@sleep2agi/commhub-server 0.9.0-preview.111 → 0.9.0-preview.113

package/src/node-daemon-bindings.test.ts

@@ -48,7 +48,7 @@ test("two-phase binding, daemon-bound pull, controllable map, adopted delete ref
   expect(await call(handlers("daemon").get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: true, node_id: CHILD, alias: "adoption-child", workdir: "/workspace/project" });
   expect(await call(handlers().get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: false });
   expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true });
-  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted" });
+  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted", binding_request_id: r.request_id });
   expect(buildControllableMap([], [{ node_id: CHILD, daemon_node_id: DAEMON }]).get(CHILD)).toBe(DAEMON);
   expect(await call(handlers().delete_node, { child_node_id: CHILD, confirm_alias: "adoption-child", network_id: NET })).toMatchObject({ ok: false, error: "adopted_node_delete_unsupported" });
   expect(db.get<any>("SELECT lifecycle_state FROM nodes WHERE node_id=?1", CHILD).lifecycle_state).toBe("active");

package/src/node-permissions.ts

@@ -16,6 +16,7 @@
 
 import { db } from "./db.js";
 import { canMessageAgent, type AgentRef } from "./agent-access.js";
+import { resolveNodeCaller } from "./create-node.js";
 
 export type NodePermissionMode = "normal" | "readonly" | "restricted";
 export const NODE_PERMISSION_MODES: readonly NodePermissionMode[] = ["normal", "readonly", "restricted"];
@@ -71,23 +72,55 @@ function normalizeMode(raw: unknown): NodePermissionMode {
 /** 节点令牌 → 节点身份(一次带索引的查询)。不是节点令牌 / 查不到 → null。 */
 export function nodeIdentity(tokenId: string | null | undefined, networkId: string | null | undefined): NodeIdentity | null {
   if (!tokenId || !networkId) return null;
-  const row = db.get<{ user_id: string | null; bound_node_id: string | null; name: string | null; owner_user_id: string | null; permission_mode: string | null; alias: string | null }>(
-    `SELECT t.user_id, t.bound_node_id, t.name, n.owner_user_id, n.permission_mode, n.alias
-       FROM api_tokens t LEFT JOIN nodes n ON n.node_id = t.bound_node_id
-      WHERE t.token_id = ?1 AND t.network_id = ?2`,
+  const row = db.get<{ user_id: string | null; name: string | null }>(
+    `SELECT user_id, name FROM api_tokens WHERE token_id = ?1 AND network_id = ?2`,
     tokenId, networkId,
   );
   if (!row) return null;
-  const aliases = new Set<string>();
-  if (row.alias) aliases.add(row.alias);
-  if (row.name?.startsWith("node:")) aliases.add(row.name.slice(5));
+  const resolved = resolveNodeCaller(tokenId);
+  // Revoked or not node-shaped: this lookup is not a second revocation gate.
+  if (!resolved.ok && resolved.reason === "not_a_node_token") {
+    const aliases = row.name?.startsWith("node:") ? [row.name.slice(5)] : [];
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases,
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  if (!resolved.ok || resolved.networkId !== networkId) {
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases: [],
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  if (resolved.kind === "unregistered") {
+    return {
+      networkId,
+      nodeId: null,
+      logKey: `token:${tokenId}`,
+      aliases: resolved.alias ? [resolved.alias] : [],
+      ownerUserId: row.user_id,
+      mode: "normal",
+    };
+  }
+  const node = db.get<{ owner_user_id: string | null; permission_mode: string | null }>(
+    `SELECT owner_user_id, permission_mode FROM nodes WHERE node_id = ?1 AND network_id = ?2`,
+    resolved.nodeId, networkId,
+  );
   return {
     networkId,
-    nodeId: row.bound_node_id,
-    logKey: row.bound_node_id ?? `token:${tokenId}`,
-    aliases: [...aliases],
-    ownerUserId: row.owner_user_id || row.user_id || null,
-    mode: normalizeMode(row.permission_mode),
+    nodeId: resolved.nodeId,
+    logKey: resolved.nodeId,
+    aliases: [resolved.alias],
+    ownerUserId: node?.owner_user_id || row.user_id || null,
+    mode: normalizeMode(node?.permission_mode),
   };
 }
 

