@sleep2agi/commhub-server 0.9.0-preview.115 → 0.9.0-preview.117

package/src/scheduled-tasks.ts

@@ -11,6 +11,7 @@ import { SCHEDULED_TASK_STORAGE_SELECT } from "./rest-projections.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { blockerTimedOut, expireStuckBlocker, sendStuckNotice, skipsBlockedBy, stuckNoticeSkips, stuckTimeoutMs, type StuckNotice } from "./scheduled-stuck.js";
 import { evaluateScheduleFailures, failureSummary } from "./scheduled-failures.js";
+import { scheduledTargetOffline, sendOfflineNotice, type OfflineNotice } from "./scheduled-offline.js";
 
 export type ScheduleSpec =
   | { type: "once"; run_at: string }
@@ -366,6 +367,7 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
   let finalStatus = "failed";
   let createdTaskId: string | undefined;
   const notices: StuckNotice[] = [];
+  let offlineNotice: OfflineNotice | null = null;
   const timedOut: Array<{ taskId: string; fromStatus: string }> = [];
 
   db.transaction(() => {
@@ -377,6 +379,35 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
       [runId, row.schedule_id, row.network_id, scheduledFor],
     );
 
+    // Board #757 — do not create a task that will merely expire while its
+    // exact target session is offline. This branch deliberately precedes the
+    // overlap check: target_offline is the actionable reason for this round.
+    const targetNode = db.get<{ node_id: string; alias: string | null }>(
+      "SELECT node_id, alias FROM nodes WHERE node_id = ?1 AND network_id = ?2",
+      row.target_node_id, row.network_id,
+    );
+    if (targetNode?.alias && scheduledTargetOffline(targetNode.node_id, targetNode.alias, row.network_id, advanceAfter.getTime())) {
+      finalStatus = "skipped";
+      db.run(
+        `UPDATE scheduled_task_runs SET status = 'skipped', error_code = 'target_offline',
+           error_message = 'The target node is offline; no task was created', completed_at = datetime('now') WHERE run_id = ?1`,
+        [runId],
+      );
+      const claimed = db.run(
+        "UPDATE scheduled_tasks SET offline_alert_at = ?1 WHERE schedule_id = ?2 AND offline_alert_at IS NULL",
+        [advanceAfter.toISOString(), row.schedule_id],
+      ).changes === 1;
+      if (claimed) offlineNotice = {
+        scheduleId: row.schedule_id, scheduleName: row.name, networkId: row.network_id,
+        createdBy: row.created_by, createdByNodeId: row.created_by_node_id,
+        targetAlias: targetNode.alias,
+      };
+      if (advanceSchedule) advance({ ...row, target_alias: targetNode.alias }, scheduledFor, advanceAfter);
+      return;
+    }
+    // Seeing the target online rearms exactly one warning for a future offline episode.
+    if (targetNode?.alias) db.run("UPDATE scheduled_tasks SET offline_alert_at = NULL WHERE schedule_id = ?1 AND offline_alert_at IS NOT NULL", [row.schedule_id]);
+
     if (row.overlap_policy === "skip") {
       const placeholders = OPEN_TASK_STATUSES.map((_, i) => `?${i + 2}`).join(", ");
       // received:节点那边有没有把这条任务取走过(inbox 行被 ack,或任务已进 acked/running)。
@@ -430,10 +461,7 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
       }
     }
 
-    const node = db.get<{ node_id: string; alias: string | null }>(
-      "SELECT node_id, alias FROM nodes WHERE node_id = ?1 AND network_id = ?2",
-      row.target_node_id, row.network_id,
-    );
+    const node = targetNode;
     if (!node?.alias) {
       finalStatus = "failed";
       db.run(
@@ -541,6 +569,7 @@ export function dispatchScheduledOccurrence(row: ScheduledRow, scheduledFor: str
   try {
     for (const t of timedOut) logTaskEvent(t.taskId, t.fromStatus, "expired", "hub-scheduler", `stuck timeout; schedule=${row.schedule_id} run=${runId}`);
     for (const n of notices) sendStuckNotice(n);
+    if (offlineNotice) sendOfflineNotice(offlineNotice);
     // #523 — a run that failed at dispatch counts toward the consecutive-failure alert (task failures arrive via db.ts).
     if (finalStatus === "failed") evaluateScheduleFailures(row.schedule_id, advanceAfter);
     if (createdTaskId) logTaskEvent(createdTaskId, null, "delivered", "hub-scheduler", `schedule=${row.schedule_id} run=${runId}`);

