@sleep2agi/commhub-server 0.9.0-preview.111 → 0.9.0-preview.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.111",
+  "version": "0.9.0-preview.113",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth-password-change-cli-tokens-http.test.ts

@@ -0,0 +1,294 @@
+// #711 改密码只让浏览器 / app 的登录会话下线,命令行和脚本令牌默认保留。
+//
+// main 上 POST /api/auth/password 跑的是 `DELETE FROM api_tokens WHERE user_id = ? AND network_id IS NULL
+// AND token_id != ?` —— 每台机器上 `anet login` 拿到的令牌、POST /api/auth/tokens 建的具名脚本令牌,
+// 跟浏览器会话一起被删光。安全复审定的形状:默认不变,保留是显式选项。这里每条都钉住:
+//   · 默认(旧 app、dashboard 代理不带字段):撤销全部不绑网络的令牌 —— 客户端自报的 cli 也活不下来;
+//   · keep_cli_tokens=true(anet passwd 默认带):只撤其他 kind='login' 会话,保留的 cli 令牌列在响应里、不含令牌值;
+//   · 当前会话(换发后的新令牌)永远可用,而且沿用当前令牌的种类;
+//   · 节点 / 网络令牌永远不动;
+//   · 启动迁移按 client_label / scope 回填存量令牌的 kind(夹具库,跑两遍幂等)。
+// SQLite 由 test798 自动收进;PostgreSQL 由 tests/test2123-hub-postgres-ladder 的 run_pg_tests_rc 跑同一个文件。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
+import { register, createNetworkTokenForNode, createToken, changePassword } from "./auth.js";
+import { db, hashToken } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-pwchange-kind-"));
+let BASE = "";
+let hub: any = null;
+const PW = "PwChangeKindPassw0rd!";
+const PW2 = "PwChangeKindPassw0rd!2";
+const CLI_LABEL = "anet 2.5.0 · test-box · login";
+
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const works = async (token: string) => (await call(token, "GET", "/api/auth/me")).status === 200;
+const kindOf = (token: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_hash = ?1", hashToken(token))?.kind ?? null;
+
+type Fleet = {
+  user: string; userId: string; net: string;
+  app: string; appB: string; regToken: string;
+  cliByLabel: string; cliByKind: string; apiToken: string;
+  nodeToken: string; netToken: string;
+};
+
+let seq = 0;
+async function fleet(): Promise<Fleet> {
+  const user = `pwk_${Date.now()}_${++seq}`;
+  const reg = register(user, PW);
+  expect(reg.ok).toBe(true);
+  const login = async (extra: Record<string, unknown>) => {
+    const r = await call("", "POST", "/api/auth/login", { username: user, password: PW, ...extra });
+    expect(r.status).toBe(200);
+    return r.body.token as string;
+  };
+  const node = createNetworkTokenForNode(reg.user!.user_id, reg.network_id!, "pwk-node", `node_pwk_${seq}`);
+  expect(node.ok).toBe(true);
+  const api = createToken(reg.user!.user_id, "ci-script");
+  expect(api.ok).toBe(true);
+  const netTok = createToken(reg.user!.user_id, "net-script", reg.network_id!);
+  expect(netTok.ok).toBe(true);
+  return {
+    user, userId: reg.user!.user_id, net: reg.network_id!,
+    regToken: reg.token!,
+    app: await login({ client_label: "Desktop app" }),
+    appB: await login({}),
+    cliByLabel: await login({ client_label: CLI_LABEL }),
+    cliByKind: await login({ client_kind: "cli" }),
+    apiToken: api.token!,
+    nodeToken: node.token!,
+    netToken: netTok.token!,
+  };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  process.env.COMMHUB_LOGIN_IP_MAX = "1000";
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("new tokens are classified at issue time", () => {
+  test("browser/app logins are 'login'; anet-labelled, client_kind=cli and named API tokens are 'cli'; node tokens unclassified", async () => {
+    const f = await fleet();
+    expect(kindOf(f.regToken)).toBe("login");
+    expect(kindOf(f.app)).toBe("login");
+    expect(kindOf(f.appB)).toBe("login");
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.nodeToken)).toBe(null);
+    expect(kindOf(f.netToken)).toBe(null);
+  });
+});
+
+// 响应里出现任何令牌值都算泄漏:换发给调用方的那一条(body.token)除外,它本来就要交给调用方。
+function assertNoTokenValues(body: any, f: Fleet) {
+  const { token: _rotated, ...rest } = body;
+  const text = JSON.stringify(rest);
