@sleep2agi/commhub-server 0.9.0-preview.112 → 0.9.0-preview.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.112",
+  "version": "0.9.0-preview.113",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth-password-change-cli-tokens-http.test.ts

@@ -0,0 +1,294 @@
+// #711 改密码只让浏览器 / app 的登录会话下线,命令行和脚本令牌默认保留。
+//
+// main 上 POST /api/auth/password 跑的是 `DELETE FROM api_tokens WHERE user_id = ? AND network_id IS NULL
+// AND token_id != ?` —— 每台机器上 `anet login` 拿到的令牌、POST /api/auth/tokens 建的具名脚本令牌,
+// 跟浏览器会话一起被删光。安全复审定的形状:默认不变,保留是显式选项。这里每条都钉住:
+//   · 默认(旧 app、dashboard 代理不带字段):撤销全部不绑网络的令牌 —— 客户端自报的 cli 也活不下来;
+//   · keep_cli_tokens=true(anet passwd 默认带):只撤其他 kind='login' 会话,保留的 cli 令牌列在响应里、不含令牌值;
+//   · 当前会话(换发后的新令牌)永远可用,而且沿用当前令牌的种类;
+//   · 节点 / 网络令牌永远不动;
+//   · 启动迁移按 client_label / scope 回填存量令牌的 kind(夹具库,跑两遍幂等)。
+// SQLite 由 test798 自动收进;PostgreSQL 由 tests/test2123-hub-postgres-ladder 的 run_pg_tests_rc 跑同一个文件。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
+import { register, createNetworkTokenForNode, createToken, changePassword } from "./auth.js";
+import { db, hashToken } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-pwchange-kind-"));
+let BASE = "";
+let hub: any = null;
+const PW = "PwChangeKindPassw0rd!";
+const PW2 = "PwChangeKindPassw0rd!2";
+const CLI_LABEL = "anet 2.5.0 · test-box · login";
+
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const works = async (token: string) => (await call(token, "GET", "/api/auth/me")).status === 200;
+const kindOf = (token: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_hash = ?1", hashToken(token))?.kind ?? null;
+
+type Fleet = {
+  user: string; userId: string; net: string;
+  app: string; appB: string; regToken: string;
+  cliByLabel: string; cliByKind: string; apiToken: string;
+  nodeToken: string; netToken: string;
+};
+
+let seq = 0;
+async function fleet(): Promise<Fleet> {
+  const user = `pwk_${Date.now()}_${++seq}`;
+  const reg = register(user, PW);
+  expect(reg.ok).toBe(true);
+  const login = async (extra: Record<string, unknown>) => {
+    const r = await call("", "POST", "/api/auth/login", { username: user, password: PW, ...extra });
+    expect(r.status).toBe(200);
+    return r.body.token as string;
+  };
+  const node = createNetworkTokenForNode(reg.user!.user_id, reg.network_id!, "pwk-node", `node_pwk_${seq}`);
+  expect(node.ok).toBe(true);
+  const api = createToken(reg.user!.user_id, "ci-script");
+  expect(api.ok).toBe(true);
+  const netTok = createToken(reg.user!.user_id, "net-script", reg.network_id!);
+  expect(netTok.ok).toBe(true);
+  return {
+    user, userId: reg.user!.user_id, net: reg.network_id!,
+    regToken: reg.token!,
+    app: await login({ client_label: "Desktop app" }),
+    appB: await login({}),
+    cliByLabel: await login({ client_label: CLI_LABEL }),
+    cliByKind: await login({ client_kind: "cli" }),
+    apiToken: api.token!,
+    nodeToken: node.token!,
+    netToken: netTok.token!,
+  };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  process.env.COMMHUB_LOGIN_IP_MAX = "1000";
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("new tokens are classified at issue time", () => {
+  test("browser/app logins are 'login'; anet-labelled, client_kind=cli and named API tokens are 'cli'; node tokens unclassified", async () => {
+    const f = await fleet();
+    expect(kindOf(f.regToken)).toBe("login");
+    expect(kindOf(f.app)).toBe("login");
+    expect(kindOf(f.appB)).toBe("login");
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.nodeToken)).toBe(null);
+    expect(kindOf(f.netToken)).toBe(null);
+  });
+});
+
+// 响应里出现任何令牌值都算泄漏:换发给调用方的那一条(body.token)除外,它本来就要交给调用方。
+function assertNoTokenValues(body: any, f: Fleet) {
+  const { token: _rotated, ...rest } = body;
+  const text = JSON.stringify(rest);
+  for (const t of [f.regToken, f.app, f.appB, f.cliByLabel, f.cliByKind, f.apiToken, f.nodeToken, f.netToken]) {
+    expect(text.includes(t)).toBe(false);
+  }
+  expect(/\b(utok|atok|ntok)_[A-Za-z0-9]{8,}/.test(text)).toBe(false);
+  expect(text.includes("token_hash")).toBe(false);
+}
+
+describe("POST /api/auth/password (default: old apps, dashboard proxy — no field)", () => {
+  test("every other non-network token is revoked (pre-#711 behaviour); node tokens and the rotated current session survive", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    expect(r.body.revoked_login).toBe(2); // reg + appB
+    expect(r.body.revoked_cli).toBe(3);   // cliByLabel + cliByKind + apiToken
+    expect(r.body.revoked).toBe(5);
+    expect(r.body.kept_cli_tokens).toBeUndefined();
+    for (const t of [f.regToken, f.appB, f.cliByLabel, f.cliByKind, f.apiToken]) expect(await works(t)).toBe(false);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("login");
+    expect(await works(f.app)).toBe(false);
+  });
+
+  test("a client-declared cli token (client_kind / anet label) does NOT survive a default password change", async () => {
+    const f = await fleet();
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.cliByLabel)).toBe(false);
+  });
+
+  test("a non-boolean keep_cli_tokens is not an opt-in; the removed revoke_cli_tokens field does nothing", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: "true", revoke_cli_tokens: false });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_cli).toBe(3);
+    expect(await works(f.cliByLabel)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+});
+
+describe("POST /api/auth/password with keep_cli_tokens=true (anet passwd)", () => {
+  test("only other login sessions are revoked; CLI/script tokens are kept and listed without token values", async () => {
+    const f = await fleet();
+    const r = await call(f.cliByLabel, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_login).toBe(3); // reg + app + appB
+    expect(r.body.revoked_cli).toBe(0);
+    expect(r.body.revoked).toBe(3);
+    for (const t of [f.regToken, f.app, f.appB]) expect(await works(t)).toBe(false);
+    expect(await works(f.cliByKind)).toBe(true);
+    expect(await works(f.apiToken)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    // 当前会话:换发的新令牌可用,沿用 cli
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("cli");
+    // 保留清单:不含当前这条(它已被换掉),只含另外两条 cli;字段齐全、无令牌值
+    const kept = r.body.kept_cli_tokens as any[];
+    const idOf = (t: string) => db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(t)).token_id;
+    expect(kept.map((k) => k.token_id).sort()).toEqual([idOf(f.cliByKind), idOf(f.apiToken)].sort());
+    for (const k of kept) {
+      expect(Object.keys(k).sort()).toEqual(["client_label", "created_at", "last_used_at", "name", "token_id"]);
+      expect(k.token_id).toMatch(/^tok_[0-9a-f]{12}$/);
+    }
+    expect(kept.find((k) => k.token_id === idOf(f.apiToken)).name).toBe("ci-script");
+    assertNoTokenValues(r.body, f);
+    // 可以逐条撤销
+    expect((await call(r.body.token, "DELETE", `/api/auth/tokens/${idOf(f.apiToken)}`)).status).toBe(200);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  test("default response carries no token values either", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    assertNoTokenValues(r.body, f);
+  });
+});
+
+describe("changePassword() keeps the current token row in both modes", () => {
+  test("no opts at all = default: CLI tokens revoked, current kept", async () => {
+    const f = await fleet();
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur);
+    expect(r.ok).toBe(true);
+    expect(r.revoked_cli).toBe(3);
+    expect(r.kept_cli_tokens).toBeUndefined();
+    expect(await works(f.app)).toBe(true);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  for (const keepCliTokens of [false, true]) {
+    test(`keepCliTokens=${keepCliTokens}: current login token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.app)).toBe(true);
+      expect(await works(f.appB)).toBe(false);
+      expect(await works(f.cliByLabel)).toBe(keepCliTokens);
+      expect(await works(f.nodeToken)).toBe(true);
+    });
+    test(`keepCliTokens=${keepCliTokens}: current CLI token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.cliByKind)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.cliByKind)).toBe(true);
+      expect(await works(f.app)).toBe(false);
+      expect(await works(f.apiToken)).toBe(keepCliTokens);
+    });
+  }
+});
+
+describe("startup migration backfills api_tokens.kind on a fixture DB", () => {
+  // 把 kind 列拿掉 = 回到 #711 之前的表结构;塞存量行;再起一个进程加载 db.ts(= Hub 启动迁移)。
+  function bootMigration() {
+    const r = spawnSync(process.execPath, ["-e", `await import(${JSON.stringify(join(import.meta.dir, "db.ts"))}); process.exit(0);`], {
+      cwd: join(import.meta.dir, ".."),
+      env: { ...process.env, NODE_ENV: "test" },
+      encoding: "utf8",
+      timeout: 60_000,
+    });
+    if (r.status !== 0) console.log(String(r.stderr || "").slice(-2000));
+    return r.status;
+  }
+
+  test("anet-labelled and named API tokens → cli, everything else → login, node tokens untouched; idempotent", async () => {
+    const f = await fleet();
+    db.exec("ALTER TABLE api_tokens DROP COLUMN kind");
+    const ins = (id: string, net: string | null, scope: string, label: string | null) =>
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, 'fixture', ?5, ?6, 1)",
+        [id, hashToken(`fixture-${id}`), f.userId, net, scope, label],
+      );
+    const id = (s: string) => `tok_fx_${seq}_${s}`;
+    ins(id("cli_label"), null, "user", "anet 2.4.0 · old-box · login");
+    ins(id("cli_demo"), null, "user", "anet dev · unknown-host · demo sci-team");
+    ins(id("browser"), null, "user", "Chrome on macOS");
+    ins(id("nolabel"), null, "user", null);
+    ins(id("lookalike"), null, "user", "planet-anet dashboard");
+    ins(id("upper"), null, "user", "ANET 2.4.0 · box · login");
+    ins(id("padded"), null, "user", "  anet 2.4.0 · box · login");
+    ins(id("named"), null, "full", null);
+    ins(id("node"), f.net, "network", null);
+    ins(id("netfull"), f.net, "full", null);
+
+    expect(bootMigration()).toBe(0);
+    const k = (s: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_id = ?1", id(s))?.kind ?? null;
+    expect(k("cli_label")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe("login");
+    expect(k("nolabel")).toBe("login");
+    expect(k("lookalike")).toBe("login");
+    expect(k("upper")).toBe("login");   // 区分大小写:SQLite 的 LIKE 会把它当 cli,PG 不会 —— 两边必须一致
+    expect(k("padded")).toBe("cli");    // 与运行时一样先 trim
+    expect(k("named")).toBe("cli");
+    expect(k("node")).toBe(null);
+    expect(k("netfull")).toBe(null);
+    // fleet() 的 live 令牌也被回填(列重建后原值丢了,按同一规则算回来)
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.app)).toBe("login");
+
+    // 幂等:已有值不被改写(手动改成 login 的 anet 行保持 login),再跑一次结果不变
+    db.run("UPDATE api_tokens SET kind = 'login' WHERE token_id = ?1", [id("cli_label")]);
+    expect(bootMigration()).toBe(0);
+    expect(k("cli_label")).toBe("login");
+    expect(k("named")).toBe("cli");
+    expect(k("browser")).toBe("login");
+
+    // 迁移后的库上,keep_cli_tokens 保留回填成 cli 的存量令牌
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens: true });
+    expect(r.ok).toBe(true);
+    expect(k("named")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe(null); // 被撤销(行已删除)
+    expect(k("node")).toBe(null);
+    expect(Number(db.get<any>("SELECT COUNT(*) AS n FROM api_tokens WHERE token_id = ?1", id("node")).n)).toBe(1);
+  }, 120_000);
+});

