@sleep2agi/commhub-server 0.9.0-preview.111 → 0.9.0-preview.113

package/src/requirements.ts

@@ -5,6 +5,7 @@ import { createHash } from "node:crypto";
 import { parsePeopleQuery, peopleDirectory, resolvePersonName } from "./requirements-people.js";
 import { encodeCursor, matchesTaskId, matchesTerms, parseListQuery, type ListQuery, type NameMaps } from "./requirements-search.js";
 import { db, logAudit } from "./db.js";
+import { resolveNodeCaller } from "./create-node.js";
 import { markGzipReusable } from "./http-gzip.js";
 import { applyTagOp, normalizeTags, parseTagOp, storedTags, type TagOp } from "./requirement-tags.js";
 import { aggregateStats, parseStatsQuery, type StatsRow } from "./requirements-stats.js";
@@ -19,11 +20,12 @@ import { notifyLeaderDeleted, notifyParticipantChange } from "./requirement-noti
 import { departmentCardsFor, departmentSubtree } from "./department-heads.js";
 import { dueReminderTimezone, dueWithinSql, ensureDueReminders, overdueSql } from "./requirement-due-reminders.js";
 import { diffRequirement, ensureRequirementEvents, eventPublic, recordRequirementEvents, type EventRow } from "./requirement-events.js";
-import { ensureNetworkTags, ensureRequirementCompletedAt, ensureRequirementIndexes, ensureRequirementProjects, ensureRequirementSeq, ensureRequirementTombstones, migrateRequirementAgentOwners, migrateRequirementPriorityCheck, nextRequirementSeq } from "./requirements-migrate.js";
+import { ensureNetworkTags, ensureRequirementCompletedAt, ensureRequirementIndexes, ensureRequirementProjects, ensureRequirementSeq, ensureRequirementTombstones, migrateRequirementAgentOwners, migrateRequirementColumnCheck, migrateRequirementPriorityCheck, nextRequirementSeq } from "./requirements-migrate.js";
 
 // 启动迁移:旧库里节点当负责人的卡,节点挪到 agent_owner(列由 db.ts 的加列循环加上)。
 // 放在这里而不是 db.ts:db.ts 每多一行,文档里钉着的行号就漂一次。
 migrateRequirementPriorityCheck(db);
+migrateRequirementColumnCheck(db);
 migrateRequirementAgentOwners(db);
 ensureRequirementProjects(db);
 ensureRequirementIndexes(db);
@@ -51,7 +53,36 @@ export type RequirementsRequestContext = {
   strictOwner?: boolean;
 };
 