+  for (const t of [f.regToken, f.app, f.appB, f.cliByLabel, f.cliByKind, f.apiToken, f.nodeToken, f.netToken]) {
+    expect(text.includes(t)).toBe(false);
+  }
+  expect(/\b(utok|atok|ntok)_[A-Za-z0-9]{8,}/.test(text)).toBe(false);
+  expect(text.includes("token_hash")).toBe(false);
+}
+
+describe("POST /api/auth/password (default: old apps, dashboard proxy — no field)", () => {
+  test("every other non-network token is revoked (pre-#711 behaviour); node tokens and the rotated current session survive", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    expect(r.body.revoked_login).toBe(2); // reg + appB
+    expect(r.body.revoked_cli).toBe(3);   // cliByLabel + cliByKind + apiToken
+    expect(r.body.revoked).toBe(5);
+    expect(r.body.kept_cli_tokens).toBeUndefined();
+    for (const t of [f.regToken, f.appB, f.cliByLabel, f.cliByKind, f.apiToken]) expect(await works(t)).toBe(false);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("login");
+    expect(await works(f.app)).toBe(false);
+  });
+
+  test("a client-declared cli token (client_kind / anet label) does NOT survive a default password change", async () => {
+    const f = await fleet();
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.cliByLabel)).toBe(false);
+  });
+
+  test("a non-boolean keep_cli_tokens is not an opt-in; the removed revoke_cli_tokens field does nothing", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: "true", revoke_cli_tokens: false });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_cli).toBe(3);
+    expect(await works(f.cliByLabel)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+});
+
+describe("POST /api/auth/password with keep_cli_tokens=true (anet passwd)", () => {
+  test("only other login sessions are revoked; CLI/script tokens are kept and listed without token values", async () => {
+    const f = await fleet();
+    const r = await call(f.cliByLabel, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_login).toBe(3); // reg + app + appB
+    expect(r.body.revoked_cli).toBe(0);
+    expect(r.body.revoked).toBe(3);
+    for (const t of [f.regToken, f.app, f.appB]) expect(await works(t)).toBe(false);
+    expect(await works(f.cliByKind)).toBe(true);
+    expect(await works(f.apiToken)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    // 当前会话:换发的新令牌可用,沿用 cli
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("cli");
+    // 保留清单:不含当前这条(它已被换掉),只含另外两条 cli;字段齐全、无令牌值
+    const kept = r.body.kept_cli_tokens as any[];
+    const idOf = (t: string) => db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(t)).token_id;
+    expect(kept.map((k) => k.token_id).sort()).toEqual([idOf(f.cliByKind), idOf(f.apiToken)].sort());
+    for (const k of kept) {
+      expect(Object.keys(k).sort()).toEqual(["client_label", "created_at", "last_used_at", "name", "token_id"]);
+      expect(k.token_id).toMatch(/^tok_[0-9a-f]{12}$/);
+    }
+    expect(kept.find((k) => k.token_id === idOf(f.apiToken)).name).toBe("ci-script");
+    assertNoTokenValues(r.body, f);
+    // 可以逐条撤销
+    expect((await call(r.body.token, "DELETE", `/api/auth/tokens/${idOf(f.apiToken)}`)).status).toBe(200);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  test("default response carries no token values either", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    assertNoTokenValues(r.body, f);
+  });
+});
+
+describe("changePassword() keeps the current token row in both modes", () => {
+  test("no opts at all = default: CLI tokens revoked, current kept", async () => {
+    const f = await fleet();
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur);
+    expect(r.ok).toBe(true);
+    expect(r.revoked_cli).toBe(3);
+    expect(r.kept_cli_tokens).toBeUndefined();
+    expect(await works(f.app)).toBe(true);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  for (const keepCliTokens of [false, true]) {
