@sleep2agi/commhub-server 0.9.0-preview.112 → 0.9.0-preview.114

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.112",
+  "version": "0.9.0-preview.114",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/auth-password-change-cli-tokens-http.test.ts

@@ -0,0 +1,294 @@
+// #711 改密码只让浏览器 / app 的登录会话下线,命令行和脚本令牌默认保留。
+//
+// main 上 POST /api/auth/password 跑的是 `DELETE FROM api_tokens WHERE user_id = ? AND network_id IS NULL
+// AND token_id != ?` —— 每台机器上 `anet login` 拿到的令牌、POST /api/auth/tokens 建的具名脚本令牌,
+// 跟浏览器会话一起被删光。安全复审定的形状:默认不变,保留是显式选项。这里每条都钉住:
+//   · 默认(旧 app、dashboard 代理不带字段):撤销全部不绑网络的令牌 —— 客户端自报的 cli 也活不下来;
+//   · keep_cli_tokens=true(anet passwd 默认带):只撤其他 kind='login' 会话,保留的 cli 令牌列在响应里、不含令牌值;
+//   · 当前会话(换发后的新令牌)永远可用,而且沿用当前令牌的种类;
+//   · 节点 / 网络令牌永远不动;
+//   · 启动迁移按 client_label / scope 回填存量令牌的 kind(夹具库,跑两遍幂等)。
+// SQLite 由 test798 自动收进;PostgreSQL 由 tests/test2123-hub-postgres-ladder 的 run_pg_tests_rc 跑同一个文件。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
+import { register, createNetworkTokenForNode, createToken, changePassword } from "./auth.js";
+import { db, hashToken } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-pwchange-kind-"));
+let BASE = "";
+let hub: any = null;
+const PW = "PwChangeKindPassw0rd!";
+const PW2 = "PwChangeKindPassw0rd!2";
+const CLI_LABEL = "anet 2.5.0 · test-box · login";
+
+async function call(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const works = async (token: string) => (await call(token, "GET", "/api/auth/me")).status === 200;
+const kindOf = (token: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_hash = ?1", hashToken(token))?.kind ?? null;
+
+type Fleet = {
+  user: string; userId: string; net: string;
+  app: string; appB: string; regToken: string;
+  cliByLabel: string; cliByKind: string; apiToken: string;
+  nodeToken: string; netToken: string;
+};
+
+let seq = 0;
+async function fleet(): Promise<Fleet> {
+  const user = `pwk_${Date.now()}_${++seq}`;
+  const reg = register(user, PW);
+  expect(reg.ok).toBe(true);
+  const login = async (extra: Record<string, unknown>) => {
+    const r = await call("", "POST", "/api/auth/login", { username: user, password: PW, ...extra });
+    expect(r.status).toBe(200);
+    return r.body.token as string;
+  };
+  const node = createNetworkTokenForNode(reg.user!.user_id, reg.network_id!, "pwk-node", `node_pwk_${seq}`);
+  expect(node.ok).toBe(true);
+  const api = createToken(reg.user!.user_id, "ci-script");
+  expect(api.ok).toBe(true);
+  const netTok = createToken(reg.user!.user_id, "net-script", reg.network_id!);
+  expect(netTok.ok).toBe(true);
+  return {
+    user, userId: reg.user!.user_id, net: reg.network_id!,
+    regToken: reg.token!,
+    app: await login({ client_label: "Desktop app" }),
+    appB: await login({}),
+    cliByLabel: await login({ client_label: CLI_LABEL }),
+    cliByKind: await login({ client_kind: "cli" }),
+    apiToken: api.token!,
+    nodeToken: node.token!,
+    netToken: netTok.token!,
+  };
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  process.env.COMMHUB_LOGIN_IP_MAX = "1000";
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("new tokens are classified at issue time", () => {
+  test("browser/app logins are 'login'; anet-labelled, client_kind=cli and named API tokens are 'cli'; node tokens unclassified", async () => {
+    const f = await fleet();
+    expect(kindOf(f.regToken)).toBe("login");
+    expect(kindOf(f.app)).toBe("login");
+    expect(kindOf(f.appB)).toBe("login");
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.nodeToken)).toBe(null);
+    expect(kindOf(f.netToken)).toBe(null);
+  });
+});
+
+// 响应里出现任何令牌值都算泄漏:换发给调用方的那一条(body.token)除外,它本来就要交给调用方。
+function assertNoTokenValues(body: any, f: Fleet) {
+  const { token: _rotated, ...rest } = body;
+  const text = JSON.stringify(rest);
+  for (const t of [f.regToken, f.app, f.appB, f.cliByLabel, f.cliByKind, f.apiToken, f.nodeToken, f.netToken]) {
+    expect(text.includes(t)).toBe(false);
+  }
