@sleep2agi/commhub-server 0.9.0-preview.116 → 0.9.0-preview.117

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.116",
+  "version": "0.9.0-preview.117",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/agent-team-whoami-http.test.ts

@@ -0,0 +1,98 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync('/tmp/team-whoami-')}/hub.db`;
+let db: any, hub: any, base: string, owner: any, outside: any;
+let selfToken: string, otherToken: string, outsideToken: string, unboundToken: string;
+const SELF = 'node_team_whoami_self', OTHER = 'node_team_whoami_other', FOREIGN = 'node_team_whoami_foreign';
+const TEAM = 'team_whoami_child', ROOT = 'team_whoami_root';
+
+async function rpc(token: string, method = 'tools/call', params: unknown = { name: 'org_whoami', arguments: {} }) {
+  const response = await fetch(`${base}/mcp`, { method: 'POST', headers: {
+    Authorization: `Bearer ${token}`, 'Content-Type': 'application/json',
+    Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-03-26',
+  }, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }) });
+  expect(response.status).toBe(200);
+  const text = await response.text();
+  const line = text.split('\n').filter(x => x.startsWith('data:')).at(-1);
+  const body = JSON.parse(line ? line.slice(5) : text);
+  expect(body.error).toBeUndefined();
+  return body.result;
+}
+async function who(token = selfToken, args: Record<string, unknown> = {}) {
+  const result = await rpc(token, 'tools/call', { name: 'org_whoami', arguments: args });
+  return JSON.parse(result.content[0].text);
+}
+
+beforeAll(async () => {
+  ({ db } = await import('./db.js'));
+  const { register, createNetworkTokenForNode } = await import('./auth.js');
+  owner = register('team_whoami_owner', 'Fixture-Passw0rd!xyz');
+  outside = register('team_whoami_outside', 'Fixture-Passw0rd!xyz');
+  db.run("UPDATE users SET display_name = 'Team owner' WHERE user_id = ?1", [owner.user.user_id]);
+  const mint = (u: any, alias: string, node?: string) => {
+    const r = createNetworkTokenForNode(u.user.user_id, u.network_id, alias, node);
+    expect(r.error ?? null).toBe(null); return r.token!;
+  };
+  selfToken = mint(owner, 'team-self', SELF);
+  otherToken = mint(owner, 'team-other', OTHER);
+  outsideToken = mint(outside, 'team-self', FOREIGN); // Same alias in a different network.
+  unboundToken = mint(owner, 'team-unregistered');
+  const { bootServer } = await import('./server.js');
+  hub = bootServer({ port: 0, hostname: '127.0.0.1' });
+  base = `http://127.0.0.1:${hub.port}`;
+  for (const [net, id, name, parent] of [
+    [owner.network_id, ROOT, 'Parent', null], [owner.network_id, TEAM, 'My team', ROOT],
+    [outside.network_id, TEAM, 'Foreign team', null],
+  ]) db.run('INSERT INTO network_agent_teams(network_id,team_id,name,parent_id) VALUES(?1,?2,?3,?4)', [net,id,name,parent]);
+  db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [SELF,owner.user.user_id,owner.network_id,TEAM]);
+  for (const [net, node] of [[owner.network_id, SELF], [outside.network_id, FOREIGN]]) {
+    db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [net,node,TEAM]);
+  }
+  // Even a stale/corrupt membership must not project a node from another network.
+  db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [owner.network_id,FOREIGN,TEAM]);
+}, 60_000);
+afterAll(() => hub?.stop(true));
+
+test('exact node team, nearest-first ancestors, Agent lead and private human display name', async () => {
+  const r = await who();
+  expect(r.ok).toBe(true); expect(r.source).toBe('node'); expect(r.node_id).toBe(SELF);
+  expect(r.team).toEqual({ id: TEAM, name: 'My team' });
+  expect(r.ancestors).toEqual([{ id: ROOT, name: 'Parent' }]);
+  expect(r.lead.node_id).toBe(SELF);
+  expect(r.owner).toEqual({ user_id: owner.user.user_id, display_name: 'Team owner' });
+  expect(r.agents.map((n: any) => n.node_id)).toEqual([SELF]);
+  expect(r.truncated).toBe(false);
+  expect(JSON.stringify(r)).not.toContain('team_whoami_owner');
+});
+test('same-id foreign team and foreign node cannot cross network; supplied identity is ignored', async () => {
+  const r = await who(selfToken, { network_id: outside.network_id, node_id: FOREIGN, alias: 'team-other' });
+  expect(r.node_id).toBe(SELF); expect(r.team.name).toBe('My team');
+  expect(JSON.stringify(r)).not.toContain(FOREIGN);
+  const b = await who(outsideToken);
+  expect(b.team.name).toBe('Foreign team'); expect(b.node_id).toBe(FOREIGN);
+  expect(b.ancestors).toEqual([]); expect(JSON.stringify(b)).not.toContain(SELF);
+});
+test('unassigned node does not inherit its owner or another node team', async () => {
+  expect(await who(otherToken)).toEqual({ ok: true, source: 'none', node_id: OTHER, team: null,
+    ancestors: [], lead: null, owner: null, agents: [], truncated: false });
+  expect((await who(unboundToken)).error).toBe('node_identity_unbound');
+});
+test('user credentials cannot list or call; node credentials can list', async () => {
+  expect((await rpc(owner.token, 'tools/list', {})).tools.some((t: any) => t.name === 'org_whoami')).toBe(false);
+  expect((await who(owner.token)).error).toBe('network_token_required');
+  expect((await rpc(selfToken, 'tools/list', {})).tools.some((t: any) => t.name === 'org_whoami')).toBe(true);
+});
+test('foreign lead and human owner references are not returned', async () => {
+  db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [FOREIGN,outside.user.user_id,owner.network_id,TEAM]);
+  try { const r = await who(); expect(r.lead).toBe(null); expect(r.owner).toBe(null); }
+  finally { db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [SELF,owner.user.user_id,owner.network_id,TEAM]); }
+});
+test('large teams are bounded to 50 and explicitly truncated', async () => {
+  for (let i = 0; i < 51; i++) {
+    const id = `node_team_whoami_cap_${i}`;
+    db.run('INSERT INTO nodes(node_id,node_name,alias,network_id) VALUES(?1,?1,?1,?2)', [id,owner.network_id]);
+    db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [owner.network_id,id,TEAM]);
+  }
+  const r = await who(); expect(r.agents.length).toBe(50); expect(r.truncated).toBe(true);
+});

