@sleep2agi/commhub-server 0.9.0-preview.110 → 0.9.0-preview.112

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.110",
+  "version": "0.9.0-preview.112",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.ts

@@ -3,6 +3,7 @@
  */
 import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js"; import { deleteDepartmentsForNetwork, groupTx, removeMemberFromChatGroups } from "./departments.js"; // #419: also ensures network_members.department_id exists (same line on purpose: docs pin auth.ts line numbers)
 import { WEAK_PASSWORDS } from "./password-dict.js";
+import { checkNodeTokenClaim, legacyNodeHolder } from "./node-token-ownership.js";
 import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 import { deleteAgentGrants, isAgentRestricted } from "./agent-access.js"; import { deleteTaskGrantsForMember, NEW_MEMBER_TASK_ACCESS, type TaskAccessMode } from "./task-access.js"; // 一行两个 import:文档钉着 auth.ts 的行号
 
@@ -136,7 +137,7 @@ export function register(username: string, password: string, email?: string, dis
   const userToken = generateUserToken();
   const userTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
     [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256)]
   );
 
@@ -144,7 +145,7 @@ export function register(username: string, password: string, email?: string, dis
   const networkToken = generateNetworkToken();
   const networkTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [networkTokenId, hashToken(networkToken), userId, networkId, "default-network", "network"]
   );
 
@@ -216,7 +217,7 @@ export function login(username: string, password: string, client: SessionClientI
   const userToken = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
     [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256)]
   );
 
@@ -246,8 +247,9 @@ export function login(username: string, password: string, client: SessionClientI
  *
  * RFC-036: callers that provide nodeId atomically establish the immutable
  * node-owner binding before the plaintext token is returned. The 3-argument
- * legacy form remains available for old clients, but its token has no bound
- * node id and therefore cannot consume external-schedule edit intents.
+ * name-only form remains available: new identities bind on first registration,
+ * and a verified same-holder refresh binds to the existing unique node. This
+ * does not fill NULL row owners or grant external-schedule ownership.
  */
 export function createNetworkTokenForNode(userId: string, networkId: string, nodeName: string, nodeId?: string): { ok: boolean; token?: string; token_id?: string; node_id?: string; error?: string } {
   // Verify user is a member of this network with write access
@@ -262,16 +264,18 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
   const tokenId = generateId("tok");
   try {
     db.transaction(() => {
+      nodeId = checkNodeTokenClaim(userId, networkId, nodeName, nodeId);
       if (nodeId) {
-        const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
-          "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
+        const existing = db.get<{ network_id: string | null; owner_user_id: string | null; alias: string | null }>(
+          "SELECT network_id, owner_user_id, alias FROM nodes WHERE node_id = ?1",
           nodeId,
         );
         if (existing?.network_id && existing.network_id !== networkId) throw new Error("cross_network_node");
+        if (existing?.alias && existing.alias !== nodeName) throw new Error("node_owner_mismatch");
         // Existing pre-RFC-036 rows have no trustworthy owner anchor. A token
         // refresh must not turn knowledge of a legacy node_id into ownership.
-        // They remain read-only until a separately authorized migration.
-        if (existing && !existing.owner_user_id) throw new Error("node_owner_unclaimed");
+        // A same-holder refresh binds the token, without filling the row owner.
+        if (existing && !existing.owner_user_id && !legacyNodeHolder(userId, networkId, nodeName, nodeId)) throw new Error("node_owner_unclaimed");
         if (existing?.owner_user_id && existing.owner_user_id !== userId) throw new Error("node_owner_mismatch");
         db.run(
           `INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, updated_at)
@@ -280,7 +284,7 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
              node_name = COALESCE(nodes.node_name, ?2),
              alias = COALESCE(nodes.alias, ?2),
              network_id = COALESCE(nodes.network_id, ?3),
-             owner_user_id = COALESCE(nodes.owner_user_id, ?4),
+             owner_user_id = nodes.owner_user_id,
              updated_at = datetime('now')`,
           [nodeId, nodeName, networkId, userId],
         );
@@ -293,7 +297,7 @@ export function createNetworkTokenForNode(userId: string, networkId: string, nod
         }
       }
       db.run(
-        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6)",
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, bound_node_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, 'network', ?6, 2)",
         [tokenId, hashToken(token), userId, networkId, `node:${nodeName}`, nodeId ?? null],
       );
     });
@@ -505,7 +509,7 @@ export function createToken(userId: string, name: string, networkId?: string): {
   const token = generateToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [tokenId, hashToken(token), userId, networkId || null, name, "full"]
   );
   return { ok: true, token, token_id: tokenId };
@@ -520,7 +524,7 @@ export function issueUserToken(userId: string, name = "user-login"): { token: st
   const token = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, NULL, ?4, 'user')",
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', 1)",
     [tokenId, hashToken(token), userId, name]
   );
   return { token, token_id: tokenId };
@@ -748,7 +752,7 @@ export function joinByInvite(inviteCode: string, userId: string): { ok: boolean;
   // Auto-create a token for this network
   const token = generateToken();
   const tokenId = generateId("tok");
-  db.run("INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+  db.run("INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
     [tokenId, hashToken(token), userId, invite.network_id, "auto-join", "full"]);
   return { ok: true, network_id: invite.network_id, role: invite.role };
 }