package/src/auth.ts

@@ -137,8 +137,8 @@ export function register(username: string, password: string, email?: string, dis
   const userToken = generateUserToken();
   const userTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256), userTokenKindFor(opts.client)]
   );
 
   // Network token (ntok_) — bound to default network, for agent-node
@@ -217,8 +217,8 @@ export function login(username: string, password: string, client: SessionClientI
   const userToken = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256), userTokenKindFor(client)]
   );
 
   // Find default network
@@ -321,7 +321,28 @@ const SESSION_TOKEN_SQL = "scope = 'user' AND network_id IS NULL";
 // 以小时为粒度对一个以天计的闲置窗口没有影响。
 const LAST_USED_WRITE_INTERVAL_SECONDS = 3600;
 
-export type SessionClientInfo = { label?: unknown; userAgent?: unknown };
+export type SessionClientInfo = { label?: unknown; userAgent?: unknown; kind?: unknown };
+
+// #711 不绑网络的用户令牌的种类(api_tokens.kind):
+//   'login' — 浏览器 / app 的登录会话;
+//   'cli'   — anet 命令行登录、POST /api/auth/tokens 建的具名脚本令牌。
+// 种类由客户端自报(client_kind / client_label),**只用于展示和「显式保留」那条路**:
+// 改密码默认仍撤销全部不绑网络的令牌(当前这条除外),调用方显式 keep_cli_tokens=true 才保留 'cli'。
+// 所以一个自称 cli 的令牌永远不能靠自报在默认改密码里活下来。
+// 节点 / 网络令牌(network_id 非空)不分类,改密码永远不碰。
+export type UserTokenKind = "login" | "cli";
+
+/** 登录 / 注册请求签发的令牌算哪一类:客户端显式报 kind='cli',或 client_label 是 anet 自报的「anet <版本> · …」。 */
+/** anet 自报的 client_label:去掉首尾空白后,区分大小写地以「anet 」开头(启动回填用同一条规则,见 db.ts)。 */
+export function isAnetClientLabel(label: string): boolean {
+  return label.trim().startsWith("anet ");
+}
+
+export function userTokenKindFor(client: SessionClientInfo = {}): UserTokenKind {
+  if (client.kind === "cli") return "cli";
+  if (typeof client.label === "string" && isAnetClientLabel(client.label)) return "cli";
+  return "login";
+}
 
 function cleanClientField(value: unknown, max: number): string | null {
   if (typeof value !== "string") return null;
@@ -508,9 +529,10 @@ export function createToken(userId: string, name: string, networkId?: string): {
   }
   const token = generateToken();
   const tokenId = generateId("tok");
+  // #711 不绑网络的具名令牌是给脚本 / 命令行长期用的:kind='cli'(改密码时可显式 keep_cli_tokens 保留)。
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
-    [tokenId, hashToken(token), userId, networkId || null, name, "full"]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, networkId || null, name, "full", networkId ? null : "cli"]
   );
   return { ok: true, token, token_id: tokenId };
 }
@@ -520,16 +542,55 @@ export function revokeToken(userId: string, tokenId: string): { ok: boolean; err
   return result.changes > 0 ? { ok: true } : { ok: false, error: "token not found" };
 }
 
-export function issueUserToken(userId: string, name = "user-login"): { token: string; token_id: string } {
+export function issueUserToken(
+  userId: string,
+  name = "user-login",
+  opts: { kind?: UserTokenKind; clientLabel?: string | null; userAgent?: string | null } = {},
+): { token: string; token_id: string } {
   const token = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', 1)",
-    [tokenId, hashToken(token), userId, name]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, name, opts.clientLabel ?? null, opts.userAgent ?? null, opts.kind === "cli" ? "cli" : "login"]
   );
   return { token, token_id: tokenId };
 }
 
+/** 一条令牌的种类和设备标识(改密码换发新令牌时沿用,命令行的令牌换完还是命令行的)。 */
+export function getUserTokenMeta(userId: string, tokenId: string): { kind: UserTokenKind; client_label: string | null; user_agent: string | null } | null {
+  const row = db.get<any>("SELECT kind, client_label, user_agent FROM api_tokens WHERE token_id = ?1 AND user_id = ?2 AND network_id IS NULL", tokenId, userId);
+  if (!row) return null;
+  return { kind: row.kind === "cli" ? "cli" : "login", client_label: row.client_label ?? null, user_agent: row.user_agent ?? null };
+}
+
+// #711 改密码撤销哪些令牌。kind 为 NULL 的(启动回填之后由旧版 Hub 签出的)按 'login' 算。
+const CLI_KIND_SQL = "kind = 'cli'";
+const NOT_CLI_KIND_SQL = "COALESCE(kind, 'login') <> 'cli'";
+
+/** 改密码后保留下来的命令行 / 脚本令牌(给 UI 列出来、让用户逐条撤销)。**永远不含令牌值。** */
+export type KeptCliToken = { token_id: string; name: string; client_label: string | null; created_at: string; last_used_at: string | null };
+
+/**
+ * 改密码后的令牌撤销。默认(keepCli=false)= 改密码前的行为:撤销全部不绑网络的令牌;
+ * keepCli=true 时保留 kind='cli' 的,并把它们列出来。当前这条(exceptTokenId)和节点 / 网络令牌永远不动。
+ */
+export function revokeTokensAfterPasswordChange(userId: string, exceptTokenId: string | null | undefined, keepCli: boolean): { login: number; cli: number; kept: KeptCliToken[] } {
+  const except = exceptTokenId ? " AND token_id != ?2" : "";
+  const params = exceptTokenId ? [userId, exceptTokenId] : [userId];
+  const login = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND ${NOT_CLI_KIND_SQL}${except}`, params).changes;
+  if (!keepCli) {
+    const cli = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL${except}`, params).changes;
+    return { login, cli, kept: [] };
+  }
+  const kept = db.all<any>(
+    `SELECT token_id, name, client_label, created_at, last_used_at FROM api_tokens
+     WHERE user_id = ?1 AND network_id IS NULL AND ${CLI_KIND_SQL}${except}
+     ORDER BY created_at DESC`,
+    ...params,
+  ).map((r) => ({ token_id: r.token_id, name: r.name, client_label: r.client_label ?? null, created_at: r.created_at, last_used_at: r.last_used_at ?? null }));
+  return { login, cli: 0, kept };
+}
+
 export function revokeOtherUserTokens(userId: string, exceptTokenId?: string | null): number {
   const result = exceptTokenId
     ? db.run("DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND token_id != ?2", [userId, exceptTokenId])
@@ -544,6 +605,7 @@ export type LoginSession = {
   last_used_at: string | null;
   client_label: string | null;
   user_agent: string | null;
+  kind: UserTokenKind;
   is_current: boolean;
 };
 