package/src/server.ts

@@ -4,6 +4,7 @@ import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip"
 import { ifNoneMatchHits, memoStatusBody } from "./status-read-cache";
 import { dispatchQueueInfo, queueDepthByNode, queueDepthKey } from "./task-queue-ahead.js";
 import { sessionTaskOnDispatch } from "./session-task-on-dispatch.js";
+import { AGENT_TEAM_SCOPE_DENIED, clearNodeFromAgentTeams, createAgentTeam, deleteAgentTeam, listAgentTeams, ownedScope, setNodeAgentTeam, updateAgentTeam } from "./agent-teams.js";
 import { TASK_CONTENT_MAX, sessionTaskPreview } from "./shared/task-content-limit.js";
 import { statusAliasResolverRead } from "./status-alias-resolver.js";
 import { readNodeHealth } from "./node-health-store.js";
@@ -28,12 +29,13 @@ import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { notifyExpiredTasks, type ExpiredTaskRow } from "./task-expiry-notice.js";
 import { expireStaleOpenTasks } from "./task-stale-open.js";
+import { flagOrphanTasks } from "./task-orphan.js";
 import { addAgentNetworkScope, addHumanNetworkScope, addNetworkScope, addOwnTrafficScope, addAgentTimelineScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, resolveRestWriteNetworkId, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { lifecycleProjections, lifecycleRequestResponse } from "./node-lifecycle-read.js";
 import { restrictedMemberSeesFile, restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { dmParticipantSeesFile, listDmThread, listDmThreads, sendHumanDm } from "./human-dm.js";
 import { groupMemberSeesFile, groupUnreadFor, listGroupMessages, listGroupThreads, markGroupRead, memberGroup, sendGroupMessage } from "./group-messages.js";
-import { getTaskAccessMode, isTaskScoped, listProjectGrants, replaceTaskGrants, NEW_MEMBER_TASK_ACCESS } from "./task-access.js";
+import { getTaskAccessMode, isTaskScoped, listProjectGrants, replaceTaskGrants, newMemberTaskAccess } from "./task-access.js";
 import { canMessageAgent, isAgentRestricted, visibleAgents, listAgentGrants, listGroupGrants, getAgentAccessMode, replaceAgentGrants, restrictedNetworkIds, usernameIsAgentAlias, listAgentGroups, createAgentGroup, updateAgentGroup, replaceAgentGroupMembers, deleteAgentGroup, usersGrantedGroup } from "./agent-access.js";
 import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_PERMISSION_MODES, nodeDecide, nodeIdentity, nodePermissionDeniedBody, nodePermissionsFlag, streamVerdict, writeVerdict, type NodeIdentity, type NodePermissionMode, type Verdict } from "./node-permissions.js";
 import { validateAvatarUrl } from "./avatar-validate.js";
@@ -976,6 +978,18 @@ export function patrolExpiredTasks(): void {
   }
 }
 
+// #758 — acked/running tasks whose node went idle/offline after starting them
+// and never replied: one task.orphan_suspected event + one sender notice per
+// task (task-orphan.ts). Status untouched. Same 5-minute timer as the TTL patrol.
+export function patrolOrphanTasks(): void {
+  try {
+    const flagged = flagOrphanTasks();
+    if (flagged.length > 0) console.warn(`[patrol] flagged ${flagged.length} orphan-suspected task(s), notified ${flagged.filter((f) => f.notified).length}`);
+  } catch (e: any) {
+    console.error(`[patrol] orphan phase failed: ${e?.message || e}`);
+  }
+}
+
 function patrolDeliveredStaleTasks(): void {
   try {
     const result = recordDeliveredStaleEvents();
@@ -1860,6 +1874,48 @@ return Bun.serve({
       return withCors(req, Response.json({ ok: true, network_id: netId, user_id: targetUid, agent_access: result.agent_access, restricted: isAgentRestricted(targetUid, netId), grants: result.grants, group_grants: result.group_grants }));
     }
 
