@sleep2agi/commhub-server 0.9.0-preview.110 → 0.9.0-preview.112

package/src/shared/task-content-limit-drift.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { SESSION_TASK_PREVIEW_MAX, TASK_CONTENT_MAX, sessionTaskPreview } from "./task-content-limit.js";
+
+// Board #668 — the node reports the whole task so the hub can match it
+// against tasks.content. Both sides must agree on the cap.
+const HUB_PATH = join(import.meta.dir, "task-content-limit.ts");
+const NODE_PATH = join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "task-content-limit.ts");
+
+describe("#668 — hub/node task-content-limit drift guard", () => {
+  test("byte-identical source files", () => {
+    expect(readFileSync(NODE_PATH, "utf-8")).toBe(readFileSync(HUB_PATH, "utf-8"));
+  });
+
+  test("constants equal at runtime", async () => {
+    const node = await import(NODE_PATH);
+    expect(node.TASK_CONTENT_MAX).toBe(TASK_CONTENT_MAX);
+    expect(node.SESSION_TASK_PREVIEW_MAX).toBe(SESSION_TASK_PREVIEW_MAX);
+  });
+
+  test("preview is the first 200 chars", () => {
+    expect(SESSION_TASK_PREVIEW_MAX).toBe(200);
+    const long = "字".repeat(TASK_CONTENT_MAX);
+    expect(sessionTaskPreview(long)).toBe(long.slice(0, 200));
+    expect(sessionTaskPreview("short")).toBe("short");
+  });
+});

package/src/shared/task-content-limit.ts

@@ -0,0 +1,25 @@
+// Board #668 — task text limits shared by hub and node.
+//
+// This file is byte-identical in server/src/shared/task-content-limit.ts and
+// agent-node/src/shared/task-content-limit.ts (task-content-limit-drift.test.ts
+// fails the build on any difference).
+//
+// TASK_CONTENT_MAX is the cap every dispatch entry (send_task, REST /api/task,
+// scheduled tasks) and report_status.task accept. The node reports the whole
+// task text so the hub can match it against tasks.content and write
+// started_at. If the dispatch cap grew without the node and report_status
+// following, long tasks would silently stop matching again.
+//
+// SESSION_TASK_PREVIEW_MAX is what the hub keeps in sessions.task. That column
+// is readable by get_all_status, the full /api/status and members who may see
+// the agent but not its conversations, so only a short preview is stored —
+// the full text is used for matching, never persisted on the session row.
+
+export const TASK_CONTENT_MAX = 10_000;
+
+export const SESSION_TASK_PREVIEW_MAX = 200;
+
+/** The preview stored in sessions.task — same cut as the dispatch preview. */
+export function sessionTaskPreview(task: string): string {
+  return task.slice(0, SESSION_TASK_PREVIEW_MAX);
+}

package/src/tools.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
+import { lockNodeAlias } from "./node-token-ownership.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
 import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
@@ -9,6 +10,8 @@ import { noteModelAuthHealth } from "./model-auth-notify.js";
 import { numberedAliasInClause, parseAliasFilter } from "./alias-filter.js";
 import { createHash } from "node:crypto";
 import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
+import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
 import { deferOfflineIfAnotherCopyConnected } from "./node-identity-conflict.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
@@ -264,7 +267,7 @@ function guardNodePermissionTools(server: McpServer, tokenId: string, networkId:
   }
 }
 