+    test(`keepCliTokens=${keepCliTokens}: current login token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.app)).toBe(true);
+      expect(await works(f.appB)).toBe(false);
+      expect(await works(f.cliByLabel)).toBe(keepCliTokens);
+      expect(await works(f.nodeToken)).toBe(true);
+    });
+    test(`keepCliTokens=${keepCliTokens}: current CLI token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.cliByKind)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.cliByKind)).toBe(true);
+      expect(await works(f.app)).toBe(false);
+      expect(await works(f.apiToken)).toBe(keepCliTokens);
+    });
+  }
+});
+
+describe("startup migration backfills api_tokens.kind on a fixture DB", () => {
+  // 把 kind 列拿掉 = 回到 #711 之前的表结构;塞存量行;再起一个进程加载 db.ts(= Hub 启动迁移)。
+  function bootMigration() {
+    const r = spawnSync(process.execPath, ["-e", `await import(${JSON.stringify(join(import.meta.dir, "db.ts"))}); process.exit(0);`], {
+      cwd: join(import.meta.dir, ".."),
+      env: { ...process.env, NODE_ENV: "test" },
+      encoding: "utf8",
+      timeout: 60_000,
+    });
+    if (r.status !== 0) console.log(String(r.stderr || "").slice(-2000));
+    return r.status;
+  }
+
+  test("anet-labelled and named API tokens → cli, everything else → login, node tokens untouched; idempotent", async () => {
+    const f = await fleet();
+    db.exec("ALTER TABLE api_tokens DROP COLUMN kind");
+    const ins = (id: string, net: string | null, scope: string, label: string | null) =>
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, 'fixture', ?5, ?6, 1)",
+        [id, hashToken(`fixture-${id}`), f.userId, net, scope, label],
+      );
+    const id = (s: string) => `tok_fx_${seq}_${s}`;
+    ins(id("cli_label"), null, "user", "anet 2.4.0 · old-box · login");
+    ins(id("cli_demo"), null, "user", "anet dev · unknown-host · demo sci-team");
+    ins(id("browser"), null, "user", "Chrome on macOS");
+    ins(id("nolabel"), null, "user", null);
+    ins(id("lookalike"), null, "user", "planet-anet dashboard");
+    ins(id("upper"), null, "user", "ANET 2.4.0 · box · login");
+    ins(id("padded"), null, "user", "  anet 2.4.0 · box · login");
+    ins(id("named"), null, "full", null);
+    ins(id("node"), f.net, "network", null);
+    ins(id("netfull"), f.net, "full", null);
+
+    expect(bootMigration()).toBe(0);
+    const k = (s: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_id = ?1", id(s))?.kind ?? null;
+    expect(k("cli_label")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe("login");
+    expect(k("nolabel")).toBe("login");
+    expect(k("lookalike")).toBe("login");
+    expect(k("upper")).toBe("login");   // 区分大小写:SQLite 的 LIKE 会把它当 cli,PG 不会 —— 两边必须一致
+    expect(k("padded")).toBe("cli");    // 与运行时一样先 trim
+    expect(k("named")).toBe("cli");
+    expect(k("node")).toBe(null);
+    expect(k("netfull")).toBe(null);
+    // fleet() 的 live 令牌也被回填(列重建后原值丢了,按同一规则算回来)
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.app)).toBe("login");
+
+    // 幂等:已有值不被改写(手动改成 login 的 anet 行保持 login),再跑一次结果不变
+    db.run("UPDATE api_tokens SET kind = 'login' WHERE token_id = ?1", [id("cli_label")]);
+    expect(bootMigration()).toBe(0);
+    expect(k("cli_label")).toBe("login");
+    expect(k("named")).toBe("cli");
+    expect(k("browser")).toBe("login");
+
+    // 迁移后的库上,keep_cli_tokens 保留回填成 cli 的存量令牌
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens: true });
+    expect(r.ok).toBe(true);
+    expect(k("named")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe(null); // 被撤销(行已删除)
+    expect(k("node")).toBe(null);
+    expect(Number(db.get<any>("SELECT COUNT(*) AS n FROM api_tokens WHERE token_id = ?1", id("node")).n)).toBe(1);
+  }, 120_000);
+});