+    // ── Agent 团队(#764):Agent 自己的组织树,和人的部门树无关。读:网络任何成员 / 本网络的节点令牌 / Hub 管理员;
+    // 写:owner / admin / Hub 管理员全管;团队 owner_user_id 管自己的子树(规则在 agent-teams.ts);节点令牌只读。 ──
+    const teamMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/agent-teams(?:\/([^/]+))?$/);
+    const nodeTeamMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/nodes\/([^/]+)\/agent-team$/);
+    if (teamMatch || nodeTeamMatch) {
+      const token = requestToken(req, { allowQueryToken: false });
+      const resolved = token ? resolveToken(token) : null;
+      if (!resolved) return withCors(req, Response.json({ ok: false, error: "auth required" }, { status: 401 }));
+      const netId = decodeURIComponent((teamMatch ?? nodeTeamMatch)![1]);
+      const notMember = () => withCors(req, Response.json({ ok: false, error: "not a member of this network" }, { status: 403 }));
+      if (resolved.networkId && resolved.networkId !== netId) return notMember();
+      const hubAdmin = isHubAdminCredential(resolved);
+      const role = resolved.networkId ? null : getUserNetworkRole(resolved.user.user_id, netId);
+      if (!hubAdmin && !role && !resolved.networkId) return notMember();
+      if (!db.get("SELECT 1 AS x FROM networks WHERE network_id = ?1", netId)) return withCors(req, Response.json({ ok: false, error: "network_not_found" }, { status: 404 }));
+      const canManage = hubAdmin || (!resolved.networkId && (role === "owner" || role === "admin"));
+      // 只看授权 Agent 的成员:看不见的节点不出现在 members / lead 里(和 Agent 列表同一判据);写路径用同一个判据,看不见 = 404。
+      const seen = !hubAdmin && !resolved.networkId && isAgentRestricted(resolved.user.user_id, netId) ? visibleAgents(resolved.user.user_id, netId) : null;
+      const hidden = (n: { node_id: string; alias: string | null }) => !!seen && !seen.nodeIds.includes(n.node_id) && !(n.alias && seen.aliases.includes(n.alias));
+      if (teamMatch && !teamMatch[2] && req.method === "GET") {
+        return withCors(req, Response.json({ ok: true, network_id: netId, teams: listAgentTeams(netId, hidden) }));
+      }
+      const write = teamMatch ? (teamMatch[2] ? ["PATCH", "DELETE"] : ["POST"]) : ["PUT"];
+      if (!write.includes(req.method)) return withCors(req, Response.json({ ok: false, error: "method_not_allowed" }, { status: 405 }));
+      // null = 全管;节点令牌 / 普通成员 → 空集(任何写都 403);团队 owner → 自己的子树。
+      const scope = canManage ? null : resolved.networkId ? new Set<string>() : ownedScope(netId, resolved.user.user_id);
+      if (scope && scope.size === 0) return withCors(req, Response.json({ ok: false, error: AGENT_TEAM_SCOPE_DENIED }, { status: 403 }));
+      let body: Record<string, unknown> = {};
+      if (req.method !== "DELETE") {
+        try { const b = await req.json(); body = b && typeof b === "object" && !Array.isArray(b) ? b as Record<string, unknown> : {}; } catch { return withCors(req, Response.json({ ok: false, error: "invalid JSON" }, { status: 400 })); }
+      }
+      const teamId = teamMatch?.[2] ? decodeURIComponent(teamMatch[2]) : "";
+      const nodeId = nodeTeamMatch ? decodeURIComponent(nodeTeamMatch[2]) : undefined;
+      const r = nodeId !== undefined ? setNodeAgentTeam(netId, nodeId, scope, hidden, body.team_id)
+        : req.method === "POST" ? createAgentTeam(netId, resolved.user.user_id, scope, hidden, body)
+        : req.method === "PATCH" ? updateAgentTeam(netId, teamId, scope, hidden, body)
+        : deleteAgentTeam(netId, teamId, scope);
+      if (!r.ok) { const { ok: _ok, status, ...rest } = r; return withCors(req, Response.json({ ok: false, ...rest }, { status })); }
+      logAudit(resolved.user.user_id, resolved.user.username, `agent_team_${req.method.toLowerCase()}`, "network", netId, JSON.stringify({ team_id: teamId || undefined, node_id: nodeId, ...body }).slice(0, 2000), undefined, netId);
+      return withCors(req, Response.json(r, { status: req.method === "POST" ? 201 : 200 }));
+    }
+
     // ── 多用户:网络里的人类成员通讯录 —— 任何成员(含受限成员)都能看,只有身份字段 ──
     const humansMatch = url.pathname.match(/^\/api\/networks\/([^/]+)\/humans$/);
     if (humansMatch && req.method === "GET") {
@@ -2178,12 +2234,12 @@ return Bun.serve({
         if (body.agent_access !== undefined && body.agent_access !== "all" && body.agent_access !== "granted") {
           return withCors(req, Response.json({ ok: false, error: "invalid_agent_access" }, { status: 400 }));
         }
-        // task_access 缺省 NEW_MEMBER_TASK_ACCESS(RFC-038 §9.4);显式传 'all' / 'scoped' 覆盖。
+        // task_access 缺省 newMemberTaskAccess(role)(RFC-038 §9.4,#746 起 member/viewer 为 'scoped');显式传 'all' / 'scoped' 覆盖。
         if (body.task_access !== undefined && body.task_access !== "all" && body.task_access !== "scoped") {
           return withCors(req, Response.json({ ok: false, error: "invalid_task_access" }, { status: 400 }));
         }
         const result = addNetworkMember(netId, body.user_id, body.role || "member", resolved.user.user_id, { agentAccess: body.agent_access, taskAccess: body.task_access });
-        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"} task_access=${body.task_access ?? NEW_MEMBER_TASK_ACCESS}`, undefined, netId);
+        if (result.ok) logAudit(resolved.user.user_id, resolved.user.username, "member_added", "network", netId, `${body.user_id} as ${body.role || "member"} agent_access=${body.agent_access === "all" ? "all" : "granted"} task_access=${body.task_access ?? newMemberTaskAccess(body.role || "member")}`, undefined, netId);
         return withCors(req, Response.json(result, { status: result.ok ? 200 : 400 }));
       }
       if (req.method === "PUT" && targetUid) {
@@ -4183,6 +4239,7 @@ return Bun.serve({
 
       db.transaction(() => {
         db.run("DELETE FROM nodes WHERE node_id = ?1", [node.node_id]);
+        clearNodeFromAgentTeams(node.node_id); // #764
         if (node.alias) {
           db.run(
             "DELETE FROM sessions WHERE alias = ?1 AND (network_id = ?2 OR (CAST(?2 AS TEXT) IS NULL AND network_id IS NULL))",
@@ -5086,7 +5143,7 @@ export function startHub(opts?: { port?: number; hostname?: string }): ReturnTyp
   const deliveredStalePatrolMs = Number(process.env.COMMHUB_DELIVERED_STALE_PATROL_MS) > 0
     ? Number(process.env.COMMHUB_DELIVERED_STALE_PATROL_MS) : 5 * 1000;
   const rateLimitSweepTimer = setInterval(sweepStaleRateLimits, rateLimitSweepMs);
-  const taskPatrolTimer = setInterval(patrolExpiredTasks, taskPatrolMs);
+  const taskPatrolTimer = setInterval(() => { patrolExpiredTasks(); patrolOrphanTasks(); }, taskPatrolMs);
   patrolDeliveredStaleTasks();
   const deliveredStalePatrolTimer = setInterval(patrolDeliveredStaleTasks, deliveredStalePatrolMs);
   const scheduledTaskTimer = startScheduledTaskScheduler();