-export function registerTools(server: McpServer, clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, listing: { includeProtocol?: boolean } = {}) {
+export function registerTools(server: McpServer, clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, listing: { includeProtocol?: boolean } = {}, callerIdentityRejected = false) {
   // 多用户 Agent 权限:用户令牌调用者在哪些网络里是受限成员(只看授权 Agent)。
   // 网络令牌不会走到这里 —— 受限成员的网络令牌在 resolveToken 就被拒了。
   const restrictedNets = enforceUserId && !callerTokenIsNetwork && !enforceNetworkId ? restrictedNetworkIds(enforceUserId) : [];
@@ -275,9 +278,26 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // an agent's send_task call always claimed from='hub' and peer agents
   // couldn't tell who actually asked them. Network-bound node tokens are an
   // identity boundary: they must not spoof another node via from_session.
-  const defaultFrom = (clientFrom?: string) => (callerTokenIsNetwork && callerAlias) ? callerAlias : (clientFrom || callerAlias || "hub");
+  const defaultFrom = (clientFrom?: string) => {
+    if (callerTokenIsNetwork && callerIdentityRejected) return "";
+    return (callerTokenIsNetwork && callerAlias) ? callerAlias : (clientFrom || callerAlias || "hub");
+  };
   const fromIdentityMismatchReply = (clientFrom?: string) => {
     const requestedFrom = clientFrom?.trim();
+    if (callerTokenIsNetwork && callerIdentityRejected) {
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify({
+            ok: false,
+            error: "from_session_identity_mismatch",
+            message: "network token from_session does not match token-bound node alias",
+            token_alias: "",
+            requested_from_session: requestedFrom ?? "",
+          }),
+        }],
+      };
+    }
     if (!callerTokenIsNetwork || !callerAlias || !requestedFrom || requestedFrom === callerAlias) return null;
     return {
       content: [{
@@ -680,7 +700,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       resume_id: z.string().min(1).max(200).describe("Claude Code session UUID (unique per session)"),
       alias: z.string().min(1).max(200).describe("Human-readable session name for dispatching (e.g. 指挥室/知识哥)"),
       status: z.enum(["working", "idle", "blocked", "error", "waiting_input", "offline"]),
-      task: z.string().max(10000).optional().describe("Current task description"),
+      task: z.string().max(TASK_CONTENT_MAX).optional().describe("Current task description (the hub stores only the first 200 chars on the session row; the full text is matched against tasks.content)"),
       output: z.string().max(50000).optional().describe("Recent output (max 4000 chars stored)"),
       score: z.number().min(0).max(10).optional().describe("Self-score 1-10"),
       progress: z.number().min(0).max(100).optional().describe("Progress 0-100"),
@@ -913,6 +933,21 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!canWrite(effectiveNetId)) {
         return writeDeniedReply(effectiveNetId);
       }
+      // A rejected network token must not heartbeat, rename its token, or open a session.
+      if (callerIdentityRejected) {
+        return {
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              ok: false,
+              error: "alias_identity_mismatch",
+              message: "report_status alias does not match the token-bound node alias; use anet node rename to change identity",
+              token_alias: "",
+              reported_alias: alias,
+            }),
+          }],
+        };
+      }
       const canonical = resolveCanonicalAlias(sessionNetId, alias);
       let effectiveAlias = canonical.alias;
       if (canonical.renamed) {
@@ -966,11 +1001,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         };
       }
       console.log(`[${ts()}] ${effectiveAlias} (${resume_id.slice(0, 8)}) → report_status: ${status}${task ? " | " + task.slice(0, 60) : ""}${effectiveNetId ? " [net]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
-      if (callerTokenIsNetwork && callerTokenId) {
-        try {
-          db.run("UPDATE api_tokens SET name = ?1 WHERE token_id = ?2", [`node:${effectiveAlias}`, callerTokenId]);
-        } catch {}
-      }
       // #507 — a second copy of this node (same token + alias) may still be connected;
       // its sibling's shutdown offline must not take the node offline under it.
       const offlineDeferred = deferOfflineIfAnotherCopyConnected(effectiveAlias, sessionNetId, status, resume_id);
@@ -1048,6 +1078,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         ) ?? null;
         const keep = <T,>(fresh: T | null | undefined, column: string): T | null =>
           (fresh ?? (handover?.[column] as T | null | undefined) ?? null);
+        // #668 — the node reports the whole task so the tasks UPDATE below can match
+        // tasks.content. sessions.task is readable far wider than the task row
+        // (get_all_status, full /api/status, members who see the agent but not its
+        // conversations), so only the dispatch-sized preview is stored here.
+        const sessionTask = task == null ? null : sessionTaskPreview(task); // board668-session-preview
         db.run("DELETE FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3", [effectiveAlias, resume_id, sessionNetId]);
         db.run(
           `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, external_schedules, peer_reply_inbox_capable, last_seen_at, updated_at)
@@ -1079,7 +1114,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              external_schedules = COALESCE(?34, sessions.external_schedules),
              peer_reply_inbox_capable = ?35,
              last_seen_at = datetime('now'), updated_at = datetime('now')`,
-          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
+          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, storedStatus, sessionTask, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
         );
         if (handover) {
           // 换 resume_id 那条路径上 ON CONFLICT 不会触发;INSERT 完再把没上报(仍为 NULL)的
@@ -1154,6 +1189,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             [uuidv4(), sessionNetId, resume_id, effectiveAlias, hostHostname, hostIp, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount]
           );
         }
+        if (callerTokenIsNetwork && callerTokenId) {
+          try {
+            db.run("UPDATE api_tokens SET name = ?1 WHERE token_id = ?2", [`node:${effectiveAlias}`, callerTokenId]);
+          } catch {}
+        }
       });
       // #448 — only the node token bound to this alias may speak for its health
       // (same rule as the *_capable flags above).
@@ -1196,10 +1236,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         } catch {}
       }
 
