@sleep2agi/commhub-server 0.9.0-preview.116 → 0.9.0-preview.118

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.116",
+  "version": "0.9.0-preview.118",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/agent-team-whoami-http.test.ts

@@ -0,0 +1,98 @@
+import { beforeAll, afterAll, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+
+process.env.COMMHUB_DB ||= `${mkdtempSync('/tmp/team-whoami-')}/hub.db`;
+let db: any, hub: any, base: string, owner: any, outside: any;
+let selfToken: string, otherToken: string, outsideToken: string, unboundToken: string;
+const SELF = 'node_team_whoami_self', OTHER = 'node_team_whoami_other', FOREIGN = 'node_team_whoami_foreign';
+const TEAM = 'team_whoami_child', ROOT = 'team_whoami_root';
+
+async function rpc(token: string, method = 'tools/call', params: unknown = { name: 'org_whoami', arguments: {} }) {
+  const response = await fetch(`${base}/mcp`, { method: 'POST', headers: {
+    Authorization: `Bearer ${token}`, 'Content-Type': 'application/json',
+    Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-03-26',
+  }, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }) });
+  expect(response.status).toBe(200);
+  const text = await response.text();
+  const line = text.split('\n').filter(x => x.startsWith('data:')).at(-1);
+  const body = JSON.parse(line ? line.slice(5) : text);
+  expect(body.error).toBeUndefined();
+  return body.result;
+}
+async function who(token = selfToken, args: Record<string, unknown> = {}) {
+  const result = await rpc(token, 'tools/call', { name: 'org_whoami', arguments: args });
+  return JSON.parse(result.content[0].text);
+}
+
+beforeAll(async () => {
+  ({ db } = await import('./db.js'));
+  const { register, createNetworkTokenForNode } = await import('./auth.js');
+  owner = register('team_whoami_owner', 'Fixture-Passw0rd!xyz');
+  outside = register('team_whoami_outside', 'Fixture-Passw0rd!xyz');
+  db.run("UPDATE users SET display_name = 'Team owner' WHERE user_id = ?1", [owner.user.user_id]);
+  const mint = (u: any, alias: string, node?: string) => {
+    const r = createNetworkTokenForNode(u.user.user_id, u.network_id, alias, node);
+    expect(r.error ?? null).toBe(null); return r.token!;
+  };
+  selfToken = mint(owner, 'team-self', SELF);
+  otherToken = mint(owner, 'team-other', OTHER);
+  outsideToken = mint(outside, 'team-self', FOREIGN); // Same alias in a different network.
+  unboundToken = mint(owner, 'team-unregistered');
+  const { bootServer } = await import('./server.js');
+  hub = bootServer({ port: 0, hostname: '127.0.0.1' });
+  base = `http://127.0.0.1:${hub.port}`;
+  for (const [net, id, name, parent] of [
+    [owner.network_id, ROOT, 'Parent', null], [owner.network_id, TEAM, 'My team', ROOT],
+    [outside.network_id, TEAM, 'Foreign team', null],
+  ]) db.run('INSERT INTO network_agent_teams(network_id,team_id,name,parent_id) VALUES(?1,?2,?3,?4)', [net,id,name,parent]);
+  db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [SELF,owner.user.user_id,owner.network_id,TEAM]);
+  for (const [net, node] of [[owner.network_id, SELF], [outside.network_id, FOREIGN]]) {
+    db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [net,node,TEAM]);
+  }
+  // Even a stale/corrupt membership must not project a node from another network.
+  db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [owner.network_id,FOREIGN,TEAM]);
+}, 60_000);
+afterAll(() => hub?.stop(true));
+
+test('exact node team, nearest-first ancestors, Agent lead and private human display name', async () => {
+  const r = await who();
+  expect(r.ok).toBe(true); expect(r.source).toBe('node'); expect(r.node_id).toBe(SELF);
+  expect(r.team).toEqual({ id: TEAM, name: 'My team' });
+  expect(r.ancestors).toEqual([{ id: ROOT, name: 'Parent' }]);
+  expect(r.lead.node_id).toBe(SELF);
+  expect(r.owner).toEqual({ user_id: owner.user.user_id, display_name: 'Team owner' });
+  expect(r.agents.map((n: any) => n.node_id)).toEqual([SELF]);
+  expect(r.truncated).toBe(false);
+  expect(JSON.stringify(r)).not.toContain('team_whoami_owner');
+});
+test('same-id foreign team and foreign node cannot cross network; supplied identity is ignored', async () => {
+  const r = await who(selfToken, { network_id: outside.network_id, node_id: FOREIGN, alias: 'team-other' });
+  expect(r.node_id).toBe(SELF); expect(r.team.name).toBe('My team');
+  expect(JSON.stringify(r)).not.toContain(FOREIGN);
+  const b = await who(outsideToken);
+  expect(b.team.name).toBe('Foreign team'); expect(b.node_id).toBe(FOREIGN);
+  expect(b.ancestors).toEqual([]); expect(JSON.stringify(b)).not.toContain(SELF);
+});
+test('unassigned node does not inherit its owner or another node team', async () => {
+  expect(await who(otherToken)).toEqual({ ok: true, source: 'none', node_id: OTHER, team: null,
+    ancestors: [], lead: null, owner: null, agents: [], truncated: false });
+  expect((await who(unboundToken)).error).toBe('node_identity_unbound');
+});
+test('user credentials cannot list or call; node credentials can list', async () => {
+  expect((await rpc(owner.token, 'tools/list', {})).tools.some((t: any) => t.name === 'org_whoami')).toBe(false);
+  expect((await who(owner.token)).error).toBe('network_token_required');
+  expect((await rpc(selfToken, 'tools/list', {})).tools.some((t: any) => t.name === 'org_whoami')).toBe(true);
+});
+test('foreign lead and human owner references are not returned', async () => {
+  db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [FOREIGN,outside.user.user_id,owner.network_id,TEAM]);
+  try { const r = await who(); expect(r.lead).toBe(null); expect(r.owner).toBe(null); }
+  finally { db.run('UPDATE network_agent_teams SET lead_node_id=?1,owner_user_id=?2 WHERE network_id=?3 AND team_id=?4', [SELF,owner.user.user_id,owner.network_id,TEAM]); }
+});
+test('large teams are bounded to 50 and explicitly truncated', async () => {
+  for (let i = 0; i < 51; i++) {
+    const id = `node_team_whoami_cap_${i}`;
+    db.run('INSERT INTO nodes(node_id,node_name,alias,network_id) VALUES(?1,?1,?1,?2)', [id,owner.network_id]);
+    db.run('INSERT INTO network_agent_team_members(network_id,node_id,team_id) VALUES(?1,?2,?3)', [owner.network_id,id,TEAM]);
+  }
+  const r = await who(); expect(r.agents.length).toBe(50); expect(r.truncated).toBe(true);
+});