package/src/task-access-http.test.ts

@@ -2,7 +2,7 @@
 //
 // 场景:Hub 管理员 admin 的网络 NET。成员:
 //   alice —— 新建成员,经授权接口显式设成 scoped,授权 P1(只看)、P2(可改);
-//            (新成员默认值 NEW_MEMBER_TASK_ACCESS 暂时是 'all',见「默认值与授权接口」)
+//            (#746 起新成员默认值 NEW_MEMBER_TASK_ACCESS 就是 'scoped',见「默认值与授权接口」)
 //   carol —— 升级前的老成员(task_access='all'):行为必须与今天逐字相同;
 //   vic   —— 经授权接口显式设成 scoped 的 viewer,授权 P3(只看)。
 // admin 建的卡:c_own(负责人 alice)、c_part(参与人 alice)、c_p1 / c_p2 / c_p3(在项目里)、c_other(与 alice 无关)。
@@ -117,10 +117,14 @@ afterAll(() => {
 });
 
 describe("默认值与授权接口", () => {
-  test("新成员默认 all:常量是 'all';管理员建号 / POST members / 邀请码加入都落在 all 且看得见全部卡", async () => {
-    expect(NEW_MEMBER_TASK_ACCESS).toBe("all");
-    const all = ["ta-other", "ta-own", "ta-p1", "ta-p2", "ta-p3", "ta-part"];
+  test("#746 新成员默认 scoped:管理员建号 / POST members / 邀请码加入都落在 scoped —— 只看自己的卡与授权项目;admin 角色照旧 all", async () => {
+    expect(NEW_MEMBER_TASK_ACCESS).toBe("scoped");
     const stamp = Date.now();
+    const names = async (t: string) => {
+      const r = await get(t, `/api/requirements?network_id=${NET}`);
+      expect(r.status).toBe(200);
+      return (r.body.requirements as any[]).map(x => x.name).filter((n: string) => n.startsWith("ta-") || n.startsWith("dm-")).sort();
+    };
     // 管理员建号
     const u1 = { username: `ta_new1_${stamp}`, password: PW, network_id: NET, role: "member" };
     expect((await send(admin.token, "POST", "/api/admin/users", u1)).status).toBe(200);
@@ -128,24 +132,43 @@ describe("默认值与授权接口", () => {
     // POST /members 不带 task_access
     const u2 = register(`ta_new2_${stamp}`, PW);
     expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: u2.user!.user_id, role: "member" })).status).toBe(200);
-    // 邀请码加入
+    // 邀请码加入(member 与 viewer 两种邀请)
     const inv = await send(admin.token, "POST", `/api/networks/${NET}/invite`, { role: "member" });
     const u3 = register(`ta_new3_${stamp}`, PW);
     expect((await send(u3.token!, "POST", "/api/networks/join", { invite_code: inv.body.invite_code })).status).toBe(200);
-    for (const [id, token] of [[l1.body.user.user_id, l1.body.token], [u2.user!.user_id, u2.token!], [u3.user!.user_id, u3.token!]] as [string, string][]) {
+    const paths: Array<[string, string, string]> = [["admin-users", l1.body.user.user_id, l1.body.token], ["post-members", u2.user!.user_id, u2.token!], ["invite", u3.user!.user_id, u3.token!]];
+    for (const [path, id, token] of paths) {
       const g = await get(admin.token, `/api/networks/${NET}/members/${id}/task-grants`);
-      expect(g.body.task_access).toBe("all");
-      expect(g.body.restricted).toBe(false);
-      expect(await listIds(token)).toEqual(all);
+      expect([path, g.body.task_access, g.body.restricted]).toEqual([path, "scoped", true]);
       const me = await get(token, "/api/auth/me");
-      expect(me.body.networks.find((n: any) => n.network_id === NET).task_access).toBe("all");
+      expect(me.body.networks.find((n: any) => n.network_id === NET).task_access).toBe("scoped");
+      // 自己负责的卡 + 授权项目 P1 看得见;别人的无关卡(ta-other)列表里没有、直取也是 404
+      expect((await send(admin.token, "POST", "/api/requirements", { network_id: NET, name: `dm-own-${path}`, owner: userRef(id) })).status).toBe(201);
+      expect((await send(admin.token, "PUT", `/api/networks/${NET}/members/${id}/task-grants`, { project_grants: [P["ta-P1"]] })).status).toBe(200);
+      expect([path, await names(token)]).toEqual([path, [`dm-own-${path}`, "ta-p1"]]);
+      expect((await get(token, `/api/requirements/${C["ta-other"].id}?network_id=${NET}`)).status).toBe(404);
+    }
+    // 管理员仍能经现有接口把成员放宽到 all,之后看见全部卡
+    expect((await send(admin.token, "PUT", `/api/networks/${NET}/members/${u2.user!.user_id}/task-grants`, { task_access: "all" })).status).toBe(200);
+    expect((await names(u2.token!))).toContain("ta-other");
+    // admin 角色(POST members / 邀请码)照旧存 'all';不受这一列约束
+    const a1 = register(`ta_new5_${stamp}`, PW);
+    expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: a1.user!.user_id, role: "admin" })).status).toBe(200);
+    const invA = await send(admin.token, "POST", `/api/networks/${NET}/invite`, { role: "admin" });
+    const a2 = register(`ta_new6_${stamp}`, PW);
+    expect((await send(a2.token!, "POST", "/api/networks/join", { invite_code: invA.body.invite_code })).status).toBe(200);
+    for (const a of [a1, a2]) {
+      const g = await get(admin.token, `/api/networks/${NET}/members/${a.user!.user_id}/task-grants`);
+      expect([g.body.task_access, g.body.restricted]).toEqual(["all", false]);
+      expect(await names(a.token!)).toContain("ta-other");
     }
-    // POST /members 显式传 scoped 仍然生效
+    // 升级前的老成员(carol,直接写 'all' 的行)照旧全看见
+    expect(await names(carol.token)).toContain("ta-other");
+    // POST /members 显式传 all 仍然生效
     const u4 = register(`ta_new4_${stamp}`, PW);
-    expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: u4.user!.user_id, role: "member", task_access: "scoped" })).status).toBe(200);
-    expect((await get(admin.token, `/api/networks/${NET}/members/${u4.user!.user_id}/task-grants`)).body.task_access).toBe("scoped");
-    expect(await listIds(u4.token!)).toEqual([]);
-    for (const id of [l1.body.user.user_id, u2.user!.user_id, u3.user!.user_id, u4.user!.user_id]) {
+    expect((await send(admin.token, "POST", `/api/networks/${NET}/members`, { user_id: u4.user!.user_id, role: "member", task_access: "all" })).status).toBe(200);
+    expect((await get(admin.token, `/api/networks/${NET}/members/${u4.user!.user_id}/task-grants`)).body.task_access).toBe("all");
+    for (const id of [l1.body.user.user_id, u2.user!.user_id, u3.user!.user_id, u4.user!.user_id, a1.user!.user_id, a2.user!.user_id]) {
       expect((await send(admin.token, "DELETE", `/api/networks/${NET}/members/${id}`)).status).toBe(200);
     }
   });