package/src/binding-generation-http.test.ts

@@ -0,0 +1,121 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { preflightCodexStart } from "../../agent-node/src/runtime/adopt-codex-start-preflight.js";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync("/tmp/binding-http-")}/hub.db`;
+process.env.COMMHUB_AUTH_TOKEN ||= "binding-master-fixture";
+let db:any, hub:ReturnType<typeof Bun.serve>, base:string, owner:any, other:any;
+const daemon="n_binding_daemon", child="n_binding_child";
+let token:string, wrong:string, cross:string, ordinary:string, revoked:string;
+async function mcp(credential:string,name:string,args:Record<string,unknown>={}) {
+  const res=await fetch(`${base}/mcp`, {method:"POST",headers:{Authorization:`Bearer ${credential}`,
+    "Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},
+    body:JSON.stringify({jsonrpc:"2.0",id:1,method:"tools/call",params:{name,arguments:args}})});
+  const raw=await res.text();
+  if(res.status!==200)return {ok:false,http_status:res.status};
+  const lines=raw.split("\n").filter(s=>s.startsWith("data:"));
+  const payload=JSON.parse(lines.length?lines.at(-1)!.slice(5):raw);
+  return payload.result?.content?.[0]?.text ? JSON.parse(payload.result.content[0].text) : {ok:false,error:payload.error};
+}
+const list=(t=token)=>mcp(t,"list_my_children");
+const request=()=>mcp(owner.token,"request_adopt_node",{node_id:child,daemon_node_id:daemon,workdir:"/fixture/project"});
+const ack=(id:string,status="adopted")=>mcp(token,"ack_adopt_request",{request_id:id,status});
+const unadopt=()=>mcp(owner.token,"unadopt_node",{node_id:child});
+async function activate(){const r=await request();expect(r.ok).toBe(true);expect((await ack(r.request_id)).status).toBe("active");return r.request_id;}
+beforeAll(async()=>{
+  ({db}=await import("./db.js"));
+  const {register}=await import("./auth.js");
+  owner=register("binding_owner","Fixture-Strong1!");other=register("binding_other","Fixture-Strong1!");
+  expect(owner.ok&&other.ok).toBe(true);
+  db.run("UPDATE users SET role='user' WHERE user_id=?1",[other.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role) VALUES(?1,?2,'member')",[owner.network_id,other.user.user_id]);
+  const {generateNetworkToken,hashToken}=await import("./db.js");
+  function node(id:string,network:string,user:string,supervisor=true){
+    db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state) VALUES(?1,?1,?1,?2,?3,'fixture-host',?4,'active')",
+      [id,network,user,JSON.stringify(supervisor?{role:"host_supervisor",daemon_capabilities:{adopt_capable:true}}:{})]);
+    db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES(?1,?1,?1,?2,'idle',datetime('now'))",[id,network]);
+    const raw=generateNetworkToken();
+    db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES(?1,?2,?3,'network',?4,?5)",[id,user,network,`node:${id}`,hashToken(raw)]);
+    return raw;
+  }
+  token=node(daemon,owner.network_id,owner.user.user_id);
+  wrong=node("n_binding_other",owner.network_id,other.user.user_id);
+  cross=node("n_binding_cross",other.network_id,other.user.user_id);
+  node(child,owner.network_id,owner.user.user_id,false);
+  ordinary=generateNetworkToken();revoked=generateNetworkToken();
+  for(const [id,raw,name,dead] of [["ordinary",ordinary,"general",null],["revoked",revoked,`node:${daemon}`,"2020-01-01"]])
+    db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash,revoked_at) VALUES(?1,?2,?3,'network',?4,?5,?6)",[id,owner.user.user_id,owner.network_id,name,hashToken(raw as string),dead]);
+  db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,lifecycle_state) VALUES('node_binding_created','created','created',?1,'active')",[owner.network_id]);
+  db.run("INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,flags_json,env_keys,status,created_at,created_by_token) VALUES('cr_binding_created',?1,'created',?2,'codex-sdk','{}','[]','succeeded',1,'fixture')",[daemon,owner.network_id]);
+  const {bootServer}=await import("./server.js");hub=bootServer({port:0,hostname:"127.0.0.1"});base=`http://127.0.0.1:${hub.port}`;
+},60000);
+afterAll(()=>hub?.stop(true));
+
+test("generation projection and unchanged created row",async()=>{
+  const id=await activate();
+  const r=await list();expect(r.ok).toBe(true);
+  expect((await mcp(token,"get_adopt_request",{request_id:id})).error).toBe("request_not_pending");