package/src/requirement-due-reminders.ts

@@ -227,7 +227,7 @@ export function dueReminderFor(due: string, nowMs: number, tz: string, maxOverdu
 export function overdueSql(params: unknown[], nowMs: number, tz: string): string {
   const today = localDate(nowMs, tz);
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
 }
 /** 没逾期、且在 tz 的「今天 + days」那天结束之前到期(0 = 今天内)。 */
 export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz: string): string {
@@ -235,7 +235,7 @@ export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz:
   const lastDay = addDays(today, days);
   const endIso = new Date(localMidnightMs(addDays(lastDay, 1), tz)).toISOString().replace(/\.\d{3}Z$/, "Z");
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
 }
 
 // ── 扫描 ───────────────────────────────────────────────────
@@ -332,7 +332,7 @@ export function runDueReminders(opts: { now?: number } = {}): DueReminderSent[]
   const rows = db.all<DueRow>(
     `SELECT requirement_id, network_id, seq, title, due_on, owner_json, participants_json, agent_owner_json
        FROM requirements
-      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name <> 'done' AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
+      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name NOT IN ('done', 'abandoned') AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
     ...params,
   );
   const out: DueReminderSent[] = [];

package/src/requirement-notify.ts

@@ -12,7 +12,7 @@ import { isParticipant } from "./task-access.js";
 import { rewriteUnreadNoticeDm, sendNoticeDm } from "./human-dm.js";
 
 export const COALESCE_WINDOW_MS = 60_000;
-const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成" };
+const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成", abandoned: "废弃" };
 const MAX_LINES = 20;
 const MAX_ITEM_CHARS = 40;
 