package/src/task-access.ts

@@ -17,7 +17,7 @@ import { deleteDepartmentGrantsForProject, departmentGrantsForMember, headCardsF
 
 // ── 表结构(放在这里而不是 db.ts:db.ts 每多一行,文档里钉着的行号就漂一次) ──
 // ALTER 的 DEFAULT 'all' 让**升级前已有的**成员行全部落在旧语义 —— 升级不收窄任何人;新成员按下面的
-// NEW_MEMBER_TASK_ACCESS 入库。项目授权:行存在 = 可看,can_edit=1 = 可改。
+// newMemberTaskAccess() 入库(#746:默认 'scoped')。项目授权:行存在 = 可看,can_edit=1 = 可改。
 try { db.exec("ALTER TABLE network_members ADD COLUMN task_access TEXT NOT NULL DEFAULT 'all'"); } catch {}
 db.exec(`
   CREATE TABLE IF NOT EXISTS network_member_project_grants (
@@ -33,12 +33,19 @@ db.exec(`
 `);
 
 /**
- * 新成员(管理员建号 / POST members / 邀请码)默认的任务范围。
- * 暂时是 'all':app ≤0.2.163 没有任务权限界面,从那些 app 加的成员若默认 scoped 会一张卡都看不到,
- * 管理员也没法在那些 app 里放宽。等 owner 的设备都 ≥0.2.164 且他确认后,改回 'scoped'(只改这一行)。
- * 显式 task_access='scoped'(POST members / PUT task-grants)不受这个默认值影响。
+ * 新成员默认的任务范围(#746,owner 选方案 2):只看相关任务。入库路径全部显式写这一列,不靠列 DEFAULT:
+ *   ① addNetworkMember —— POST /api/networks/:id/members、POST /api/admin/users(带 network_id)
+ *   ② joinByInvite     —— POST /api/networks/join(邀请码)
+ * owner 行(register 自动建网、createNetwork、db.ts 的 V3.13 迁移)不经过这里,照旧落列默认 'all'。
+ * 列 DEFAULT 仍是 'all'、不迁移老行 —— 升级前的成员一个都不收窄。显式 task_access 覆盖默认;
+ * 管理员随时可 PUT /api/networks/:id/members/:uid/task-grants {task_access:'all'} 放宽。
  */
-export const NEW_MEMBER_TASK_ACCESS: TaskAccessMode = "all";
+export const NEW_MEMBER_TASK_ACCESS: TaskAccessMode = "scoped";
+
+/** 新成员行要写入的 task_access。admin 角色本来就不受这一列约束,照旧存 'all'(降级成 member 时与今天行为一致)。 */
+export function newMemberTaskAccess(role: string): TaskAccessMode {
+  return UNRESTRICTED_ROLES.has(role) ? "all" : NEW_MEMBER_TASK_ACCESS;
+}
 
 export type TaskAccessMode = "all" | "scoped";
 export type ProjectGrant = { project_id: string; can_edit: boolean };

package/src/task-expiry-notice.ts

@@ -201,31 +201,33 @@ function noteEvent(taskId: string, status: string, detail: string): void {
   } catch {}
 }
 
-function deliverToAgent(alias: string, networkId: string | null, inReplyTo: string, text: string, meta: Record<string, unknown>): string {
-  const id = `exp_${uuidv4().replace(/-/g, "").slice(0, 20)}`;
+function deliverToAgent(alias: string, networkId: string | null, inReplyTo: string, text: string, meta: Record<string, unknown>, status = "expired", prefix = "exp_"): string {
+  const id = `${prefix}${uuidv4().replace(/-/g, "").slice(0, 20)}`;
   const nodeId = agentSession(alias, networkId)?.node_id ?? null;
   db.run(
     `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id, meta_json)
      VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, 'hub', ?5, 'none', ?6, ?7)`,
     [id, alias, nodeId, text, inReplyTo, networkId, JSON.stringify(meta)],
   );
-  pushEvent(alias, { type: "new_reply", inbox_count: pendingInboxCount(alias, networkId), from: "hub", message_id: id, in_reply_to: inReplyTo, status: "expired" }, networkId);
+  pushEvent(alias, { type: "new_reply", inbox_count: pendingInboxCount(alias, networkId), from: "hub", message_id: id, in_reply_to: inReplyTo, status }, networkId);
   return id;
 }
 