-const COLUMNS = new Set(["pool", "doing", "done"]);
+const COLUMNS = new Set(["pool", "doing", "done", "abandoned"]);
+/**
+ * 废弃(abandoned):和 done 一样是关闭态 —— 不算开着、不算逾期、不发到期提醒,不记完成时间;能改回 pool / doing。
+ * 旧客户端(desktop ≤ 0.2.220)只认 pool / doing / done,不认识的值一律当成 pool(会把废弃的卡摆回需求池、还标逾期)。
+ * 所以客户端没声明认识它时,响应里把 abandoned 投影成 done;声明方式二选一:
+ *   请求头 `X-Anet-Accept-Columns: abandoned`,或查询参数 `accept_columns=abandoned`。
+ * MCP(tools.ts)总是声明。文档:docs-site/docs/api/mcp-tools.md「需求池 / 任务看板」的 column 字段。
+ */
+const ACCEPT_COLUMNS_HEADER = "x-anet-accept-columns";
+function knowsAbandoned(ctx: RequirementsRequestContext): boolean {
+  const raw = `${ctx.req.headers.get(ACCEPT_COLUMNS_HEADER) ?? ""},${ctx.url.searchParams.get("accept_columns") ?? ""}`;
+  return raw.split(",").some(v => v.trim() === "abandoned");
+}
+/**
+ * 动态的旧客户端视图:column 改动的 old / new、created 的 new.column 都投影;投影后前后一样(done ↔ abandoned)= null(不回)。
+ */
+function projectEvent<T extends { kind: string; field: string | null; old: unknown; new: unknown }>(ev: T, aware: boolean): T | null {
+  if (aware) return ev;
+  if (ev.kind === "created" && ev.new && typeof ev.new === "object" && typeof (ev.new as any).column === "string") {
+    return { ...ev, new: { ...(ev.new as object), column: projectColumn((ev.new as any).column, false) } };
+  }
+  if (ev.field !== "column") return ev;
+  const old = typeof ev.old === "string" ? projectColumn(ev.old, false) : ev.old;
+  const neu = typeof ev.new === "string" ? projectColumn(ev.new, false) : ev.new;
+  return old === neu ? null : { ...ev, old, new: neu };
+}
+/** 旧客户端看到的状态:abandoned → done,其余原样。 */
+export function projectColumn(column: string, aware: boolean): string {
+  return column === "abandoned" && !aware ? "done" : column;
+}
 // 界面上 P0–P3:high=P0 最高、normal=P1 普通、low=P2 低、lowest=P3 极低。存的值不变,旧客户端照常读写前三个。
 const PRIORITIES = new Set(["high", "normal", "low", "lowest"]);
 const DUE = /^\d{4}-\d{2}-\d{2}$/;
@@ -72,6 +103,7 @@ type Row = {
   parent_id: string | null;
   children_total: number | null;
   children_done: number | null;
+  children_abandoned?: number | null;
   participants_json: string;
   requirement_id: string;
   network_id: string;
@@ -510,7 +542,8 @@ function toPublic(row: Row) {
     updated_by: row.updated_by_json ? JSON.parse(row.updated_by_json) : null,
     // 子需求:parent_id(可空)和父卡上的子需求进度(未归档的子需求数 / 其中完成的)。
     parent_id: row.parent_id || null,
-    children: { total: Number(row.children_total ?? 0), done: Number(row.children_done ?? 0) },
+    // 废弃的子需求不算进度(total 里减掉);旧客户端眼里它是 done,见 toPublicFor。
+    children: { total: Number(row.children_total ?? 0) - Number(row.children_abandoned ?? 0), done: Number(row.children_done ?? 0) },
     // 完成时间:进「完成」列的时刻,移出清空(不在「完成」列 = null)。completedAtApprox = 升级前就完成的卡,
     // 时刻是按 updated_at 补的近似值。completedBy = 谁移进「完成」的(近似值的卡为 null)。旧 App 忽略这三个字段。
     completedAt: row.completed_at || null,
@@ -562,7 +595,14 @@ function toPublicFor(ctx: RequirementsRequestContext, row: Row) {
   if (!perms) permsByCtx.set(ctx, perms = taskPermissionsResolver(taskCaller(ctx)));
   // viewer_can:只对「只看相关任务」的调用者出现,客户端据此画只读锁、藏删除;不出现 = 与今天一样全能(旧 Hub 也不出现)。
   const can = perms(row);
-  const pub = can ? { ...toPublic(row), viewer_can: can } : toPublic(row);
+  const base = toPublic(row);
+  if (!knowsAbandoned(ctx)) {
+    base.column = projectColumn(base.column, false);
+    // 旧客户端把废弃的子需求当 done 列出来:进度也按「算进总数、算作完成」给,和它看到的子需求列表对得上。
+    const abandoned = Number(row.children_abandoned ?? 0);
+    base.children = { total: base.children.total + abandoned, done: base.children.done + abandoned };
+  }
+  const pub = can ? { ...base, viewer_can: can } : base;
   const hidden = hiddenNodeFilter(ctx, row.network_id);
   if (!hidden) return pub;
   return {
@@ -578,6 +618,7 @@ function toPublicFor(ctx: RequirementsRequestContext, row: Row) {
 