+  expect(r.children.find((n:any)=>n.child_node_id===child)).toEqual({child_node_id:child,alias:child,lifecycle_state:"active",managed:"adopted",binding_request_id:id});
+  expect(r.children.find((n:any)=>n.child_node_id==="node_binding_created")).toEqual({child_node_id:"node_binding_created",alias:"created",lifecycle_state:"active"});
+  // Old consumers continue reading exactly the same fields; additive only.
+  expect(r.children.map(({child_node_id,alias,lifecycle_state,managed}:any)=>({child_node_id,alias,lifecycle_state,managed}))).toContainEqual({child_node_id:child,alias:child,lifecycle_state:"active",managed:"adopted"});
+  expect((await unadopt()).ok).toBe(true);
+});
+test("token boundary denies humans general revoked and other owners",async()=>{
+  await activate();
+  for(const t of [owner.token,other.token,ordinary,revoked])expect((await list(t)).ok).toBe(false);
+  for(const t of [wrong,cross]){const r=await list(t);expect(r.ok).toBe(true);expect(r.children).toEqual([]);}
+  expect((await unadopt()).ok).toBe(true);
+});
+test("child node token sees an empty list, not its parent binding",async()=>{
+  const id=await activate();
+  try {
+    const issued=await fetch(`${base}/api/auth/node-token`,{method:"POST",
+      headers:{Authorization:`Bearer ${owner.token}`,"Content-Type":"application/json"},
+      body:JSON.stringify({network_id:owner.network_id,node_name:child,node_id:child})});
+    expect(issued.status).toBe(200);
+    const credential=await issued.json() as any;
+    expect(credential.ok).toBe(true);
+    expect(typeof credential.token).toBe("string");
+    // Same owner and network do not confer the parent's daemon identity.
+    expect((await list()).children.find((n:any)=>n.child_node_id===child).binding_request_id).toBe(id);
+    expect(await list(credential.token)).toEqual({ok:true,count:0,children:[]});
+  } finally {expect((await unadopt()).ok).toBe(true);}
+});
+test("network predicate rejects corrupted cross-network binding sentinel",async()=>{
+  const id=await activate();
+  // Deliberately inconsistent test DB: daemon stays in A, binding and child in B.
+  // This makes the network predicate independently load-bearing, HTTP still real.
+  try {
+    db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2",[other.network_id,id]);
+    db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[other.network_id,child]);
+    expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  } finally {
+    db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2",[owner.network_id,id]);
+    db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[owner.network_id,child]);await unadopt();
+  }
+});
+test("node join rejects mismatched node network sentinel",async()=>{
+  await activate();
+  try {db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[other.network_id,child]);expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);}
+  finally {db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[owner.network_id,child]);await unadopt();}
+});
+test("non-active bindings never project generation",async()=>{
+  const r=await request();expect(r.ok).toBe(true);
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  expect((await ack(r.request_id,"refused")).status).toBe("refused");
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  await activate();await unadopt();expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+});
+test("revocation rotates generation and old acknowledgements cannot revive",async()=>{
+  const r1=await activate();await unadopt();
+  expect((await ack(r1)).error).toBe("request_not_pending");
+  const r2=await request();expect(r2.ok).toBe(true);expect(r2.request_id).not.toBe(r1);
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  expect((await ack(r2.request_id)).status).toBe("active");
+  const current=(await list()).children.find((n:any)=>n.child_node_id===child).binding_request_id;
+  expect(current).toBe(r2.request_id);expect(current).not.toBe(r1);
+  // Real HTTP authority feeds the existing daemon gate; later probes must not run.
+  for(const authority of [current,undefined])await expect(preflightCodexStart({request_id:r1} as any,{} as any,{} as any,authority,()=>true)).rejects.toThrow("adopt_codex_binding_generation_unproven");
+  await unadopt();
+});