package/src/requirements-abandoned-http.test.ts

@@ -0,0 +1,236 @@
+// 任务状态「废弃」(abandoned)—— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+// test2123 在真实 PostgreSQL 上原样再跑一遍(COMMHUB_TEST_PG_URL)。
+//
+// 废弃是关闭态(同 done):不算开着、不逾期、不发到期提醒、不记完成时间;改进 / 改出都记动态;能改回 pool / doing。
+// 旧 App(desktop ≤ 0.2.220)把不认识的状态当 pool —— 所以没声明 `X-Anet-Accept-Columns: abandoned`
+// (或 `accept_columns=abandoned`)的调用者看到的是 done;MCP 总是声明,看到真值。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-req-abandoned-"));
+process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+process.env.HOST = "127.0.0.1";
+for (const k of ["COMMHUB_DUE_REMINDER_TZ", "COMMHUB_DUE_OVERDUE_MAX_DAYS", "COMMHUB_DUE_REMINDER_NETWORKS", "COMMHUB_DUE_REMINDERS", "COMMHUB_DUE_REMINDERS_NETWORKS", "COMMHUB_DUE_REMINDERS_EXCLUDE_NETWORKS", "COMMHUB_DUE_REMINDERS_OWNERS"]) delete process.env[k];
+const PW = "AbandonedPassw0rd!x";
+const T0 = Date.UTC(2026, 9, 10, 2, 0, 0);
+const DAY = 86_400_000;
+const AWARE = { "X-Anet-Accept-Columns": "abandoned" };
+
+let BASE = "";
+let hub: any = null;
+let NET = "";
+let TOKEN = "";
+let OWNER = "";
+let db: any;
+let due: typeof import("./requirement-due-reminders.js");
+
+type R = { status: number; body: any };
+async function send(method: string, path: string, payload?: unknown, headers: Record<string, string> = {}): Promise<R> {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", ...headers },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  }, 60_000);
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+async function mcp(name: string, args: Record<string, unknown>): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  }, 60_000);
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  const payload = lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+async function card(name: string, extra: Record<string, unknown> = {}): Promise<string> {
+  const r = await send("POST", "/api/requirements", { network_id: NET, name, owner: { kind: "user", id: OWNER }, ...extra });
+  expect(r.status).toBe(201);
+  return r.body.requirement.id as string;
+}
+const get = (id: string, headers: Record<string, string> = {}) => send("GET", `/api/requirements/${id}?network_id=${NET}`, undefined, headers);
+const patch = (id: string, body: Record<string, unknown>, headers: Record<string, string> = {}) => send("PATCH", `/api/requirements/${id}?network_id=${NET}`, body, headers);
+const list = (qs = "", headers: Record<string, string> = {}) => send("GET", `/api/requirements?network_id=${NET}${qs}`, undefined, headers);
+const ids = (r: R) => (r.body.requirements as any[]).map(x => x.id);
+const columnIn = (r: R, id: string) => (r.body.requirements as any[]).find(x => x.id === id)?.column;
+const sentFor = (out: Array<{ requirement_id: string; kind: string }>, id: string) => out.filter(x => x.requirement_id === id).map(x => x.kind);
+const columnEvents = async (id: string) => ((await send("GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`, undefined, AWARE)).body.events as any[])
+  .filter(e => e.kind === "changed" && e.field === "column").map(e => [e.old, e.new]).reverse();
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const r = register(`ab_owner_${Date.now()}`, PW);
+  expect(r.ok).toBe(true);
+  TOKEN = r.token!;
+  OWNER = r.user!.user_id;
+  NET = r.network_id!;
+  due = await import("./requirement-due-reminders.js");
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  due.runDueReminders({ now: T0 - 30 * DAY }); // 到期提醒基线(同 requirement-due-reminders-http.test.ts)
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("abandoned column", () => {
+  test("schema accepts abandoned; the legacy CHECK migration is idempotent (SQLite rebuild / PG constraint swap)", async () => {
+    const { migrateRequirementColumnCheck } = await import("./requirements-migrate.js");
+    if (db.dialect === "postgres") {
+      // 模拟旧 PG 库:换回旧约束,迁移后 abandoned 能写,再跑一次照样不报错。
+      db.exec("ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check");
+      db.exec("ALTER TABLE requirements ADD CONSTRAINT requirements_column_name_check CHECK(column_name IN ('pool', 'doing', 'done'))");
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(true);
+      // 已经认识 abandoned:不再动表(不是每次启动都删了重加)
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(false);
+      // 加约束失败要响亮地失败,而且是一条语句:旧约束原样留着,不会落到「没约束」
+      db.exec("ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check");
+      db.exec("ALTER TABLE requirements ADD CONSTRAINT requirements_column_name_check CHECK(column_name IN ('pool', 'doing', 'done', 'bogus'))");