package/src/agent-teams.ts

@@ -125,6 +125,28 @@ export function listAgentTeams(networkId: string, hidden: Hidden) {
   }));
 }
 
+/** #765: node-token identity only; no fallback to a human's department.
+ * Reuse the REST projection's network joins and display-name privacy rules.
+ */
+export function agentTeamWhoami(networkId: string, nodeId: string | null) {
+  if (!nodeId) return { ok: false, error: "node_identity_unbound" };
+  const teams = listAgentTeams(networkId, () => false);
+  const self = teams.find(t => t.members.some(n => n.node_id === nodeId));
+  if (!self) return { ok: true, source: "none", node_id: nodeId, team: null, ancestors: [], lead: null, owner: null, agents: [], truncated: false };
+  const byId = new Map(teams.map(t => [t.id, t]));
+  const seen = new Set([self.id]);
+  const ancestors: { id: string; name: string }[] = [];
+  for (let id = self.parent_id; id && !seen.has(id);) {
+    const parent = byId.get(id);
+    if (!parent) break;
+    seen.add(id);
+    ancestors.push({ id, name: parent.name });
+    id = parent.parent_id;
+  }
+  return { ok: true, source: "node", node_id: nodeId, team: { id: self.id, name: self.name }, ancestors,
+    lead: self.lead, owner: self.owner, agents: self.members.slice(0, 50), truncated: self.members.length > 50 };
+}
+
 /** scope = null 表示全管;否则是调用者能管的团队集合。 */
 export function createAgentTeam(networkId: string, actor: string, scope: Set<string> | null, hidden: Hidden, body: Record<string, unknown>) {
   const name = cleanName(body.name);