package/src/auth.ts

@@ -137,8 +137,8 @@ export function register(username: string, password: string, email?: string, dis
   const userToken = generateUserToken();
   const userTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256), userTokenKindFor(opts.client)]
   );
 
   // Network token (ntok_) — bound to default network, for agent-node
@@ -217,8 +217,8 @@ export function login(username: string, password: string, client: SessionClientI
   const userToken = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256), userTokenKindFor(client)]
   );
 
   // Find default network
@@ -321,7 +321,28 @@ const SESSION_TOKEN_SQL = "scope = 'user' AND network_id IS NULL";
 // 以小时为粒度对一个以天计的闲置窗口没有影响。
 const LAST_USED_WRITE_INTERVAL_SECONDS = 3600;
 
-export type SessionClientInfo = { label?: unknown; userAgent?: unknown };
+export type SessionClientInfo = { label?: unknown; userAgent?: unknown; kind?: unknown };
+
+// #711 不绑网络的用户令牌的种类(api_tokens.kind):
+//   'login' — 浏览器 / app 的登录会话;
+//   'cli'   — anet 命令行登录、POST /api/auth/tokens 建的具名脚本令牌。
+// 种类由客户端自报(client_kind / client_label),**只用于展示和「显式保留」那条路**:
+// 改密码默认仍撤销全部不绑网络的令牌(当前这条除外),调用方显式 keep_cli_tokens=true 才保留 'cli'。
+// 所以一个自称 cli 的令牌永远不能靠自报在默认改密码里活下来。
+// 节点 / 网络令牌(network_id 非空)不分类,改密码永远不碰。
+export type UserTokenKind = "login" | "cli";
+
+/** 登录 / 注册请求签发的令牌算哪一类:客户端显式报 kind='cli',或 client_label 是 anet 自报的「anet <版本> · …」。 */
+/** anet 自报的 client_label:去掉首尾空白后,区分大小写地以「anet 」开头(启动回填用同一条规则,见 db.ts)。 */
+export function isAnetClientLabel(label: string): boolean {
+  return label.trim().startsWith("anet ");
+}
+
+export function userTokenKindFor(client: SessionClientInfo = {}): UserTokenKind {
+  if (client.kind === "cli") return "cli";
+  if (typeof client.label === "string" && isAnetClientLabel(client.label)) return "cli";
+  return "login";
+}
 
 function cleanClientField(value: unknown, max: number): string | null {
   if (typeof value !== "string") return null;
@@ -508,9 +529,10 @@ export function createToken(userId: string, name: string, networkId?: string): {
   }
   const token = generateToken();
   const tokenId = generateId("tok");
+  // #711 不绑网络的具名令牌是给脚本 / 命令行长期用的:kind='cli'(改密码时可显式 keep_cli_tokens 保留)。
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
-    [tokenId, hashToken(token), userId, networkId || null, name, "full"]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, networkId || null, name, "full", networkId ? null : "cli"]
   );
   return { ok: true, token, token_id: tokenId };
 }
@@ -520,16 +542,55 @@ export function revokeToken(userId: string, tokenId: string): { ok: boolean; err
   return result.changes > 0 ? { ok: true } : { ok: false, error: "token not found" };
 }
 
-export function issueUserToken(userId: string, name = "user-login"): { token: string; token_id: string } {
+export function issueUserToken(
+  userId: string,
+  name = "user-login",
+  opts: { kind?: UserTokenKind; clientLabel?: string | null; userAgent?: string | null } = {},
+): { token: string; token_id: string } {
   const token = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', 1)",
-    [tokenId, hashToken(token), userId, name]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, name, opts.clientLabel ?? null, opts.userAgent ?? null, opts.kind === "cli" ? "cli" : "login"]
   );
   return { token, token_id: tokenId };
 }
 