 const SELECT = "requirement_id, network_id, title, column_name, priority, due_on, assignee, issues_json, tags_json, created_at, owner_json, participants_json, agent_owner_json, description, checklist_json, project_id, external_ref, external_url, archived, created_by, created_by_json, updated_by_json, updated_at, parent_id, start_on, seq, completed_at, completed_by_json, completed_at_approx, " +
   "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0) AS children_total, " +
+  "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0 AND c.column_name = 'abandoned') AS children_abandoned, " +
   "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0 AND c.column_name = 'done') AS children_done";
 
 type PersonRef = { kind: 'user' | 'node'; id: string };
@@ -729,7 +770,7 @@ function ifNoneMatchHits(header: string | null, etag: string): boolean {
 // list_summary:GET 认 view=summary(不带描述正文与子任务条目,见 toSummary);changes:GET 认 changes=1 + updated_since
 // (改过的卡含归档的,加上 deleted 墓碑与 server_time,见 listChanges)。
 // events:GET /api/requirements/events —— 字段级的改动流水(谁、何时、旧值 → 新值,requirement-events.ts)。
-export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event"] as const;
+export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
 
 // ── 子需求 ──
 // parent_id:同一网络里的另一张卡;不能成环;最多 5 层(顶层是第 1 层)。删父卡 = 子卡保留、parent_id 置空。
@@ -795,13 +836,8 @@ function actorOf(ctx: RequirementsRequestContext): Actor | null {
   if (!ctx.auth) return null;
   if (!ctx.isNodeToken) return { kind: "user", id: ctx.auth.userId };
   const tokenId = ctx.auth.tokenId ?? null;
-  const bound = tokenId ? db.get<{ bound_node_id: string | null }>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", tokenId)?.bound_node_id : null;
-  if (bound) return { kind: "node", id: bound };
-  const alias = ctx.auth.tokenName?.startsWith("node:") ? ctx.auth.tokenName.slice(5) : null;
-  if (alias && ctx.auth.networkId) {
-    const node = db.get<{ node_id: string }>("SELECT node_id FROM nodes WHERE network_id = ?1 AND alias = ?2", ctx.auth.networkId, alias);
-    if (node) return { kind: "node", id: node.node_id };
-  }
+  const resolved = tokenId ? resolveNodeCaller(tokenId) : null;
+  if (resolved?.ok && resolved.kind === "node") return { kind: "node", id: resolved.nodeId };
   return { kind: "node", id: `token:${tokenId ?? "unknown"}` };
 }
 