+  expect(/\b(utok|atok|ntok)_[A-Za-z0-9]{8,}/.test(text)).toBe(false);
+  expect(text.includes("token_hash")).toBe(false);
+}
+
+describe("POST /api/auth/password (default: old apps, dashboard proxy — no field)", () => {
+  test("every other non-network token is revoked (pre-#711 behaviour); node tokens and the rotated current session survive", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(r.body.ok).toBe(true);
+    expect(r.body.revoked_login).toBe(2); // reg + appB
+    expect(r.body.revoked_cli).toBe(3);   // cliByLabel + cliByKind + apiToken
+    expect(r.body.revoked).toBe(5);
+    expect(r.body.kept_cli_tokens).toBeUndefined();
+    for (const t of [f.regToken, f.appB, f.cliByLabel, f.cliByKind, f.apiToken]) expect(await works(t)).toBe(false);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("login");
+    expect(await works(f.app)).toBe(false);
+  });
+
+  test("a client-declared cli token (client_kind / anet label) does NOT survive a default password change", async () => {
+    const f = await fleet();
+    expect(kindOf(f.cliByKind)).toBe("cli");
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.cliByLabel)).toBe(false);
+  });
+
+  test("a non-boolean keep_cli_tokens is not an opt-in; the removed revoke_cli_tokens field does nothing", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: "true", revoke_cli_tokens: false });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_cli).toBe(3);
+    expect(await works(f.cliByLabel)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+});
+
+describe("POST /api/auth/password with keep_cli_tokens=true (anet passwd)", () => {
+  test("only other login sessions are revoked; CLI/script tokens are kept and listed without token values", async () => {
+    const f = await fleet();
+    const r = await call(f.cliByLabel, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_login).toBe(3); // reg + app + appB
+    expect(r.body.revoked_cli).toBe(0);
+    expect(r.body.revoked).toBe(3);
+    for (const t of [f.regToken, f.app, f.appB]) expect(await works(t)).toBe(false);
+    expect(await works(f.cliByKind)).toBe(true);
+    expect(await works(f.apiToken)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.netToken)).toBe(true);
+    // 当前会话:换发的新令牌可用,沿用 cli
+    expect(await works(r.body.token)).toBe(true);
+    expect(kindOf(r.body.token)).toBe("cli");
+    // 保留清单:不含当前这条(它已被换掉),只含另外两条 cli;字段齐全、无令牌值
+    const kept = r.body.kept_cli_tokens as any[];
+    const idOf = (t: string) => db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(t)).token_id;
+    expect(kept.map((k) => k.token_id).sort()).toEqual([idOf(f.cliByKind), idOf(f.apiToken)].sort());
+    for (const k of kept) {
+      expect(Object.keys(k).sort()).toEqual(["client_label", "created_at", "last_used_at", "name", "token_id"]);
+      expect(k.token_id).toMatch(/^tok_[0-9a-f]{12}$/);
+    }
+    expect(kept.find((k) => k.token_id === idOf(f.apiToken)).name).toBe("ci-script");
+    assertNoTokenValues(r.body, f);
+    // 可以逐条撤销
+    expect((await call(r.body.token, "DELETE", `/api/auth/tokens/${idOf(f.apiToken)}`)).status).toBe(200);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  test("default response carries no token values either", async () => {
+    const f = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    assertNoTokenValues(r.body, f);
+  });
+});
+
+describe("changePassword() keeps the current token row in both modes", () => {
+  test("no opts at all = default: CLI tokens revoked, current kept", async () => {
+    const f = await fleet();
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur);
+    expect(r.ok).toBe(true);
+    expect(r.revoked_cli).toBe(3);
+    expect(r.kept_cli_tokens).toBeUndefined();
+    expect(await works(f.app)).toBe(true);
+    expect(await works(f.cliByKind)).toBe(false);
+    expect(await works(f.apiToken)).toBe(false);
+  });
+
+  for (const keepCliTokens of [false, true]) {
+    test(`keepCliTokens=${keepCliTokens}: current login token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.app)).toBe(true);