package/src/create-node.ts

@@ -232,40 +232,91 @@ export type DaemonResolveResult =
   | { ok: true; daemonNodeId: string; daemonAlias: string; networkId: string }
   | { ok: false; error: string };
 
+export type NodeCallerResolution =
+  | { ok: true; kind: "node"; nodeId: string; alias: string; networkId: string }
+  | { ok: true; kind: "unregistered"; alias: string; networkId: string }
+  | { ok: false; reason: "not_a_node_token" | "bound_node_missing" | "ambiguous" | "not_owner" };
+
+type NodeCallerRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+
+// nodes has no unique (network, alias). An unbound token that hits several
+// rows is not rejected outright: the row owned by the token's issuer wins;
+// if that is still not unique, the node_id on the latest session for the
+// alias wins. Still not unique, then refuse.
+function disambiguateUnboundAlias(
+  rows: NodeCallerRow[],
+  userId: string | null,
+  alias: string,
+  networkId: string,
+): NodeCallerRow | undefined {
+  const owned = userId ? rows.filter((row) => row.owner_user_id === userId) : [];
+  if (owned.length === 1) return owned[0]; // board679-unbound-dup
+  const pool = owned.length > 1 ? owned : rows;
+  const recent = db.get<{ node_id: string | null }>(
+    `SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND node_id IS NOT NULL ORDER BY updated_at DESC LIMIT 1`,
+    alias,
+    networkId,
+  );
+  const hit = recent?.node_id ? pool.filter((row) => row.node_id === recent.node_id) : [];
+  return hit.length === 1 ? hit[0] : undefined;
+}
+
+// One lookup for every caller-identity entry. The token name is a hint.
+// bound_node_id is the row: if that row is gone, refuse — do not look up by name.
+// An unbound token with no row in its network stays the token name. First
+// registration (report_status) still depends on that; sending and subscribing
+// do not get a second exception.
+export function resolveNodeCaller(tokenId: string | null | undefined): NodeCallerResolution {
+  if (!tokenId) return { ok: false, reason: "not_a_node_token" };
+  const tokRow = db.get<{ name: string; network_id: string | null; user_id: string | null; bound_node_id: string | null; node_identity_epoch: number }>(
+    `SELECT name, network_id, user_id, bound_node_id, node_identity_epoch FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
+    tokenId,
+  );
+  if (!tokRow || !tokRow.name || !tokRow.name.startsWith("node:") || !tokRow.network_id) {
+    return { ok: false, reason: "not_a_node_token" };
+  }
+  const tokenAlias = tokRow.name.slice(5);
+  type DaemonRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+  const rows = tokRow.bound_node_id
+    ? db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE node_id = ?1 AND network_id = ?2`, tokRow.bound_node_id, tokRow.network_id)
+    : db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE alias = ?1 AND network_id = ?2`, tokenAlias, tokRow.network_id);
+  const nodeRow = rows.length === 1
+    ? rows[0]
+    : (!tokRow.bound_node_id && rows.length > 1
+      ? disambiguateUnboundAlias(rows, tokRow.user_id, tokenAlias, tokRow.network_id)
+      : undefined);
+  // board679-bound-row-missing: a bound token with no row is refused. Do not look up by name.
+  if (tokRow.bound_node_id && !nodeRow) return { ok: false, reason: "bound_node_missing" };
+  if (!nodeRow && rows.length === 0) {
+    return { ok: true, kind: "unregistered", alias: tokenAlias, networkId: tokRow.network_id };
+  }
+  if (!nodeRow) return { ok: false, reason: "ambiguous" };
+  // Legacy unbound tokens keep their owner's authority. A token name is only a hint.
+  const ownsNode = !!tokRow.user_id && tokRow.user_id === nodeRow.owner_user_id;
+  const boundToNode = tokRow.bound_node_id === nodeRow.node_id;
+  const legacyOwnerless = nodeRow.owner_user_id === null && tokRow.node_identity_epoch === 0;
+  if (!ownsNode && !boundToNode && !legacyOwnerless) return { ok: false, reason: "not_owner" };
+  return { ok: true, kind: "node", nodeId: nodeRow.node_id, alias: nodeRow.alias, networkId: nodeRow.network_id };
+}
+
 export function resolveCallerDaemonTokenBound(opts: {
   callerTokenIsNetwork: boolean;
   callerTokenId: string | null | undefined;
   enforceNetworkId: string | null | undefined;
 }): DaemonResolveResult {
-  if (!opts.callerTokenIsNetwork || !opts.callerTokenId) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
-  if (!opts.enforceNetworkId) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
-  const tokRow = db.get<{ name: string; network_id: string | null }>(
-    `SELECT name, network_id FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
-    opts.callerTokenId,
-  );
-  if (!tokRow || !tokRow.name || !tokRow.name.startsWith("node:")) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
-  if (tokRow.network_id !== opts.enforceNetworkId) {
+  if (!opts.callerTokenIsNetwork || !opts.callerTokenId || !opts.enforceNetworkId) {
     return { ok: false, error: "caller_not_a_daemon" };
   }
-  const tokenAlias = tokRow.name.slice(5);
-  const nodeRow = db.get<{ node_id: string; alias: string; network_id: string }>(
-    `SELECT node_id, alias, network_id FROM nodes WHERE alias = ?1 AND network_id = ?2 LIMIT 1`,
-    tokenAlias, tokRow.network_id,
-  );
-  if (!nodeRow) {
+  const resolved = resolveNodeCaller(opts.callerTokenId);
+  // No row yet is not a daemon. First registration stays on report_status.
+  if (!resolved.ok || resolved.kind !== "node" || resolved.networkId !== opts.enforceNetworkId) {
     return { ok: false, error: "caller_not_a_daemon" };
   }
   return {
     ok: true,
-    daemonNodeId: nodeRow.node_id,
-    daemonAlias: nodeRow.alias,
-    networkId: nodeRow.network_id,
+    daemonNodeId: resolved.nodeId,
+    daemonAlias: resolved.alias,
+    networkId: resolved.networkId,
   };
 }
 

