@sleep2agi/commhub-server 0.9.0-preview.111 → 0.9.0-preview.112

package/src/node-daemon-bindings.test.ts

@@ -48,7 +48,7 @@ test("two-phase binding, daemon-bound pull, controllable map, adopted delete ref
   expect(await call(handlers("daemon").get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: true, node_id: CHILD, alias: "adoption-child", workdir: "/workspace/project" });
   expect(await call(handlers().get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: false });
   expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true });
-  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted" });
+  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted", binding_request_id: r.request_id });
   expect(buildControllableMap([], [{ node_id: CHILD, daemon_node_id: DAEMON }]).get(CHILD)).toBe(DAEMON);
   expect(await call(handlers().delete_node, { child_node_id: CHILD, confirm_alias: "adoption-child", network_id: NET })).toMatchObject({ ok: false, error: "adopted_node_delete_unsupported" });
   expect(db.get<any>("SELECT lifecycle_state FROM nodes WHERE node_id=?1", CHILD).lifecycle_state).toBe("active");

package/src/node-permissions.ts

@@ -16,6 +16,7 @@
 
 import { db } from "./db.js";
 import { canMessageAgent, type AgentRef } from "./agent-access.js";
+import { resolveNodeCaller } from "./create-node.js";
 
 export type NodePermissionMode = "normal" | "readonly" | "restricted";
 export const NODE_PERMISSION_MODES: readonly NodePermissionMode[] = ["normal", "readonly", "restricted"];
@@ -71,23 +72,55 @@ function normalizeMode(raw: unknown): NodePermissionMode {
 /** 节点令牌 → 节点身份(一次带索引的查询)。不是节点令牌 / 查不到 → null。 */
 export function nodeIdentity(tokenId: string | null | undefined, networkId: string | null | undefined): NodeIdentity | null {
   if (!tokenId || !networkId) return null;
-  const row = db.get<{ user_id: string | null; bound_node_id: string | null; name: string | null; owner_user_id: string | null; permission_mode: string | null; alias: string | null }>(
-    `SELECT t.user_id, t.bound_node_id, t.name, n.owner_user_id, n.permission_mode, n.alias
-       FROM api_tokens t LEFT JOIN nodes n ON n.node_id = t.bound_node_id
-      WHERE t.token_id = ?1 AND t.network_id = ?2`,
+  const row = db.get<{ user_id: string | null; name: string | null }>(
+    `SELECT user_id, name FROM api_tokens WHERE token_id = ?1 AND network_id = ?2`,
     tokenId, networkId,
   );
   if (!row) return null;
-  const aliases = new Set<string>();
-  if (row.alias) aliases.add(row.alias);
-  if (row.name?.startsWith("node:")) aliases.add(row.name.slice(5));
+  const resolved = resolveNodeCaller(tokenId);
+  // Revoked or not node-shaped: this lookup is not a second revocation gate.
+  if (!resolved.ok && resolved.reason === "not_a_node_token") {
+    const aliases = row.name?.startsWith("node:") ? [row.name.slice(5)] : [];
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases,
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  if (!resolved.ok || resolved.networkId !== networkId) {
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases: [],
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  if (resolved.kind === "unregistered") {
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases: resolved.alias ? [resolved.alias] : [],
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  const node = db.get<{ owner_user_id: string | null; permission_mode: string | null }>(
+    `SELECT owner_user_id, permission_mode FROM nodes WHERE node_id = ?1 AND network_id = ?2`,
+    resolved.nodeId, networkId,
+  );
   return {
     networkId,
-    nodeId: row.bound_node_id,
-    logKey: row.bound_node_id ?? `token:${tokenId}`,
-    aliases: [...aliases],
-    ownerUserId: row.owner_user_id || row.user_id || null,
-    mode: normalizeMode(row.permission_mode),
+    nodeId: resolved.nodeId,
+    logKey: resolved.nodeId,
+    aliases: [resolved.alias],
+    ownerUserId: node?.owner_user_id || row.user_id || null,
+    mode: normalizeMode(node?.permission_mode),
   };
 }
 