+      expect(await works(f.appB)).toBe(false);
+      expect(await works(f.cliByLabel)).toBe(keepCliTokens);
+      expect(await works(f.nodeToken)).toBe(true);
+    });
+    test(`keepCliTokens=${keepCliTokens}: current CLI token kept`, async () => {
+      const f = await fleet();
+      const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.cliByKind)).token_id;
+      const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens });
+      expect(r.ok).toBe(true);
+      expect(await works(f.cliByKind)).toBe(true);
+      expect(await works(f.app)).toBe(false);
+      expect(await works(f.apiToken)).toBe(keepCliTokens);
+    });
+  }
+});
+
+describe("startup migration backfills api_tokens.kind on a fixture DB", () => {
+  // 把 kind 列拿掉 = 回到 #711 之前的表结构;塞存量行;再起一个进程加载 db.ts(= Hub 启动迁移)。
+  function bootMigration() {
+    const r = spawnSync(process.execPath, ["-e", `await import(${JSON.stringify(join(import.meta.dir, "db.ts"))}); process.exit(0);`], {
+      cwd: join(import.meta.dir, ".."),
+      env: { ...process.env, NODE_ENV: "test" },
+      encoding: "utf8",
+      timeout: 60_000,
+    });
+    if (r.status !== 0) console.log(String(r.stderr || "").slice(-2000));
+    return r.status;
+  }
+
+  test("anet-labelled and named API tokens → cli, everything else → login, node tokens untouched; idempotent", async () => {
+    const f = await fleet();
+    db.exec("ALTER TABLE api_tokens DROP COLUMN kind");
+    const ins = (id: string, net: string | null, scope: string, label: string | null) =>
+      db.run(
+        "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, 'fixture', ?5, ?6, 1)",
+        [id, hashToken(`fixture-${id}`), f.userId, net, scope, label],
+      );
+    const id = (s: string) => `tok_fx_${seq}_${s}`;
+    ins(id("cli_label"), null, "user", "anet 2.4.0 · old-box · login");
+    ins(id("cli_demo"), null, "user", "anet dev · unknown-host · demo sci-team");
+    ins(id("browser"), null, "user", "Chrome on macOS");
+    ins(id("nolabel"), null, "user", null);
+    ins(id("lookalike"), null, "user", "planet-anet dashboard");
+    ins(id("upper"), null, "user", "ANET 2.4.0 · box · login");
+    ins(id("padded"), null, "user", "  anet 2.4.0 · box · login");
+    ins(id("named"), null, "full", null);
+    ins(id("node"), f.net, "network", null);
+    ins(id("netfull"), f.net, "full", null);
+
+    expect(bootMigration()).toBe(0);
+    const k = (s: string) => db.get<any>("SELECT kind FROM api_tokens WHERE token_id = ?1", id(s))?.kind ?? null;
+    expect(k("cli_label")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe("login");
+    expect(k("nolabel")).toBe("login");
+    expect(k("lookalike")).toBe("login");
+    expect(k("upper")).toBe("login");   // 区分大小写:SQLite 的 LIKE 会把它当 cli,PG 不会 —— 两边必须一致
+    expect(k("padded")).toBe("cli");    // 与运行时一样先 trim
+    expect(k("named")).toBe("cli");
+    expect(k("node")).toBe(null);
+    expect(k("netfull")).toBe(null);
+    // fleet() 的 live 令牌也被回填(列重建后原值丢了,按同一规则算回来)
+    expect(kindOf(f.cliByLabel)).toBe("cli");
+    expect(kindOf(f.apiToken)).toBe("cli");
+    expect(kindOf(f.app)).toBe("login");
+
+    // 幂等:已有值不被改写(手动改成 login 的 anet 行保持 login),再跑一次结果不变
+    db.run("UPDATE api_tokens SET kind = 'login' WHERE token_id = ?1", [id("cli_label")]);
+    expect(bootMigration()).toBe(0);
+    expect(k("cli_label")).toBe("login");
+    expect(k("named")).toBe("cli");
+    expect(k("browser")).toBe("login");
+
+    // 迁移后的库上,keep_cli_tokens 保留回填成 cli 的存量令牌
+    const cur = db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash = ?1", hashToken(f.app)).token_id;
+    const r = changePassword(f.userId, PW, PW2, cur, { keepCliTokens: true });
+    expect(r.ok).toBe(true);
+    expect(k("named")).toBe("cli");
+    expect(k("cli_demo")).toBe("cli");
+    expect(k("browser")).toBe(null); // 被撤销(行已删除)
+    expect(k("node")).toBe(null);
+    expect(Number(db.get<any>("SELECT COUNT(*) AS n FROM api_tokens WHERE token_id = ?1", id("node")).n)).toBe(1);
+  }, 120_000);
+});