@@ -551,7 +613,7 @@ export type LoginSession = {
 export function listSessions(userId: string, currentTokenId: string | null): LoginSession[] {
   const cutoff = idleCutoffOffset();
   const rows = db.all<any>(
-    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent FROM api_tokens
+    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent, kind FROM api_tokens
      WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND revoked_at IS NULL${cutoff ? `
        AND COALESCE(last_used_at, created_at) >= datetime('now', ?2)` : ""}
      ORDER BY COALESCE(last_used_at, created_at) DESC, created_at DESC`,
@@ -563,6 +625,7 @@ export function listSessions(userId: string, currentTokenId: string | null): Log
     last_used_at: r.last_used_at ?? null,
     client_label: r.client_label ?? null,
     user_agent: r.user_agent ?? null,
+    kind: r.kind === "cli" ? "cli" : "login",
     is_current: !!currentTokenId && r.token_id === currentTokenId,
   }));
 }
@@ -578,7 +641,14 @@ export function revokeOtherSessions(userId: string, currentTokenId: string): num
   return db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND token_id != ?2`, [userId, currentTokenId]).changes;
 }
 
-export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null): { ok: boolean; error?: string; revoked?: number } {
+export type ChangePasswordResult = { ok: boolean; error?: string; revoked?: number; revoked_login?: number; revoked_cli?: number; kept_cli_tokens?: KeptCliToken[] };
+
+/**
+ * 改密码。默认撤销该用户全部不绑网络的令牌(改密码前的行为,旧 app 依赖它)。#711:opts.keepCliTokens=true
+ * 时保留 kind='cli' 的(anet 命令行登录、具名脚本令牌),并在 kept_cli_tokens 里列出。当前会话和节点令牌永远保留。
+ * revoked = 两类合计(旧字段,兼容旧客户端)。
+ */
+export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null, opts: { keepCliTokens?: boolean } = {}): ChangePasswordResult {
   const passwordError = validatePasswordStrength(newPassword, "new password");
   if (passwordError) return { ok: false, error: passwordError };
   const user = db.get<any>("SELECT password_hash FROM users WHERE user_id = ?1", userId);
@@ -593,8 +663,9 @@ export function changePassword(userId: string, oldPassword: string, newPassword:
   // nudge goes away on next login. SET to 0 explicitly (rather than skip)
   // so a future flag flip can't drift the state.
   db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
-  const revoked = revokeOtherUserTokens(userId, currentTokenId);
-  return { ok: true, revoked };
+  const keep = opts.keepCliTokens === true;
+  const r = revokeTokensAfterPasswordChange(userId, currentTokenId, keep);
+  return { ok: true, revoked: r.login + r.cli, revoked_login: r.login, revoked_cli: r.cli, ...(keep ? { kept_cli_tokens: r.kept } : {}) };
 }
 
 /**

package/src/db.ts

@@ -646,12 +646,26 @@ for (const ddl of [
   // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
   "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
   "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",
+  // #711 不绑网络的用户令牌分两类:'login' = 浏览器 / app 的登录会话;'cli' = anet 命令行登录、
+  // POST /api/auth/tokens 建的具名脚本令牌。只用于展示和 keep_cli_tokens 那条显式保留路径;节点 / 网络令牌(network_id 非空)不填。
+  "ALTER TABLE api_tokens ADD COLUMN kind TEXT",
 ]) {
   try { db.exec(ddl); }
   catch (e: any) {
     if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
   }
 }
+// #711 回填 kind:只碰 kind 还是 NULL 的非网络令牌(幂等;回滚到旧 Hub 期间新签的行,下次启动照样补上)。
+// 能明确认出是 anet 命令行的才算 'cli':scope='full'(POST /api/auth/tokens 建的具名令牌),
+// 或 client_label 去掉首尾空格后以「anet 」开头(anet 自报的「anet <版本> · <主机> · <子命令>」)。其余一律 'login'。
+// 用 SUBSTR + = 而不是 LIKE:SQLite 的 LIKE 不分大小写、PG 分,两边结果会不一样;= 两边都区分大小写,
+// 与运行时 isAnetClientLabel(auth.ts)同一条规则。
+db.run(
+  `UPDATE api_tokens SET kind = CASE
+     WHEN scope = 'full' OR SUBSTR(TRIM(client_label), 1, 5) = 'anet ' THEN 'cli'
+     ELSE 'login' END
+   WHERE network_id IS NULL AND kind IS NULL`,
+);
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
 catch (e: any) { /* index may already exist */ void e; }
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_bound_node ON api_tokens(bound_node_id)`); }
@@ -969,7 +983,7 @@ db.exec(`
     requirement_id TEXT PRIMARY KEY,
     network_id     TEXT NOT NULL,
     title          TEXT NOT NULL,
-    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done')),
+    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned')),
     priority       TEXT NOT NULL DEFAULT 'normal' CHECK(priority IN ('high', 'normal', 'low', 'lowest')),
     due_on         TEXT,
     assignee       TEXT,

package/src/requirement-due-reminders.ts

@@ -227,7 +227,7 @@ export function dueReminderFor(due: string, nowMs: number, tz: string, maxOverdu
 export function overdueSql(params: unknown[], nowMs: number, tz: string): string {
   const today = localDate(nowMs, tz);
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
 }
 /** 没逾期、且在 tz 的「今天 + days」那天结束之前到期(0 = 今天内)。 */
 export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz: string): string {
@@ -235,7 +235,7 @@ export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz:
   const lastDay = addDays(today, days);
   const endIso = new Date(localMidnightMs(addDays(lastDay, 1), tz)).toISOString().replace(/\.\d{3}Z$/, "Z");
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
 }
 
 // ── 扫描 ───────────────────────────────────────────────────
@@ -332,7 +332,7 @@ export function runDueReminders(opts: { now?: number } = {}): DueReminderSent[]
   const rows = db.all<DueRow>(
     `SELECT requirement_id, network_id, seq, title, due_on, owner_json, participants_json, agent_owner_json
        FROM requirements
-      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name <> 'done' AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
+      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name NOT IN ('done', 'abandoned') AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
     ...params,
   );
   const out: DueReminderSent[] = [];

package/src/requirement-notify.ts

@@ -12,7 +12,7 @@ import { isParticipant } from "./task-access.js";
 import { rewriteUnreadNoticeDm, sendNoticeDm } from "./human-dm.js";
 
 export const COALESCE_WINDOW_MS = 60_000;
-const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成" };
+const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成", abandoned: "废弃" };
 const MAX_LINES = 20;
 const MAX_ITEM_CHARS = 40;
 