+      db.run("INSERT INTO requirements (requirement_id, network_id, title, column_name) VALUES ('req_ab_bogus', ?1, 'bogus', 'bogus')", [NET]);
+      expect(() => migrateRequirementColumnCheck(db)).toThrow();
+      const def = (db.get("SELECT pg_get_constraintdef(c.oid) AS def FROM pg_constraint c JOIN pg_class t ON t.oid = c.conrelid WHERE t.relname = 'requirements' AND c.conname = 'requirements_column_name_check'") as any)?.def ?? "";
+      expect(def).toContain("'bogus'");
+      db.run("DELETE FROM requirements WHERE requirement_id = 'req_ab_bogus'");
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(true);
+    } else {
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(false);
+    }
+    const id = await card("ab-schema");
+    expect((await patch(id, { column: "abandoned" }, AWARE)).status).toBe(200);
+    expect((await patch(id, { column: "cancelled" }, AWARE)).body.error).toBe("invalid_column");
+    expect((await list()).body.capabilities).toContain("column_abandoned");
+  }, 60_000);
+
+  test("set and restore: events recorded each way, no completedAt, restorable to pool and doing", async () => {
+    const id = await card("ab-set");
+    const a = await patch(id, { column: "abandoned" }, AWARE);
+    expect(a.status).toBe(200);
+    expect(a.body.requirement.column).toBe("abandoned");
+    expect(a.body.requirement.completedAt).toBeNull();
+    expect((await patch(id, { column: "doing" }, AWARE)).body.requirement.column).toBe("doing");
+    expect((await patch(id, { column: "abandoned" }, AWARE)).body.requirement.column).toBe("abandoned");
+    expect((await patch(id, { column: "pool" }, AWARE)).body.requirement.column).toBe("pool");
+    expect(await columnEvents(id)).toEqual([["pool", "abandoned"], ["abandoned", "doing"], ["doing", "abandoned"], ["abandoned", "pool"]]);
+    // 直接建在废弃列(带声明)也行
+    const created = await send("POST", "/api/requirements", { network_id: NET, name: "ab-born", column: "abandoned" }, AWARE);
+    expect(created.body.requirement.column).toBe("abandoned");
+  }, 60_000);
+
+  test("closed like done: not overdue, no due reminder, not counted as open in stats; restoring reopens it", async () => {
+    // id:到期提醒用假时钟 T0(10-10),到期 10-07 = 逾期 3 天;old:列表的 overdue 筛选用真时钟,到期给一个早就过了的日子。
+    const id = await card("ab-overdue", { due: "2026-10-07", column: "doing" });
+    const old = await card("ab-overdue-list", { due: "2020-01-01", column: "doing" });
+    expect(ids(await list("&overdue=1"))).toContain(old);
+    await patch(id, { column: "abandoned" }, AWARE);
+    await patch(old, { column: "abandoned" }, AWARE);
+    expect(ids(await list("&overdue=1"))).not.toContain(old);
+    expect(ids(await list("&overdue=0"))).toContain(old);
+    expect(sentFor(due.runDueReminders({ now: T0 }), id)).toEqual([]);
+    const stats = (await send("GET", `/api/requirements/stats?network_id=${NET}`)).body.totals;
+    const raw = db.all("SELECT column_name FROM requirements WHERE network_id = ?1 AND COALESCE(archived, 0) = 0", NET) as any[];
+    const n = (c: string) => raw.filter(r => r.column_name === c).length;
+    expect(stats.doing).toBe(n("doing"));
+    expect(stats.pool).toBe(n("pool"));
+    expect(stats.abandoned).toBe(n("abandoned"));
+    expect(n("abandoned")).toBeGreaterThan(0);
+    // 子任务进度不把废弃的子任务算进去
+    const parent = await card("ab-parent");
+    const kid = await card("ab-kid", { parent_id: parent });
+    await card("ab-kid2", { parent_id: parent });
+    await patch(kid, { column: "abandoned" }, AWARE);
+    // 声明了:废弃的子需求不算进度;没声明(旧 App 把它当 done 列出来):算进总数、算作完成,和它看到的列表对得上
+    expect((await get(parent, AWARE)).body.requirement.children).toEqual({ total: 1, done: 0 });
+    expect((await get(parent)).body.requirement.children).toEqual({ total: 2, done: 1 });
+    expect(columnIn(await list("&parent_id=" + parent), kid)).toBe("done");
+    // 改回 doing:又逾期、又提醒
+    await patch(id, { column: "doing" }, AWARE);
+    await patch(old, { column: "doing" }, AWARE);
+    expect(ids(await list("&overdue=1"))).toContain(old);
+    expect(sentFor(due.runDueReminders({ now: T0 }), id)).toEqual(["overdue"]);
+  }, 60_000);
+
+  test("old clients (no declaration) see abandoned as done; their writes cannot un-abandon it by echo", async () => {
+    const id = await card("ab-legacy");
+    await patch(id, { column: "abandoned" }, AWARE);
+    expect((await get(id)).body.requirement.column).toBe("done");
+    expect((await get(id, AWARE)).body.requirement.column).toBe("abandoned");