+/** 一条令牌的种类和设备标识(改密码换发新令牌时沿用,命令行的令牌换完还是命令行的)。 */
+export function getUserTokenMeta(userId: string, tokenId: string): { kind: UserTokenKind; client_label: string | null; user_agent: string | null } | null {
+  const row = db.get<any>("SELECT kind, client_label, user_agent FROM api_tokens WHERE token_id = ?1 AND user_id = ?2 AND network_id IS NULL", tokenId, userId);
+  if (!row) return null;
+  return { kind: row.kind === "cli" ? "cli" : "login", client_label: row.client_label ?? null, user_agent: row.user_agent ?? null };
+}
+
+// #711 改密码撤销哪些令牌。kind 为 NULL 的(启动回填之后由旧版 Hub 签出的)按 'login' 算。
+const CLI_KIND_SQL = "kind = 'cli'";
+const NOT_CLI_KIND_SQL = "COALESCE(kind, 'login') <> 'cli'";
+
+/** 改密码后保留下来的命令行 / 脚本令牌(给 UI 列出来、让用户逐条撤销)。**永远不含令牌值。** */
+export type KeptCliToken = { token_id: string; name: string; client_label: string | null; created_at: string; last_used_at: string | null };
+
+/**
+ * 改密码后的令牌撤销。默认(keepCli=false)= 改密码前的行为:撤销全部不绑网络的令牌;
+ * keepCli=true 时保留 kind='cli' 的,并把它们列出来。当前这条(exceptTokenId)和节点 / 网络令牌永远不动。
+ */
+export function revokeTokensAfterPasswordChange(userId: string, exceptTokenId: string | null | undefined, keepCli: boolean): { login: number; cli: number; kept: KeptCliToken[] } {
+  const except = exceptTokenId ? " AND token_id != ?2" : "";
+  const params = exceptTokenId ? [userId, exceptTokenId] : [userId];
+  const login = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND ${NOT_CLI_KIND_SQL}${except}`, params).changes;
+  if (!keepCli) {
+    const cli = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL${except}`, params).changes;
+    return { login, cli, kept: [] };
+  }
+  const kept = db.all<any>(
+    `SELECT token_id, name, client_label, created_at, last_used_at FROM api_tokens
+     WHERE user_id = ?1 AND network_id IS NULL AND ${CLI_KIND_SQL}${except}
+     ORDER BY created_at DESC`,
+    ...params,
+  ).map((r) => ({ token_id: r.token_id, name: r.name, client_label: r.client_label ?? null, created_at: r.created_at, last_used_at: r.last_used_at ?? null }));
+  return { login, cli: 0, kept };
+}
+
 export function revokeOtherUserTokens(userId: string, exceptTokenId?: string | null): number {
   const result = exceptTokenId
     ? db.run("DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND token_id != ?2", [userId, exceptTokenId])
@@ -544,6 +605,7 @@ export type LoginSession = {
   last_used_at: string | null;
   client_label: string | null;
   user_agent: string | null;
+  kind: UserTokenKind;
   is_current: boolean;
 };
 
@@ -551,7 +613,7 @@ export type LoginSession = {
 export function listSessions(userId: string, currentTokenId: string | null): LoginSession[] {
   const cutoff = idleCutoffOffset();
   const rows = db.all<any>(
-    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent FROM api_tokens
+    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent, kind FROM api_tokens
      WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND revoked_at IS NULL${cutoff ? `
        AND COALESCE(last_used_at, created_at) >= datetime('now', ?2)` : ""}
      ORDER BY COALESCE(last_used_at, created_at) DESC, created_at DESC`,
@@ -563,6 +625,7 @@ export function listSessions(userId: string, currentTokenId: string | null): Log
     last_used_at: r.last_used_at ?? null,
     client_label: r.client_label ?? null,
     user_agent: r.user_agent ?? null,
+    kind: r.kind === "cli" ? "cli" : "login",
     is_current: !!currentTokenId && r.token_id === currentTokenId,
   }));
 }
@@ -578,7 +641,14 @@ export function revokeOtherSessions(userId: string, currentTokenId: string): num
   return db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND token_id != ?2`, [userId, currentTokenId]).changes;
 }
 
-export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null): { ok: boolean; error?: string; revoked?: number } {
+export type ChangePasswordResult = { ok: boolean; error?: string; revoked?: number; revoked_login?: number; revoked_cli?: number; kept_cli_tokens?: KeptCliToken[] };
+
+/**
+ * 改密码。默认撤销该用户全部不绑网络的令牌(改密码前的行为,旧 app 依赖它)。#711:opts.keepCliTokens=true
+ * 时保留 kind='cli' 的(anet 命令行登录、具名脚本令牌),并在 kept_cli_tokens 里列出。当前会话和节点令牌永远保留。
+ * revoked = 两类合计(旧字段,兼容旧客户端)。
+ */
+export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null, opts: { keepCliTokens?: boolean } = {}): ChangePasswordResult {
   const passwordError = validatePasswordStrength(newPassword, "new password");
   if (passwordError) return { ok: false, error: passwordError };
   const user = db.get<any>("SELECT password_hash FROM users WHERE user_id = ?1", userId);
@@ -593,8 +663,9 @@ export function changePassword(userId: string, oldPassword: string, newPassword:
   // nudge goes away on next login. SET to 0 explicitly (rather than skip)
   // so a future flag flip can't drift the state.
   db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
-  const revoked = revokeOtherUserTokens(userId, currentTokenId);
-  return { ok: true, revoked };
+  const keep = opts.keepCliTokens === true;
+  const r = revokeTokensAfterPasswordChange(userId, currentTokenId, keep);
+  return { ok: true, revoked: r.login + r.cli, revoked_login: r.login, revoked_cli: r.cli, ...(keep ? { kept_cli_tokens: r.kept } : {}) };
 }
 