package/src/requirements-abandoned-http.test.ts

@@ -0,0 +1,236 @@
+// 任务状态「废弃」(abandoned)—— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+// test2123 在真实 PostgreSQL 上原样再跑一遍(COMMHUB_TEST_PG_URL)。
+//
+// 废弃是关闭态(同 done):不算开着、不逾期、不发到期提醒、不记完成时间;改进 / 改出都记动态;能改回 pool / doing。
+// 旧 App(desktop ≤ 0.2.220)把不认识的状态当 pool —— 所以没声明 `X-Anet-Accept-Columns: abandoned`
+// (或 `accept_columns=abandoned`)的调用者看到的是 done;MCP 总是声明,看到真值。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-req-abandoned-"));
+process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+process.env.HOST = "127.0.0.1";
+for (const k of ["COMMHUB_DUE_REMINDER_TZ", "COMMHUB_DUE_OVERDUE_MAX_DAYS", "COMMHUB_DUE_REMINDER_NETWORKS", "COMMHUB_DUE_REMINDERS", "COMMHUB_DUE_REMINDERS_NETWORKS", "COMMHUB_DUE_REMINDERS_EXCLUDE_NETWORKS", "COMMHUB_DUE_REMINDERS_OWNERS"]) delete process.env[k];
+const PW = "AbandonedPassw0rd!x";
+const T0 = Date.UTC(2026, 9, 10, 2, 0, 0);
+const DAY = 86_400_000;
+const AWARE = { "X-Anet-Accept-Columns": "abandoned" };
+
+let BASE = "";
+let hub: any = null;
+let NET = "";
+let TOKEN = "";
+let OWNER = "";
+let db: any;
+let due: typeof import("./requirement-due-reminders.js");
+
+type R = { status: number; body: any };
+async function send(method: string, path: string, payload?: unknown, headers: Record<string, string> = {}): Promise<R> {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", ...headers },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  }, 60_000);
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+async function mcp(name: string, args: Record<string, unknown>): Promise<any> {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  }, 60_000);
+  const raw = await res.text();
+  const lines = raw.split("\n").filter(x => x.startsWith("data:"));
+  const payload = lines.length ? JSON.parse(lines.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+async function card(name: string, extra: Record<string, unknown> = {}): Promise<string> {
+  const r = await send("POST", "/api/requirements", { network_id: NET, name, owner: { kind: "user", id: OWNER }, ...extra });
+  expect(r.status).toBe(201);
+  return r.body.requirement.id as string;
+}
+const get = (id: string, headers: Record<string, string> = {}) => send("GET", `/api/requirements/${id}?network_id=${NET}`, undefined, headers);
+const patch = (id: string, body: Record<string, unknown>, headers: Record<string, string> = {}) => send("PATCH", `/api/requirements/${id}?network_id=${NET}`, body, headers);
+const list = (qs = "", headers: Record<string, string> = {}) => send("GET", `/api/requirements?network_id=${NET}${qs}`, undefined, headers);
+const ids = (r: R) => (r.body.requirements as any[]).map(x => x.id);
+const columnIn = (r: R, id: string) => (r.body.requirements as any[]).find(x => x.id === id)?.column;
+const sentFor = (out: Array<{ requirement_id: string; kind: string }>, id: string) => out.filter(x => x.requirement_id === id).map(x => x.kind);
+const columnEvents = async (id: string) => ((await send("GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`, undefined, AWARE)).body.events as any[])
+  .filter(e => e.kind === "changed" && e.field === "column").map(e => [e.old, e.new]).reverse();
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { register } = await import("./auth.js");
+  const r = register(`ab_owner_${Date.now()}`, PW);
+  expect(r.ok).toBe(true);
+  TOKEN = r.token!;
+  OWNER = r.user!.user_id;
+  NET = r.network_id!;
+  due = await import("./requirement-due-reminders.js");
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  due.runDueReminders({ now: T0 - 30 * DAY }); // 到期提醒基线(同 requirement-due-reminders-http.test.ts)
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("abandoned column", () => {
+  test("schema accepts abandoned; the legacy CHECK migration is idempotent (SQLite rebuild / PG constraint swap)", async () => {
+    const { migrateRequirementColumnCheck } = await import("./requirements-migrate.js");
+    if (db.dialect === "postgres") {
+      // 模拟旧 PG 库:换回旧约束,迁移后 abandoned 能写,再跑一次照样不报错。
+      db.exec("ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check");
+      db.exec("ALTER TABLE requirements ADD CONSTRAINT requirements_column_name_check CHECK(column_name IN ('pool', 'doing', 'done'))");
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(true);
+      // 已经认识 abandoned:不再动表(不是每次启动都删了重加)
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(false);
+      // 加约束失败要响亮地失败,而且是一条语句:旧约束原样留着,不会落到「没约束」
+      db.exec("ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check");
+      db.exec("ALTER TABLE requirements ADD CONSTRAINT requirements_column_name_check CHECK(column_name IN ('pool', 'doing', 'done', 'bogus'))");
+      db.run("INSERT INTO requirements (requirement_id, network_id, title, column_name) VALUES ('req_ab_bogus', ?1, 'bogus', 'bogus')", [NET]);
+      expect(() => migrateRequirementColumnCheck(db)).toThrow();
+      const def = (db.get("SELECT pg_get_constraintdef(c.oid) AS def FROM pg_constraint c JOIN pg_class t ON t.oid = c.conrelid WHERE t.relname = 'requirements' AND c.conname = 'requirements_column_name_check'") as any)?.def ?? "";
+      expect(def).toContain("'bogus'");
+      db.run("DELETE FROM requirements WHERE requirement_id = 'req_ab_bogus'");
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(true);
+    } else {
+      expect(migrateRequirementColumnCheck(db).rebuilt).toBe(false);
+    }
+    const id = await card("ab-schema");
+    expect((await patch(id, { column: "abandoned" }, AWARE)).status).toBe(200);
+    expect((await patch(id, { column: "cancelled" }, AWARE)).body.error).toBe("invalid_column");
+    expect((await list()).body.capabilities).toContain("column_abandoned");
+  }, 60_000);
+
+  test("set and restore: events recorded each way, no completedAt, restorable to pool and doing", async () => {
+    const id = await card("ab-set");
+    const a = await patch(id, { column: "abandoned" }, AWARE);
+    expect(a.status).toBe(200);
+    expect(a.body.requirement.column).toBe("abandoned");
+    expect(a.body.requirement.completedAt).toBeNull();
+    expect((await patch(id, { column: "doing" }, AWARE)).body.requirement.column).toBe("doing");
+    expect((await patch(id, { column: "abandoned" }, AWARE)).body.requirement.column).toBe("abandoned");
+    expect((await patch(id, { column: "pool" }, AWARE)).body.requirement.column).toBe("pool");
+    expect(await columnEvents(id)).toEqual([["pool", "abandoned"], ["abandoned", "doing"], ["doing", "abandoned"], ["abandoned", "pool"]]);
+    // 直接建在废弃列(带声明)也行
+    const created = await send("POST", "/api/requirements", { network_id: NET, name: "ab-born", column: "abandoned" }, AWARE);
+    expect(created.body.requirement.column).toBe("abandoned");
+  }, 60_000);
+
+  test("closed like done: not overdue, no due reminder, not counted as open in stats; restoring reopens it", async () => {
+    // id:到期提醒用假时钟 T0(10-10),到期 10-07 = 逾期 3 天;old:列表的 overdue 筛选用真时钟,到期给一个早就过了的日子。
+    const id = await card("ab-overdue", { due: "2026-10-07", column: "doing" });
+    const old = await card("ab-overdue-list", { due: "2020-01-01", column: "doing" });
+    expect(ids(await list("&overdue=1"))).toContain(old);
+    await patch(id, { column: "abandoned" }, AWARE);
+    await patch(old, { column: "abandoned" }, AWARE);
+    expect(ids(await list("&overdue=1"))).not.toContain(old);
+    expect(ids(await list("&overdue=0"))).toContain(old);
+    expect(sentFor(due.runDueReminders({ now: T0 }), id)).toEqual([]);
+    const stats = (await send("GET", `/api/requirements/stats?network_id=${NET}`)).body.totals;
+    const raw = db.all("SELECT column_name FROM requirements WHERE network_id = ?1 AND COALESCE(archived, 0) = 0", NET) as any[];
+    const n = (c: string) => raw.filter(r => r.column_name === c).length;
+    expect(stats.doing).toBe(n("doing"));
+    expect(stats.pool).toBe(n("pool"));
+    expect(stats.abandoned).toBe(n("abandoned"));
+    expect(n("abandoned")).toBeGreaterThan(0);
+    // 子任务进度不把废弃的子任务算进去
+    const parent = await card("ab-parent");
+    const kid = await card("ab-kid", { parent_id: parent });
+    await card("ab-kid2", { parent_id: parent });
+    await patch(kid, { column: "abandoned" }, AWARE);
+    // 声明了:废弃的子需求不算进度;没声明(旧 App 把它当 done 列出来):算进总数、算作完成,和它看到的列表对得上
+    expect((await get(parent, AWARE)).body.requirement.children).toEqual({ total: 1, done: 0 });
+    expect((await get(parent)).body.requirement.children).toEqual({ total: 2, done: 1 });
+    expect(columnIn(await list("&parent_id=" + parent), kid)).toBe("done");
+    // 改回 doing:又逾期、又提醒
+    await patch(id, { column: "doing" }, AWARE);
+    await patch(old, { column: "doing" }, AWARE);
+    expect(ids(await list("&overdue=1"))).toContain(old);
+    expect(sentFor(due.runDueReminders({ now: T0 }), id)).toEqual(["overdue"]);
+  }, 60_000);
+
+  test("old clients (no declaration) see abandoned as done; their writes cannot un-abandon it by echo", async () => {
+    const id = await card("ab-legacy");
+    await patch(id, { column: "abandoned" }, AWARE);
+    expect((await get(id)).body.requirement.column).toBe("done");
+    expect((await get(id, AWARE)).body.requirement.column).toBe("abandoned");
+    expect((await send("GET", `/api/requirements/${id}?network_id=${NET}&accept_columns=abandoned`)).body.requirement.column).toBe("abandoned");
+    expect(columnIn(await list(), id)).toBe("done");
+    expect(columnIn(await list("&view=summary"), id)).toBe("done");
+    expect(columnIn(await list("", AWARE), id)).toBe("abandoned");
+    // 列表缓存按声明分开:同一个查询串,先旧后新,不串值
+    expect(columnIn(await list(), id)).toBe("done");
+    expect(columnIn(await list("", AWARE), id)).toBe("abandoned");
+    // 旧客户端按 done 筛:带上废弃的(它眼里就是 done)
+    expect(ids(await list("&status=done"))).toContain(id);
+    expect(ids(await list("&status=done", AWARE))).not.toContain(id);
+    expect(ids(await list("&status=abandoned", AWARE))).toContain(id);
+    // 旧客户端改别的字段 / 回传它看到的 done:仍是废弃;响应里仍是 done
+    const p1 = await patch(id, { priority: "high" });
+    expect(p1.body.requirement.column).toBe("done");
+    const p2 = await patch(id, { column: "done" });
+    expect(p2.body.requirement.column).toBe("done");
+    expect((await get(id, AWARE)).body.requirement.column).toBe("abandoned");
+    // 旧客户端明确改回 pool:照办
+    expect((await patch(id, { column: "pool" })).body.requirement.column).toBe("pool");
+    // 新客户端从 abandoned 改成 done:真的完成
+    await patch(id, { column: "abandoned" }, AWARE);
+    const done = await patch(id, { column: "done" }, AWARE);
+    expect(done.body.requirement.column).toBe("done");
+    expect(done.body.requirement.completedAt).not.toBeNull();
+  }, 60_000);
+
+  test("events and last_event: undeclared callers see the projected column; done ↔ abandoned disappears for them", async () => {
+    const id = await card("ab-events");
+    await patch(id, { column: "abandoned" }, AWARE);
+    await patch(id, { column: "done" }, AWARE);
+    await patch(id, { column: "abandoned" }, AWARE);
+    const evs = async (headers: Record<string, string> = {}) => ((await send("GET", `/api/requirements/events?network_id=${NET}&requirement_id=${id}`, undefined, headers)).body.events as any[])
+      .filter(e => e.kind === "changed" && e.field === "column").map(e => [e.old, e.new]).reverse();
+    expect(await evs(AWARE)).toEqual([["pool", "abandoned"], ["abandoned", "done"], ["done", "abandoned"]]);
+    expect(await evs()).toEqual([["pool", "done"]]);
+    const legacyRaw = JSON.stringify((await send("GET", `/api/requirements/events?network_id=${NET}`)).body.events);
+    expect(legacyRaw).not.toContain("abandoned");
+    // 每行的 last_event:最新一条是 done → abandoned,旧客户端那里投影后前后一样 → 不给字段 / 摘要
+    const legacyRow = (await list()).body.requirements.find((r: any) => r.id === id);
+    expect(legacyRow.last_event.field).toBeNull();
+    expect(legacyRow.last_event.summary).toBeUndefined();
+    const awareRow = (await list("", AWARE)).body.requirements.find((r: any) => r.id === id);
+    expect(awareRow.last_event).toMatchObject({ field: "column", summary: "done → abandoned" });
+    await patch(id, { column: "doing" }, AWARE);
+    const back = (await list()).body.requirements.find((r: any) => r.id === id);
+    expect(back.last_event).toMatchObject({ field: "column", summary: "done → doing" });
+    expect(JSON.stringify((await list()).body.requirements)).not.toContain("abandoned");
+  }, 60_000);
+
+  test("checklist toggle response is projected for undeclared callers", async () => {
+    const id = await card("ab-check", { checklist: [{ id: "c1", text: "one" }] });
+    await patch(id, { column: "abandoned" }, AWARE);
+    const legacy = await send("PATCH", `/api/requirements/${id}/checklist/c1?network_id=${NET}`, { done: true });
+    expect(legacy.status).toBe(200);
+    expect(legacy.body.requirement.column).toBe("done");
+    const aware = await send("PATCH", `/api/requirements/${id}/checklist/c1?network_id=${NET}`, { done: false }, AWARE);
+    expect(aware.body.requirement.column).toBe("abandoned");
+  }, 60_000);
+
+  test("MCP declares support: requirements_update / get / list carry the real value", async () => {
+    const id = await card("ab-mcp");
+    const up = await mcp("requirements_update", { id, network_id: NET, status: "abandoned" });
+    expect(up.requirement.column).toBe("abandoned");
+    expect((await mcp("requirements_get", { id, network_id: NET })).requirement.column).toBe("abandoned");
+    const l = await mcp("requirements_list", { network_id: NET, status: "abandoned" });
+    expect(l.requirements.map((x: any) => x.id)).toContain(id);
+    expect((await mcp("requirements_update", { id, network_id: NET, column: "doing" })).requirement.column).toBe("doing");
+  }, 60_000);
+});