package/src/auth.ts

@@ -137,8 +137,8 @@ export function register(username: string, password: string, email?: string, dis
   const userToken = generateUserToken();
   const userTokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [userTokenId, hashToken(userToken), userId, null, "user-login", "user", cleanClientField(opts.client?.label, 64), cleanClientField(opts.client?.userAgent, 256), userTokenKindFor(opts.client)]
   );
 
   // Network token (ntok_) — bound to default network, for agent-node
@@ -217,8 +217,8 @@ export function login(username: string, password: string, client: SessionClientI
   const userToken = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)",
-    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256)]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 1)",
+    [tokenId, hashToken(userToken), user.user_id, null, "user-login", "user", cleanClientField(client.label, 64), cleanClientField(client.userAgent, 256), userTokenKindFor(client)]
   );
 
   // Find default network
@@ -321,7 +321,28 @@ const SESSION_TOKEN_SQL = "scope = 'user' AND network_id IS NULL";
 // 以小时为粒度对一个以天计的闲置窗口没有影响。
 const LAST_USED_WRITE_INTERVAL_SECONDS = 3600;
 
-export type SessionClientInfo = { label?: unknown; userAgent?: unknown };
+export type SessionClientInfo = { label?: unknown; userAgent?: unknown; kind?: unknown };
+
+// #711 不绑网络的用户令牌的种类(api_tokens.kind):
+//   'login' — 浏览器 / app 的登录会话;
+//   'cli'   — anet 命令行登录、POST /api/auth/tokens 建的具名脚本令牌。
+// 种类由客户端自报(client_kind / client_label),**只用于展示和「显式保留」那条路**:
+// 改密码默认仍撤销全部不绑网络的令牌(当前这条除外),调用方显式 keep_cli_tokens=true 才保留 'cli'。
+// 所以一个自称 cli 的令牌永远不能靠自报在默认改密码里活下来。
+// 节点 / 网络令牌(network_id 非空)不分类,改密码永远不碰。
+export type UserTokenKind = "login" | "cli";
+
+/** 登录 / 注册请求签发的令牌算哪一类:客户端显式报 kind='cli',或 client_label 是 anet 自报的「anet <版本> · …」。 */
+/** anet 自报的 client_label:去掉首尾空白后,区分大小写地以「anet 」开头(启动回填用同一条规则,见 db.ts)。 */
+export function isAnetClientLabel(label: string): boolean {
+  return label.trim().startsWith("anet ");
+}
+
+export function userTokenKindFor(client: SessionClientInfo = {}): UserTokenKind {
+  if (client.kind === "cli") return "cli";
+  if (typeof client.label === "string" && isAnetClientLabel(client.label)) return "cli";
+  return "login";
+}
 
 function cleanClientField(value: unknown, max: number): string | null {
   if (typeof value !== "string") return null;
@@ -508,9 +529,10 @@ export function createToken(userId: string, name: string, networkId?: string): {
   }
   const token = generateToken();
   const tokenId = generateId("tok");
+  // #711 不绑网络的具名令牌是给脚本 / 命令行长期用的:kind='cli'(改密码时可显式 keep_cli_tokens 保留)。
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1)",
-    [tokenId, hashToken(token), userId, networkId || null, name, "full"]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, kind, node_identity_epoch) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, networkId || null, name, "full", networkId ? null : "cli"]
   );
   return { ok: true, token, token_id: tokenId };
 }
@@ -520,16 +542,55 @@ export function revokeToken(userId: string, tokenId: string): { ok: boolean; err
   return result.changes > 0 ? { ok: true } : { ok: false, error: "token not found" };
 }
 