 /**

package/src/binding-generation-http.test.ts

@@ -0,0 +1,121 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { preflightCodexStart } from "../../agent-node/src/runtime/adopt-codex-start-preflight.js";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync("/tmp/binding-http-")}/hub.db`;
+process.env.COMMHUB_AUTH_TOKEN ||= "binding-master-fixture";
+let db:any, hub:ReturnType<typeof Bun.serve>, base:string, owner:any, other:any;
+const daemon="n_binding_daemon", child="n_binding_child";
+let token:string, wrong:string, cross:string, ordinary:string, revoked:string;
+async function mcp(credential:string,name:string,args:Record<string,unknown>={}) {
+  const res=await fetch(`${base}/mcp`, {method:"POST",headers:{Authorization:`Bearer ${credential}`,
+    "Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},
+    body:JSON.stringify({jsonrpc:"2.0",id:1,method:"tools/call",params:{name,arguments:args}})});
+  const raw=await res.text();
+  if(res.status!==200)return {ok:false,http_status:res.status};
+  const lines=raw.split("\n").filter(s=>s.startsWith("data:"));
+  const payload=JSON.parse(lines.length?lines.at(-1)!.slice(5):raw);
+  return payload.result?.content?.[0]?.text ? JSON.parse(payload.result.content[0].text) : {ok:false,error:payload.error};
+}
+const list=(t=token)=>mcp(t,"list_my_children");
+const request=()=>mcp(owner.token,"request_adopt_node",{node_id:child,daemon_node_id:daemon,workdir:"/fixture/project"});
+const ack=(id:string,status="adopted")=>mcp(token,"ack_adopt_request",{request_id:id,status});
+const unadopt=()=>mcp(owner.token,"unadopt_node",{node_id:child});
+async function activate(){const r=await request();expect(r.ok).toBe(true);expect((await ack(r.request_id)).status).toBe("active");return r.request_id;}
+beforeAll(async()=>{
+  ({db}=await import("./db.js"));
+  const {register}=await import("./auth.js");
+  owner=register("binding_owner","Fixture-Strong1!");other=register("binding_other","Fixture-Strong1!");
+  expect(owner.ok&&other.ok).toBe(true);
+  db.run("UPDATE users SET role='user' WHERE user_id=?1",[other.user.user_id]);
+  db.run("INSERT INTO network_members(network_id,user_id,role) VALUES(?1,?2,'member')",[owner.network_id,other.user.user_id]);
+  const {generateNetworkToken,hashToken}=await import("./db.js");
+  function node(id:string,network:string,user:string,supervisor=true){
+    db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state) VALUES(?1,?1,?1,?2,?3,'fixture-host',?4,'active')",
+      [id,network,user,JSON.stringify(supervisor?{role:"host_supervisor",daemon_capabilities:{adopt_capable:true}}:{})]);
+    db.run("INSERT INTO sessions(resume_id,alias,node_id,network_id,status,last_seen_at) VALUES(?1,?1,?1,?2,'idle',datetime('now'))",[id,network]);
+    const raw=generateNetworkToken();
+    db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES(?1,?2,?3,'network',?4,?5)",[id,user,network,`node:${id}`,hashToken(raw)]);
+    return raw;
+  }
+  token=node(daemon,owner.network_id,owner.user.user_id);
+  wrong=node("n_binding_other",owner.network_id,other.user.user_id);
+  cross=node("n_binding_cross",other.network_id,other.user.user_id);
+  node(child,owner.network_id,owner.user.user_id,false);
+  ordinary=generateNetworkToken();revoked=generateNetworkToken();
+  for(const [id,raw,name,dead] of [["ordinary",ordinary,"general",null],["revoked",revoked,`node:${daemon}`,"2020-01-01"]])
+    db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash,revoked_at) VALUES(?1,?2,?3,'network',?4,?5,?6)",[id,owner.user.user_id,owner.network_id,name,hashToken(raw as string),dead]);
+  db.run("INSERT INTO nodes(node_id,node_name,alias,network_id,lifecycle_state) VALUES('node_binding_created','created','created',?1,'active')",[owner.network_id]);
+  db.run("INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,flags_json,env_keys,status,created_at,created_by_token) VALUES('cr_binding_created',?1,'created',?2,'codex-sdk','{}','[]','succeeded',1,'fixture')",[daemon,owner.network_id]);
+  const {bootServer}=await import("./server.js");hub=bootServer({port:0,hostname:"127.0.0.1"});base=`http://127.0.0.1:${hub.port}`;
+},60000);
+afterAll(()=>hub?.stop(true));
+
+test("generation projection and unchanged created row",async()=>{
+  const id=await activate();
+  const r=await list();expect(r.ok).toBe(true);