package/src/daemon-token-owner-http.test.ts

@@ -0,0 +1,231 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { nodeTokenReissueError } from "../../agent-network/src/cli-errors";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync("/tmp/owner678-")}/hub.db`;
+let db: any, hub: ReturnType<typeof Bun.serve>, base: string;
+let owner: any, member: any, outsider: any, legacy: string, mismatched: string, bound: string;
+let wrongBound: string, ownerless: string, revoked: string, crossNetwork: string, requestId: string;
+const daemon = "n_owner_fixture_daemon", child = "n_owner_fixture_child";
+
+async function call(token: string, name: string, args: Record<string, unknown> = {}) {
+  const response = await fetch(`${base}/mcp`, {
+    method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  expect(response.status).toBe(200);
+  const raw = await response.text(), lines = raw.split("\n").filter(line => line.startsWith("data:"));
+  const message = JSON.parse(lines.length ? lines.at(-1)!.slice(5) : raw);
+  expect(message.error).toBeUndefined();
+  return JSON.parse(message.result.content[0].text);
+}
+async function mint(token: string, network: string, name: string, nodeId?: string) {
+  const response = await fetch(`${base}/api/auth/node-token`, { method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ network_id: network, node_name: name, ...(nodeId ? { node_id: nodeId } : {}) }),
+  });
+  return { status: response.status, body: await response.json() as any };
+}
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const { generateNetworkToken, hashToken } = await import("./db.js");
+  owner = register("owner678", "Fixture-Strong1!");
+  member = register("member678", "Fixture-Strong1!");
+  outsider = register("outside678", "Fixture-Strong1!");
+  db.run("UPDATE users SET role='user' WHERE user_id IN (?1,?2)", [member.user.user_id, outsider.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role) VALUES(?1,?2,'member')", [owner.network_id, member.user.user_id]);
+  for (const id of [daemon, child, "n_ownerless_fixture"]) {
+    db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state)
+      VALUES(?1,?1,?1,?2,?3,'fixture-host',?4,'active')`, [id, owner.network_id,
+      id === "n_ownerless_fixture" ? null : owner.user.user_id,
+      JSON.stringify(id === daemon ? { role: "host_supervisor", daemon_capabilities: { adopt_capable: true } } : {})]);
+  }
+  db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES(?1,?1,?1,?2,'idle',datetime('now'))", [daemon, owner.network_id]);
+  function credential(label: string, user: string, node: string | null = null, alias = daemon, network = owner.network_id) {
+    const token = generateNetworkToken();
+    db.run(`INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash,bound_node_id)
+      VALUES(?1,?2,?3,'network',?4,?5,?6)`, [label, user, network, `node:${alias}`, hashToken(token), node]);
+    return token;
+  }
+  legacy = credential("owner678_legacy", owner.user.user_id);
+  mismatched = credential("owner678_mismatch", member.user.user_id);
+  bound = credential("owner678_bound", member.user.user_id, daemon);
+  wrongBound = credential("owner678_wrong_bound", member.user.user_id, "n_absent_bound");
+  ownerless = credential("owner678_ownerless", member.user.user_id, null, "n_ownerless_fixture");
+  db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'");
+  revoked = credential("owner678_revoked", owner.user.user_id);
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id='owner678_revoked'");
+  crossNetwork = credential("owner678_cross", outsider.user.user_id, daemon, daemon, outsider.network_id);
+  const { bootServer } = await import("./server.js");
+  hub = bootServer({ port: 0, hostname: "127.0.0.1" }); base = `http://127.0.0.1:${hub.port}`;
+  const request = await call(owner.token, "request_adopt_node", { node_id: child, daemon_node_id: daemon, workdir: "/fixture/project" });