package/src/requirements.ts

@@ -5,6 +5,7 @@ import { createHash } from "node:crypto";
 import { parsePeopleQuery, peopleDirectory, resolvePersonName } from "./requirements-people.js";
 import { encodeCursor, matchesTaskId, matchesTerms, parseListQuery, type ListQuery, type NameMaps } from "./requirements-search.js";
 import { db, logAudit } from "./db.js";
+import { resolveNodeCaller } from "./create-node.js";
 import { markGzipReusable } from "./http-gzip.js";
 import { applyTagOp, normalizeTags, parseTagOp, storedTags, type TagOp } from "./requirement-tags.js";
 import { aggregateStats, parseStatsQuery, type StatsRow } from "./requirements-stats.js";
@@ -795,13 +796,8 @@ function actorOf(ctx: RequirementsRequestContext): Actor | null {
   if (!ctx.auth) return null;
   if (!ctx.isNodeToken) return { kind: "user", id: ctx.auth.userId };
   const tokenId = ctx.auth.tokenId ?? null;
-  const bound = tokenId ? db.get<{ bound_node_id: string | null }>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", tokenId)?.bound_node_id : null;
-  if (bound) return { kind: "node", id: bound };
-  const alias = ctx.auth.tokenName?.startsWith("node:") ? ctx.auth.tokenName.slice(5) : null;
-  if (alias && ctx.auth.networkId) {
-    const node = db.get<{ node_id: string }>("SELECT node_id FROM nodes WHERE network_id = ?1 AND alias = ?2", ctx.auth.networkId, alias);
-    if (node) return { kind: "node", id: node.node_id };
-  }
+  const resolved = tokenId ? resolveNodeCaller(tokenId) : null;
+  if (resolved?.ok && resolved.kind === "node") return { kind: "node", id: resolved.nodeId };
   return { kind: "node", id: `token:${tokenId ?? "unknown"}` };
 }
 

package/src/rest-identity.ts

@@ -12,15 +12,20 @@
 // task row and, once sender labels reach the copresence TUIs, rendered to a
 // human as an attribution.
 //
-// This is the same decision expressed as a pure function so every credential
-// kind is a directly constructible test input rather than a hand-assembled
-// Request (the #503 convention in this codebase).
+// Production network tokens pass tokenId and resolve through resolveNodeCaller.
+// A token whose name is not `node:` (not_a_node_token, the registration token
+// before report_status) falls back to nodeAliasForToken, same as main.
+// tokenId omitted keeps the name-only shape used by the unit cases below.
+
+import { resolveNodeCaller } from "./create-node.js";
 
 export interface RestIdentityInput {
   /** Raw bearer token, only its prefix matters (`ntok_` = network-bound). */
   token: string;
   /** `api_tokens.name`; for node tokens it is `node:<alias>`. */
   tokenName: string | null | undefined;
+  /** Set on the production path. Network tokens then ignore tokenName as authority. */
+  tokenId?: string | null;
   /** Username resolved from the authenticated token. */
   authenticatedUsername?: string | null;
   /** Caller-supplied `body.from`. */
@@ -46,8 +51,28 @@ export function nodeAliasForToken(token: string, tokenName: string | null | unde
 }
 
 export function resolveRestFromSession(input: RestIdentityInput): RestIdentityResult {
-  const alias = nodeAliasForToken(input.token, input.tokenName);
   const requested = typeof input.requestedFrom === "string" ? input.requestedFrom.trim() : "";
+  let alias: string | null;
+  if (input.token.startsWith("ntok_") && input.tokenId) {
+    const resolved = resolveNodeCaller(input.tokenId);
+    if (resolved.ok) {
+      alias = resolved.alias;
+    } else if (resolved.reason === "not_a_node_token") { // board679-plain-ntok-rest
+      // Name is not `node:` yet. Main signs that as api, and refuses a claim.
+      // not_owner / bound_node_missing / ambiguous stay the hard reject.
+      alias = nodeAliasForToken(input.token, input.tokenName);
+    } else {
+      return {
+        ok: false,
+        error: "from_session_identity_mismatch",
+        message: "network token from_session does not match token-bound node alias",
+        tokenAlias: "",
+        requestedFromSession: requested,
+      };
+    }
+  } else {
+    alias = nodeAliasForToken(input.token, input.tokenName);
+  }
 
   // A network-bound token whose name we cannot resolve to an alias (`node:`,
   // `node:   `, or a name that was never node-scoped) is the degenerate case.