@@ -1021,7 +1057,10 @@ function patchRequirement(ctx: RequirementsRequestContext, row: Row, body: Recor
     archived = body.archived ? 1 : 0;
   }
   const updatedAt = new Date().toISOString();
-  const column = has("column") ? String(body.column) : row.column_name;
+  // 旧客户端眼里废弃的卡是 done:它回传 column=done 不是「改成完成」,保持废弃。
+  const column = !has("column") ? row.column_name
+    : row.column_name === "abandoned" && body.column === "done" && !knowsAbandoned(ctx) ? "abandoned"
+    : String(body.column);
   const actor = JSON.stringify(actorOf(ctx));
   // 完成时间:移进「完成」= 此刻 + 这次的操作者;移出 = 清空;留在「完成」(done → done、改别的字段)= 原样不动。
   const completed = column !== "done" ? { at: null, by: null, approx: 0 }
@@ -1087,7 +1126,9 @@ function listFilters(url: URL, sql: string, params: unknown[], ctx?: Requirement
   const status = q.get("status");
   if (status !== null) {
     if (!COLUMNS.has(status)) return jsonError("invalid_status", 400);
-    sql += ` AND column_name = ?${params.push(status)}`;
+    // 旧客户端把废弃的卡看成 done:它按 done 筛时也要带上废弃的,否则同一张卡在列表里有、筛出来没有。
+    if (status === "done" && ctx && !knowsAbandoned(ctx)) sql += " AND column_name IN ('done', 'abandoned')";
+    else sql += ` AND column_name = ?${params.push(status)}`;
   }
   const project = q.get("project_id");
   if (project !== null) sql += project === "none" ? " AND project_id IS NULL" : ` AND project_id = ?${params.push(project)}`;
@@ -1323,7 +1364,9 @@ function lastEventsFor(ctx: RequirementsRequestContext, rows: readonly Row[]): M
     ...ids,
   );
   if (!events.length) return out;
-  const pubs = events.map(eventPublic);
+  const aware = knowsAbandoned(ctx);
+  // 投影后成了 done → done 的那条:当作没有可展示的字段(同下面隐去节点的处理)。
+  const pubs = events.map(e => { const ev = eventPublic(e); return projectEvent(ev, aware) ?? { ...ev, field: null, old: null, new: null }; });
   const userIds = new Set<string>(), nodeIds = new Set<string>();
   for (const ev of pubs) if (isRef(ev.actor)) (ev.actor.kind === "user" ? userIds : nodeIds).add(ev.actor.id);
   // 名字规则同 GET /api/requirements/people 的 name(没设显示名 → 用户名 / alias / node_name)。
@@ -1388,6 +1431,7 @@ function listEvents(ctx: RequirementsRequestContext): Response {
   const serverTime = new Date().toISOString();
   const caller = taskCaller(ctx);
   const hidden = hiddenNodeFilter(ctx, networkId);
+  const aware = knowsAbandoned(ctx);
   const seen = new Map<string, boolean>();
   const canSee = (id: string): boolean => {
     if (!caller) return true;
@@ -1403,7 +1447,8 @@ function listEvents(ctx: RequirementsRequestContext): Response {
   };
   const shown = (row: EventRow) => {
     if (!canSee(row.requirement_id)) return null;
-    const ev = eventPublic(row);
+    const ev = projectEvent(eventPublic(row), aware);
+    if (!ev) return null;
     if (!hidden) return ev;
     const mask = (ref: unknown) => (isHiddenRef(ref, hidden) ? null : ref);
     const masked = { ...ev, actor: mask(ev.actor) };
@@ -1483,7 +1528,7 @@ function listCacheAcl(ctx: RequirementsRequestContext): string | null {
 
 function listCacheKey(ctx: RequirementsRequestContext): string {
   const sorted = [...ctx.url.searchParams.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-  return JSON.stringify({ u: ctx.auth?.userId ?? null, n: ctx.auth?.networkId ?? null, a: ctx.isAdmin, t: ctx.isNodeToken, s: ctx.scope, q: sorted });
+  return JSON.stringify({ u: ctx.auth?.userId ?? null, n: ctx.auth?.networkId ?? null, a: ctx.isAdmin, t: ctx.isNodeToken, s: ctx.scope, q: sorted, c: knowsAbandoned(ctx) });
 }
 
 /** Test-only. */

package/src/rest-identity.ts

@@ -12,15 +12,20 @@
 // task row and, once sender labels reach the copresence TUIs, rendered to a
 // human as an attribution.
 //
-// This is the same decision expressed as a pure function so every credential
-// kind is a directly constructible test input rather than a hand-assembled
-// Request (the #503 convention in this codebase).
+// Production network tokens pass tokenId and resolve through resolveNodeCaller.
+// A token whose name is not `node:` (not_a_node_token, the registration token
+// before report_status) falls back to nodeAliasForToken, same as main.
+// tokenId omitted keeps the name-only shape used by the unit cases below.
+
+import { resolveNodeCaller } from "./create-node.js";
 