-export function issueUserToken(userId: string, name = "user-login"): { token: string; token_id: string } {
+export function issueUserToken(
+  userId: string,
+  name = "user-login",
+  opts: { kind?: UserTokenKind; clientLabel?: string | null; userAgent?: string | null } = {},
+): { token: string; token_id: string } {
   const token = generateUserToken();
   const tokenId = generateId("tok");
   db.run(
-    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', 1)",
-    [tokenId, hashToken(token), userId, name]
+    "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope, client_label, user_agent, kind, node_identity_epoch) VALUES (?1, ?2, ?3, NULL, ?4, 'user', ?5, ?6, ?7, 1)",
+    [tokenId, hashToken(token), userId, name, opts.clientLabel ?? null, opts.userAgent ?? null, opts.kind === "cli" ? "cli" : "login"]
   );
   return { token, token_id: tokenId };
 }
 
+/** 一条令牌的种类和设备标识(改密码换发新令牌时沿用,命令行的令牌换完还是命令行的)。 */
+export function getUserTokenMeta(userId: string, tokenId: string): { kind: UserTokenKind; client_label: string | null; user_agent: string | null } | null {
+  const row = db.get<any>("SELECT kind, client_label, user_agent FROM api_tokens WHERE token_id = ?1 AND user_id = ?2 AND network_id IS NULL", tokenId, userId);
+  if (!row) return null;
+  return { kind: row.kind === "cli" ? "cli" : "login", client_label: row.client_label ?? null, user_agent: row.user_agent ?? null };
+}
+
+// #711 改密码撤销哪些令牌。kind 为 NULL 的(启动回填之后由旧版 Hub 签出的)按 'login' 算。
+const CLI_KIND_SQL = "kind = 'cli'";
+const NOT_CLI_KIND_SQL = "COALESCE(kind, 'login') <> 'cli'";
+
+/** 改密码后保留下来的命令行 / 脚本令牌(给 UI 列出来、让用户逐条撤销)。**永远不含令牌值。** */
+export type KeptCliToken = { token_id: string; name: string; client_label: string | null; created_at: string; last_used_at: string | null };
+
+/**
+ * 改密码后的令牌撤销。默认(keepCli=false)= 改密码前的行为:撤销全部不绑网络的令牌;
+ * keepCli=true 时保留 kind='cli' 的,并把它们列出来。当前这条(exceptTokenId)和节点 / 网络令牌永远不动。
+ */
+export function revokeTokensAfterPasswordChange(userId: string, exceptTokenId: string | null | undefined, keepCli: boolean): { login: number; cli: number; kept: KeptCliToken[] } {
+  const except = exceptTokenId ? " AND token_id != ?2" : "";
+  const params = exceptTokenId ? [userId, exceptTokenId] : [userId];
+  const login = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND ${NOT_CLI_KIND_SQL}${except}`, params).changes;
+  if (!keepCli) {
+    const cli = db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL${except}`, params).changes;
+    return { login, cli, kept: [] };
+  }
+  const kept = db.all<any>(
+    `SELECT token_id, name, client_label, created_at, last_used_at FROM api_tokens
+     WHERE user_id = ?1 AND network_id IS NULL AND ${CLI_KIND_SQL}${except}
+     ORDER BY created_at DESC`,
+    ...params,
+  ).map((r) => ({ token_id: r.token_id, name: r.name, client_label: r.client_label ?? null, created_at: r.created_at, last_used_at: r.last_used_at ?? null }));
+  return { login, cli: 0, kept };
+}
+
 export function revokeOtherUserTokens(userId: string, exceptTokenId?: string | null): number {
   const result = exceptTokenId
     ? db.run("DELETE FROM api_tokens WHERE user_id = ?1 AND network_id IS NULL AND token_id != ?2", [userId, exceptTokenId])
@@ -544,6 +605,7 @@ export type LoginSession = {
   last_used_at: string | null;
   client_label: string | null;
   user_agent: string | null;
+  kind: UserTokenKind;
   is_current: boolean;
 };
 