package/src/agent-teams.ts

@@ -125,6 +125,28 @@ export function listAgentTeams(networkId: string, hidden: Hidden) {
   }));
 }
 
+/** #765: node-token identity only; no fallback to a human's department.
+ * Reuse the REST projection's network joins and display-name privacy rules.
+ */
+export function agentTeamWhoami(networkId: string, nodeId: string | null) {
+  if (!nodeId) return { ok: false, error: "node_identity_unbound" };
+  const teams = listAgentTeams(networkId, () => false);
+  const self = teams.find(t => t.members.some(n => n.node_id === nodeId));
+  if (!self) return { ok: true, source: "none", node_id: nodeId, team: null, ancestors: [], lead: null, owner: null, agents: [], truncated: false };
+  const byId = new Map(teams.map(t => [t.id, t]));
+  const seen = new Set([self.id]);
+  const ancestors: { id: string; name: string }[] = [];
+  for (let id = self.parent_id; id && !seen.has(id);) {
+    const parent = byId.get(id);
+    if (!parent) break;
+    seen.add(id);
+    ancestors.push({ id, name: parent.name });
+    id = parent.parent_id;
+  }
+  return { ok: true, source: "node", node_id: nodeId, team: { id: self.id, name: self.name }, ancestors,
+    lead: self.lead, owner: self.owner, agents: self.members.slice(0, 50), truncated: self.members.length > 50 };
+}
+
 /** scope = null 表示全管;否则是调用者能管的团队集合。 */
 export function createAgentTeam(networkId: string, actor: string, scope: Set<string> | null, hidden: Hidden, body: Record<string, unknown>) {
   const name = cleanName(body.name);

package/src/node-permissions.ts

@@ -257,7 +257,7 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   get_adopt_request: "always", ack_adopt_request: "always",
   send_desktop_message: "always", // 发给人的私信,不是派活
   // 读
-  get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read",
+  get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read", org_whoami: "read",
   list_skills: "read", get_skill: "read", list_host_supervisors: "read", list_network_secrets: "read", list_providers: "read",
   get_probe_results: "read", read_node_rules_file: "read", list_node_skills: "read", read_node_skill: "read", list_node_files: "read",
   read_node_file: "read", tail_node_logs: "read",

package/src/tool-audience.ts

@@ -26,7 +26,7 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   request_adopt_node: "user", unadopt_node: "user",
   get_adopt_request: "protocol", ack_adopt_request: "protocol",
   // ── 节点:用户令牌一律 network_token_required ──
-  report_status: "node",
+  report_status: "node", org_whoami: "node",
   // #733 定时任务:节点工具(用户令牌一律 network_token_required;人走 REST /api/scheduled-tasks)
   schedule_list: "node", schedule_get: "node", schedule_create: "node", schedule_update: "node",
   schedule_cancel: "node", schedule_run_now: "node", schedule_runs: "node",

package/src/tools.ts

@@ -2,7 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { lockNodeAlias } from "./node-token-ownership.js";
-import { clearNodeFromAgentTeams } from "./agent-teams.js";
+import { clearNodeFromAgentTeams, agentTeamWhoami } from "./agent-teams.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
 import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
@@ -6403,6 +6403,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   server.tool("schedule_runs", "A schedule's recent runs.", { schedule_id: schedId },
     async ({ schedule_id }) => scheduleCall(id => agentScheduleRuns(id, schedule_id)));
 
+  // #765: exact authenticated node; team tree is independent of human departments.
+  server.tool("org_whoami", "Your Agent team, ancestors, lead, owner and up to 50 teammates. Read-only.", {},
+    async () => scheduleCall(id => agentTeamWhoami(id.networkId, id.nodeId)));
+
   // #478:tools/list 只列这个调用者真能用的工具(tool-audience.ts)。只滤列表,tools/call 不变。
   const caller: ToolCaller = callerTokenIsNetwork
     ? { kind: "node", tokenId: callerTokenId ?? null, networkId: enforceNetworkId ?? null, includeProtocol: listing.includeProtocol === true }