+    expect((await send("GET", `/api/requirements/${id}?network_id=${NET}&accept_columns=abandoned`)).body.requirement.column).toBe("abandoned");
+    expect(columnIn(await list(), id)).toBe("done");
+    expect(columnIn(await list("&view=summary"), id)).toBe("done");
+    expect(columnIn(await list("", AWARE), id)).toBe("abandoned");
+    // 列表缓存按声明分开:同一个查询串,先旧后新,不串值
+    expect(columnIn(await list(), id)).toBe("done");
+    expect(columnIn(await list("", AWARE), id)).toBe("abandoned");
+    // 旧客户端按 done 筛:带上废弃的(它眼里就是 done)
+    expect(ids(await list("&status=done"))).toContain(id);
+    expect(ids(await list("&status=done", AWARE))).not.toContain(id);
+    expect(ids(await list("&status=abandoned", AWARE))).toContain(id);
+    // 旧客户端改别的字段 / 回传它看到的 done:仍是废弃;响应里仍是 done
+    const p1 = await patch(id, { priority: "high" });
+    expect(p1.body.requirement.column).toBe("done");
+    const p2 = await patch(id, { column: "done" });
+    expect(p2.body.requirement.column).toBe("done");
+    expect((await get(id, AWARE)).body.requirement.column).toBe("abandoned");
+    // 旧客户端明确改回 pool:照办
+    expect((await patch(id, { column: "pool" })).body.requirement.column).toBe("pool");
+    // 新客户端从 abandoned 改成 done:真的完成
+    await patch(id, { column: "abandoned" }, AWARE);
+    const done = await patch(id, { column: "done" }, AWARE);
+    expect(done.body.requirement.column).toBe("done");
+    expect(done.body.requirement.completedAt).not.toBeNull();
+  }, 60_000);
+
+  test("events and last_event: undeclared callers see the projected column; done ↔ abandoned disappears for them", async () => {
+    const id = await card("ab-events");
+    await patch(id, { column: "abandoned" }, AWARE);
+    await patch(id, { column: "done" }, AWARE);
+    await patch(id, { column: "abandoned" }, AWARE);
+    const evs = async (headers: Record<string, string> = {}) => ((await send("GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`, undefined, headers)).body.events as any[])
+      .filter(e => e.kind === "changed" && e.field === "column").map(e => [e.old, e.new]).reverse();
+    expect(await evs(AWARE)).toEqual([["pool", "abandoned"], ["abandoned", "done"], ["done", "abandoned"]]);
+    expect(await evs()).toEqual([["pool", "done"]]);
+    const legacyRaw = JSON.stringify((await send("GET", `/api/requirements/events?network_id=${NET}`)).body.events);
+    expect(legacyRaw).not.toContain("abandoned");
+    // 每行的 last_event:最新一条是 done → abandoned,旧客户端那里投影后前后一样 → 不给字段 / 摘要
+    const legacyRow = (await list()).body.requirements.find((r: any) => r.id === id);
+    expect(legacyRow.last_event.field).toBeNull();
+    expect(legacyRow.last_event.summary).toBeUndefined();
+    const awareRow = (await list("", AWARE)).body.requirements.find((r: any) => r.id === id);
+    expect(awareRow.last_event).toMatchObject({ field: "column", summary: "done → abandoned" });
+    await patch(id, { column: "doing" }, AWARE);
+    const back = (await list()).body.requirements.find((r: any) => r.id === id);
+    expect(back.last_event).toMatchObject({ field: "column", summary: "done → doing" });
+    expect(JSON.stringify((await list()).body.requirements)).not.toContain("abandoned");
+  }, 60_000);
+
+  test("checklist toggle response is projected for undeclared callers", async () => {
+    const id = await card("ab-check", { checklist: [{ id: "c1", text: "one" }] });
+    await patch(id, { column: "abandoned" }, AWARE);
+    const legacy = await send("PATCH", `/api/requirements/${id}/checklist/c1?network_id=${NET}`, { done: true });
+    expect(legacy.status).toBe(200);
+    expect(legacy.body.requirement.column).toBe("done");
+    const aware = await send("PATCH", `/api/requirements/${id}/checklist/c1?network_id=${NET}`, { done: false }, AWARE);
+    expect(aware.body.requirement.column).toBe("abandoned");
+  }, 60_000);
+
+  test("MCP declares support: requirements_update / get / list carry the real value", async () => {
+    const id = await card("ab-mcp");
+    const up = await mcp("requirements_update", { id, network_id: NET, status: "abandoned" });
+    expect(up.requirement.column).toBe("abandoned");
+    expect((await mcp("requirements_get", { id, network_id: NET })).requirement.column).toBe("abandoned");
+    const l = await mcp("requirements_list", { network_id: NET, status: "abandoned" });
+    expect(l.requirements.map((x: any) => x.id)).toContain(id);
+    expect((await mcp("requirements_update", { id, network_id: NET, column: "doing" })).requirement.column).toBe("doing");
+  }, 60_000);
+});