@@ -551,7 +613,7 @@ export type LoginSession = {
 export function listSessions(userId: string, currentTokenId: string | null): LoginSession[] {
   const cutoff = idleCutoffOffset();
   const rows = db.all<any>(
-    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent FROM api_tokens
+    `SELECT token_id, name, created_at, last_used_at, client_label, user_agent, kind FROM api_tokens
      WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND revoked_at IS NULL${cutoff ? `
        AND COALESCE(last_used_at, created_at) >= datetime('now', ?2)` : ""}
      ORDER BY COALESCE(last_used_at, created_at) DESC, created_at DESC`,
@@ -563,6 +625,7 @@ export function listSessions(userId: string, currentTokenId: string | null): Log
     last_used_at: r.last_used_at ?? null,
     client_label: r.client_label ?? null,
     user_agent: r.user_agent ?? null,
+    kind: r.kind === "cli" ? "cli" : "login",
     is_current: !!currentTokenId && r.token_id === currentTokenId,
   }));
 }
@@ -578,7 +641,14 @@ export function revokeOtherSessions(userId: string, currentTokenId: string): num
   return db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND token_id != ?2`, [userId, currentTokenId]).changes;
 }
 
-export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null): { ok: boolean; error?: string; revoked?: number } {
+export type ChangePasswordResult = { ok: boolean; error?: string; revoked?: number; revoked_login?: number; revoked_cli?: number; kept_cli_tokens?: KeptCliToken[] };
+
+/**
+ * 改密码。默认撤销该用户全部不绑网络的令牌(改密码前的行为,旧 app 依赖它)。#711:opts.keepCliTokens=true
+ * 时保留 kind='cli' 的(anet 命令行登录、具名脚本令牌),并在 kept_cli_tokens 里列出。当前会话和节点令牌永远保留。
+ * revoked = 两类合计(旧字段,兼容旧客户端)。
+ */
+export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null, opts: { keepCliTokens?: boolean } = {}): ChangePasswordResult {
   const passwordError = validatePasswordStrength(newPassword, "new password");
   if (passwordError) return { ok: false, error: passwordError };
   const user = db.get<any>("SELECT password_hash FROM users WHERE user_id = ?1", userId);
@@ -593,8 +663,9 @@ export function changePassword(userId: string, oldPassword: string, newPassword:
   // nudge goes away on next login. SET to 0 explicitly (rather than skip)
   // so a future flag flip can't drift the state.
   db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
-  const revoked = revokeOtherUserTokens(userId, currentTokenId);
-  return { ok: true, revoked };
+  const keep = opts.keepCliTokens === true;
+  const r = revokeTokensAfterPasswordChange(userId, currentTokenId, keep);
+  return { ok: true, revoked: r.login + r.cli, revoked_login: r.login, revoked_cli: r.cli, ...(keep ? { kept_cli_tokens: r.kept } : {}) };
 }
 
 /**
@@ -886,7 +957,7 @@ const NETWORK_CLEANUP_TABLES = [
   "network_members", "network_member_agent_grants", "network_invites", "api_tokens",
   "node_create_requests", "node_start_requests", "node_stop_requests", "node_rules_requests",
   "node_config_updates", "rename_txn", "probe_results", "agent_telemetry", "completions",
-  "task_events", "task_terminal_events", "scheduled_task_runs", "external_schedule_edits",
+  "task_events", "task_terminal_events", "task_late_replies", "scheduled_task_runs", "external_schedule_edits",
   // 标签颜色:网络本身的元数据(标签本体在 requirements 行里,那张表是阻断项)。
   "network_tags",
   // 组织架构(board #419):部门是网络本身的元数据。