package/src/node-permissions.ts

@@ -257,7 +257,7 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   get_adopt_request: "always", ack_adopt_request: "always",
   send_desktop_message: "always", // 发给人的私信,不是派活
   // 读
-  get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read",
+  get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read", org_whoami: "read",
   list_skills: "read", get_skill: "read", list_host_supervisors: "read", list_network_secrets: "read", list_providers: "read",
   get_probe_results: "read", read_node_rules_file: "read", list_node_skills: "read", read_node_skill: "read", list_node_files: "read",
   read_node_file: "read", tail_node_logs: "read",
@@ -271,6 +271,7 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   // 定时任务(#733):在 schedule-agent.ts 里按排程判(范围 / 目标 = send_task 的 dispatchVerdict / 配额)
   schedule_list: "read", schedule_get: "read", schedule_runs: "read",
   schedule_create: "schedule", schedule_update: "schedule", schedule_cancel: "schedule", schedule_run_now: "schedule",
+  schedule_batch_interval: "schedule",
   // 写节点 / 技能 / 探测:只读、受限不行;正常由 RFC-036 等既有规则管
   update_node_config: "node_write", write_node_rules_file: "node_write", restart_node: "node_write", create_node: "node_write",
   stop_node: "node_write", delete_node: "node_write", start_node: "node_write", submit_skill: "node_write", probe_provider_model: "node_write",

package/src/schedule-agent-mcp-http.test.ts

@@ -161,6 +161,72 @@ describe("happy path from a node", () => {
   });
 });
 
+describe("batch interval updates (#816)", () => {
+  const batch = (token: string, schedule_ids: string[], every_seconds = 600) =>
+    mcp(token, "schedule_batch_interval", { schedule_ids, every_seconds });
+  const get = async (id: string) => (await mcp(node.b.token, "schedule_get", { schedule_id: id })).schedule;
+
+  test("two updates, deduplicated IDs, paused stays paused, unselected stays untouched", async () => {
+    const a = (await create("b")).schedule, b = (await create("b")).schedule;
+    const untouched = (await create("b")).schedule;
+    await mcp(node.b.token, "schedule_update", { schedule_id: b.schedule_id, status: "paused" });
+    const before = Date.now();
+    const result = await batch(node.b.token, [a.schedule_id, b.schedule_id, a.schedule_id]);
+    expect(result).toMatchObject({ ok: true, updated: 2, failed: 0 });
+    expect(result.results).toHaveLength(2);
+    expect(result.results[0]).toMatchObject({ schedule_id: a.schedule_id, every_seconds: 600, revision: a.revision + 1, status: "active" });
+    expect(Date.parse(result.results[0].next_run_at)).toBeGreaterThanOrEqual(before + 600_000);
+    expect(result.results[1]).toMatchObject({ status: "paused", next_run_at: null, every_seconds: 600 });
+    for (const original of [a, b]) {
+      expect(await get(original.schedule_id)).toMatchObject({ name: original.name, task_content: original.task_content, target_node_id: original.target_node_id, schedule: { type: "interval", every_seconds: 600 } });
+    }
+    expect(await get(untouched.schedule_id)).toEqual(untouched);
+  });
+
+  test("partial results preserve human, foreign-network, daily and cancelled schedules", async () => {
+    const own = (await create("b")).schedule;
+    const daily = (await create("b", { schedule: { type: "daily", time: "09:30" } })).schedule;
+    const cancelled = (await create("b")).schedule;
+    await mcp(node.b.token, "schedule_cancel", { schedule_id: cancelled.schedule_id });
+    const human = await rest(user.boss.token, "POST", "/api/scheduled-tasks", { network_id: net, name: "human batch", task: "t", target_node_id: node.b.id, schedule: EVERY_MIN });
+    const foreign = (await create("x")).schedule;
+    const ids = [human.body.schedule.schedule_id, foreign.schedule_id, "no-such-schedule", daily.schedule_id, cancelled.schedule_id, own.schedule_id];
+    const result = await batch(node.b.token, ids);
+    expect(result).toMatchObject({ ok: false, updated: 1, failed: 5 });
+    expect(result.results.map((r: any) => r.error ?? "ok")).toEqual(["not_schedule_creator", "schedule_not_found", "schedule_not_found", "not_interval_schedule", "schedule_cancelled", "ok"]);
+    expect((await get(ids[0])).schedule).toEqual(EVERY_MIN);
+    expect((await mcp(node.x.token, "schedule_get", { schedule_id: foreign.schedule_id })).schedule).toEqual(foreign);
+    expect(await get(daily.schedule_id)).toEqual(daily);
+    expect((await get(cancelled.schedule_id)).status).toBe("cancelled");
+  });
+
+  test("invalid interval or batch shape performs no writes; node-only and readonly gates remain", async () => {
+    const own = (await create("b")).schedule, ids = [own.schedule_id];
+    for (const seconds of [59, 60.5, 365 * 86400 + 1]) {
+      expect(await batch(node.b.token, ids, seconds)).toMatchObject({ ok: false, error: "invalid_interval" });
+    }
+    for (const invalid of [[], Array(101).fill(own.schedule_id), [""]]) {
+      expect((await batch(node.b.token, invalid)).ok).not.toBe(true);
+    }
+    expect((await batch(user.boss.token, ids)).error).toBe("network_token_required");
+    expect(await batch(node.ro.token, ids)).toMatchObject({ error: "node_permission_denied", reason: "mode_readonly" });
+    expect(await get(own.schedule_id)).toEqual(own);
+  });
+
+  test("creator still needs permission to reach the current target", async () => {
+    const own = (await create("b", { target_node_id: node.a.id })).schedule;
+    db.run("UPDATE nodes SET owner_user_id = ?1 WHERE node_id = ?2", [user.rst.id, node.b.id]);
+    try {
+      const result = await batch(node.b.token, [own.schedule_id]);
+      expect(result).toMatchObject({ ok: false, updated: 0, failed: 1 });
+      expect(result.results[0]).toMatchObject({ reason: "agent_not_granted_to_owner" });
+      expect(await get(own.schedule_id)).toEqual(own);
+    } finally {
+      db.run("UPDATE nodes SET owner_user_id = ?1 WHERE node_id = ?2", [user.boss.id, node.b.id]);
+    }
+  });
+});
+
 describe("denials", () => {
   test("another network: cannot target, see or touch it", async () => {
     const mine = (await create("a")).schedule.schedule_id;