 export interface RestIdentityInput {
   /** Raw bearer token, only its prefix matters (`ntok_` = network-bound). */
   token: string;
   /** `api_tokens.name`; for node tokens it is `node:<alias>`. */
   tokenName: string | null | undefined;
+  /** Set on the production path. Network tokens then ignore tokenName as authority. */
+  tokenId?: string | null;
   /** Username resolved from the authenticated token. */
   authenticatedUsername?: string | null;
   /** Caller-supplied `body.from`. */
@@ -46,8 +51,28 @@ export function nodeAliasForToken(token: string, tokenName: string | null | unde
 }
 
 export function resolveRestFromSession(input: RestIdentityInput): RestIdentityResult {
-  const alias = nodeAliasForToken(input.token, input.tokenName);
   const requested = typeof input.requestedFrom === "string" ? input.requestedFrom.trim() : "";
+  let alias: string | null;
+  if (input.token.startsWith("ntok_") && input.tokenId) {
+    const resolved = resolveNodeCaller(input.tokenId);
+    if (resolved.ok) {
+      alias = resolved.alias;
+    } else if (resolved.reason === "not_a_node_token") { // board679-plain-ntok-rest
+      // Name is not `node:` yet. Main signs that as api, and refuses a claim.
+      // not_owner / bound_node_missing / ambiguous stay the hard reject.
+      alias = nodeAliasForToken(input.token, input.tokenName);
+    } else {
+      return {
+        ok: false,
+        error: "from_session_identity_mismatch",
+        message: "network token from_session does not match token-bound node alias",
+        tokenAlias: "",
+        requestedFromSession: requested,
+      };
+    }
+  } else {
+    alias = nodeAliasForToken(input.token, input.tokenName);
+  }
 
   // A network-bound token whose name we cannot resolve to an alias (`node:`,
   // `node:   `, or a name that was never node-scoped) is the degenerate case.

package/src/server.ts

@@ -39,7 +39,7 @@ import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_PERMISSION_MO
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
 import { daemonDefaultWorkdirRoot } from "./create-node-validate.js";
-import { register, login, resolveToken, tokenRejection, isExpiredSessionToken, sessionIdleDays, listSessions, revokeSession, revokeOtherSessions, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, adminDeleteEmptyNetwork, renameNetwork, changePassword, issueUserToken, listTokens, createToken, revokeToken, getNetworkMembers, getNetworkHumans, getUserNetworkRole, addNetworkMember, adminCreateUser, listUsersWithMemberships, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
+import { register, login, resolveToken, tokenRejection, isExpiredSessionToken, sessionIdleDays, listSessions, revokeSession, revokeOtherSessions, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, adminDeleteEmptyNetwork, renameNetwork, changePassword, issueUserToken, getUserTokenMeta, listTokens, createToken, revokeToken, getNetworkMembers, getNetworkHumans, getUserNetworkRole, addNetworkMember, adminCreateUser, listUsersWithMemberships, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
 import { abortRename, cleanupCommittedRenameSessions, commitRename, prepareRename, resolveCanonicalAlias } from "./rename.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
 import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
@@ -75,6 +75,7 @@ import {
   TASK_REST_SELECT,
 } from "./rest-projections.js";
 import { resolveRestFromSession } from "./rest-identity.js";
+import { resolveNodeCaller } from "./create-node.js";
 import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 import { diagnoseTask } from "./task-diagnostic.js";
 import { assertScheduledTaskBackendSupported, handleScheduledTaskRequest, startScheduledTaskScheduler } from "./scheduled-tasks.js";
@@ -197,12 +198,12 @@ function sweepStaleRateLimits(): void {
 }
 
 // ── Factory: 每个请求创建新的 McpServer（stateless 模式）──
-function createServer(clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, includeProtocolTools = false): McpServer {
+function createServer(clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null, includeProtocolTools = false, callerIdentityRejected = false): McpServer {
   const server = new McpServer({
     name: "commhub",
     version: "0.5.0",
   });
-  registerTools(server, clientIP, enforceNetworkId, enforceUserId, callerAlias, callerTokenIsNetwork, callerTokenId, { includeProtocol: includeProtocolTools });
+  registerTools(server, clientIP, enforceNetworkId, enforceUserId, callerAlias, callerTokenIsNetwork, callerTokenId, { includeProtocol: includeProtocolTools }, callerIdentityRejected);
   return server;
 }
 