package/src/db.ts

@@ -646,12 +646,26 @@ for (const ddl of [
   // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
   "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
   "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",
+  // #711 不绑网络的用户令牌分两类:'login' = 浏览器 / app 的登录会话;'cli' = anet 命令行登录、
+  // POST /api/auth/tokens 建的具名脚本令牌。只用于展示和 keep_cli_tokens 那条显式保留路径;节点 / 网络令牌(network_id 非空)不填。
+  "ALTER TABLE api_tokens ADD COLUMN kind TEXT",
 ]) {
   try { db.exec(ddl); }
   catch (e: any) {
     if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
   }
 }
+// #711 回填 kind:只碰 kind 还是 NULL 的非网络令牌(幂等;回滚到旧 Hub 期间新签的行,下次启动照样补上)。
+// 能明确认出是 anet 命令行的才算 'cli':scope='full'(POST /api/auth/tokens 建的具名令牌),
+// 或 client_label 去掉首尾空格后以「anet 」开头(anet 自报的「anet <版本> · <主机> · <子命令>」)。其余一律 'login'。
+// 用 SUBSTR + = 而不是 LIKE:SQLite 的 LIKE 不分大小写、PG 分,两边结果会不一样;= 两边都区分大小写,
+// 与运行时 isAnetClientLabel(auth.ts)同一条规则。
+db.run(
+  `UPDATE api_tokens SET kind = CASE
+     WHEN scope = 'full' OR SUBSTR(TRIM(client_label), 1, 5) = 'anet ' THEN 'cli'
+     ELSE 'login' END
+   WHERE network_id IS NULL AND kind IS NULL`,
+);
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
 catch (e: any) { /* index may already exist */ void e; }
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_bound_node ON api_tokens(bound_node_id)`); }
@@ -969,7 +983,7 @@ db.exec(`
     requirement_id TEXT PRIMARY KEY,
     network_id     TEXT NOT NULL,
     title          TEXT NOT NULL,
-    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done')),
+    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned')),
     priority       TEXT NOT NULL DEFAULT 'normal' CHECK(priority IN ('high', 'normal', 'low', 'lowest')),
     due_on         TEXT,
     assignee       TEXT,
@@ -1475,6 +1489,31 @@ try { db.exec("ALTER TABLE tasks ADD COLUMN consumed_at TEXT"); } catch {}
 try { db.exec("ALTER TABLE tasks ADD COLUMN thread_id TEXT"); } catch {}
 try { db.exec("ALTER TABLE tasks ADD COLUMN turn_id TEXT"); } catch {}
 
+// Board #710 — a result that arrives after the task is already terminal is
+// evidence about that exact runtime turn, not a second task transition. Keep
+// it in an additive table: old clients and old Hub code continue to read the
+// tasks row unchanged, while new detail readers can project `late_replies`.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS task_late_replies (
+    late_reply_id TEXT PRIMARY KEY,
+    inbox_id TEXT NOT NULL UNIQUE,
+    task_id TEXT NOT NULL,
+    network_id TEXT,
+    from_node_id TEXT NOT NULL,
+    thread_id TEXT NOT NULL,
+    turn_id TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('replied','failed','cancelled')),
+    result TEXT NOT NULL,
+    meta_json TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    UNIQUE (task_id, thread_id, turn_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_task_late_replies_task_time
+    ON task_late_replies(task_id, created_at);
+  CREATE INDEX IF NOT EXISTS idx_task_late_replies_network
+    ON task_late_replies(network_id, created_at);
+`);
+
 // #1181 durable outbound terminal cursor.  A task's created_at cannot be used
 // as a recovery watermark because an old task may become terminal after newer
 // tasks.  Record terminal transitions in their own monotonically increasing
@@ -1599,6 +1638,10 @@ try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN misfire_policy TEXT NOT NU
 // whether the node had ever picked it up: not_received | in_progress.
 try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN blocked_by_task_id TEXT"); } catch {}
 try { db.exec("ALTER TABLE scheduled_task_runs ADD COLUMN blocked_by_state TEXT"); } catch {}
+// Board #733 — schedules an Agent created over MCP name the creating node. NULL = created by a person
+// (REST / Dashboard) or a row from before this column; old rows keep NULL and old code never reads it.
+try { db.exec("ALTER TABLE scheduled_tasks ADD COLUMN created_by_node_id TEXT"); } catch {}
+try { db.exec("CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_creator_node ON scheduled_tasks(network_id, created_by_node_id)"); } catch {}
 // #523 — consecutive-failure alert bookkeeping (scheduled-failures.ts). Additive and nullable:
 // an older Hub never reads them, so rolling back is safe. failure_alert_at = ISO time of the last
 // alert; failure_alert_key = the last successful run_id at that moment ('' = none yet), so a

package/src/node-permissions.ts

@@ -244,7 +244,7 @@ export function streamVerdict(id: NodeIdentity, target: AgentRef | "network"): V
 }
 