package/src/schedule-agent.ts

@@ -23,7 +23,7 @@
 import { db } from "./db.js";
 import {
   cancelSchedule, decodeRowForAgent, dispatchScheduledOccurrence, getScheduleRow, insertSchedule, patchSchedule,
-  scheduleRuns, ScheduleInputError, validateScheduleCreate, type ScheduledRow,
+  scheduleRuns, ScheduleInputError, validateScheduleCreate, parseScheduleSpec, type ScheduledRow,
 } from "./scheduled-tasks.js";
 import { SCHEDULED_TASK_STORAGE_SELECT } from "./rest-projections.js";
 import { dispatchVerdict, nodePermissionDeniedBody, recordNodePermission, type NodeIdentity } from "./node-permissions.js";
@@ -145,6 +145,25 @@ export function agentUpdateSchedule(id: NodeIdentity, canWrite: boolean, schedul
   } catch (e) { return inputError(e); }
 }
 
+/** #816: partial success, one result per distinct ID; no change to existing write authority. */
+export function agentBatchScheduleInterval(id: NodeIdentity, canWrite: boolean, scheduleIds: string[], everySeconds: number): AgentScheduleResult {
+  const gate = writeGate(id, canWrite, "mcp:schedule_batch_interval");
+  if (gate) return gate;
+  const schedule = { type: "interval", every_seconds: everySeconds };
+  try { parseScheduleSpec(schedule, "UTC"); } catch (e) { return inputError(e); }
+  const results = [...new Set(scheduleIds)].map(schedule_id => {
+    const row = ownRow(id, schedule_id);
+    if (!isRow(row)) return { schedule_id, ...row };
+    if (row.schedule_type !== "interval") return { schedule_id, ok: false, error: "not_interval_schedule" };
+    const result = agentUpdateSchedule(id, canWrite, schedule_id, { schedule, base_revision: row.revision });
+    if (!result.ok) return { schedule_id, ...result };
+    const updated = result.schedule as ReturnType<typeof decodeRowForAgent>;
+    return { schedule_id, ok: true, every_seconds: everySeconds, next_run_at: updated.next_run_at, status: updated.status, revision: updated.revision };
+  });
+  const updated = results.filter(r => r.ok).length;
+  return { ok: updated === results.length, updated, failed: results.length - updated, results };
+}
+
 export function agentCancelSchedule(id: NodeIdentity, canWrite: boolean, scheduleId: string): AgentScheduleResult {
   const gate = writeGate(id, canWrite, "mcp:schedule_cancel");
   if (gate) return gate;

package/src/tool-audience-http.test.ts

@@ -43,6 +43,7 @@ const OVERRIDES: Record<string, Record<string, unknown>> = {
   mark_tasks_consumed: { task_ids: ["task_probe"] },
   upsert_network_secret: { key: "PROBE_KEY" },
   update_provider: { provider_id: "prov_probe" },
+  schedule_batch_interval: { schedule_ids: ["sched_probe"], every_seconds: 60 },
 };
 function fill(schema: any, key: string, ctx: Record<string, unknown>): unknown {
   if (!schema) return "probe";