package/src/server.ts

@@ -75,6 +75,7 @@ import {
   TASK_REST_SELECT,
 } from "./rest-projections.js";
 import { resolveRestFromSession } from "./rest-identity.js";
+import { resolveNodeCaller } from "./create-node.js";
 import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 import { diagnoseTask } from "./task-diagnostic.js";
 import { assertScheduledTaskBackendSupported, handleScheduledTaskRequest, startScheduledTaskScheduler } from "./scheduled-tasks.js";
@@ -197,12 +198,12 @@ function sweepStaleRateLimits(): void {
 }
 
 // ── Factory: 每个请求创建新的 McpServer（stateless 模式）──
-function createServer(clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, includeProtocolTools = false): McpServer {
+function createServer(clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, includeProtocolTools = false, callerIdentityRejected = false): McpServer {
   const server = new McpServer({
     name: "commhub",
     version: "0.5.0",
   });
-  registerTools(server, clientIP, enforceNetworkId, enforceUserId, callerAlias, callerTokenIsNetwork, callerTokenId, { includeProtocol: includeProtocolTools });
+  registerTools(server, clientIP, enforceNetworkId, enforceUserId, callerAlias, callerTokenIsNetwork, callerTokenId, { includeProtocol: includeProtocolTools }, callerIdentityRejected);
   return server;
 }
 
@@ -272,6 +273,16 @@ function nodeSubscriberInfo(req: Request, server: any, tokenId: string | null, a
   return { nodeId, instanceId, remote, userAgent: req.headers.get("user-agent")?.slice(0, 200) ?? null };
 }
 
+// The stream belongs to a node id, not a name. A session that never stored
+// node_id still owns its stream when this network has exactly one nodes row
+// for the alias. Null does not match null.
+function streamOwnerNodeId(alias: string, networkId: string): string | null {
+  const fromSession = db.get<{ node_id: string | null }>("SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2", alias, networkId)?.node_id ?? null;
+  if (fromSession) return fromSession;
+  const rows = db.all<{ node_id: string }>("SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2", alias, networkId);
+  return rows.length === 1 ? rows[0].node_id : null;
+}
+
 function isLocalhostIP(ip: string): boolean {
   return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1" || ip === "localhost";
 }
@@ -310,17 +321,24 @@ function isHubAdminCredential(resolved: { networkId: string | null; user: { role
 function nodeTokenAlias(resolved: { tokenName: string | null }): string | null {
   return resolved.tokenName?.startsWith("node:") ? resolved.tokenName.slice("node:".length) : null;
 }
-function nodeMayRename(resolved: { networkId: string | null; tokenName: string | null }, networkId: unknown, oldAlias: unknown): boolean {
+function resolvedNodeAlias(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }): string | null {
+  if (!resolved.tokenId) return nodeTokenAlias(resolved);
+  const caller = resolveNodeCaller(resolved.tokenId);
+  if (!caller.ok) return null;
+  if (resolved.networkId && caller.networkId !== resolved.networkId) return null;
+  return caller.alias;
+}
+function nodeMayRename(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }, networkId: unknown, oldAlias: unknown): boolean {
   if (!resolved.networkId) return true;
-  return networkId === resolved.networkId && typeof oldAlias === "string" && oldAlias === nodeTokenAlias(resolved);
+  return networkId === resolved.networkId && typeof oldAlias === "string" && oldAlias === resolvedNodeAlias(resolved);
 }
-function nodeMayRenameTxn(resolved: { networkId: string | null; tokenName: string | null }, txnId: unknown): boolean {
+function nodeMayRenameTxn(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }, txnId: unknown): boolean {
   if (!resolved.networkId) return true;
   if (typeof txnId !== "string") return false;
   const txn = db.get<{ network_id: string; old_alias: string; new_alias: string }>("SELECT network_id, old_alias, new_alias FROM rename_txn WHERE txn_id = ?1", txnId);
   if (!txn || txn.network_id !== resolved.networkId) return false;
   // commit 前后令牌名可能已被改成新 alias(api_tokens.name 跟随改名),两个都算它自己。
-  const self = nodeTokenAlias(resolved);
+  const self = resolvedNodeAlias(resolved);
   return self === txn.old_alias || self === txn.new_alias;
 }
 