package/src/requirements-errors.ts

@@ -54,7 +54,7 @@ const ENTRIES: Record<string, Entry> = {
   participants_conflict: { field: 'participants', message: 'participants (replace the whole list) cannot be combined with participants_add / participants_remove.', hint: 'Use participants_add / participants_remove to change a few people, or participants alone to replace the list.' },
   participants_add_remove_overlap: { field: 'participants_remove', message: 'The same person is in both participants_add and participants_remove.', hint: 'Send each person in only one of the two lists.' },
   too_many_participants: { field: 'participants_add', message: 'A task can have at most 100 participants.', hint: 'Remove some with participants_remove first.' },
-  status_conflicts_with_column: { field: 'status', message: 'status is an alias of column, and the two values sent differ.', hint: 'Send only one of them (pool, doing or done).' },
+  status_conflicts_with_column: { field: 'status', message: 'status is an alias of column, and the two values sent differ.', hint: 'Send only one of them (pool, doing, done or abandoned).' },
   invalid_assignee: { field: 'assignee', message: 'assignee must be a string (legacy free-text field).', hint: 'Prefer owner / agent_owner.' },
   // ── 项目 ──
   invalid_project: { field: 'project_id', message: 'project_id must be a project id string or null.', hint: 'Call projects_list to get project ids (proj_…); null removes the task from its project.' },
@@ -77,14 +77,14 @@ const ENTRIES: Record<string, Entry> = {
   empty_patch: (ctx) => {
     const sent = ctx.sent ?? [];
     const writable = ctx.writable?.length ? ctx.writable.join(', ') : 'name, column, priority, due, start, description, checklist, tags, owner, agent_owner, participants, project_id, parent_id, external_ref, external_url, archived';
-    const statusHint = sent.includes('status') ? 'To move a task between pool / doing / done, use column (status is the name of the list filter). ' : '';
+    const statusHint = sent.includes('status') ? 'To move a task between pool / doing / done / abandoned, use column (status is the name of the list filter). ' : '';
     return { message: sent.length ? `None of the keys sent (${sent.join(', ')}) is a writable field.` : 'The patch changes nothing.', hint: `${statusHint}Writable fields: ${writable}.` };
   },
   invalid_json: { message: 'The request body must be a JSON object.' },
   invalid_name: { field: 'name', message: 'name must be 1–80 characters.' },
   invalid_description: { field: 'description', message: 'description must be a string (markdown) of at most 20 000 characters.' },
-  invalid_column: { field: 'column', message: 'column must be pool, doing or done.' },
-  invalid_status: { field: 'status', message: 'status (list filter) must be pool, doing or done.' },
+  invalid_column: { field: 'column', message: 'column must be pool, doing, done or abandoned.' },
+  invalid_status: { field: 'status', message: 'status (list filter) must be pool, doing, done or abandoned.' },
   invalid_priority: { field: 'priority', message: 'priority must be high (P0), normal (P1), low (P2) or lowest (P3).' },
   invalid_due: { field: 'due', message: 'due is not a date this hub understands.', hint: `Use ${DUE_FORMATS}.` },
   invalid_start: { field: 'start', message: 'start is not a date this hub understands.', hint: `Use ${DUE_FORMATS}.` },

package/src/requirements-http.test.ts

@@ -373,7 +373,7 @@ describe("requirements stay on the hub", () => {
     expect((await api(ownerToken, path, { method: "PATCH", body: JSON.stringify({ due: "" }) })).body.requirement.due).toBe("");
     const listed = await api(ownerToken, "/api/requirements");
     expect(listed.body.capabilities).toContain("due_datetime");
-    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event"]);
+    expect(listed.body.capabilities).toEqual(["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"]);
   });
 
   test("sub-requirements: parent_id in the same network, no cycles, ≤ 5 levels, child counts, filters, delete detaches children", async () => {

package/src/requirements-list-slim-http.test.ts

@@ -125,8 +125,8 @@ describe("view=summary", () => {
     const one = await send(admin.token, "GET", `/api/requirements/${card.id}?network_id=${NET}`);
     expect(one.body.requirement.description).toBe(f.description);
     // 比的是 summary 省掉的那部分(正文 / 子任务):两边一样多的 last_event(#506,每行约 150 B)不算,
-    // 否则这张只有几行的小表上,固定开销会把比例拉过一半。
-    const bare = (body: any) => JSON.stringify({ ...body, requirements: body.requirements.map(({ last_event: _l, ...r }: any) => r) }).length;
+    // 否则这张只有几行的小表上,固定开销会把比例拉过一半。capabilities 同理:两边一样、每加一个能力就长一截。
+    const bare = (body: any) => JSON.stringify({ ...body, capabilities: [], requirements: body.requirements.map(({ last_event: _l, ...r }: any) => r) }).length;
     expect(summary.body.requirements.every((r: any) => "last_event" in r)).toBe(true);
     expect(bare(summary.body)).toBeLessThan(bare(full.body) / 2);
   });

package/src/requirements-migrate.ts

@@ -119,6 +119,40 @@ export function migrateRequirementPriorityCheck(database: DbAdapter): { rebuilt:
   return { rebuilt: true };
 }
 