+  expect(request.ok).toBe(true); requestId = request.request_id;
+}, 60000);
+afterAll(() => hub?.stop(true));
+
+test("name-only issuance checks existing ownership atomically", async () => {
+  const count = () => db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  const before = count();
+  expect(await mint(member.token, owner.network_id, daemon)).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(await mint(owner.token, owner.network_id, "n_ownerless_fixture")).toEqual({ status: 400, body: { ok: false, error: "node_owner_mismatch" } });
+  expect(count()).toBe(before);
+  // Legacy owner refresh and a new node name remain supported.
+  const refresh = await mint(owner.token, owner.network_id, daemon);
+  expect(refresh.status).toBe(200);
+  expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  expect((await mint(member.token, owner.network_id, "fresh678")).status).toBe(200);
+  expect((await mint(member.token, owner.network_id, daemon, daemon)).body.error).toBe("node_owner_mismatch");
+});
+
+// Every daemon-facing handler must fail at the shared identity boundary,
+// not incidentally at request lookup or argument validation.
+const endpoints: [string, Record<string, unknown>][] = [
+  ["list_my_pending_create_requests", {}], ["list_my_pending_lifecycle_requests", {}],
+  ["get_create_request", { request_id: "cr_fixture_absent" }],
+  ["ack_create_request", { request_id: "cr_fixture_absent", status: "started" }],
+  ["get_stop_request", { request_id: "sr_fixture_absent" }],
+  ["ack_stop_request", { request_id: "sr_fixture_absent", status: "stopped" }],
+  ["get_start_request", { request_id: "start_fixture_absent" }],
+  ["ack_start_request", { request_id: "start_fixture_absent", status: "started" }],
+  ["list_my_children", {}], ["get_adopt_request", {}], ["ack_adopt_request", { status: "adopted" }],
+  ["get_probe_request", { probe_id: "probe_fixture_absent" }],
+  ["ack_probe_request", { probe_id: "probe_fixture_absent", status: "ok", latency_ms: 1 }],
+];
+for (const [name, arguments_] of endpoints) {
+  test(`daemon identity boundary: ${name}`, async () => {
+    const args = name.includes("adopt_request") ? { ...arguments_, request_id: requestId } : arguments_;
+    for (const token of [mismatched, wrongBound, ownerless, owner.token, member.token]) {
+      expect(await call(token, name, args)).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+    }
+    expect(db.get("SELECT status FROM node_daemon_bindings WHERE request_id=?1", requestId).status).toBe("pending");
+  });
+}
+
+test("legacy owner and exact bound identity remain supported", async () => {
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id='owner678_legacy'").bound_node_id).toBeNull();
+  for (const token of [legacy, bound]) {
+    expect((await call(token, "list_my_children")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_create_requests")).ok).toBe(true);
+    expect((await call(token, "list_my_pending_lifecycle_requests")).ok).toBe(true);
+    expect((await call(token, "get_adopt_request", { request_id: requestId })).ok).toBe(true);
+  }
+  // An explicit binding does not bypass the network or revocation boundaries.
+  expect(await call(crossNetwork, "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  const denied = await fetch(`${base}/mcp`, { method: "POST", headers: { Authorization: `Bearer ${revoked}` } });
+  expect(denied.status).toBe(401);
+  expect(await call(legacy, "ack_adopt_request", { request_id: requestId, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
+  expect((await call(legacy, "list_my_children")).children).toContainEqual({ child_node_id: child, alias: child, lifecycle_state: "active", managed: "adopted", binding_request_id: requestId });
+  const stop = await call(owner.token, "stop_node", { node_id: child, network_id: owner.network_id });