+  expect((await mcp(token,"get_adopt_request",{request_id:id})).error).toBe("request_not_pending");
+  expect(r.children.find((n:any)=>n.child_node_id===child)).toEqual({child_node_id:child,alias:child,lifecycle_state:"active",managed:"adopted",binding_request_id:id});
+  expect(r.children.find((n:any)=>n.child_node_id==="node_binding_created")).toEqual({child_node_id:"node_binding_created",alias:"created",lifecycle_state:"active"});
+  // Old consumers continue reading exactly the same fields; additive only.
+  expect(r.children.map(({child_node_id,alias,lifecycle_state,managed}:any)=>({child_node_id,alias,lifecycle_state,managed}))).toContainEqual({child_node_id:child,alias:child,lifecycle_state:"active",managed:"adopted"});
+  expect((await unadopt()).ok).toBe(true);
+});
+test("token boundary denies humans general revoked and other owners",async()=>{
+  await activate();
+  for(const t of [owner.token,other.token,ordinary,revoked])expect((await list(t)).ok).toBe(false);
+  for(const t of [wrong,cross]){const r=await list(t);expect(r.ok).toBe(true);expect(r.children).toEqual([]);}
+  expect((await unadopt()).ok).toBe(true);
+});
+test("child node token sees an empty list, not its parent binding",async()=>{
+  const id=await activate();
+  try {
+    const issued=await fetch(`${base}/api/auth/node-token`,{method:"POST",
+      headers:{Authorization:`Bearer ${owner.token}`,"Content-Type":"application/json"},
+      body:JSON.stringify({network_id:owner.network_id,node_name:child,node_id:child})});
+    expect(issued.status).toBe(200);
+    const credential=await issued.json() as any;
+    expect(credential.ok).toBe(true);
+    expect(typeof credential.token).toBe("string");
+    // Same owner and network do not confer the parent's daemon identity.
+    expect((await list()).children.find((n:any)=>n.child_node_id===child).binding_request_id).toBe(id);
+    expect(await list(credential.token)).toEqual({ok:true,count:0,children:[]});
+  } finally {expect((await unadopt()).ok).toBe(true);}
+});
+test("network predicate rejects corrupted cross-network binding sentinel",async()=>{
+  const id=await activate();
+  // Deliberately inconsistent test DB: daemon stays in A, binding and child in B.
+  // This makes the network predicate independently load-bearing, HTTP still real.
+  try {
+    db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2",[other.network_id,id]);
+    db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[other.network_id,child]);
+    expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  } finally {
+    db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2",[owner.network_id,id]);
+    db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[owner.network_id,child]);await unadopt();
+  }
+});
+test("node join rejects mismatched node network sentinel",async()=>{
+  await activate();
+  try {db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[other.network_id,child]);expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);}
+  finally {db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2",[owner.network_id,child]);await unadopt();}
+});
+test("non-active bindings never project generation",async()=>{
+  const r=await request();expect(r.ok).toBe(true);
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  expect((await ack(r.request_id,"refused")).status).toBe("refused");
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  await activate();await unadopt();expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+});
+test("revocation rotates generation and old acknowledgements cannot revive",async()=>{
+  const r1=await activate();await unadopt();
+  expect((await ack(r1)).error).toBe("request_not_pending");
+  const r2=await request();expect(r2.ok).toBe(true);expect(r2.request_id).not.toBe(r1);
+  expect((await list()).children.some((n:any)=>n.child_node_id===child)).toBe(false);
+  expect((await ack(r2.request_id)).status).toBe("active");
+  const current=(await list()).children.find((n:any)=>n.child_node_id===child).binding_request_id;
+  expect(current).toBe(r2.request_id);expect(current).not.toBe(r1);
+  // Real HTTP authority feeds the existing daemon gate; later probes must not run.
+  for(const authority of [current,undefined])await expect(preflightCodexStart({request_id:r1} as any,{} as any,{} as any,authority,()=>true)).rejects.toThrow("adopt_codex_binding_generation_unproven");
+  await unadopt();
+});