+/**
+ * 状态加 abandoned(废弃)。同 migrateRequirementPriorityCheck:旧库的 CHECK(column_name IN ('pool', 'doing', 'done'))
+ * SQLite 不能就地改,只重建一次;PostgreSQL 换掉默认名的列约束。已经放开的库什么都不做。存量值不改。
+ */
+const OLD_COLUMN_CHECK = /CHECK\s*\(\s*column_name\s+IN\s*\(\s*'pool'\s*,\s*'doing'\s*,\s*'done'\s*\)\s*\)/i;
+export const COLUMN_CHECK = "CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned'))";
+export function migrateRequirementColumnCheck(database: DbAdapter): { rebuilt: boolean } {
+  if (database.dialect === "postgres") {
+    // 只在约束还不认识 abandoned(或不存在)时动;一条 ALTER TABLE 里先删后加 = 一个语句,原子,
+    // 失败(比如存量里有不合法的值)整条回滚、旧约束原样留着,并且直接抛出 —— 不吞错,启动就该停下来。
+    const def = database.get<{ def: string }>(
+      "SELECT pg_get_constraintdef(c.oid) AS def FROM pg_constraint c JOIN pg_class t ON t.oid = c.conrelid WHERE t.relname = 'requirements' AND c.conname = 'requirements_column_name_check'",
+    )?.def ?? "";
+    if (def.includes("'abandoned'")) return { rebuilt: false };
+    database.exec(`ALTER TABLE requirements DROP CONSTRAINT IF EXISTS requirements_column_name_check, ADD CONSTRAINT requirements_column_name_check ${COLUMN_CHECK}`);
+    return { rebuilt: true };
+  }
+  const table = database.get<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'");
+  if (!table?.sql || !OLD_COLUMN_CHECK.test(table.sql)) return { rebuilt: false };
+  const indexes = database.all<{ sql: string }>("SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'requirements' AND sql IS NOT NULL");
+  const createSql = table.sql
+    .replace(/^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?requirements["`]?/i, "CREATE TABLE requirements_migrated")
+    .replace(OLD_COLUMN_CHECK, COLUMN_CHECK);
+  database.transaction(() => {
+    database.exec("DROP TABLE IF EXISTS requirements_migrated");
+    database.exec(createSql);
+    database.exec("INSERT INTO requirements_migrated SELECT * FROM requirements");
+    database.exec("DROP TABLE requirements");
+    database.exec("ALTER TABLE requirements_migrated RENAME TO requirements");
+    for (const index of indexes) database.exec(index.sql);
+  });
+  return { rebuilt: true };
+}
+
 /**
  * 任务短号 seq:每个网络自己的 #1、#2…,界面显示和按 #N 查都用它。主键 requirement_id 不变。
  * - 加可空列 seq;没有号的旧行按 created_at(再按 requirement_id)补号,接在该网络已有的最大号后面。

package/src/requirements-priority-lowest.test.ts

@@ -68,7 +68,7 @@ describe("P3 lowest priority", () => {
   test("startup rebuilds the legacy CHECK once and keeps every row and index", async () => {
     const sql = db.get("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'requirements'").sql as string;
     expect(sql).toContain("'lowest'");
-    expect(sql).toContain("CHECK(column_name IN ('pool', 'doing', 'done'))");
+    expect(sql).toContain("CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned'))");
     const rows = db.all("SELECT requirement_id, network_id, title, priority, client_id, description, tags_json FROM requirements WHERE network_id = 'net_legacy' ORDER BY requirement_id") as any[];
     expect(rows.map(r => [r.requirement_id, r.priority])).toEqual([["r_high", "high"], ["r_low", "low"], ["r_normal", "normal"]]);
     for (const r of rows) {

package/src/requirements-stats.ts

@@ -93,7 +93,7 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
   const sparkDays = new Set(days.slice(-STATS_SPARK_DAYS));
   const daily = new Map(days.map(d => [d, 0]));
 
-  let done = 0, approx = 0, created = 0, createdDone = 0, doing = 0, pool = 0, unattributed = 0;
+  let done = 0, approx = 0, created = 0, createdDone = 0, doing = 0, pool = 0, abandoned = 0, unattributed = 0;
   const byProject = new Map<string | null, number>();
   const byCompleter = new Map<string, { ref: Ref; n: number; spark: Map<string, number> }>();
   const recent: { row: StatsRow; ms: number; by: Ref | null }[] = [];
@@ -102,6 +102,7 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
     // 当前还开着的卡(不看时间范围;归档的不算「进行中」)。
     if (!row.archived && row.column_name === "doing") doing++;
     if (!row.archived && row.column_name === "pool") pool++;
+    if (!row.archived && row.column_name === "abandoned") abandoned++;
     const completedMs = row.column_name === "done" ? msOf(row.completed_at) : null;
     const createdMs = msOf(row.created_at);
     if (inRange(createdMs)) {
@@ -143,6 +144,8 @@ export function aggregateStats(rows: StatsRow[], q: StatsQuery, hidden: ((nodeId
       completion_rate: created ? createdDone / created : null,
       doing,
       pool,
+      // 废弃(关闭,不算开着也不算完成)。旧 App 忽略这个字段。
+      abandoned,
     },
     daily: days.map(date => ({ date, n: daily.get(date) ?? 0 })),
     by_project: [...byProject].map(([project_id, n]) => ({ project_id, n })).sort((a, b) => b.n - a.n || String(a.project_id).localeCompare(String(b.project_id))),

package/src/requirements.ts

@@ -20,11 +20,12 @@ import { notifyLeaderDeleted, notifyParticipantChange } from "./requirement-noti
 import { departmentCardsFor, departmentSubtree } from "./department-heads.js";
 import { dueReminderTimezone, dueWithinSql, ensureDueReminders, overdueSql } from "./requirement-due-reminders.js";
 import { diffRequirement, ensureRequirementEvents, eventPublic, recordRequirementEvents, type EventRow } from "./requirement-events.js";
-import { ensureNetworkTags, ensureRequirementCompletedAt, ensureRequirementIndexes, ensureRequirementProjects, ensureRequirementSeq, ensureRequirementTombstones, migrateRequirementAgentOwners, migrateRequirementPriorityCheck, nextRequirementSeq } from "./requirements-migrate.js";
+import { ensureNetworkTags, ensureRequirementCompletedAt, ensureRequirementIndexes, ensureRequirementProjects, ensureRequirementSeq, ensureRequirementTombstones, migrateRequirementAgentOwners, migrateRequirementColumnCheck, migrateRequirementPriorityCheck, nextRequirementSeq } from "./requirements-migrate.js";
 
 // 启动迁移:旧库里节点当负责人的卡,节点挪到 agent_owner(列由 db.ts 的加列循环加上)。
 // 放在这里而不是 db.ts:db.ts 每多一行,文档里钉着的行号就漂一次。
 migrateRequirementPriorityCheck(db);
+migrateRequirementColumnCheck(db);
 migrateRequirementAgentOwners(db);
 ensureRequirementProjects(db);
 ensureRequirementIndexes(db);
@@ -52,7 +53,36 @@ export type RequirementsRequestContext = {
   strictOwner?: boolean;
 };
 
-const COLUMNS = new Set(["pool", "doing", "done"]);
+const COLUMNS = new Set(["pool", "doing", "done", "abandoned"]);
+/**
+ * 废弃(abandoned):和 done 一样是关闭态 —— 不算开着、不算逾期、不发到期提醒,不记完成时间;能改回 pool / doing。
+ * 旧客户端(desktop ≤ 0.2.220)只认 pool / doing / done,不认识的值一律当成 pool(会把废弃的卡摆回需求池、还标逾期)。
+ * 所以客户端没声明认识它时,响应里把 abandoned 投影成 done;声明方式二选一:
+ *   请求头 `X-Anet-Accept-Columns: abandoned`,或查询参数 `accept_columns=abandoned`。
+ * MCP(tools.ts)总是声明。文档:docs-site/docs/api/mcp-tools.md「需求池 / 任务看板」的 column 字段。
+ */
+const ACCEPT_COLUMNS_HEADER = "x-anet-accept-columns";
+function knowsAbandoned(ctx: RequirementsRequestContext): boolean {
+  const raw = `${ctx.req.headers.get(ACCEPT_COLUMNS_HEADER) ?? ""},${ctx.url.searchParams.get("accept_columns") ?? ""}`;
+  return raw.split(",").some(v => v.trim() === "abandoned");
+}
+/**
+ * 动态的旧客户端视图:column 改动的 old / new、created 的 new.column 都投影;投影后前后一样(done ↔ abandoned)= null(不回)。
+ */
+function projectEvent<T extends { kind: string; field: string | null; old: unknown; new: unknown }>(ev: T, aware: boolean): T | null {
+  if (aware) return ev;
+  if (ev.kind === "created" && ev.new && typeof ev.new === "object" && typeof (ev.new as any).column === "string") {
+    return { ...ev, new: { ...(ev.new as object), column: projectColumn((ev.new as any).column, false) } };
+  }
+  if (ev.field !== "column") return ev;
+  const old = typeof ev.old === "string" ? projectColumn(ev.old, false) : ev.old;
+  const neu = typeof ev.new === "string" ? projectColumn(ev.new, false) : ev.new;
+  return old === neu ? null : { ...ev, old, new: neu };
+}
+/** 旧客户端看到的状态:abandoned → done,其余原样。 */
+export function projectColumn(column: string, aware: boolean): string {
+  return column === "abandoned" && !aware ? "done" : column;
+}
 // 界面上 P0–P3:high=P0 最高、normal=P1 普通、low=P2 低、lowest=P3 极低。存的值不变,旧客户端照常读写前三个。
 const PRIORITIES = new Set(["high", "normal", "low", "lowest"]);
 const DUE = /^\d{4}-\d{2}-\d{2}$/;
@@ -73,6 +103,7 @@ type Row = {
   parent_id: string | null;
   children_total: number | null;
   children_done: number | null;
+  children_abandoned?: number | null;
   participants_json: string;
   requirement_id: string;
   network_id: string;
@@ -511,7 +542,8 @@ function toPublic(row: Row) {
     updated_by: row.updated_by_json ? JSON.parse(row.updated_by_json) : null,
     // 子需求:parent_id(可空)和父卡上的子需求进度(未归档的子需求数 / 其中完成的)。
     parent_id: row.parent_id || null,
-    children: { total: Number(row.children_total ?? 0), done: Number(row.children_done ?? 0) },
+    // 废弃的子需求不算进度(total 里减掉);旧客户端眼里它是 done,见 toPublicFor。
+    children: { total: Number(row.children_total ?? 0) - Number(row.children_abandoned ?? 0), done: Number(row.children_done ?? 0) },
     // 完成时间:进「完成」列的时刻,移出清空(不在「完成」列 = null)。completedAtApprox = 升级前就完成的卡,
     // 时刻是按 updated_at 补的近似值。completedBy = 谁移进「完成」的(近似值的卡为 null)。旧 App 忽略这三个字段。
     completedAt: row.completed_at || null,
@@ -563,7 +595,14 @@ function toPublicFor(ctx: RequirementsRequestContext, row: Row) {
   if (!perms) permsByCtx.set(ctx, perms = taskPermissionsResolver(taskCaller(ctx)));
   // viewer_can:只对「只看相关任务」的调用者出现,客户端据此画只读锁、藏删除;不出现 = 与今天一样全能(旧 Hub 也不出现)。
   const can = perms(row);
-  const pub = can ? { ...toPublic(row), viewer_can: can } : toPublic(row);
+  const base = toPublic(row);
+  if (!knowsAbandoned(ctx)) {
+    base.column = projectColumn(base.column, false);
+    // 旧客户端把废弃的子需求当 done 列出来:进度也按「算进总数、算作完成」给,和它看到的子需求列表对得上。
+    const abandoned = Number(row.children_abandoned ?? 0);
+    base.children = { total: base.children.total + abandoned, done: base.children.done + abandoned };
+  }
+  const pub = can ? { ...base, viewer_can: can } : base;
   const hidden = hiddenNodeFilter(ctx, row.network_id);
   if (!hidden) return pub;
   return {
@@ -579,6 +618,7 @@ function toPublicFor(ctx: RequirementsRequestContext, row: Row) {
 