@@ -1030,11 +1048,20 @@ return Bun.serve({
       const token = requestToken(req);
       const authCtx = resolveRequestAuth(req);
       const enforceNetId = authCtx?.networkId || null;
-      // Derive the calling alias from the token name (e.g., 'node:视频审查')
-      // so peer agents see the real sender instead of 'hub' on send_task.
-      const callerAlias = authCtx?.tokenName?.startsWith("node:")
-        ? authCtx.tokenName.slice("node:".length)
-        : (authCtx?.username || null);
+      // A resolved node token speaks as that node. A token whose name is not
+      // `node:` (the registration network token) keeps the username. Only a
+      // `node:` token refused as not_owner / bound_node_missing / ambiguous
+      // is impersonation, and must not fall through to a client-supplied from.
+      let callerAlias: string | null = authCtx?.username || null;
+      let callerIdentityRejected = false;
+      if (token?.startsWith("ntok_")) {
+        const resolvedCaller = authCtx?.tokenId ? resolveNodeCaller(authCtx.tokenId) : null;
+        if (resolvedCaller?.ok) callerAlias = resolvedCaller.alias;
+        else if (resolvedCaller && resolvedCaller.reason !== "not_a_node_token") { // board679-plain-ntok
+          callerAlias = null;
+          callerIdentityRejected = true;
+        }
+      }
       const transport = new WebStandardStreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
       });
@@ -1052,7 +1079,7 @@ return Bun.serve({
         labelRoute(req, mcpParsedBody === undefined ? "?" : mcpRouteLabel(mcpParsedBody));
       }
       // #478:tools/list 按调用者过滤;X-Anet-Tools: all / ?tools=all 时节点令牌也列出协议工具。
-      const mcpServer = createServer(clientIP, enforceNetId, authCtx?.userId || null, callerAlias, !!token?.startsWith("ntok_"), authCtx?.tokenId || null, wantsAllTools(req, url));
+      const mcpServer = createServer(clientIP, enforceNetId, authCtx?.userId || null, callerAlias, !!token?.startsWith("ntok_"), authCtx?.tokenId || null, wantsAllTools(req, url), callerIdentityRejected);
       await mcpServer.connect(transport);
       const response = await transport.handleRequest(req, mcpParsedBody === undefined ? undefined : { parsedBody: mcpParsedBody });
       // Disconnect after response to prevent McpServer leak
@@ -1206,11 +1233,22 @@ return Bun.serve({
           nodeId: db.get<{ node_id: string | null }>("SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2", sessionName, scopedNetId)?.node_id ?? null,
         }));
         if (streamDenied) return streamDenied;
-        // #507 — the node's OWN stream (token bound to this alias) is node-scoped:
-        // at most one per (network, alias), newest wins. A node token watching some
-        // other alias stays a plain monitor and can never supersede that node.
-        if (authCtx.tokenName === `node:${sessionName}` && authCtx.networkId === scopedNetId) {
-          return createSSEStream(sessionName, scopedNetId, { node: nodeSubscriberInfo(req, server, authCtx.tokenId, sessionName, scopedNetId) });
+        // #507 — the node's OWN stream is node-scoped: at most one per (network,
+        // alias), newest wins. Own means the resolved node id equals this stream's
+        // node id. A matching token name is not enough, and a monitor never supersedes.
+        const resolvedCaller = authCtx.tokenId ? resolveNodeCaller(authCtx.tokenId) : null;
+        const streamNodeId = streamOwnerNodeId(sessionName, scopedNetId);
+        if (
+          resolvedCaller?.ok
+          && resolvedCaller.kind === "node"
+          && resolvedCaller.nodeId
+          && streamNodeId
+          && resolvedCaller.nodeId === streamNodeId
+          && resolvedCaller.networkId === scopedNetId
+        ) {
+          const info = nodeSubscriberInfo(req, server, authCtx.tokenId, sessionName, scopedNetId);
+          if (!info.nodeId) info.nodeId = resolvedCaller.nodeId;
+          return createSSEStream(sessionName, scopedNetId, { node: info });
         }
         return createSSEStream(sessionName, scopedNetId);
       }
@@ -1395,8 +1433,9 @@ return Bun.serve({
       // RFC-040:managed_department_ids = 我负责的部门 + 全部下级(空 = 不是负责人;viewer 恒空;节点令牌不是人,恒空)。
       const networks = (resolved.networkId ? allNetworks.filter((n: any) => n.network_id === resolved.networkId) : allNetworks)
         .map((n: any) => ({ ...n, managed_department_ids: resolved.networkId ? [] : managedDepartmentIds(n.network_id, resolved.user.user_id) }));
+      const nodeCaller = resolved.networkId && resolved.tokenId ? resolveNodeCaller(resolved.tokenId) : null;
       const credential = resolved.networkId
-        ? { kind: "node", network_id: resolved.networkId, node_alias: resolved.tokenName?.startsWith("node:") ? resolved.tokenName.slice(5) : null, acts_as_owner: false }
+        ? { kind: "node", network_id: resolved.networkId, node_alias: nodeCaller?.ok ? nodeCaller.alias : null, acts_as_owner: false }
         : { kind: "user" };
       return withCors(req, Response.json({ ok: true, user: resolved.user, networks, current_network: resolved.networkId, credential }));
     }
@@ -3546,6 +3585,7 @@ return Bun.serve({
       const identity = resolveRestFromSession({
         token: requestToken(req),
         tokenName: restAuth?.tokenName,
+        tokenId: restAuth?.tokenId,
         authenticatedUsername: restAuth?.username,
         requestedFrom: body.from,
       });