-      // V2: upsert nodes table for persistent node identity. SEC-1
-      // gate (PR A #287 follow-up, 通信牛 catch 2026-06-28): delegate
-      // to upsertNodeWithSec1Guard so production + test exercise the
-      // exact same code path. See helper below registerTools.
+      // A copied node_id must not relabel the row. The heartbeat itself still
+      // succeeds: only a token rejected as impersonation fails the whole call.
+      // identity_mismatch must not leave this session pointing at the other row.
       if (node_id) {
         try {
           const nodeRuntime = ag?.includes(":") ? ag.split(":")[1] + "-sdk" : ag ?? null;
@@ -1218,8 +1257,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             hostname: hn ?? null,
             config_snapshot: cfgSnap ?? null,
           });
-          // The session row above already took node_id; a refused identity claim
-          // must not leave this session pointing at another node's row.
           if (upserted.result === "refused" && upserted.reason === "identity_mismatch") {
             db.run("UPDATE sessions SET node_id = NULL WHERE resume_id = ?1 AND node_id = ?2", [resume_id, node_id]);
           }
@@ -1739,7 +1776,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "Dispatch a task to a session's inbox (by alias). The reply carries queue_ahead (open tasks already on the target), target_busy, est_wait_minutes (rough, null = no history) and, when the queue is long, a warning: queued, never refused — consider an idle node.",
     {
       alias: z.string().min(1).max(200).describe("Target session alias"),
-      task: z.string().min(1).max(10000).describe("Task content"),
+      task: z.string().min(1).max(TASK_CONTENT_MAX).describe("Task content"),
       priority: z.enum(["high", "normal", "low"]).optional().default("normal"),
       context: z.string().max(10000).optional(),
       from_session: z.string().max(200).optional(),
@@ -1771,8 +1808,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
 
       // Resolve parent_task_id: explicit > inferred (caller's most recent
-      // delivered/started inbox task that's still open). Inference is the
-      // safety net for when the LLM forgets to pass parent_task_id.
+      // delivered inbox task). Inference is the safety net for when the LLM
+      // forgets to pass parent_task_id.
+      //
+      // #668 — only 'delivered'. 'started' was never a tasks status. A task
+      // the caller has acked or is running is NOT inferred: an unrelated
+      // dispatch without parent_task_id would hang under it, the child's
+      // reply would close it early (chainReplyToParent), and the node's own
+      // reply would then be refused as reply_task_terminal.
       //
       // round5 F1 fix: the inference SELECT MUST be network-scoped. Without
       // it, a caller in network B can pick up the parent_task_id of a
@@ -1782,7 +1825,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
         try {
           const recentParams: any[] = [from_session];
-          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered','started')";
+          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered')"; // board668-parent-delivered-only
           recentSql = addScope(recentSql, recentParams, effectiveNetId);
           recentSql += " ORDER BY created_at DESC LIMIT 1";
           const recent = db.get<{ task_id: string }>(recentSql, ...recentParams);
@@ -1930,8 +1973,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
            VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'delivered', ?7, 'reply', datetime('now'), datetime('now'), datetime('now', ?8), ?9, ?10, ?11)`,
           [id, fromNodeId, from_session, targetNodeId, targetAlias, priority, task, `+${ttl_seconds || 3600} seconds`, effectiveNetId ?? null, parentTaskId, metaJson]
         );
-        const touchParams: any[] = [task.slice(0, 200), targetAlias];
-        let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
+        const touchParams: any[] = [sessionTaskPreview(task), targetAlias];
+        let touchSql = `UPDATE sessions SET task = ${sessionTaskOnDispatch("?1")}, updated_at = datetime('now') WHERE alias = ?2`;
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
         // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
@@ -4353,7 +4396,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "auth_required" }) }] };
       }
       db.run(
-        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)`,
+        `INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, role, request_id, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 2)`,
         [childTokenId, hashToken(childToken), enforceUserId, networkIdForChild, `node:${node_spec.name}`, "network", "child", requestId]
       );
 