@@ -272,6 +273,16 @@ function nodeSubscriberInfo(req: Request, server: any, tokenId: string | null, a
   return { nodeId, instanceId, remote, userAgent: req.headers.get("user-agent")?.slice(0, 200) ?? null };
 }
 
+// The stream belongs to a node id, not a name. A session that never stored
+// node_id still owns its stream when this network has exactly one nodes row
+// for the alias. Null does not match null.
+function streamOwnerNodeId(alias: string, networkId: string): string | null {
+  const fromSession = db.get<{ node_id: string | null }>("SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2", alias, networkId)?.node_id ?? null;
+  if (fromSession) return fromSession;
+  const rows = db.all<{ node_id: string }>("SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2", alias, networkId);
+  return rows.length === 1 ? rows[0].node_id : null;
+}
+
 function isLocalhostIP(ip: string): boolean {
   return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1" || ip === "localhost";
 }
@@ -310,17 +321,24 @@ function isHubAdminCredential(resolved: { networkId: string | null; user: { role
 function nodeTokenAlias(resolved: { tokenName: string | null }): string | null {
   return resolved.tokenName?.startsWith("node:") ? resolved.tokenName.slice("node:".length) : null;
 }
-function nodeMayRename(resolved: { networkId: string | null; tokenName: string | null }, networkId: unknown, oldAlias: unknown): boolean {
+function resolvedNodeAlias(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }): string | null {
+  if (!resolved.tokenId) return nodeTokenAlias(resolved);
+  const caller = resolveNodeCaller(resolved.tokenId);
+  if (!caller.ok) return null;
+  if (resolved.networkId && caller.networkId !== resolved.networkId) return null;
+  return caller.alias;
+}
+function nodeMayRename(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }, networkId: unknown, oldAlias: unknown): boolean {
   if (!resolved.networkId) return true;
-  return networkId === resolved.networkId && typeof oldAlias === "string" && oldAlias === nodeTokenAlias(resolved);
+  return networkId === resolved.networkId && typeof oldAlias === "string" && oldAlias === resolvedNodeAlias(resolved);
 }
-function nodeMayRenameTxn(resolved: { networkId: string | null; tokenName: string | null }, txnId: unknown): boolean {
+function nodeMayRenameTxn(resolved: { networkId: string | null; tokenName: string | null; tokenId?: string | null }, txnId: unknown): boolean {
   if (!resolved.networkId) return true;
   if (typeof txnId !== "string") return false;
   const txn = db.get<{ network_id: string; old_alias: string; new_alias: string }>("SELECT network_id, old_alias, new_alias FROM rename_txn WHERE txn_id = ?1", txnId);
   if (!txn || txn.network_id !== resolved.networkId) return false;
   // commit 前后令牌名可能已被改成新 alias(api_tokens.name 跟随改名),两个都算它自己。
-  const self = nodeTokenAlias(resolved);
+  const self = resolvedNodeAlias(resolved);
   return self === txn.old_alias || self === txn.new_alias;
 }
 