+  expect(stop.ok).toBe(true);
+  expect((await call(legacy, "get_stop_request", { request_id: stop.request_id })).ok).toBe(true);
+  expect((await call(legacy, "ack_stop_request", { request_id: stop.request_id, status: "stopped" })).ok).toBe(true);
+  const start = await call(owner.token, "start_node", { node_id: child, network_id: owner.network_id });
+  expect(start.ok).toBe(true);
+  expect((await call(legacy, "get_start_request", { request_id: start.request_id })).ok).toBe(true);
+  expect(await call(legacy, "ack_start_request", { request_id: start.request_id, status: "started", child_pid: 4321 })).toMatchObject({ ok: true, status: "started" });
+});
+
+test("ownerless legacy daemon remains supported without rewriting its owner", async () => {
+  db.run("UPDATE api_tokens SET node_identity_epoch=0 WHERE token_id='owner678_ownerless'");
+  try {
+    expect((await call(ownerless, "list_my_children")).ok).toBe(true);
+    const refresh = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_ownerless_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+    const withId = await mint(member.token, owner.network_id, "n_ownerless_fixture", "n_ownerless_fixture");
+    expect(withId.status).toBe(200);
+    expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_ownerless_fixture'").owner_user_id).toBeNull();
+    expect((await mint(owner.token, owner.network_id, "n_ownerless_fixture")).status).toBe(400);
+  } finally { db.run("UPDATE api_tokens SET node_identity_epoch=1 WHERE token_id='owner678_ownerless'"); }
+});
+
+test("new name-only registration binds once and its holder can refresh with either shape", async () => {
+  const first = await mint(member.token, owner.network_id, "refresh_fixture");
+  expect(first.status).toBe(200);
+  expect(db.get("SELECT node_identity_epoch FROM api_tokens WHERE token_id=?1", first.body.token_id).node_identity_epoch).toBe(2);
+  const result = await call(first.body.token, "report_status", {
+    resume_id: "refresh-fixture-session", alias: "refresh_fixture", status: "idle", node_id: "n_refresh_fixture",
+  });
+  expect(result.ok).toBe(true);
+  expect(db.get("SELECT bound_node_id FROM api_tokens WHERE token_id=?1", first.body.token_id).bound_node_id).toBe("n_refresh_fixture");
+  expect(db.get("SELECT owner_user_id FROM nodes WHERE node_id='n_refresh_fixture'").owner_user_id).toBeNull();
+  for (const id of [undefined, "n_refresh_fixture"]) {
+    const refresh = await mint(member.token, owner.network_id, "refresh_fixture", id);
+    expect(refresh.status).toBe(200);
+    expect(refresh.body.node_id).toBe("n_refresh_fixture");
+    expect((await call(refresh.body.token, "list_my_children")).ok).toBe(true);
+  }
+  expect((await mint(owner.token, owner.network_id, "refresh_fixture")).status).toBe(400);
+});
+
+test("fresh ID cannot mint another node alias", async () => {
+  const before = db.get("SELECT COUNT(*) AS n FROM api_tokens").n;
+  expect((await mint(member.token, owner.network_id, daemon, "n_fresh_impostor")).status).toBe(400);
+  expect(db.get("SELECT node_id FROM nodes WHERE node_id='n_fresh_impostor'")).toBeNull();
+  expect(db.get("SELECT COUNT(*) AS n FROM api_tokens").n).toBe(before);
+  expect((await call(legacy, "list_my_children")).ok).toBe(true);
+});
+
+test("duplicate legacy aliases use bound IDs and an unbound token follows its owner", async () => {
+  // Historical duplicate rows: the member's row was inserted first. Neither
+  // lookup order nor alias can redirect an exact-bound token. An unbound
+  // token resolves to the row its issuer owns.
+  const { hashToken, generateNetworkToken } = await import("./db.js");
+  const tokens: string[] = [];
+  for (const [id, user] of [["n_duplicate_first", member.user.user_id], ["n_duplicate_owner", owner.user.user_id]]) {