@@ -5409,7 +5452,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "Daemon pulls the alias + node_id list of children it spawned (for childrenMap rebuild after restart). RFC-027 PR1.1.",
     {},
     async () => {
-      const callerDaemon = resolveCallerDaemonTokenBound();
+      const callerDaemon = resolveCallerDaemonTokenBound(); // board #674: token-bound snapshot, not a lease
       if (!callerDaemon.ok) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
       }
@@ -5432,18 +5475,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             AND COALESCE(n.lifecycle_state, 'active') NOT IN ('stopped', 'stop_failed')`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      const children: Array<{ child_node_id: string; alias: string; lifecycle_state: string; managed?: "adopted" }> = rows.map(r => ({
+      const children: Array<{ child_node_id: string; alias: string; lifecycle_state: string; managed?: "adopted"; binding_request_id?: string }> = rows.map(r => ({
         child_node_id: r.child_node_id,
         alias: r.child_name,
         lifecycle_state: r.lifecycle_state ?? "active",
       }));
-      const adopted = db.all<{ node_id: string; alias: string; lifecycle_state: string | null }>(
-        `SELECT n.node_id,n.alias,n.lifecycle_state FROM node_daemon_bindings b
+      const adopted = db.all<{ node_id: string; alias: string; lifecycle_state: string | null; request_id: string }>(
+        `SELECT n.node_id,n.alias,n.lifecycle_state,b.request_id FROM node_daemon_bindings b
          JOIN nodes n ON n.node_id=b.node_id AND n.network_id=b.network_id
          WHERE b.daemon_node_id=?1 AND b.network_id=?2 AND b.status='active'`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      for (const n of adopted) children.push({ child_node_id: n.node_id, alias: n.alias, lifecycle_state: n.lifecycle_state ?? "active", managed: "adopted" });
+      for (const n of adopted) children.push({ child_node_id: n.node_id, alias: n.alias, lifecycle_state: n.lifecycle_state ?? "active", managed: "adopted", binding_request_id: n.request_id });
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: children.length, children }) }] };
     },
   );
@@ -6269,6 +6312,13 @@ export function trustedConfigSnapshotForNode(
 }
 
 export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
+  return db.transaction(() => {
+    if (input.callerNetworkId && input.alias) lockNodeAlias(input.callerNetworkId, input.alias, input.node_id ?? undefined);
+    return upsertNodeIdentity(input);
+  });
+}
+
+function upsertNodeIdentity(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
   if (!input.node_id) return { result: "skipped", reason: "missing_node_id" };
   const existing = db.get<{ network_id: string | null; owner_user_id: string | null; alias: string | null; config_path: string | null }>(
     "SELECT network_id, owner_user_id, alias, config_path FROM nodes WHERE node_id = ?1",
@@ -6280,8 +6330,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
   // report only that exact node. Legacy unbound ntok rows remain compatible,
   // but they can never consume owner-gated schedule intents.
   if (input.callerTokenId) {
-    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null }>(
-      "SELECT bound_node_id, user_id, network_id FROM api_tokens WHERE token_id = ?1",
+    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null; node_identity_epoch: number; name: string }>(
+      "SELECT bound_node_id, user_id, network_id, node_identity_epoch, name FROM api_tokens WHERE token_id = ?1",
       input.callerTokenId,
     );
     if (token?.bound_node_id && token.bound_node_id !== input.node_id) {
@@ -6290,6 +6340,16 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     if (token?.network_id && _norm(token.network_id) !== _norm(callerNet)) {
       return { result: "refused", reason: "cross_network", existingNet: existing?.network_id ?? null, callerNet };
     }
+    // New name-only node tokens bind once, at their first registration. General
+    // tokens renamed by report_status are deliberately NOT upgraded to epoch 2.
+    if (token?.node_identity_epoch === 2 && !token.bound_node_id) {
+      const conflict = db.get("SELECT node_id FROM nodes WHERE network_id=?1 AND alias=?2 AND node_id<>?3 LIMIT 1",
+        callerNet, input.alias ?? "", input.node_id);
+      if (conflict || token.name !== `node:${input.alias}` || token.user_id !== input.callerUserId || existing) {
+        console.warn(`[commhub] 🚫 report_status node upsert refused (identity_mismatch): node_id=${input.node_id} first-binding conflict`);
+        return { result: "refused", reason: "identity_mismatch", existingNet: existing?.network_id ?? null, callerNet };
+      }
+    }
   }
   if (existing?.owner_user_id && input.callerUserId !== existing.owner_user_id) {
     return { result: "refused", reason: "owner_mismatch", existingNet: existing.network_id, callerNet };
@@ -6354,6 +6414,8 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       callerNet ?? null,
     ],
   );
+  if (input.callerTokenId) db.run(`UPDATE api_tokens SET bound_node_id=?1
+    WHERE token_id=?2 AND node_identity_epoch=2 AND bound_node_id IS NULL`, [input.node_id, input.callerTokenId]);
   const trustedSnapshot = trustedConfigSnapshotForNode(
     input.config_snapshot,
     input.callerTokenId,