package/src/tools.ts

@@ -267,7 +267,7 @@ function guardNodePermissionTools(server: McpServer, tokenId: string, networkId:
   }
 }
 
-export function registerTools(server: McpServer, clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, listing: { includeProtocol?: boolean } = {}) {
+export function registerTools(server: McpServer, clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, listing: { includeProtocol?: boolean } = {}, callerIdentityRejected = false) {
   // 多用户 Agent 权限:用户令牌调用者在哪些网络里是受限成员(只看授权 Agent)。
   // 网络令牌不会走到这里 —— 受限成员的网络令牌在 resolveToken 就被拒了。
   const restrictedNets = enforceUserId && !callerTokenIsNetwork && !enforceNetworkId ? restrictedNetworkIds(enforceUserId) : [];
@@ -278,9 +278,26 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // an agent's send_task call always claimed from='hub' and peer agents
   // couldn't tell who actually asked them. Network-bound node tokens are an
   // identity boundary: they must not spoof another node via from_session.
-  const defaultFrom = (clientFrom?: string) => (callerTokenIsNetwork && callerAlias) ? callerAlias : (clientFrom || callerAlias || "hub");
+  const defaultFrom = (clientFrom?: string) => {
+    if (callerTokenIsNetwork && callerIdentityRejected) return "";
+    return (callerTokenIsNetwork && callerAlias) ? callerAlias : (clientFrom || callerAlias || "hub");
+  };
   const fromIdentityMismatchReply = (clientFrom?: string) => {
     const requestedFrom = clientFrom?.trim();
+    if (callerTokenIsNetwork && callerIdentityRejected) {
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify({
+            ok: false,
+            error: "from_session_identity_mismatch",
+            message: "network token from_session does not match token-bound node alias",
+            token_alias: "",
+            requested_from_session: requestedFrom ?? "",
+          }),
+        }],
+      };
+    }
     if (!callerTokenIsNetwork || !callerAlias || !requestedFrom || requestedFrom === callerAlias) return null;
     return {
       content: [{
@@ -916,6 +933,21 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!canWrite(effectiveNetId)) {
         return writeDeniedReply(effectiveNetId);
       }
+      // A rejected network token must not heartbeat, rename its token, or open a session.
+      if (callerIdentityRejected) {
+        return {
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              ok: false,
+              error: "alias_identity_mismatch",
+              message: "report_status alias does not match the token-bound node alias; use anet node rename to change identity",
+              token_alias: "",
+              reported_alias: alias,
+            }),
+          }],
+        };
+      }
       const canonical = resolveCanonicalAlias(sessionNetId, alias);
       let effectiveAlias = canonical.alias;
       if (canonical.renamed) {
@@ -969,11 +1001,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         };
       }
       console.log(`[${ts()}] ${effectiveAlias} (${resume_id.slice(0, 8)}) → report_status: ${status}${task ? " | " + task.slice(0, 60) : ""}${effectiveNetId ? " [net]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
-      if (callerTokenIsNetwork && callerTokenId) {
-        try {
-          db.run("UPDATE api_tokens SET name = ?1 WHERE token_id = ?2", [`node:${effectiveAlias}`, callerTokenId]);
-        } catch {}
-      }
       // #507 — a second copy of this node (same token + alias) may still be connected;
       // its sibling's shutdown offline must not take the node offline under it.
       const offlineDeferred = deferOfflineIfAnotherCopyConnected(effectiveAlias, sessionNetId, status, resume_id);
@@ -1162,6 +1189,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             [uuidv4(), sessionNetId, resume_id, effectiveAlias, hostHostname, hostIp, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount]
           );
         }
+        if (callerTokenIsNetwork && callerTokenId) {
+          try {
+            db.run("UPDATE api_tokens SET name = ?1 WHERE token_id = ?2", [`node:${effectiveAlias}`, callerTokenId]);
+          } catch {}
+        }
       });
       // #448 — only the node token bound to this alias may speak for its health
       // (same rule as the *_capable flags above).
@@ -1204,10 +1236,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         } catch {}
       }
 