-function deliver(
+/** 按 route 投递一条通知。#758 孤儿任务通知复用它(kind / status / id 前缀不同)。 */
+export function deliver(
   route: Extract<ExpirySenderRoute, { kind: "agent" | "user" }>,
   networkId: string | null,
   fromAlias: string,
   inReplyTo: string,
   notice: { title: string; text: string },
   meta: Record<string, unknown>,
+  as: { kind: string; status: string; agentPrefix: string; userPrefix: string } = { kind: TASK_EXPIRED_NOTICE_KIND, status: "expired", agentPrefix: "exp_", userPrefix: "dm_expired_" },
 ): string | null {
-  if (route.kind === "agent") return deliverToAgent(route.alias, networkId, inReplyTo, notice.text, meta);
+  if (route.kind === "agent") return deliverToAgent(route.alias, networkId, inReplyTo, notice.text, meta, as.status, as.agentPrefix);
   if (!networkId) return null;
   return sendAgentNotice({
-    networkId, userId: route.userId, fromAlias, kind: TASK_EXPIRED_NOTICE_KIND,
-    title: notice.title, text: notice.text, severity: "warning", meta, idPrefix: "dm_expired_",
+    networkId, userId: route.userId, fromAlias, kind: as.kind,
+    title: notice.title, text: notice.text, severity: "warning", meta, idPrefix: as.userPrefix,
   });
 }
 