@@ -1030,11 +1048,20 @@ return Bun.serve({
       const token = requestToken(req);
       const authCtx = resolveRequestAuth(req);
       const enforceNetId = authCtx?.networkId || null;
-      // Derive the calling alias from the token name (e.g., 'node:视频审查')
-      // so peer agents see the real sender instead of 'hub' on send_task.
-      const callerAlias = authCtx?.tokenName?.startsWith("node:")
-        ? authCtx.tokenName.slice("node:".length)
-        : (authCtx?.username || null);
+      // A resolved node token speaks as that node. A token whose name is not
+      // `node:` (the registration network token) keeps the username. Only a
+      // `node:` token refused as not_owner / bound_node_missing / ambiguous
+      // is impersonation, and must not fall through to a client-supplied from.
+      let callerAlias: string | null = authCtx?.username || null;
+      let callerIdentityRejected = false;
+      if (token?.startsWith("ntok_")) {
+        const resolvedCaller = authCtx?.tokenId ? resolveNodeCaller(authCtx.tokenId) : null;
+        if (resolvedCaller?.ok) callerAlias = resolvedCaller.alias;
+        else if (resolvedCaller && resolvedCaller.reason !== "not_a_node_token") { // board679-plain-ntok
+          callerAlias = null;
+          callerIdentityRejected = true;
+        }
+      }
       const transport = new WebStandardStreamableHTTPServerTransport({
         sessionIdGenerator: undefined,
       });
@@ -1052,7 +1079,7 @@ return Bun.serve({
         labelRoute(req, mcpParsedBody === undefined ? "?" : mcpRouteLabel(mcpParsedBody));
       }
       // #478:tools/list 按调用者过滤;X-Anet-Tools: all / ?tools=all 时节点令牌也列出协议工具。
-      const mcpServer = createServer(clientIP, enforceNetId, authCtx?.userId || null, callerAlias, !!token?.startsWith("ntok_"), authCtx?.tokenId || null, wantsAllTools(req, url));
+      const mcpServer = createServer(clientIP, enforceNetId, authCtx?.userId || null, callerAlias, !!token?.startsWith("ntok_"), authCtx?.tokenId || null, wantsAllTools(req, url), callerIdentityRejected);
       await mcpServer.connect(transport);
       const response = await transport.handleRequest(req, mcpParsedBody === undefined ? undefined : { parsedBody: mcpParsedBody });
       // Disconnect after response to prevent McpServer leak
@@ -1206,11 +1233,22 @@ return Bun.serve({
           nodeId: db.get<{ node_id: string | null }>("SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2", sessionName, scopedNetId)?.node_id ?? null,
         }));
         if (streamDenied) return streamDenied;
-        // #507 — the node's OWN stream (token bound to this alias) is node-scoped:
-        // at most one per (network, alias), newest wins. A node token watching some
-        // other alias stays a plain monitor and can never supersede that node.
-        if (authCtx.tokenName === `node:${sessionName}` && authCtx.networkId === scopedNetId) {
-          return createSSEStream(sessionName, scopedNetId, { node: nodeSubscriberInfo(req, server, authCtx.tokenId, sessionName, scopedNetId) });
+        // #507 — the node's OWN stream is node-scoped: at most one per (network,
+        // alias), newest wins. Own means the resolved node id equals this stream's
+        // node id. A matching token name is not enough, and a monitor never supersedes.
+        const resolvedCaller = authCtx.tokenId ? resolveNodeCaller(authCtx.tokenId) : null;
+        const streamNodeId = streamOwnerNodeId(sessionName, scopedNetId);
+        if (
+          resolvedCaller?.ok
+          && resolvedCaller.kind === "node"
+          && resolvedCaller.nodeId
+          && streamNodeId
+          && resolvedCaller.nodeId === streamNodeId
+          && resolvedCaller.networkId === scopedNetId
+        ) {
+          const info = nodeSubscriberInfo(req, server, authCtx.tokenId, sessionName, scopedNetId);
+          if (!info.nodeId) info.nodeId = resolvedCaller.nodeId;
+          return createSSEStream(sessionName, scopedNetId, { node: info });
         }