package/src/requirements-errors.ts

@@ -54,7 +54,7 @@ const ENTRIES: Record<string, Entry> = {
   participants_conflict: { field: 'participants', message: 'participants (replace the whole list) cannot be combined with participants_add / participants_remove.', hint: 'Use participants_add / participants_remove to change a few people, or participants alone to replace the list.' },
   participants_add_remove_overlap: { field: 'participants_remove', message: 'The same person is in both participants_add and participants_remove.', hint: 'Send each person in only one of the two lists.' },
   too_many_participants: { field: 'participants_add', message: 'A task can have at most 100 participants.', hint: 'Remove some with participants_remove first.' },
-  status_conflicts_with_column: { field: 'status', message: 'status is an alias of column, and the two values sent differ.', hint: 'Send only one of them (pool, doing or done).' },
+  status_conflicts_with_column: { field: 'status', message: 'status is an alias of column, and the two values sent differ.', hint: 'Send only one of them (pool, doing, done or abandoned).' },
   invalid_assignee: { field: 'assignee', message: 'assignee must be a string (legacy free-text field).', hint: 'Prefer owner / agent_owner.' },
   // ── 项目 ──
   invalid_project: { field: 'project_id', message: 'project_id must be a project id string or null.', hint: 'Call projects_list to get project ids (proj_…); null removes the task from its project.' },
@@ -77,14 +77,14 @@ const ENTRIES: Record<string, Entry> = {
   empty_patch: (ctx) => {
     const sent = ctx.sent ?? [];
     const writable = ctx.writable?.length ? ctx.writable.join(', ') : 'name, column, priority, due, start, description, checklist, tags, owner, agent_owner, participants, project_id, parent_id, external_ref, external_url, archived';
-    const statusHint = sent.includes('status') ? 'To move a task between pool / doing / done, use column (status is the name of the list filter). ' : '';
+    const statusHint = sent.includes('status') ? 'To move a task between pool / doing / done / abandoned, use column (status is the name of the list filter). ' : '';
     return { message: sent.length ? `None of the keys sent (${sent.join(', ')}) is a writable field.` : 'The patch changes nothing.', hint: `${statusHint}Writable fields: ${writable}.` };
   },
   invalid_json: { message: 'The request body must be a JSON object.' },
   invalid_name: { field: 'name', message: 'name must be 1–80 characters.' },
   invalid_description: { field: 'description', message: 'description must be a string (markdown) of at most 20 000 characters.' },
-  invalid_column: { field: 'column', message: 'column must be pool, doing or done.' },
-  invalid_status: { field: 'status', message: 'status (list filter) must be pool, doing or done.' },
+  invalid_column: { field: 'column', message: 'column must be pool, doing, done or abandoned.' },
+  invalid_status: { field: 'status', message: 'status (list filter) must be pool, doing, done or abandoned.' },
   invalid_priority: { field: 'priority', message: 'priority must be high (P0), normal (P1), low (P2) or lowest (P3).' },
   invalid_due: { field: 'due', message: 'due is not a date this hub understands.', hint: `Use ${DUE_FORMATS}.` },
   invalid_start: { field: 'start', message: 'start is not a date this hub understands.', hint: `Use ${DUE_FORMATS}.` },

