than the task row
+        // (get_all_status, full /api/status, members who see the agent but not its
+        // conversations), so only the dispatch-sized preview is stored here.
+        const sessionTask = task == null ? null : sessionTaskPreview(task); // board668-session-preview
         db.run("DELETE FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3", [effectiveAlias, resume_id, sessionNetId]);
         db.run(
           `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, external_schedules, peer_reply_inbox_capable, last_seen_at, updated_at)
@@ -1079,7 +1087,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              external_schedules = COALESCE(?34, sessions.external_schedules),
              peer_reply_inbox_capable = ?35,
              last_seen_at = datetime('now'), updated_at = datetime('now')`,
-          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
+          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, sessionTask, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
         );
         if (handover) {
           // 换 resume_id 那条路径上 ON CONFLICT 不会触发;INSERT 完再把没上报(仍为 NULL)的
@@ -1739,7 +1747,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "Dispatch a task to a session's inbox (by alias). The reply carries queue_ahead (open tasks already on the target), target_busy, est_wait_minutes (rough, null = no history) and, when the queue is long, a warning: queued, never refused — consider an idle node.",
     {
       alias: z.string().min(1).max(200).describe("Target session alias"),
-      task: z.string().min(1).max(10000).describe("Task content"),
+      task: z.string().min(1).max(TASK_CONTENT_MAX).describe("Task content"),
       priority: z.enum(["high", "normal", "low"]).optional().default("normal"),
       context: z.string().max(10000).optional(),
       from_session: z.string().max(200).optional(),
@@ -1771,8 +1779,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
 
       // Resolve parent_task_id: explicit > inferred (caller's most recent
-      // delivered/started inbox task that's still open). Inference is the
-      // safety net for when the LLM forgets to pass parent_task_id.
+      // delivered inbox task). Inference is the safety net for when the LLM
+      // forgets to pass parent_task_id.
+      //
+      // #668 — only 'delivered'. 'started' was never a tasks status. A task
+      // the caller has acked or is running is NOT inferred: an unrelated
+      // dispatch without parent_task_id would hang under it, the child's
+      // reply would close it early (chainReplyToParent), and the node's own
+      // reply would then be refused as reply_task_terminal.
       //
       // round5 F1 fix: the inference SELECT MUST be network-scoped. Without
       // it, a caller in network B can pick up the parent_task_id of a
@@ -1782,7 +1796,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
         try {
           const recentParams: any[] = [from_session];
-          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered','started')";
+          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered')"; // board668-parent-delivered-only
           recentSql = addScope(recentSql, recentParams, effectiveNetId);
           recentSql += " ORDER BY created_at DESC LIMIT 1";
           const recent = db.get<{ task_id: string }>(recentSql, ...recentParams);
@@ -1930,8 +1944,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
            VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'delivered', ?7, 'reply', datetime('now'), datetime('now'), datetime('now', ?8), ?9, ?10, ?11)`,
           [id, fromNodeId, from_session, targetNodeId, targetAlias, priority, task, `+${ttl_seconds || 3600} seconds`, effectiveNetId ?? null, parentTaskId, metaJson]
         );
-        const touchParams: any[] = [task.slice(0, 200), targetAlias];
-        let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
+        const touchParams: any[] = [sessionTaskPreview(task), targetAlias];
+        let touchSql = `UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE alias = ?2`;
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
         // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
@@ -4353,7 +4367,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "auth_required" }) }] };
       }
       db.run(
-        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)`,
+        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 2)`,
         [childTokenId, hashToken(childToken), enforceUserId, networkIdForChild, `node:${node_spec.name}`, "network", "child", requestId]
       );
 
@@ -6269,6 +6283,13 @@ export function trustedConfigSnapshotForNode(
 }
 
 export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
+  return db.transaction(() => {
+    if (input.callerNetworkId && input.alias) lockNodeAlias(input.callerNetworkId, input.alias, input.node_id ?? undefined);
+    return upsertNodeIdentity(input);
+  });
+}
+
+function upsertNodeIdentity(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
   if (!input.node_id) return { result: "skipped", reason: "missing_node_id" };
   const existing = db.get<{ network_id: string | null; owner_user_id: string | null; alias: string | null; config_path: string | null }>(
     "SELECT network_id, owner_user_id, alias, config_path FROM nodes WHERE node_id = ?1",
@@ -6280,8 +6301,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
   // report only that exact node. Legacy unbound ntok rows remain compatible,
   // but they can never consume owner-gated schedule intents.
   if (input.callerTokenId) {
-    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null }>(
-      "SELECT bound_node_id, user_id, network_id FROM api_tokens WHERE token_id = ?1",
+    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null; node_identity_epoch: number; name: string }>(
+      "SELECT bound_node_id, user_id, network_id, node_identity_epoch, name FROM api_tokens WHERE token_id = ?1",
       input.callerTokenId,
     );
     if (token?.bound_node_id && token.bound_node_id !== input.node_id) {
@@ -6290,6 +6311,16 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     if (token?.network_id && _norm(token.network_id) !== _norm(callerNet)) {
       return { result: "refused", reason: "cross_network", existingNet: existing?.network_id ?? null, callerNet };
     }
+    // New name-only node tokens bind once, at their first registration. General
+    // tokens renamed by report_status are deliberately NOT upgraded to epoch 2.
+    if (token?.node_identity_epoch === 2 && !token.bound_node_id) {
+      const conflict = db.get("SELECT node_id FROM nodes WHERE network_id=?1 AND alias=?2 AND node_id<>?3 LIMIT 1",
+        callerNet, input.alias ?? "", input.node_id);
+      if (conflict || token.name !== `node:${input.alias}` || token.user_id !== input.callerUserId || existing) {
+        console.warn(`[commhub] 🚫 report_status node upsert refused (identity_mismatch): node_id=${input.node_id} first-binding conflict`);
+        return { result: "refused", reason: "identity_mismatch", existingNet: existing?.network_id ?? null, callerNet };
+      }
+    }
   }
   if (existing?.owner_user_id && input.callerUserId !== existing.owner_user_id) {
     return { result: "refused", reason: "owner_mismatch", existingNet: existing.network_id, callerNet };
@@ -6354,6 +6385,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       callerNet ?? null,
     ],
   );
+  if (input.callerTokenId) db.run(`UPDATE api_tokens SET bound_node_id=?1
+    WHERE token_id=?2 AND node_identity_epoch=2 AND bound_node_id IS NULL`, [input.node_id, input.callerTokenId]);
   const trustedSnapshot = trustedConfigSnapshotForNode(
     input.config_snapshot,
     input.callerTokenId,