         return createSSEStream(sessionName, scopedNetId);
       }
@@ -1338,7 +1376,7 @@ return Bun.serve({
       }
       try {
         const body = await req.json() as any;
-        const result = register(body.username, body.password, body.email, body.display_name, { client: { label: body.client_label, userAgent: req.headers.get("user-agent") } });
+        const result = register(body.username, body.password, body.email, body.display_name, { client: { label: body.client_label, userAgent: req.headers.get("user-agent"), kind: body.client_kind } });
         if (result.ok) logAudit(result.user!.user_id, body.username, "register", "user", result.user!.user_id);
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
       } catch (e: any) {
@@ -1366,7 +1404,7 @@ return Bun.serve({
             { status: 429, headers: { "Retry-After": String(Math.ceil((lock.retryAfterMs ?? 1000) / 1000)) } }
           ));
         }
-        const result = login(body.username, body.password, { label: body.client_label, userAgent: req.headers.get("user-agent") });
+        const result = login(body.username, body.password, { label: body.client_label, userAgent: req.headers.get("user-agent"), kind: body.client_kind });
         if (result.ok) {
           sharedLoginFailureLockout.recordSuccess(body.username);
           logAudit(result.user!.user_id, body.username, "login", "user", result.user!.user_id);
@@ -1395,8 +1433,9 @@ return Bun.serve({
       // RFC-040:managed_department_ids = 我负责的部门 + 全部下级(空 = 不是负责人;viewer 恒空;节点令牌不是人,恒空)。
       const networks = (resolved.networkId ? allNetworks.filter((n: any) => n.network_id === resolved.networkId) : allNetworks)
         .map((n: any) => ({ ...n, managed_department_ids: resolved.networkId ? [] : managedDepartmentIds(n.network_id, resolved.user.user_id) }));
+      const nodeCaller = resolved.networkId && resolved.tokenId ? resolveNodeCaller(resolved.tokenId) : null;
       const credential = resolved.networkId
-        ? { kind: "node", network_id: resolved.networkId, node_alias: resolved.tokenName?.startsWith("node:") ? resolved.tokenName.slice(5) : null, acts_as_owner: false }
+        ? { kind: "node", network_id: resolved.networkId, node_alias: nodeCaller?.ok ? nodeCaller.alias : null, acts_as_owner: false }
         : { kind: "user" };
       return withCors(req, Response.json({ ok: true, user: resolved.user, networks, current_network: resolved.networkId, credential }));
     }
@@ -1434,9 +1473,13 @@ return Bun.serve({
       if (isNodeCredential(resolved)) return userTokenRequired(req);
       try {
         const body = await req.json() as any;
-        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId);
+        // #711 不带 keep_cli_tokens 的请求(旧 app、dashboard 代理)= 改密码前的行为:撤销全部不绑网络的令牌。
+        // keep_cli_tokens 必须是布尔 true 才保留命令行 / 脚本令牌。
+        const meta = resolved.tokenId ? getUserTokenMeta(resolved.user.user_id, resolved.tokenId) : null;
+        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId, { keepCliTokens: body.keep_cli_tokens === true });
         if (result.ok) {
-          const issued = issueUserToken(resolved.user.user_id, "password-change");
+          // 换发的新令牌沿用当前这条的种类和设备标识:anet passwd 换完仍是命令行令牌。
+          const issued = issueUserToken(resolved.user.user_id, "password-change", { kind: meta?.kind, clientLabel: meta?.client_label, userAgent: meta?.user_agent });
           if (resolved.tokenId) revokeToken(resolved.user.user_id, resolved.tokenId);
           logAudit(resolved.user.user_id, resolved.user.username, "password_changed", "user", resolved.user.user_id);
           return withCors(req, Response.json({ ...result, token: issued.token, token_id: issued.token_id }));
@@ -3546,6 +3589,7 @@ return Bun.serve({
       const identity = resolveRestFromSession({
         token: requestToken(req),
         tokenName: restAuth?.tokenName,
+        tokenId: restAuth?.tokenId,
         authenticatedUsername: restAuth?.username,
         requestedFrom: body.from,
       });