-      // V2: upsert nodes table for persistent node identity. SEC-1
-      // gate (PR A #287 follow-up, 通信牛 catch 2026-06-28): delegate
-      // to upsertNodeWithSec1Guard so production + test exercise the
-      // exact same code path. See helper below registerTools.
+      // A copied node_id must not relabel the row. The heartbeat itself still
+      // succeeds: only a token rejected as impersonation fails the whole call.
+      // identity_mismatch must not leave this session pointing at the other row.
       if (node_id) {
         try {
           const nodeRuntime = ag?.includes(":") ? ag.split(":")[1] + "-sdk" : ag ?? null;
@@ -1226,8 +1257,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             hostname: hn ?? null,
             config_snapshot: cfgSnap ?? null,
           });
-          // The session row above already took node_id; a refused identity claim
-          // must not leave this session pointing at another node's row.
           if (upserted.result === "refused" && upserted.reason === "identity_mismatch") {
             db.run("UPDATE sessions SET node_id = NULL WHERE resume_id = ?1 AND node_id = ?2", [resume_id, node_id]);
           }
@@ -5423,7 +5452,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "Daemon pulls the alias + node_id list of children it spawned (for childrenMap rebuild after restart). RFC-027 PR1.1.",
     {},
     async () => {
-      const callerDaemon = resolveCallerDaemonTokenBound();
+      const callerDaemon = resolveCallerDaemonTokenBound(); // board #674: token-bound snapshot, not a lease
       if (!callerDaemon.ok) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
       }
@@ -5446,18 +5475,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             AND COALESCE(n.lifecycle_state, 'active') NOT IN ('stopped', 'stop_failed')`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      const children: Array<{ child_node_id: string; alias: string; lifecycle_state: string; managed?: "adopted" }> = rows.map(r => ({
+      const children: Array<{ child_node_id: string; alias: string; lifecycle_state: string; managed?: "adopted"; binding_request_id?: string }> = rows.map(r => ({
         child_node_id: r.child_node_id,
         alias: r.child_name,
         lifecycle_state: r.lifecycle_state ?? "active",
       }));
-      const adopted = db.all<{ node_id: string; alias: string; lifecycle_state: string | null }>(
-        `SELECT n.node_id,n.alias,n.lifecycle_state FROM node_daemon_bindings b
+      const adopted = db.all<{ node_id: string; alias: string; lifecycle_state: string | null; request_id: string }>(
+        `SELECT n.node_id,n.alias,n.lifecycle_state,b.request_id FROM node_daemon_bindings b
          JOIN nodes n ON n.node_id=b.node_id AND n.network_id=b.network_id
          WHERE b.daemon_node_id=?1 AND b.network_id=?2 AND b.status='active'`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      for (const n of adopted) children.push({ child_node_id: n.node_id, alias: n.alias, lifecycle_state: n.lifecycle_state ?? "active", managed: "adopted" });
+      for (const n of adopted) children.push({ child_node_id: n.node_id, alias: n.alias, lifecycle_state: n.lifecycle_state ?? "active", managed: "adopted", binding_request_id: n.request_id });
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: children.length, children }) }] };
     },
   );