package/src/task-orphan-http.test.ts

@@ -0,0 +1,287 @@
+// #758 —— 孤儿任务:acked / running 超过阈值,接收节点在开工之后回到 idle / offline 却没回复。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库);test2123 在真实 PostgreSQL 上原样再跑一遍。
+//
+// 任务经真入口 POST /api/task 派出,目标用自己的节点令牌经 /mcp ack_inbox / report_status 推进;
+// 只把任务的时间戳往前拨,然后调巡检(server.ts patrolOrphanTasks,5 分钟定时器调的就是它)。
+//
+// 钉住:
+//   1. 孤儿(agent 派的)→ 记一条 task.orphan_suspected、发一条 inbox reply 给派活节点,任务状态不变;第二次巡检不重发。
+//   2. 人派的孤儿 → user_inbox 一条。
+//   3. 节点 working → 不标。
+//   4. 不到阈值 → 不标;阈值可由 COMMHUB_ORPHAN_TASK_MINUTES 改,0 = 关。
+//   5. 节点开工之后没再报过状态 → 不标。
+//   6. scheduler 派的孤儿 → 标,但不通知。
+//   7. TTL 巡检(patrolExpiredTasks)不碰孤儿阶段:不写 orphan 事件。
+//
+// 跑法:cd server && bun test src/task-orphan-http.test.ts
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-orphan-"));
+process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+process.env.HOST = "127.0.0.1";
+const ENV = "COMMHUB_ORPHAN_TASK_MINUTES";
+const LOOKBACK_ENV = "COMMHUB_ORPHAN_TASK_LOOKBACK_HOURS";
+delete process.env[ENV];
+delete process.env[LOOKBACK_ENV];
+const PW = "Orphan123!xyz";
+const stamp = Date.now();
+
+let db: any;
+let patrol: () => void;
+let ttlPatrol: () => void;
+let flag: (o?: { minutes?: number | null }) => Array<{ task_id: string; notified: string | null }>;
+let hub: any = null;
+let BASE = "";
+let NET = "";
+let umaToken = "", umaId = "";
+let EVENT = "";
+type Node = { alias: string; nodeId: string; token: string };
+const nodes: Record<"sender" | "target", Node> = {} as any;
+
+async function send(token: string, method: string, path: string, payload?: unknown) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+async function tool(token: string, name: string, args: Record<string, unknown>) {
+  const res = await fetch(`${BASE}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }),
+  });
+  const raw = await res.text();
+  const data = raw.split("\n").filter((x) => x.startsWith("data:"));
+  const payload = data.length ? JSON.parse(data.at(-1)!.slice(5).trim()) : JSON.parse(raw);
+  return JSON.parse(payload.result.content[0].text);
+}
+
+let seq = 0;
+async function dispatch(token: string): Promise<{ id: string; content: string }> {
+  const content = `orphan case ${stamp} #${++seq}`;
+  const r = await send(token, "POST", "/api/task", { alias: nodes.target.alias, task: content, network_id: NET });
+  expect(r.status).toBe(200);
+  expect(r.body.ok).toBe(true);
+  return { id: r.body.task_id, content };
+}
+async function ack(taskId: string) {
+  const r = await tool(nodes.target.token, "ack_inbox", { alias: nodes.target.alias, message_id: taskId, network_id: NET });
+  expect(r.ok).toBe(true);
+  expect(taskRow(taskId).status).toBe("acked");
+}
+async function targetStatus(status: string, task?: string) {
+  const r = await tool(nodes.target.token, "report_status", { resume_id: `sdk-${nodes.target.nodeId}`, alias: nodes.target.alias, status, task, node_id: nodes.target.nodeId, network_id: NET });
+  expect(r.ok).toBe(true);
+}
+/** 任务的时间戳拨到 `minutes` 分钟前(节点的 last_seen_at 不动 = 「之后还报过状态」)。 */
+function age(taskId: string, minutes: number) {
+  const off = `-${minutes * 60} seconds`;
+  db.run(
+    `UPDATE tasks SET created_at = datetime('now', ?2),
+        delivered_at = CASE WHEN delivered_at IS NULL THEN NULL ELSE datetime('now', ?2) END,
+        started_at = CASE WHEN started_at IS NULL THEN NULL ELSE datetime('now', ?2) END,
+        consumed_at = CASE WHEN consumed_at IS NULL THEN NULL ELSE datetime('now', ?2) END
+      WHERE task_id = ?1`,
+    [taskId, off],
+  );
+}
+const taskRow = (taskId: string) => db.get("SELECT status, result, completed_at FROM tasks WHERE task_id = ?1", taskId) as { status: string; result: string | null; completed_at: string | null };
+const orphanEvents = (taskId: string) => db.all("SELECT from_status, to_status, event_type, event_key, actor, detail FROM task_events WHERE task_id = ?1 AND event_type = ?2", taskId, EVENT) as any[];
+const agentNotices = () => db.all("SELECT in_reply_to, type, requires_response, content FROM inbox WHERE network_id = ?1 AND session_name = ?2 AND from_session = 'hub'", NET, nodes.sender.alias) as any[];
+const userNotices = () => db.all("SELECT kind, from_session, content FROM user_inbox WHERE network_id = ?1 AND user_id = ?2", NET, umaId) as any[];
+
+function withMinutes<T>(value: string | undefined, fn: () => T): T {
+  const prev = process.env[ENV];
+  if (value === undefined) delete process.env[ENV]; else process.env[ENV] = value;
+  try { return fn(); } finally { if (prev === undefined) delete process.env[ENV]; else process.env[ENV] = prev; }
+}
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  const { addNetworkMember, createNetworkTokenForNode, register } = await import("./auth.js");
+  const orphan: any = await import("./task-orphan.js");
+  EVENT = orphan.ORPHAN_EVENT_TYPE;
+  flag = orphan.flagOrphanTasks;
+  const boss = register(`orphan_boss_${stamp}`, PW);
+  expect(boss.ok).toBe(true);
+  NET = boss.network_id!;
+  const bossId = boss.user!.user_id;
+  const uma = register(`orphan_uma_${stamp}`, PW);
+  umaToken = uma.token!; umaId = uma.user!.user_id;
+  expect(addNetworkMember(NET, umaId, "member", bossId, { agentAccess: "all" }).ok).toBe(true);
+  for (const key of ["sender", "target"] as const) {
+    const alias = `orphan-${key}-${stamp}`;
+    const nodeId = `n_orphan_${key}_${stamp}`;
+    const minted = createNetworkTokenForNode(bossId, NET, alias, nodeId);
+    expect(minted.ok).toBe(true);
+    nodes[key] = { alias, nodeId, token: minted.token! };
+  }
+  const mod: any = await import("./server.js");
+  patrol = mod.patrolOrphanTasks;
+  ttlPatrol = mod.patrolExpiredTasks;
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  for (const n of Object.values(nodes)) {
+    const r = await tool(n.token, "report_status", { resume_id: `sdk-${n.nodeId}`, alias: n.alias, status: "idle", node_id: n.nodeId, network_id: NET });
+    expect(r.ok).toBe(true);
+  }
+}, 30_000);
+
+beforeEach(() => {
+  db.run("UPDATE tasks SET status = 'replied', completed_at = datetime('now') WHERE network_id = ?1 AND status IN ('created', 'delivered', 'acked', 'running')", [NET]);
+  db.run("DELETE FROM inbox WHERE network_id = ?1 AND from_session = 'hub'", [NET]);
+  db.run("DELETE FROM user_inbox WHERE network_id = ?1", [NET]);
+  // 上一条用例可能把目标留在 offline / working:派活前先让它回到 idle(否则 /api/task 回 202 排队)。