 const SELECT = "requirement_id, network_id, title, column_name, priority, due_on, assignee, issues_json, tags_json, created_at, owner_json, participants_json, agent_owner_json, description, checklist_json, project_id, external_ref, external_url, archived, created_by, created_by_json, updated_by_json, updated_at, parent_id, start_on, seq, completed_at, completed_by_json, completed_at_approx, " +
   "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0) AS children_total, " +
+  "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0 AND c.column_name = 'abandoned') AS children_abandoned, " +
   "(SELECT COUNT(*) FROM requirements c WHERE c.parent_id = requirements.requirement_id AND COALESCE(c.archived, 0) = 0 AND c.column_name = 'done') AS children_done";
 
 type PersonRef = { kind: 'user' | 'node'; id: string };
@@ -730,7 +770,7 @@ function ifNoneMatchHits(header: string | null, etag: string): boolean {
 // list_summary:GET 认 view=summary(不带描述正文与子任务条目,见 toSummary);changes:GET 认 changes=1 + updated_since
 // (改过的卡含归档的,加上 deleted 墓碑与 server_time,见 listChanges)。
 // events:GET /api/requirements/events —— 字段级的改动流水(谁、何时、旧值 → 新值,requirement-events.ts)。
-export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event"] as const;
+export const REQUIREMENT_CAPABILITIES = ["agent_owner", "description", "checklist", "projects", "due_datetime", "external_ref", "archived", "agent_api", "sub_requirements", "tags", "priority_lowest", "start_date", "requirement_seq", "search", "paging", "completed_at", "stats", "tag_ops", "list_summary", "changes", "events", "last_event", "column_abandoned"] as const;
 
 // ── 子需求 ──
 // parent_id:同一网络里的另一张卡;不能成环;最多 5 层(顶层是第 1 层)。删父卡 = 子卡保留、parent_id 置空。
@@ -1017,7 +1057,10 @@ function patchRequirement(ctx: RequirementsRequestContext, row: Row, body: Recor
     archived = body.archived ? 1 : 0;
   }
   const updatedAt = new Date().toISOString();
-  const column = has("column") ? String(body.column) : row.column_name;
+  // 旧客户端眼里废弃的卡是 done:它回传 column=done 不是「改成完成」,保持废弃。
+  const column = !has("column") ? row.column_name
+    : row.column_name === "abandoned" && body.column === "done" && !knowsAbandoned(ctx) ? "abandoned"
+    : String(body.column);
   const actor = JSON.stringify(actorOf(ctx));
   // 完成时间:移进「完成」= 此刻 + 这次的操作者;移出 = 清空;留在「完成」(done → done、改别的字段)= 原样不动。
   const completed = column !== "done" ? { at: null, by: null, approx: 0 }
@@ -1083,7 +1126,9 @@ function listFilters(url: URL, sql: string, params: unknown[], ctx?: Requirement
   const status = q.get("status");
   if (status !== null) {
     if (!COLUMNS.has(status)) return jsonError("invalid_status", 400);
-    sql += ` AND column_name = ?${params.push(status)}`;
+    // 旧客户端把废弃的卡看成 done:它按 done 筛时也要带上废弃的,否则同一张卡在列表里有、筛出来没有。
+    if (status === "done" && ctx && !knowsAbandoned(ctx)) sql += " AND column_name IN ('done', 'abandoned')";
+    else sql += ` AND column_name = ?${params.push(status)}`;
   }
   const project = q.get("project_id");
   if (project !== null) sql += project === "none" ? " AND project_id IS NULL" : ` AND project_id = ?${params.push(project)}`;
@@ -1319,7 +1364,9 @@ function lastEventsFor(ctx: RequirementsRequestContext, rows: readonly Row[]): M
     ...ids,
   );
   if (!events.length) return out;
-  const pubs = events.map(eventPublic);
+  const aware = knowsAbandoned(ctx);
+  // 投影后成了 done → done 的那条:当作没有可展示的字段(同下面隐去节点的处理)。
+  const pubs = events.map(e => { const ev = eventPublic(e); return projectEvent(ev, aware) ?? { ...ev, field: null, old: null, new: null }; });
   const userIds = new Set<string>(), nodeIds = new Set<string>();
   for (const ev of pubs) if (isRef(ev.actor)) (ev.actor.kind === "user" ? userIds : nodeIds).add(ev.actor.id);
   // 名字规则同 GET /api/requirements/people 的 name(没设显示名 → 用户名 / alias / node_name)。
@@ -1384,6 +1431,7 @@ function listEvents(ctx: RequirementsRequestContext): Response {
   const serverTime = new Date().toISOString();
   const caller = taskCaller(ctx);
   const hidden = hiddenNodeFilter(ctx, networkId);
+  const aware = knowsAbandoned(ctx);
   const seen = new Map<string, boolean>();
   const canSee = (id: string): boolean => {
     if (!caller) return true;
@@ -1399,7 +1447,8 @@ function listEvents(ctx: RequirementsRequestContext): Response {
   };
   const shown = (row: EventRow) => {
     if (!canSee(row.requirement_id)) return null;
-    const ev = eventPublic(row);
+    const ev = projectEvent(eventPublic(row), aware);
+    if (!ev) return null;
     if (!hidden) return ev;
     const mask = (ref: unknown) => (isHiddenRef(ref, hidden) ? null : ref);
     const masked = { ...ev, actor: mask(ev.actor) };
@@ -1479,7 +1528,7 @@ function listCacheAcl(ctx: RequirementsRequestContext): string | null {
 
 function listCacheKey(ctx: RequirementsRequestContext): string {
   const sorted = [...ctx.url.searchParams.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-  return JSON.stringify({ u: ctx.auth?.userId ?? null, n: ctx.auth?.networkId ?? null, a: ctx.isAdmin, t: ctx.isNodeToken, s: ctx.scope, q: sorted });
+  return JSON.stringify({ u: ctx.auth?.userId ?? null, n: ctx.auth?.networkId ?? null, a: ctx.isAdmin, t: ctx.isNodeToken, s: ctx.scope, q: sorted, c: knowsAbandoned(ctx) });
 }
 