package/src/tool-audience.ts

@@ -26,10 +26,10 @@ export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
   request_adopt_node: "user", unadopt_node: "user",
   get_adopt_request: "protocol", ack_adopt_request: "protocol",
   // ── 节点:用户令牌一律 network_token_required ──
-  report_status: "node",
+  report_status: "node", org_whoami: "node",
   // #733 定时任务:节点工具(用户令牌一律 network_token_required;人走 REST /api/scheduled-tasks)
   schedule_list: "node", schedule_get: "node", schedule_create: "node", schedule_update: "node",
-  schedule_cancel: "node", schedule_run_now: "node", schedule_runs: "node",
+  schedule_cancel: "node", schedule_run_now: "node", schedule_runs: "node", schedule_batch_interval: "node",
   // ── 协议:用户令牌一律 network_token_required / node_token_required / caller_not_a_daemon ──
   mark_tasks_runtime_submitted: "protocol", mark_tasks_consumed: "protocol",
   get_config_update: "protocol", ack_config_update: "protocol",

package/src/tools.ts

@@ -2,7 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
 import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { lockNodeAlias } from "./node-token-ownership.js";
-import { clearNodeFromAgentTeams } from "./agent-teams.js";
+import { clearNodeFromAgentTeams, agentTeamWhoami } from "./agent-teams.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
 import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
@@ -21,7 +21,7 @@ import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
 import { addAgentNetworkScope, addAgentTimelineScope, addNetworkScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
 import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS, type AgentRef } from "./agent-access.js";
 import { listedToolFilter, scopeToolsList, type ToolCaller } from "./tool-audience.js";
-import { agentCancelSchedule, agentCreateSchedule, agentGetSchedule, agentListSchedules, agentRunScheduleNow, agentScheduleRuns, agentUpdateSchedule } from "./schedule-agent.js";
+import { agentBatchScheduleInterval, agentCancelSchedule, agentCreateSchedule, agentGetSchedule, agentListSchedules, agentRunScheduleNow, agentScheduleRuns, agentUpdateSchedule } from "./schedule-agent.js";
 import { broadcastVerdict, dispatchVerdict, humanOnlyVerdict, NODE_TOOL_CLASS, nodeDecide, nodeIdentity, nodePermissionDeniedBody, writeVerdict, type NodeIdentity, type Verdict } from "./node-permissions.js";
 import { restrictedMemberAttachmentsDenied } from "./restricted-files.js";
 import { errorBody } from "./requirements-errors.js";
@@ -6396,6 +6396,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   server.tool("schedule_update", "Edit your schedule; status=paused|active.",
     { ...schedFields, schedule_id: schedId, base_revision: z.number().int().min(0).optional().describe("Reject if current revision differs."), name: z.string().optional(), task: z.string().optional(), schedule: z.any().optional(), status: z.string().optional() },
     async ({ schedule_id, ...rest }) => scheduleCall((id, w) => agentUpdateSchedule(id, w, schedule_id, rest as Record<string, unknown>)));
+  server.tool("schedule_batch_interval", "Batch interval edit; per-ID results.",
+    { schedule_ids: z.array(z.string()).min(1).max(100), every_seconds: z.number() },
+    async ({ schedule_ids, every_seconds }) => scheduleCall((id, w) => agentBatchScheduleInterval(id, w, schedule_ids, every_seconds)));
   server.tool("schedule_cancel", "Cancel your schedule.", { schedule_id: schedId },
     async ({ schedule_id }) => scheduleCall((id, w) => agentCancelSchedule(id, w, schedule_id)));
   server.tool("schedule_run_now", "Run your schedule now.", { schedule_id: schedId },
@@ -6403,6 +6406,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   server.tool("schedule_runs", "A schedule's recent runs.", { schedule_id: schedId },
     async ({ schedule_id }) => scheduleCall(id => agentScheduleRuns(id, schedule_id)));
 
+  // #765: exact authenticated node; team tree is independent of human departments.
+  server.tool("org_whoami", "Your Agent team, ancestors, lead, owner and up to 50 teammates. Read-only.", {},
+    async () => scheduleCall(id => agentTeamWhoami(id.networkId, id.nodeId)));
+
   // #478:tools/list 只列这个调用者真能用的工具(tool-audience.ts)。只滤列表,tools/call 不变。
   const caller: ToolCaller = callerTokenIsNetwork
     ? { kind: "node", tokenId: callerTokenId ?? null, networkId: enforceNetworkId ?? null, includeProtocol: listing.includeProtocol === true }