@sleep2agi/commhub-server 0.9.0-preview.114 → 0.9.0-preview.115

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.114",
+  "version": "0.9.0-preview.115",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/create-node-unicode-name.test.ts

@@ -96,6 +96,8 @@ describe("#652 create_node via /mcp — Unicode names", () => {
   test("illegal characters are refused with reason + char + message, and no row is written", async () => {
     for (const [name, reason] of [["a/b", "forbidden_char"], ["a\\b", "forbidden_char"], ["a:b", "forbidden_char"],
       [".hidden", "forbidden_char"], ["..", "forbidden_char"], ["a b", "forbidden_char"], ["a\u0007b", "forbidden_char"],
+      ["a\nb", "forbidden_char"], ["a\tb", "forbidden_char"], ["a\u001fb", "forbidden_char"], ["a\u007fb", "forbidden_char"],
+      ["a\u2028b", "forbidden_char"], ["a\u2029b", "forbidden_char"],
       ["-x", "leading_dash"], ["测".repeat(65), "too_long"]] as const) {
       const r = await create(name);
       expect({ name, error: r.error, reason: r.reason }).toEqual({ name, error: "node_name_invalid", reason });

package/src/node-alias-control.ts

@@ -0,0 +1,12 @@
+// C0/C1 controls plus Unicode's two dedicated line separators. The latter are
+// not General_Category=Cc, but they still split log/source-prefix lines.
+const CONTROL_CHARACTER = /[\p{Cc}\u2028\u2029]/u;
+
+export function aliasControlCharacter(alias: string): string | null {
+  return [...alias].find((char) => CONTROL_CHARACTER.test(char)) ?? null;
+}
+
+export function describeAliasControlCharacter(char: string): string {
+  const codePoint = char.codePointAt(0) ?? 0;
+  return `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
+}

package/src/node-token-privilege-http.test.ts

@@ -129,6 +129,15 @@ describe("account and network management need a user token", () => {
     expect(mine.body.ok).toBe(true);
     expect((await call(ntok, "POST", "/api/node-rename/abort", { txn_id: mine.body.txn_id })).body.ok).toBe(true);
   });
+  test("rename rejects line breaks, tabs and other control characters before reserving an alias", async () => {
+    for (const newAlias of ["hidden\nnode", "hidden\tnode", "hidden\u001fnode", "hidden\u007fnode", "hidden\u2028node", "hidden\u2029node"]) {
+      const r = await call(ntok, "POST", "/api/node-rename/prepare", { network_id: NET, old_alias: "ntok-node", new_alias: newAlias });
+      expect(r.status).toBe(400);
+      expect(r.body).toMatchObject({ ok: false, error: "node_alias_invalid", code: "node_alias_invalid", reason: "control_character" });
+      expect(r.body.message).toContain("control character U+");
+    }
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM rename_txn WHERE network_id = ?1 AND status = 'prepared'", NET)?.n).toBe(0);
+  });
 });
 
 describe("/api/auth/me says what the credential is", () => {

package/src/rename.ts

@@ -18,6 +18,7 @@ import { getUserNetworkRole, getNetworkMembers } from "./auth";
 import { canSeeAgent, isAgentRestricted } from "./agent-access";
 import { pushEvent } from "./push";
 import { eventBus } from "./event_bus";
+import { aliasControlCharacter, describeAliasControlCharacter } from "./node-alias-control";
 
 export interface RenameResult {
   ok: boolean;
@@ -25,6 +26,9 @@ export interface RenameResult {
   error?: string;
   code?: string;
   suggested?: string;
+  reason?: string;
+  char?: string;
+  message?: string;
 }
 
 export interface CanonicalAlias {
@@ -111,6 +115,17 @@ export function prepareRename(
 ): RenameResult {
   if (!hasWriteAccess(userId, networkId)) return { ok: false, error: "no write access to this network" };
   if (!oldAlias || !newAlias) return { ok: false, error: "old and new alias required" };
+  const control = aliasControlCharacter(newAlias);
+  if (control !== null) {
+    return {
+      ok: false,
+      code: "node_alias_invalid",
+      error: "node_alias_invalid",
+      reason: "control_character",
+      char: control,
+      message: `alias cannot contain control character ${describeAliasControlCharacter(control)}`,
+    };
+  }
   if (oldAlias === newAlias) return { ok: false, error: "old and new alias are identical" };
 