 // ── MCP:每个工具归一类(test 钉住「每个注册的工具都归了类」,新工具忘了归类会红) ──
-export type ToolClass = "always" | "read" | "dispatch" | "broadcast" | "requirements" | "node_write" | "human_only";
+export type ToolClass = "always" | "read" | "dispatch" | "broadcast" | "requirements" | "schedule" | "node_write" | "human_only";
 export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   // 回复 / 上报 / 自己的收件箱 / 生命周期协议(节点自己的请求)—— 任何模式都能做
   report_status: "always", report_completion: "always", get_inbox: "always", ack_inbox: "always",
@@ -268,6 +268,9 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   requirements_list: "requirements", requirements_people: "requirements", requirements_get: "requirements", requirements_create: "requirements",
   requirements_update: "requirements", requirements_checklist_toggle: "requirements", requirements_upsert_by_external_ref: "requirements",
   requirements_events: "requirements", requirements_comment: "requirements", projects_list: "requirements",
+  // 定时任务(#733):在 schedule-agent.ts 里按排程判(范围 / 目标 = send_task 的 dispatchVerdict / 配额)
+  schedule_list: "read", schedule_get: "read", schedule_runs: "read",
+  schedule_create: "schedule", schedule_update: "schedule", schedule_cancel: "schedule", schedule_run_now: "schedule",
   // 写节点 / 技能 / 探测:只读、受限不行;正常由 RFC-036 等既有规则管
   update_node_config: "node_write", write_node_rules_file: "node_write", restart_node: "node_write", create_node: "node_write",
   stop_node: "node_write", delete_node: "node_write", start_node: "node_write", submit_skill: "node_write", probe_provider_model: "node_write",

package/src/requirement-due-reminders.ts

@@ -227,7 +227,7 @@ export function dueReminderFor(due: string, nowMs: number, tz: string, maxOverdu
 export function overdueSql(params: unknown[], nowMs: number, tz: string): string {
   const today = localDate(nowMs, tz);
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on < ?${params.push(today)}) OR (length(due_on) > 10 AND due_on <= ?${params.push(nowIso)})))`;
 }
 /** 没逾期、且在 tz 的「今天 + days」那天结束之前到期(0 = 今天内)。 */
 export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz: string): string {
@@ -235,7 +235,7 @@ export function dueWithinSql(params: unknown[], days: number, nowMs: number, tz:
   const lastDay = addDays(today, days);
   const endIso = new Date(localMidnightMs(addDays(lastDay, 1), tz)).toISOString().replace(/\.\d{3}Z$/, "Z");
   const nowIso = new Date(nowMs).toISOString().replace(/\.\d{3}Z$/, "Z");
-  return `(due_on IS NOT NULL AND column_name <> 'done' AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
+  return `(due_on IS NOT NULL AND column_name NOT IN ('done', 'abandoned') AND ((length(due_on) = 10 AND due_on >= ?${params.push(today)} AND due_on <= ?${params.push(lastDay)}) OR (length(due_on) > 10 AND due_on > ?${params.push(nowIso)} AND due_on < ?${params.push(endIso)})))`;
 }
 
 // ── 扫描 ───────────────────────────────────────────────────
@@ -332,7 +332,7 @@ export function runDueReminders(opts: { now?: number } = {}): DueReminderSent[]
   const rows = db.all<DueRow>(
     `SELECT requirement_id, network_id, seq, title, due_on, owner_json, participants_json, agent_owner_json
        FROM requirements
-      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name <> 'done' AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
+      WHERE due_on IS NOT NULL AND due_on >= ?1 AND due_on < ?2 AND column_name NOT IN ('done', 'abandoned') AND COALESCE(archived, 0) = 0${netFilter}${ownerFilter}`,
     ...params,
   );
   const out: DueReminderSent[] = [];

package/src/requirement-notify.ts

@@ -12,7 +12,7 @@ import { isParticipant } from "./task-access.js";
 import { rewriteUnreadNoticeDm, sendNoticeDm } from "./human-dm.js";
 
 export const COALESCE_WINDOW_MS = 60_000;
-const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成" };
+const COLUMN_LABEL: Record<string, string> = { pool: "需求池", doing: "进行中", done: "完成", abandoned: "废弃" };
 const MAX_LINES = 20;
 const MAX_ITEM_CHARS = 40;