+  db.run("UPDATE sessions SET status = 'idle' WHERE alias = ?1 AND network_id = ?2", [nodes.target.alias, NET]);
+});
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("#758 orphan detected", () => {
+  test("acked 2h, node idle since → one event + one inbox reply to the sending agent; status unchanged; second pass silent", async () => {
+    const t = await dispatch(nodes.sender.token);
+    await ack(t.id);
+    age(t.id, 120);
+    await targetStatus("idle");
+
+    withMinutes(undefined, () => patrol());
+
+    expect(taskRow(t.id)).toMatchObject({ status: "acked", result: null, completed_at: null });
+    const ev = orphanEvents(t.id);
+    expect(ev.length).toBe(1);
+    expect(ev[0]).toMatchObject({ from_status: "acked", to_status: "acked", event_key: EVENT, actor: "patrol" });
+    expect(ev[0].detail).toContain(`notify: agent ${nodes.sender.alias}`);
+    const n = agentNotices();
+    expect(n.length).toBe(1);
+    expect(n[0]).toMatchObject({ in_reply_to: t.id, type: "reply", requires_response: "none" });
+    expect(n[0].content).toContain(nodes.target.alias);
+    expect(n[0].content).toContain("没有改这条任务的状态");
+
+    // 第二、三次巡检:不重发、不重记。
+    withMinutes(undefined, () => { patrol(); patrol(); });
+    expect(orphanEvents(t.id).length).toBe(1);
+    expect(agentNotices().length).toBe(1);
+    expect(taskRow(t.id).status).toBe("acked");
+  });
+
+  test("running task, node went offline afterwards → flagged; a human sender gets one user_inbox notice", async () => {
+    const t = await dispatch(umaToken);
+    await ack(t.id);
+    await targetStatus("working", t.content);
+    expect(taskRow(t.id).status).toBe("running");
+    age(t.id, 90);
+    await targetStatus("idle");
+    db.run("UPDATE sessions SET status = 'offline' WHERE alias = ?1 AND network_id = ?2", [nodes.target.alias, NET]);
+
+    const out = withMinutes(undefined, () => flag());
+    expect(out).toEqual([{ task_id: t.id, notified: "user" }]);
+    expect(taskRow(t.id).status).toBe("running");
+    const u = userNotices();
+    expect(u.length).toBe(1);
+    expect(u[0]).toMatchObject({ kind: "task_orphan_suspected", from_session: nodes.target.alias });
+    expect(withMinutes(undefined, () => flag())).toEqual([]);
+    expect(userNotices().length).toBe(1);
+  });
+});
+
+describe("#758 not orphans", () => {
+  test("node is working (busy) → not flagged", async () => {
+    const t = await dispatch(nodes.sender.token);
+    await ack(t.id);
+    age(t.id, 120);
+    await targetStatus("working", "something else");
+    withMinutes(undefined, () => patrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    expect(agentNotices().length).toBe(0);
+  });
+
+  test("younger than the threshold → not flagged; env lowers it; 0 turns it off", async () => {
+    const t = await dispatch(nodes.sender.token);
+    await ack(t.id);
+    age(t.id, 45);
+    await targetStatus("idle");
+    withMinutes(undefined, () => patrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    withMinutes("0", () => patrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    withMinutes("30", () => patrol());
+    expect(orphanEvents(t.id).length).toBe(1);
+    expect(agentNotices().length).toBe(1);
+  });
+
+  test("node has not reported any status since the task started → not flagged", async () => {
+    const t = await dispatch(nodes.sender.token);
+    await ack(t.id);
+    age(t.id, 120);
+    await targetStatus("idle");
+    db.run("UPDATE sessions SET last_seen_at = datetime('now', '-180 minutes'), updated_at = datetime('now', '-180 minutes') WHERE alias = ?1 AND network_id = ?2", [nodes.target.alias, NET]);
+    withMinutes(undefined, () => patrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    expect(agentNotices().length).toBe(0);
+  });
+});
+
+describe("#758 lookback cap", () => {
+  test("a 10-day-old orphan is not flagged by default (72h cap) but is with lookback 0", async () => {
+    // 10 天前的那条直接写库(目标上已有开着的任务时 /api/task 回 202 排队,而这里要两条同时开着)。
+    const t = { id: `orphan_old_${stamp}` };
+    db.run(
+      `INSERT INTO tasks (task_id, from_name, from_node_id, to_name, to_node_id, priority, status, content, requires_response, created_at, delivered_at, network_id)
+       VALUES (?1, ?2, ?3, ?4, ?5, 'normal', 'acked', 'ten days old', 'reply', datetime('now', '-240 hours'), datetime('now', '-240 hours'), ?6)`,
+      [t.id, nodes.sender.alias, nodes.sender.nodeId, nodes.target.alias, nodes.target.nodeId, NET],
+    );
+    await targetStatus("idle");
+    withMinutes(undefined, () => patrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    expect(agentNotices().length).toBe(0);
+    // 71 小时的照常标出:上限只挡更老的。
+    const recent = await dispatch(nodes.sender.token);
+    await ack(recent.id);
+    age(recent.id, 71 * 60);
+    await targetStatus("idle");
+    withMinutes(undefined, () => patrol());
+    expect(orphanEvents(recent.id).length).toBe(1);
+    expect(orphanEvents(t.id).length).toBe(0);
+    process.env[LOOKBACK_ENV] = "0";
+    try { withMinutes(undefined, () => patrol()); } finally { delete process.env[LOOKBACK_ENV]; }
+    expect(orphanEvents(t.id).length).toBe(1);
+    expect(agentNotices().map((n) => n.in_reply_to).sort()).toEqual([recent.id, t.id].sort());
+  });
+});
+
+describe("#758 scheduler and regression", () => {
+  test("scheduler-sent orphan → flagged, sender not notified", async () => {
+    const id = `orphan_sched_${stamp}`;
+    db.run(
+      `INSERT INTO tasks (task_id, from_name, to_name, to_node_id, priority, status, content, requires_response, created_at, delivered_at, network_id)
+       VALUES (?1, 'scheduler', ?2, ?3, 'normal', 'acked', 'scheduled run', 'reply', datetime('now', '-120 minutes'), datetime('now', '-120 minutes'), ?4)`,
+      [id, nodes.target.alias, nodes.target.nodeId, NET],
+    );
+    await targetStatus("idle");
+    const out = withMinutes(undefined, () => flag());
+    expect(out).toEqual([{ task_id: id, notified: null }]);
+    expect(orphanEvents(id)[0].detail).toContain("notify: none (scheduler)");
+    expect(agentNotices().length).toBe(0);
+    expect(userNotices().length).toBe(0);
+  });
+
+  test("the TTL patrol alone does not run the orphan phase", async () => {
+    const t = await dispatch(nodes.sender.token);
+    await ack(t.id);
+    age(t.id, 120);
+    await targetStatus("idle");
+    withMinutes(undefined, () => ttlPatrol());
+    expect(orphanEvents(t.id).length).toBe(0);
+    expect(taskRow(t.id).status).toBe("acked");
+  });
+});