package/src/requirements-http.test.ts

@@ -373,7 +373,7 @@ describe("requirements stay on the hub", () => {
     expect((await api(ownerToken, path, { method: "PATCH", body: JSON.stringify({ due: "" }) })).body.requirement.due).toBe("");
     const listed = await api(ownerToken, "/api/requirements");
     expect(listed.body.capabilities).toContain("due_datetime");
-    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event"]);
+    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"]);
   });
 
   test("sub-requirements: parent_id in the same network, no cycles, ≤ 5 levels, child counts, filters, delete detaches children", async () => {

package/src/requirements-list-slim-http.test.ts

@@ -125,8 +125,8 @@ describe("view=summary", () => {
     const one = await send(admin.token, "GET", `/api/requirements/${card.id}?network_id=${NET}`);
     expect(one.body.requirement.description).toBe(f.description);
     // 比的是 summary 省掉的那部分(正文 / 子任务):两边一样多的 last_event(#506,每行约 150 B)不算,
-    // 否则这张只有几行的小表上,固定开销会把比例拉过一半。
-    const bare = (body: any) => JSON.stringify({ ...body, requirements: body.requirements.map(({ last_event: _l, ...r }: any) => r) }).length;
+    // 否则这张只有几行的小表上,固定开销会把比例拉过一半。capabilities 同理:两边一样、每加一个能力就长一截。
+    const bare = (body: any) => JSON.stringify({ ...body, capabilities: [], requirements: body.requirements.map(({ last_event: _l, ...r }: any) => r) }).length;
     expect(summary.body.requirements.every((r: any) => "last_event" in r)).toBe(true);
     expect(bare(summary.body)).toBeLessThan(bare(full.body) / 2);
   });

package/src/requirements-migrate.ts

@@ -119,6 +119,40 @@ export function migrateRequirementPriorityCheck(database: DbAdapter): { rebuilt:
   return { rebuilt: true };
 }
 