 /** Test-only. */

package/src/server.ts

@@ -39,7 +39,7 @@ import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_PERMISSION_MO
 import { validateAvatarUrl } from "./avatar-validate.js";
 import { narrowTags, parseStoredTags, validateScalarAttr } from "./node-attrs-validate.js";
 import { daemonDefaultWorkdirRoot } from "./create-node-validate.js";
-import { register, login, resolveToken, tokenRejection, isExpiredSessionToken, sessionIdleDays, listSessions, revokeSession, revokeOtherSessions, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, adminDeleteEmptyNetwork, renameNetwork, changePassword, issueUserToken, listTokens, createToken, revokeToken, getNetworkMembers, getNetworkHumans, getUserNetworkRole, addNetworkMember, adminCreateUser, listUsersWithMemberships, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
+import { register, login, resolveToken, tokenRejection, isExpiredSessionToken, sessionIdleDays, listSessions, revokeSession, revokeOtherSessions, getUserNetworks, getUserAllNetworks, createNetwork, deleteNetwork, adminDeleteEmptyNetwork, renameNetwork, changePassword, issueUserToken, getUserTokenMeta, listTokens, createToken, revokeToken, getNetworkMembers, getNetworkHumans, getUserNetworkRole, addNetworkMember, adminCreateUser, listUsersWithMemberships, updateMemberRole, removeNetworkMember, createInvite, joinByInvite, createNetworkTokenForNode, type AuthUser } from "./auth.js";
 import { abortRename, cleanupCommittedRenameSessions, commitRename, prepareRename, resolveCanonicalAlias } from "./rename.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
 import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
@@ -1376,7 +1376,7 @@ return Bun.serve({
       }
       try {
         const body = await req.json() as any;
-        const result = register(body.username, body.password, body.email, body.display_name, { client: { label: body.client_label, userAgent: req.headers.get("user-agent") } });
+        const result = register(body.username, body.password, body.email, body.display_name, { client: { label: body.client_label, userAgent: req.headers.get("user-agent"), kind: body.client_kind } });
         if (result.ok) logAudit(result.user!.user_id, body.username, "register", "user", result.user!.user_id);
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
       } catch (e: any) {
@@ -1404,7 +1404,7 @@ return Bun.serve({
             { status: 429, headers: { "Retry-After": String(Math.ceil((lock.retryAfterMs ?? 1000) / 1000)) } }
           ));
         }
-        const result = login(body.username, body.password, { label: body.client_label, userAgent: req.headers.get("user-agent") });
+        const result = login(body.username, body.password, { label: body.client_label, userAgent: req.headers.get("user-agent"), kind: body.client_kind });
         if (result.ok) {
           sharedLoginFailureLockout.recordSuccess(body.username);
           logAudit(result.user!.user_id, body.username, "login", "user", result.user!.user_id);
@@ -1473,9 +1473,13 @@ return Bun.serve({
       if (isNodeCredential(resolved)) return userTokenRequired(req);
       try {
         const body = await req.json() as any;
-        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId);
+        // #711 不带 keep_cli_tokens 的请求(旧 app、dashboard 代理)= 改密码前的行为:撤销全部不绑网络的令牌。
+        // keep_cli_tokens 必须是布尔 true 才保留命令行 / 脚本令牌。
+        const meta = resolved.tokenId ? getUserTokenMeta(resolved.user.user_id, resolved.tokenId) : null;
+        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId, { keepCliTokens: body.keep_cli_tokens === true });
         if (result.ok) {
-          const issued = issueUserToken(resolved.user.user_id, "password-change");
+          // 换发的新令牌沿用当前这条的种类和设备标识:anet passwd 换完仍是命令行令牌。
+          const issued = issueUserToken(resolved.user.user_id, "password-change", { kind: meta?.kind, clientLabel: meta?.client_label, userAgent: meta?.user_agent });
           if (resolved.tokenId) revokeToken(resolved.user.user_id, resolved.tokenId);
           logAudit(resolved.user.user_id, resolved.user.username, "password_changed", "user", resolved.user.user_id);
           return withCors(req, Response.json({ ...result, token: issued.token, token_id: issued.token_id }));

package/src/tools.ts

@@ -3684,7 +3684,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "list_node_skills",
-    "Ask a node to list the skills its runtime loads (name, scope project|user|system, display path, frontmatter description). Read-only; no path argument. Poll get_rules_file_result — content is JSON {skills:[…]}.",
+    "Ask a node to list the skills its runtime loads (name, scope project|user|system, display path, frontmatter description; team skills also include origin \"team\"). Read-only; no path argument. Poll get_rules_file_result — content is JSON {skills:[…], roots, warnings}.",
     {
       ...NODE_ID_ALIAS_FIELDS,
       alias: z.string().min(1).max(200).optional().describe("Alias instead of node_id (a node, or a session reporting skills_capable)."),
@@ -3695,7 +3695,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "read_node_skill",
-    "Ask a node for one skill's SKILL.md by name. Read-only; the node resolves the name under its own runtime's skills roots — no path argument. Poll get_rules_file_result — content is JSON {name, scope, path_rel, description, content}.",
+    "Ask a node for one skill's SKILL.md by name. Read-only; the node resolves the name under its own runtime's skills roots — no path argument. Poll get_rules_file_result — content is JSON {name, scope, path_rel, description, content, origin?}. origin is \"team\" only for a team skill.",
     {
       ...NODE_ID_ALIAS_FIELDS,
       alias: z.string().min(1).max(200).optional().describe("Alias instead of node_id (a node, or a session reporting skills_capable)."),
@@ -5993,7 +5993,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     const scope = resolveRestNetworkScope(enforceNetworkId ? null : (clientNetId ?? null), mcpAuthCtx, false);
     if (scope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "access_denied", message: scope.denied }) }] };
     const url = new URL(`http://mcp.internal${path}`);
-    const req = new Request(url, { method, headers: { "content-type": "application/json" }, body: body ? JSON.stringify(body) : undefined });
+    const req = new Request(url, { method, headers: { "content-type": "application/json", "x-anet-accept-columns": "abandoned" }, body: body ? JSON.stringify(body) : undefined });
     const res = await handleRequirementsRequest({
       req, url,
       auth: mcpAuthCtx ? { ...mcpAuthCtx, username: "", tokenId: callerTokenId ?? null, tokenName: callerTokenIsNetwork && callerAlias ? `node:${callerAlias}` : null } : null,
@@ -6021,7 +6021,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     tags: z.array(z.string()).max(10).optional().describe("Task labels; each 1–20 Unicode characters. Omit to preserve, [] to clear."),
     name: z.string().min(1).max(80).optional(),
     priority: z.enum(["high", "normal", "low", "lowest"]).optional().describe("high = P0 最高, normal = P1 普通, low = P2 低, lowest = P3 极低"),
-    column: z.enum(["pool", "doing", "done"]).optional(),
+    column: z.enum(["pool", "doing", "done", "abandoned"]).optional(),
     due: z.string().max(40).optional().describe("YYYY-MM-DD (all day) or ISO 8601 with Z / ±HH:MM (stored as UTC seconds); \"\" clears"),
     start: z.string().max(40).optional().describe("start date (Gantt): same shapes as due; \"\" clears"),
     description: z.string().max(20_000).optional().describe("markdown"),
@@ -6037,7 +6037,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const REQ_WRITE_KEYS = [...Object.keys(reqFields), "external_ref", "archived"];
   // #475 —— status 是 column 的别名(列表的筛选参数就叫 status,Agent 写任务时也常这么写)。只在 MCP 这层换名,REST 不变;
   // 两个都给且不同 → 400 status_conflicts_with_column,不替调用方挑一个。
-  const reqStatus = z.enum(["pool", "doing", "done"]).optional().describe("alias of column; must match it if both are sent");
+  const reqStatus = z.enum(["pool", "doing", "done", "abandoned"]).optional().describe("alias of column; must match it if both are sent");
   const withColumn = (args: Record<string, unknown>, call: (args: Record<string, unknown>) => Promise<{ content: { type: "text"; text: string }[] }>) => {
     if (args.status === undefined) return call(args);
     if (args.column !== undefined && args.column !== args.status) return Promise.resolve({ content: [{ type: "text" as const, text: JSON.stringify({ ...errorBody("status_conflicts_with_column"), status: 400 }) }] });
@@ -6053,7 +6053,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   const reqListShape = {
     network_id: z.string().max(200).optional(),
     seq: z.number().int().positive().optional().describe("short number (#N) of one task in this network"),
-    status: z.enum(["pool", "doing", "done"]).optional(),
+    status: z.enum(["pool", "doing", "done", "abandoned"]).optional(),
     project_id: z.string().max(200).optional(),
     owner: z.string().max(210).optional(),
     agent_owner: z.string().max(210).optional(),
@@ -6134,14 +6134,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
   server.tool(
     "requirements_create",
-    "Create a requirement task. name is required. column (or its alias status) = pool / doing / done. A duplicate external_ref in the network returns 409 external_ref_exists with existing_id — use requirements_upsert_by_external_ref for syncing.",
+    "Create a requirement task. name is required. column (or its alias status) = pool / doing / done / abandoned. A duplicate external_ref in the network returns 409 external_ref_exists with existing_id — use requirements_upsert_by_external_ref for syncing.",
     { network_id: z.string().max(200).optional(), ...reqFields, status: reqStatus, name: z.string().min(1).max(80), external_ref: z.string().max(200).optional() },
     async (args) => withColumn(args, a => requirementsCall("POST", "/api/requirements", args.network_id, pick(a, REQ_WRITE_KEYS))),
   );
 
   server.tool(
     "requirements_update",
-    "Patch a requirement task (id or \"#N\"); omitted fields keep their value. column (or its alias status) moves it between pool / doing / done. participants REPLACES the whole list; to add or remove people without dropping the others use participants_add / participants_remove. archived=true hides it from the default list (agents cannot delete).",
+    "Patch a requirement task (id or \"#N\"); omitted fields keep their value. column (or its alias status) moves it between pool / doing / done / abandoned. participants REPLACES the whole list; to add or remove people without dropping the others use participants_add / participants_remove. archived=true hides it from the default list (agents cannot delete).",
     { id: z.string().min(1).max(200).describe(REQ_ID_DESC), network_id: z.string().max(200).optional(), ...reqFields, status: reqStatus, participants_add: reqPeopleDelta("add"), participants_remove: reqPeopleDelta("remove"), external_ref: z.string().max(200).nullable().optional(), archived: z.boolean().optional() },
     async (args) => withColumn(args, a => requirementsCall("PATCH", `/api/requirements/${encodeURIComponent(args.id)}`, args.network_id, pick(a, [...REQ_WRITE_KEYS, "participants_add", "participants_remove"]))),
   );