   // old-alias must exist as a session in this network

package/src/schedule-agent-mcp-http.test.ts

@@ -108,6 +108,24 @@ describe("happy path from a node", () => {
     expect((await mcp(node.a.token, "schedule_run_now", { schedule_id: s.schedule_id })).error).toBe("schedule_cancelled");
   });
 
+  test("base_revision prevents a stale Agent update; omitting it keeps legacy last-write behavior", async () => {
+    const made = (await create("a")).schedule;
+    const baseRevision = made.revision;
+    const first = await mcp(node.a.token, "schedule_update", {
+      schedule_id: made.schedule_id, base_revision: baseRevision, name: "first writer",
+    });
+    expect(first).toMatchObject({ ok: true, schedule: { name: "first writer", revision: baseRevision + 1 } });
+
+    const stale = await mcp(node.a.token, "schedule_update", {
+      schedule_id: made.schedule_id, base_revision: baseRevision, name: "stale writer",
+    });
+    expect(stale).toEqual({ ok: false, error: "revision_conflict", current_revision: baseRevision + 1 });
+    expect((await mcp(node.a.token, "schedule_get", { schedule_id: made.schedule_id })).schedule.name).toBe("first writer");
+
+    const legacy = await mcp(node.a.token, "schedule_update", { schedule_id: made.schedule_id, name: "legacy writer" });
+    expect(legacy).toMatchObject({ ok: true, schedule: { name: "legacy writer", revision: baseRevision + 2 } });
+  });
+
   test("a schedule for another node the caller can send_task to; the target can read it but not change it", async () => {
     const c = await create("a", { target_node_id: node.b.id });
     expect(c.ok).toBe(true);

package/src/schedule-agent.ts

@@ -126,6 +126,9 @@ export function agentUpdateSchedule(id: NodeIdentity, canWrite: boolean, schedul
   if (gate) return gate;
   const row = ownRow(id, scheduleId);
   if (!isRow(row)) return row;
+  if (body.base_revision !== undefined && Number(body.base_revision) !== row.revision) {
+    return fail("revision_conflict", { current_revision: row.revision });
+  }
   const retarget = body.target_node_id !== undefined && body.target_node_id !== row.target_node_id;
   let target = { node_id: row.target_node_id, alias: row.target_alias };
   if (retarget) {

package/src/tools.ts

@@ -6392,7 +6392,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   server.tool("schedule_create", "Schedule a task to target_node_id (default you).", schedFields,
     async (args) => scheduleCall((id, w) => agentCreateSchedule(id, w, args as Record<string, unknown>)));
   server.tool("schedule_update", "Edit your schedule; status=paused|active.",
-    { ...schedFields, schedule_id: schedId, name: z.string().optional(), task: z.string().optional(), schedule: z.any().optional(), status: z.string().optional() },
+    { ...schedFields, schedule_id: schedId, base_revision: z.number().int().min(0).optional().describe("Reject if current revision differs."), name: z.string().optional(), task: z.string().optional(), schedule: z.any().optional(), status: z.string().optional() },
     async ({ schedule_id, ...rest }) => scheduleCall((id, w) => agentUpdateSchedule(id, w, schedule_id, rest as Record<string, unknown>)));
   server.tool("schedule_cancel", "Cancel your schedule.", { schedule_id: schedId },
     async ({ schedule_id }) => scheduleCall((id, w) => agentCancelSchedule(id, w, schedule_id)));