+    db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id) VALUES(?1,'duplicate_fixture','duplicate_fixture',?2,?3)", [id, owner.network_id, user]);
+    const token = generateNetworkToken(); tokens.push(token);
+    db.run("INSERT INTO api_tokens(token_id,token_hash,user_id,network_id,name,scope,bound_node_id) VALUES(?1,?2,?3,?4,'node:duplicate_fixture','network',?1)", [id, hashToken(token), user, owner.network_id]);
+    db.run("INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at) VALUES(?1,?2,?1,?1,'/fixture',?3,'pending',1,1)", [id, owner.network_id, user]);
+  }
+  for (let i = 0; i < tokens.length; i++) {
+    const result = await call(tokens[i], "list_my_children");
+    expect(result.ok).toBe(true);
+    const ownId = i === 0 ? "n_duplicate_first" : "n_duplicate_owner";
+    expect((await call(tokens[i], "get_adopt_request", { request_id: ownId })).ok).toBe(true);
+    expect((await call(tokens[i], "get_adopt_request", { request_id: i === 0 ? "n_duplicate_owner" : "n_duplicate_first" })).ok).toBe(false);
+  }
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_owner'");
+  expect((await call(tokens[1], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(false);
+  db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_first'");
+  expect((await call(tokens[0], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(false);
+  expect((await mint(owner.token, owner.network_id, "duplicate_fixture", "n_third_duplicate")).status).toBe(400);
+});
+
+test("all production token issuers explicitly mark the rollout epoch", () => {
+  const root = `${import.meta.dir}/../..`;
+  function sources(dir: string): string[] {
+    return readdirSync(dir, { withFileTypes: true }).flatMap(entry => {
+      const path = `${dir}/${entry.name}`;
+      return entry.isDirectory() ? sources(path) : entry.name.endsWith(".ts") && !entry.name.endsWith(".test.ts") ? [path] : [];
+    });
+  }
+  const sourceFiles = ["server/src", "agent-network/src", "agent-network/bin", "agent-node/src"].flatMap(dir => sources(`${root}/${dir}`));
+  let count = 0;
+  for (const file of sourceFiles) {
+    const source = readFileSync(file, "utf8");
+    for (const match of source.matchAll(/INSERT\s+INTO\s+api_tokens\s*\(([^)]+)\)/gi)) {
+      expect(match[1]).toContain("node_identity_epoch"); count++;
+    }
+  }
+  expect(count).toBe(9);
+  expect(readFileSync(`${root}/agent-network/bin/cli.ts`, "utf8")).toContain("'admin-reset', 'user', 1)");
+});
+
+test("revoked ownerless credential cannot be reclaimed by doctor and gives actionable guidance", async () => {
+  db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE name='node:n_ownerless_fixture'");
+  const result = await mint(member.token, owner.network_id, "n_ownerless_fixture");
+  expect(result.status).toBe(400);
+  expect(result.body.error).toBe("node_owner_mismatch");
+  expect(nodeTokenReissueError(result.body)).toContain("这个节点没有归属，请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "node_owner_unclaimed" })).toContain("请联系管理员认领（#682）");
+  expect(nodeTokenReissueError({ error: "network_not_found" })).toBe("network_not_found");
+  expect(readFileSync(`${import.meta.dir}/../../agent-network/bin/cli.ts`, "utf8")).toContain("body ? nodeTokenReissueError(body) : r.status");
+});

package/src/db.ts

@@ -640,6 +640,9 @@ for (const ddl of [
   "ALTER TABLE api_tokens ADD COLUMN revoked_at TEXT",
   "ALTER TABLE api_tokens ADD COLUMN role TEXT",
   "ALTER TABLE api_tokens ADD COLUMN bound_node_id TEXT",
+  // Existing tokens retain epoch 0. Every production issuer writes 1 (general)
+  // or 2 (ownership-checked node token); 0 is a rollout boundary, not a clock.
+  "ALTER TABLE api_tokens ADD COLUMN node_identity_epoch INTEGER NOT NULL DEFAULT 0",
   // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
   "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
   "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",