+/**
+ * 状态加 abandoned(废弃)。同 migrateRequirementPriorityCheck:旧库的 CHECK(column_name IN ('pool', 'doing', 'done'))
+ * SQLite 不能就地改,只重建一次;PostgreSQL 换掉默认名的列约束。已经放开的库什么都不做。存量值不改。
+ */
+const OLD_COLUMN_CHECK = /CHECK\s*\(\s*column_name\s+IN\s*\(\s*'pool'\s*,\s*'doing'\s*,\s*'done'\s*\)\s*\)/i;
+export const COLUMN_CHECK = "CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned'))";
+export function migrateRequirementColumnCheck(database: DbAdapter): { rebuilt: boolean } {
+  if (database.dialect === "postgres") {
+    // 只在约束还不认识 abandoned(或不存在)时动;一条 ALTER TABLE 里先删后加 = 一个语句,原子,
+    // 失败(比如存量里有不合法的值)整条回滚、旧约束原样留着,并且直接抛出 —— 不吞错,启动就该停下来。
+    const def = database.get<{ def: string }>(
+      "SELECT pg_get_constraintdef(c.oid) AS def FROM pg_constraint c JOIN pg_class t ON t.oid = c.conrelid WHERE t.relname = 'requirements' AND c.conname = 'requirements_column_name_check'",
+    )?.def ?? "";
+    if (def.includes("'abandoned'")) return { rebuilt: false };
+    database.exec(`ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check, ADD CONSTRAINT requirements_column_name_check ${COLUMN_CHECK}`);
+    return { rebuilt: true };
+  }
+  const table = database.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'");
+  if (!table?.sql || !OLD_COLUMN_CHECK.test(table.sql)) return { rebuilt: false };
+  const indexes = database.all<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'requirements' AND sql IS NOT NULL");
+  const createSql = table.sql
+    .replace(/^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?requirements["`]?/i, "CREATE TABLE requirements_migrated")
+    .replace(OLD_COLUMN_CHECK, COLUMN_CHECK);
+  database.transaction(() => {
+    database.exec("DROP TABLE IF EXISTS requirements_migrated");
+    database.exec(createSql);
+    database.exec("INSERT INTO requirements_migrated SELECT * FROM requirements");
+    database.exec("DROP TABLE requirements");
+    database.exec("ALTER TABLE requirements_migrated RENAME TO requirements");
+    for (const index of indexes) database.exec(index.sql);
+  });
+  return { rebuilt: true };
+}
+
 /**
  * 任务短号 seq:每个网络自己的 #1、#2…,界面显示和按 #N 查都用它。主键 requirement_id 不变。
  * - 加可空列 seq;没有号的旧行按 created_at(再按 requirement_id)补号,接在该网络已有的最大号后面。

package/src/requirements-priority-lowest.test.ts

@@ -68,7 +68,7 @@ describe("P3 lowest priority", () => {
   test("startup rebuilds the legacy CHECK once and keeps every row and index", async () => {
     const sql = db.get("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'").sql as string;
     expect(sql).toContain("'lowest'");
-    expect(sql).toContain("CHECK(column_name IN ('pool', 'doing', 'done'))");
+    expect(sql).toContain("CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned'))");
     const rows = db.all("SELECT requirement_id, network_id, title, priority, client_id, description, tags_json FROM requirements WHERE network_id = 'net_legacy' ORDER BY requirement_id") as any[];
     expect(rows.map(r => [r.requirement_id, r.priority])).toEqual([["r_high", "high"], ["r_low", "low"], ["r_normal", "normal"]]);
     for (const r of rows) {

package/src/requirements-stats.ts

@@ -93,7 +93,7 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
   const sparkDays = new Set(days.slice(-STATS_SPARK_DAYS));
   const daily = new Map(days.map(d => [d, 0]));
 
-  let done = 0, approx = 0, created = 0, createdDone = 0, doing = 0, pool = 0, unattributed = 0;
+  let done = 0, approx = 0, created = 0, createdDone = 0, doing = 0, pool = 0, abandoned = 0, unattributed = 0;
   const byProject = new Map<string | null, number>();
   const byCompleter = new Map<string, { ref: Ref; n: number; spark: Map<string, number> }>();
   const recent: { row: StatsRow; ms: number; by: Ref | null }[] = [];
@@ -102,6 +102,7 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
     // 当前还开着的卡(不看时间范围;归档的不算「进行中」)。
     if (!row.archived && row.column_name === "doing") doing++;
     if (!row.archived && row.column_name === "pool") pool++;
+    if (!row.archived && row.column_name === "abandoned") abandoned++;
     const completedMs = row.column_name === "done" ? msOf(row.completed_at) : null;
     const createdMs = msOf(row.created_at);
     if (inRange(createdMs)) {
@@ -143,6 +144,8 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
       completion_rate: created ? createdDone / created : null,
       doing,
       pool,
+      // 废弃(关闭,不算开着也不算完成)。旧 App 忽略这个字段。
+      abandoned,
     },
     daily: days.map(date => ({ date, n: daily.get(date) ?? 0 })),
     by_project: [...byProject].map(([project_id, n]) => ({ project_id, n })).sort((a, b) => b.n - a.n || String(a.project_id).localeCompare(String(b.project_id))),